{ "Event": { "published": true, "date": "2022-03-05", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-03-05", "timestamp": 1646524981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "ec03b7fd-79a7-431a-9704-fa3cc66c163f", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18c25aa7-9cce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646516953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516953, "uuid": "f312d7ec-5513-4473-844c-d360fa3cbdf0", "comment": "Malware payload", "value": "9c3f4e4ed9586b048bc27407501e2976", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516953, "uuid": "b1c17a5c-499e-41e9-a782-b9556991484e", "comment": "Malware payload", "value": "003df9926a62461c99135fd6aa1e8cfdee60a656269ef945c9417668187b5966", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516953, "uuid": "31aec543-5501-403e-8c2b-9d7e2bd947c4", "comment": "Malware payload", "value": "789f2addd9b573b130136dc60fbbeeef8286c351", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516953, "uuid": "394d6632-c650-4fa8-a763-77c2449d5377", "comment": "Malware payload", "value": "6ed24c33512c715a077bea5b52448b0e306456cc395f37b2b02d885328e28736f79cb1fae0cd62b6ee68ee0e68f43ef9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516953, "uuid": "e1e3e3a3-9219-4af1-a6dd-9773dd955f39", "value": "T12425338245C718A5FB63347063A794926E29E57420604357B3CEFE973BEC7B3782AE04", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516953, "uuid": "7c7cb59a-df54-4d94-a8ae-b5cae84d8ebb", "value": "8515d19fce73421f02c6f2624fca9371", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516953, "uuid": "e39735c1-d4fc-47c0-a574-adb439378acf", "value": "24576:/D/DP79c98RnCuY06xwHQMaW822ahx9QbT0wo/rLFB7H2yZheQYHPg:/zD+qRU2VaV2VubT2/rLFtWyZhvYHPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646516953, "uuid": "48de5306-5e76-4d34-ad53-f6156ff5ac5c", "value": 1036304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646516953, "uuid": "e575261e-1afd-43cb-9fca-b4a90e593654", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516953, "uuid": "017719e9-12c1-4d91-9654-d14024505244", "value": "003df9926a62461c99135fd6aa1e8cfdee60a656269ef945c9417668187b5966", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e60272-9cb5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646506556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506556, "uuid": "c10393e4-66ae-4f06-a00d-de0bc55f51a2", "comment": "Malware payload (RedLineStealer)", "value": "6721891f69e4723a97310afe2f150e47", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506556, "uuid": "42abd6dc-201e-45f6-883a-0dbded9bba5e", "comment": "Malware payload (RedLineStealer)", "value": "02d6b6d6a27c2c88abbd109a5e1d987183252f7ed6165bfe6ad1fb968f0cb9f6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506556, "uuid": "90579ee5-b534-4c14-ac01-26dde8ba39dc", "comment": "Malware payload (RedLineStealer)", "value": "fd1e2f001d68a74a30376f263e5a3b44b7e3274f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506556, "uuid": "98efa11c-4bb2-41d0-af89-0176e9156f32", "comment": "Malware payload (RedLineStealer)", "value": "a9a96966491e206f0adfe941c22f378761cc222d9a36cd376763cebd4a74229f39be1a2a272b1686312bb68703b59f13", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506556, "uuid": "f6d8882a-d8b5-47ca-bd84-749691fe434e", "value": "T191058B0273D1C036FFABA2739B6AF60556BC79254133852F13981DB9BD701B2263E663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506556, "uuid": "37e18a45-8fd8-465f-8207-67af6d21e7c7", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506556, "uuid": "62aae17d-7279-49a4-908b-f49e327b0358", "value": "24576:GAHnh+eWsN3skA4RV1Hom2KXMmHaSD4W5:hh+ZkldoPK8YaSDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646506556, "uuid": "70e56309-c759-4cee-afc6-ee45a6193ebe", "value": 869376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646506556, "uuid": "cfab5f13-9338-4d54-83d9-812b80f182dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506556, "uuid": "6ad4c9fb-3f7f-4330-899e-c8b51dfd26de", "value": "02d6b6d6a27c2c88abbd109a5e1d987183252f7ed6165.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5705cd2c-9cab-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646502025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502025, "uuid": "152fda7e-6ba0-4b35-9cc7-305c3412d696", "comment": "Malware payload (RedLineStealer)", "value": "4704a2b92e0b1f6c93b17a726c29beac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502025, "uuid": "fadc8109-663a-45b7-bd16-34e2e5e8031c", "comment": "Malware payload (RedLineStealer)", "value": "0451b52fd50f6cd16a0faced555ef70b3bb6488a1f1199ea76365b8823716733", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502025, "uuid": "4c98d2aa-3913-4a83-b792-c9e2825b333f", "comment": "Malware payload (RedLineStealer)", "value": "e3d45d72e8a757fb455441817d9ba941686d5bdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502025, "uuid": "8cfcaa06-02bb-491f-99e9-6b68951d8101", "comment": "Malware payload (RedLineStealer)", "value": "3da21e316b046d45570ab4110a324e112ee6b0b4147ee69aa344d6827231693e4e6286bd452369765ba0bd6a5c9e2a2e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502025, "uuid": "6f3ae37d-a3d6-4edd-a0e5-f12bdea381e7", "value": "T188F38C1836F8C072E26B15764474C3B54E7B78B66F356D8F7EC52AB91F262E1872030A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502025, "uuid": "5d17b4f5-f670-4435-8752-22a82cf1e4f9", "value": "5ed2bba8dd6d67921a51920bf446a033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502025, "uuid": "41be7924-945a-49d0-9a55-65b8e31e69aa", "value": "3072:qZZVgLWTYEyJi9T1AfGuJe7azs4CUFyF4NG4/fE5bx4kvpJ3:eVgLWcET1weos4FygG4KLvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646502025, "uuid": "4794bbdf-2316-4567-9177-b210f74bab6d", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646502025, "uuid": "0e6b8b50-d7e0-49ad-9beb-5a10f1fe8b72", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502025, "uuid": "18f93b1b-e5aa-4fc9-9161-4865939b1df5", "value": "4704a2b92e0b1f6c93b17a726c29beac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "368f463c-9cb1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646504548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504548, "uuid": "6897d728-1af0-48a6-8e39-fd55a794f231", "comment": "Malware payload (Formbook)", "value": "a4a3769e4f45754cba878d7ef4d1e38c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504548, "uuid": "7990d1cf-1483-482f-9327-5cd935a3f394", "comment": "Malware payload (Formbook)", "value": "04f02788e4ea8c82ee19b5205a7fb91dab83590d9290ed21b2bb2e00a2a18162", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504548, "uuid": "bb982b64-bba1-4c35-acc0-1fd47e7b0c8c", "comment": "Malware payload (Formbook)", "value": "ffb7a2eed363f0bbcfa5190a2938b17f9ca1028f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504548, "uuid": "0fd47e08-506f-4d1d-8f4f-ec66c0578e76", "comment": "Malware payload (Formbook)", "value": "cf40351deea8e3f887b728b26ec93080464c3544d51822ead2f7080985ec48deccd2cb48318927782e803840c657c721", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504548, "uuid": "d94091b3-a551-43d3-85d4-1644d0270a71", "value": "T1D3B4E12A96C911ACC16D077056FC95E423F84647BA43D76F7D9202E8EF6272FE302687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504548, "uuid": "c35291af-3c61-43c8-a0ca-05045b36d639", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504548, "uuid": "964c0e3a-acf8-41ff-a0eb-8cabc7d8ed89", "value": "12288:lU5znbveSXs7k9K0k+RPs92JOyvCdLq6CDY62UY:m1bveSXsiRNOyaBq6CDB3Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504548, "uuid": "616ebb60-d306-4d44-8f73-560113425d4f", "value": 504320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504548, "uuid": "8a4e6f78-8b5d-4d5c-aeca-7de8266c071e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504548, "uuid": "ff42cb5e-869a-494c-b6b3-7a9d37c231f1", "value": "a4a3769e4f45754cba878d7ef4d1e38c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d95d2ef-9ca1-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1646497848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497848, "uuid": "40bcce09-656e-4d85-94cc-a34a9b1d62f8", "comment": "Malware payload (QuasarRAT)", "value": "1755e55d32771a3d51e049ef4ee9f7ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497848, "uuid": "0d47c3e9-b6d9-4796-9a60-30bc971273e7", "comment": "Malware payload (QuasarRAT)", "value": "05f1ffa1ec36931cc7eea37bec05882e59b185e237b4832fc0abe393dd5e0519", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497848, "uuid": "365774b0-ea42-4ae1-8da2-80d1f69cb851", "comment": "Malware payload (QuasarRAT)", "value": "bbfcea2e25a843d2d2c4023ed026809c0a173e88", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497848, "uuid": "73e4ab49-f678-41ea-a12f-b15cd7acd859", "comment": "Malware payload (QuasarRAT)", "value": "dea0d7e40e04668879e694746e67cf22ff37ac2aaf047ce601c4cd68bdbb77e84de874b9a07eea8e195e417064892419", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497848, "uuid": "140a5dc2-ab1e-4235-b0b8-ff55c4f69a37", "value": "T186B3F7A385DD7CE8E8761ABA737343E5EB9EDE16102AD41D27E07470157C0973822BE2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497848, "uuid": "26f4f6cc-19b2-41ba-b782-494e19d33018", "value": "4bfde1223391e32fec766cd1d41fa3e7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497848, "uuid": "1c105775-c81f-499b-bd59-11319f5d9ad6", "value": "384:EJIceSxofNBIaNgThhN5T6gWTbM4FyjBuoTSslaYK:+PIIaKTv6XF01uoTSsNK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646497848, "uuid": "18dd05e8-41d4-4eb5-b295-d06044b4be7b", "value": 112128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646497848, "uuid": "960a4be5-b142-44df-953e-a24913c73743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497848, "uuid": "e2d462ed-4737-43fa-94dd-785195b28ce5", "value": "05F1FFA1EC36931CC7EEA37BEC05882E59B185E237B48.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ef1684-9cc6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646513544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513544, "uuid": "1600693e-124d-4839-9b08-492ff863df58", "comment": "Malware payload", "value": "61089a51d3be666631053d516ad9b827", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nvidia certificate", "colour": "#CB2ABC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513544, "uuid": "3581779c-6763-4469-8f5f-ddaf6a04ad8d", "comment": "Malware payload", "value": "065077fa74c211adf9563f00e57b5daf9594e72cea15b1c470d41b756c3b87e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nvidia certificate", "colour": "#CB2ABC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513544, "uuid": "96b57e48-ce51-4b2d-9c0f-9c92e560ad40", "comment": "Malware payload", "value": "91b88d281ef983296157f8ebfc73958036148194", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nvidia certificate", "colour": "#CB2ABC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513544, "uuid": "acfcbb32-28fd-4385-aa6e-c69bf8338046", "comment": "Malware payload", "value": "54436fe042fcf9033a5c8c9e9ca77d642acf0c8a4a968e5d3948797afa643e76725f1d1eb8f5ac19b7843c4aed795ebc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nvidia certificate", "colour": "#CB2ABC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513544, "uuid": "68319804-f422-48db-9215-ddf0f4a8f159", "value": "T17245A4FA235D7099E65576F404526090E2F36E3289BB61292C7F38A805B1B37CC537AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513544, "uuid": "d496d636-54b4-43e5-bf69-7e21b3b5b8fe", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513544, "uuid": "d88497ae-c54a-468c-8aaa-2188f231c3ce", "value": "12288:r03iTRCYMyvjBBBYiL9l/bFfpBBBBBBBBBBBB2OP:91CABBBYiLvzFfpBBBBBBBBBBBB2OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646513544, "uuid": "a24114d0-0e2c-4289-bb03-0ede6bd85ee6", "value": 1254976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646513544, "uuid": "34a6296b-e0ab-40c8-8388-abb5df896e6a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513544, "uuid": "e9ad008a-110d-4a2d-8d46-bd31eb244b48", "value": "065077fa74c211adf9563f00e57b5daf9594e72cea15b1c470d41b756c3b87e1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1df2e6-9cb4-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646505951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646505951, "uuid": "ed8c5e1f-e8ff-46b4-86b1-abdc9c15fd3f", "comment": "Malware payload (RedLineStealer)", "value": "c09e32652b8cfd9f21292f53f03087aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646505951, "uuid": "dd051fcf-0a5e-405f-b988-7e498b03ed29", "comment": "Malware payload (RedLineStealer)", "value": "093c77391ffd6eb280164f85a236886dfa56c3e1463fbba681982ce463b36810", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646505951, "uuid": "031be70f-b867-4623-a6ac-59e37f0bfa53", "comment": "Malware payload (RedLineStealer)", "value": "188c62f91bcd79d5a10ea8f9b0f61d07d7efaae2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646505951, "uuid": "a8ffc781-2698-47f6-95f1-6963db771dd1", "comment": "Malware payload (RedLineStealer)", "value": "9e8a7ae2b1b3544702817af0418f80a2c451638d4323db13aa7a7ce203d562f037af8b2b870b72febd3334b0c9230f08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646505951, "uuid": "f07221be-23af-42b6-ba41-228ef0a225b1", "value": "T16BC4233B2346A80ED99F1AB4F77E7A4C918A4BB828ECF277332507C71455892D64C8F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646505951, "uuid": "7512aaf9-f0a0-4318-8ab2-48040af15a68", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646505951, "uuid": "38047038-1765-44b0-8908-43b56686dad7", "value": "12288:cATI+pEMjsVgKlDdQS03ULaHNqrxlKIQNotEqolY3NVzrEevveN:cEuMSgKVdkEaHNYK367oy3NVzLvveN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646505951, "uuid": "489d1e45-c5d3-456a-96b2-e9303042f55e", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646505951, "uuid": "366744c2-10a4-4805-9bdc-ffd66feaf1bb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646505951, "uuid": "be869f6e-f526-48a4-a934-04184bac08bb", "value": "c09e32652b8cfd9f21292f53f03087aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "573593aa-9cad-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646502884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502884, "uuid": "f247bbf8-84a3-4047-8fd1-143cc45d8527", "comment": "Malware payload (RedLineStealer)", "value": "78fa3cd506e149a295e068e4ba9bbd6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502884, "uuid": "eaf24780-1ed5-48a6-947a-f2f62ed6dff6", "comment": "Malware payload (RedLineStealer)", "value": "095e3c515619da6de76ab8f04b1b9e5200f4957a055fc9e249a1e50991f4c8cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502884, "uuid": "9dc924a2-74e5-46fc-b753-d9416ba62c57", "comment": "Malware payload (RedLineStealer)", "value": "8b7737176582ec368cfecfae08180a6b360dc5cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502884, "uuid": "af166c82-201e-4e9e-8ccd-2859328971fe", "comment": "Malware payload (RedLineStealer)", "value": "8155dc3479a00bf60003502a82a4a4095400a3e8c8f69b6dfd92c18bcfdb803a97ca7c18624d73b39fef665fa76e296e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502884, "uuid": "75965043-cce3-476a-a4cb-7020a7b3ad8f", "value": "T1C86533E5E25D1617C21A777BA175B31E2AD2E11B68040FE338AD254ACE0D58E364BF38", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502884, "uuid": "dfd94ab8-5873-47bc-a2c7-4974bbc435ef", "value": "a5843307901c5296ac55c70c3d9ece92", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502884, "uuid": "129c5a07-6c63-411a-b97a-8a6b5d4dd180", "value": "24576:mNewbgaebWGY54Ki3kknhJ05IJ11ZF1TgbJWf1xp368dsKoWuQq+Lfe1oYYvkgj:mNeaSRjRKKLgbJYxh6zlefeqrvkgj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646502884, "uuid": "54ab79ba-1c82-4598-baa8-53054465be7e", "value": 1459520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646502884, "uuid": "63472ad2-3b1f-49aa-b201-24436b146dfb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502884, "uuid": "5f733329-171b-4901-a15b-ebbab79f9800", "value": "78fa3cd506e149a295e068e4ba9bbd6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d91ae82b-9cb0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646504391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504391, "uuid": "ddd5bbd0-5e77-4021-b051-73ca69012771", "comment": "Malware payload", "value": "b91cae3ba85168a2842cffdcc32da705", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504391, "uuid": "2a630289-8241-4e94-a582-9a53b52cfb6a", "comment": "Malware payload", "value": "0b4784972468b114e8fb957769af4aa76d1f050ef4913296f1a3c412afa5b49e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504391, "uuid": "42276cf9-ece5-4ed4-906a-0d5450d15a94", "comment": "Malware payload", "value": "650092176c018ecd3796d94479fe2bb7d0d22ec0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504391, "uuid": "4218713b-b0d4-47e7-96a3-e18ddb803a22", "comment": "Malware payload", "value": "7c784f36917a5b90a33d8b92bd123ebceb7dda60890727fab857de59244d400ecf32651c701b1b4d06e318ad679e9f3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504391, "uuid": "22000872-c482-4717-9d17-9c81a100b81a", "value": "T16A351214FA90D032E4B711F815A9A36DB62E7AB09B3514CF63D51AEE57387E0EC3121B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504391, "uuid": "2d903f63-e64e-4c8b-8219-6ba59eb5d39e", "value": "da969c9b2899100752633683fc4632cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504391, "uuid": "d00a634c-f264-481a-b54e-295a3c9ad9c9", "value": "24576:MDj1Qc7UhUqMb+pl51KgA/51NFvtsETRNa2wGzNtYcSJ+0PMKx:MDyhTMbMNKf1fvuETWXcS43Kx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504391, "uuid": "777c1766-1e50-40f2-89ca-122a4ac1501f", "value": 1128960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504391, "uuid": "a449792e-89e1-4716-8c1b-c6ce6acf9ad1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504391, "uuid": "748d4737-5a3e-472f-bb99-21502e453d24", "value": "b91cae3ba85168a2842cffdcc32da705.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "966f2dfb-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438566, "uuid": "7f43b66a-671c-41ba-88c1-4939c19302e4", "comment": "Malware payload (Heodo)", "value": "4e9b662a4116e15adfca3263afedb4e9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438566, "uuid": "60df5668-18fb-44ac-a5c0-3cdd8c0b1d2a", "comment": "Malware payload (Heodo)", "value": "0f02118fcc07151d343256b5caf015c406ac9957cbb7b0544b290b8380e429f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438566, "uuid": "41adf7b3-3a2e-44ea-b37c-f14abb5d1605", "comment": "Malware payload (Heodo)", "value": "8a420934dd852950cb2138725ed4d6cce147ff37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438566, "uuid": "da3197ff-4345-4662-9398-e0e603df97b7", "comment": "Malware payload (Heodo)", "value": "13153cff5a2ee61f8fdd13dc6175ca3e9f9c9337f7c0b1f0c58aa7a115675e1636380897cbecc50865202bf2a8ede663", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438566, "uuid": "89ce90f7-17d3-4089-a989-47064971386e", "value": "T1DC94DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438566, "uuid": "ed5a9647-8346-4059-aa6d-b474088c3d69", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438566, "uuid": "43bc9821-346a-445c-b8a1-92bfa9a7453e", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8vCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCraYuiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438566, "uuid": "021113fb-dc82-487d-89a3-97c694e92866", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438566, "uuid": "d0040d0c-9e3b-4b5e-a0c7-46b7da0beee7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438566, "uuid": "0325c670-5192-441f-ac50-89a9c3501de5", "value": "emotet_exe_e5_0f02118fcc07151d343256b5caf015c406ac9957cbb7b0544b290b8380e429f2_2022-03-05__000239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37364dbe-9c6d-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646475343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646475343, "uuid": "36dc665c-338f-40e1-b9cc-cf6ec9babfa3", "comment": "Malware payload (DCRat)", "value": "b2687948f59b6bbeede996c0c972ab88", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646475343, "uuid": "1c8d2c89-a927-4bcf-9978-e9d4d2e8ed94", "comment": "Malware payload (DCRat)", "value": "0f10d88699eec9ef46958ac79f574ded8b9a7f4ba4d2783370d628e32378a6ad", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646475343, "uuid": "b21c0a41-1431-48c1-95a4-38feb7acf95b", "comment": "Malware payload (DCRat)", "value": "92f0deff81b858db8064136b67ee8642790596c2", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646475343, "uuid": "14f00106-f247-42c3-bf5c-1c45a9877b8d", "comment": "Malware payload (DCRat)", "value": "f4b69874997bbd3f2d4b4cf6985fbe2d2a2dc18aefacae688ddac81135e3df74a7b3801df10ce224c3362581d61c48fd", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646475343, "uuid": "9de31054-2ec1-4049-a44c-98d4b5a27fe4", "value": "T1F8656C027A46CD63E4650637C9EF4118C3BCBD922B26DB5B7E5A339D15123A3AD092CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646475343, "uuid": "60b4e542-5b34-4f8f-b3d0-b7e368cb798f", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646475343, "uuid": "8ff5e565-2d99-4681-b73b-d6bd4da916eb", "value": "24576:P2G/nvxW3WMH0YoY8SlJUFr/C1DdRd59OfO0RPhj+:PbA31UYhjJUFrQRvqF8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646475343, "uuid": "4b51f7a6-6af4-4484-b49f-c7dca2775e6d", "value": 1455733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646475343, "uuid": "c62df1fa-62de-4ce4-aa22-3f0102778eb6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646475343, "uuid": "44af2099-422d-4560-ab97-5924f4e7d839", "value": "b2687948f59b6bbeede996c0c972ab88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f78c71f9-9c2e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646448607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448607, "uuid": "06d0b49c-1f8d-443e-a368-fe43f117992d", "comment": "Malware payload", "value": "52fff69aea46ba15f6dd8c9d064f1dd7", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448607, "uuid": "eef68365-fab8-4752-a7d8-4e9b6e8f461e", "comment": "Malware payload", "value": "10d51ce006cc7fa5830ffd464a7b51e31de4f0981135552bbaa3a722e51ae5c4", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448607, "uuid": "99182ab4-8b2c-40cc-813e-95c28a94d649", "comment": "Malware payload", "value": "0c14799d5cd42671befd1972b4bcdd92664e0904", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448607, "uuid": "96c43172-a80b-4006-ad55-619988a5697d", "comment": "Malware payload", "value": "fc1a65575c44538db2b0be5a6d556f08bbcb2ab32797d7023fd565ec12603d06a58934c34c19e189c9d92a1678dbb2b7", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646448607, "uuid": "fbc6b30c-2fff-425b-8220-848412e7f41e", "value": "T12B52C7E6B9559A07CAC44233FB0E83EC7F295709F2EF3303671B6F506257A270A66406", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646448607, "uuid": "1431d3ad-0b9a-4140-b1d3-f4d40c14bc68", "value": "192:XgTAlKmy5hspa9yzBjA4UL4wunUtGsJkI2kEZx4eLDao:Xum499OT0dVGFx4eLd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646448607, "uuid": "82ea9da7-130b-4b61-9b51-3eb96789f32b", "value": 13544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646448607, "uuid": "fd8fa0b9-95f9-4a4b-8958-3bb702fc5163", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646448607, "uuid": "ea9cbcf0-83b1-4ef6-9ba4-e3a09f61ecd9", "value": "shloop.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3978eac2-9c6d-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646475347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646475347, "uuid": "3f1a695f-5312-4a2a-b133-874ee09f2dab", "comment": "Malware payload (DCRat)", "value": "b2643de726ecbce4e46c5ca48947d977", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646475347, "uuid": "59ff6917-2833-490b-ab37-ae5a78ceb280", "comment": "Malware payload (DCRat)", "value": "123270643e892d91a0efc9aa9f244a6e901c419b692ce6dae2917e05af31b0a6", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646475347, "uuid": "0c91f4d2-5595-4640-b4ba-085dc7bdb83b", "comment": "Malware payload (DCRat)", "value": "6fe99586596397a2a8e01f6f236b46500f97016d", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646475347, "uuid": "706fdbcb-fa0b-4857-b36e-b70d78460d25", "comment": "Malware payload (DCRat)", "value": "578ee504857a8fe901000aec6aac96d7658615534a9ef422089da2d735d284f368985aa0fcbf6a14ddc050f38f4e5b02", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646475347, "uuid": "658a2b50-1a00-4e6a-a063-955cc6b3b6bd", "value": "T15DC5D0067A56CE23D0690737C6DFC01843ACBD42A666D75A7E5A33AE22013E79E4D4CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646475347, "uuid": "07caf14f-1a34-49a2-8262-c11157dffc9a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646475347, "uuid": "1b8baf41-1156-41d2-b9cd-5bcab160688e", "value": "49152:1fyK6PjUvjgJHiIkDpgFCW9q1pqozF85D/VTr9j:8JQgJHFLc1pdz+LrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646475347, "uuid": "cff1bae9-e5ce-452e-a64b-3e2fc5e698b6", "value": 2725888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646475347, "uuid": "f5f393ea-cd97-49c0-acb5-197fcc2c4963", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646475347, "uuid": "c04747a0-ea84-4921-89d9-7740c9bc1214", "value": "b2643de726ecbce4e46c5ca48947d977.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e44eeb00-9ca0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646497538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497538, "uuid": "4aa8f672-fca1-44d4-9b6f-8647762d613c", "comment": "Malware payload (RedLineStealer)", "value": "22878b895b582cac203520697acec573", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497538, "uuid": "e5d660bd-eefe-41c8-9b49-6dc8f2282160", "comment": "Malware payload (RedLineStealer)", "value": "130b502503d177f9d567f0446929f4dcd7e139087531ef41211c0db149ccc729", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497538, "uuid": "94915626-8d2b-4147-b633-322d623bebaf", "comment": "Malware payload (RedLineStealer)", "value": "f431e72bcce65b8d7bd0632b208b950373d9d11a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497538, "uuid": "3959c79e-e010-4f98-ab32-822600544f54", "comment": "Malware payload (RedLineStealer)", "value": "7355e56b18c055ae550616c0c2ea3da066a4eb89bddb7e5bd89f39e0276a6edc79e2975bc86a68a6cefb50cc5245f23d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497538, "uuid": "b61db1e4-ac3a-4f78-9ca0-f65f33ef2e4c", "value": "T1AC14AE2031E5C032D1A725764474C7F54EBBB8A616356A8FBFC42BBE1F256E2973430A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497538, "uuid": "019ca00f-ba37-41cf-9d9d-7ed37cf64444", "value": "854bb78feb50b0dda6ba146455affeba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497538, "uuid": "77561083-568d-4bd8-a595-bfdc88de8120", "value": "3072:mafsLSICRCJiwF38g/kkHwAL7CQ/A8t4LbRPxvpJ3:NfsLUIt/XHwaP/7upxvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646497538, "uuid": "dd58b8ed-9867-4465-975e-2870f4437b4d", "value": 190976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646497538, "uuid": "a738d18b-87ec-49b3-bf2a-6cff85bde8de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497538, "uuid": "cf2ba7fa-593f-4ca8-ac68-0c71e06ddcb3", "value": "22878b895b582cac203520697acec573.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8be7db39-9cae-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646503402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503402, "uuid": "2c7ac5dc-9224-42c8-b3f2-d48e568bc284", "comment": "Malware payload (AgentTesla)", "value": "a081e53c1694171985d92201ee9b9515", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503402, "uuid": "494894ad-8a7a-4403-9a59-dc040bc403b2", "comment": "Malware payload (AgentTesla)", "value": "131055f834b36ceb99dd2a03813310ee58cd25798c5415e6d0510d7f46719c43", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503402, "uuid": "d9633356-1b3d-43f9-bb68-f45a025f92e1", "comment": "Malware payload (AgentTesla)", "value": "e64b2940b920e837fe77cf7e6df2fa6734bededd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503402, "uuid": "853cdde4-4111-4d3a-81d6-de7235a35f46", "comment": "Malware payload (AgentTesla)", "value": "411779839b7578bd029ff0b8a85ff3f2b94b29d1731afda58d88ad1e72e012cd4f3151e8e7c56c265da445f98c8748be", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503402, "uuid": "cbd82af4-b745-46fb-af2a-f0bca3ae8dec", "value": "T11814129636B51D41EF4E2A7B24783353E3A0FF558F02D510A7C8357D19B1C9258AE227", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503402, "uuid": "352832a2-0d89-4285-80ba-c326ae292509", "value": "3072:fiFv+NCJ9ptLbJXMomU8T/rTq+pZqYKr8BDFd+A2LYtuawh+yT7Ft1a7zZl:KFW4Jn1JH2/fqmhFo93Dh+Q7vYdl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646503402, "uuid": "1c2f6ab0-7aab-41cc-8a7e-8c3569275096", "value": 191080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646503402, "uuid": "3939225c-62fa-4e1c-8802-d71d09436bee", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503402, "uuid": "c6d526bc-bf98-447b-ba45-eaa5e9c6fcff", "value": "704V3 30.09.2021 ARTEKS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b58deec3-9c1f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646442054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646442054, "uuid": "98e546d7-f6b0-477b-adf8-871c0c75fafd", "comment": "Malware payload (Heodo)", "value": "bdd2b3171be68c9a65beabc01b7fc896", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646442054, "uuid": "7d53bb54-2bd7-4942-8784-40bf5b8fb595", "comment": "Malware payload (Heodo)", "value": "1c5bab4aeea0b736789136458f55e468e44396a9637bc87945be457e9dc31ff7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646442054, "uuid": "dccba5f3-90df-4b49-bfdc-9d380c5d8740", "comment": "Malware payload (Heodo)", "value": "43ac1b29393c20ce502f37e4db583b0adca1f75d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646442054, "uuid": "94b9b13b-f323-403f-8a40-2ca541e101a7", "comment": "Malware payload (Heodo)", "value": "e35adb645bef5fdf6410ce91aef593bd93c2ddcca96c29c0fac948e572dd94b19650b1aee0a172187882888346493bfc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646442054, "uuid": "ca45a49a-9b30-411b-bbb6-5aa81be5194c", "value": "T13D353951B04FD1BDC08F04BD596AA37EB29C9E100B7544EB329C3BDEAB389E545B2D06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646442054, "uuid": "3dab1d6e-60f8-42b7-bbda-016ab8a1b859", "value": "570e13786e13464ca954b67524d1cbb1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646442054, "uuid": "39b1aad8-fc93-491e-9108-63115d9f1a16", "value": "12288:NLyWPZ3mtGkQoQK/1mqXXpvoCpN8ARRZr1EPq9vsOwDu3kQybR:0KWtGkXQgDXloA1ZnytX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646442054, "uuid": "080a2b89-62e6-4d8b-954c-c753190861ef", "value": 1064960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646442054, "uuid": "05135dc8-5d1e-4add-b630-e025d4b57c57", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646442054, "uuid": "7c5e1277-8ecf-43ad-b107-dfd87e0dcf27", "value": "emotet_exe_e5_1c5bab4aeea0b736789136458f55e468e44396a9637bc87945be457e9dc31ff7_2022-03-05__010049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6ecd9f3-9c2e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646448606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448606, "uuid": "bcce55c4-39da-4b98-89b4-71b01ccde87d", "comment": "Malware payload", "value": "5a78bd9da746d302f10e5b730b757bc0", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448606, "uuid": "1a568a18-9730-4c66-acf9-7a0511717c3d", "comment": "Malware payload", "value": "1cddc3fced60a70846cda0a5f13bb92e1b0b6f0a0596741f3ef5302b44396cc3", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448606, "uuid": "6888105d-d48f-4441-9ce4-4aa08431984c", "comment": "Malware payload", "value": "0c9c0df4e5001998b196769aa8de2c55eb79871c", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448606, "uuid": "cbaff4c2-5cd6-44f8-910c-fedc16b855db", "comment": "Malware payload", "value": "b0b91cfae1bfe2f52086cb9f0d24e967e3ea35d1adb19e6b0642e73e55ad2568021219e3eeda927e76276b22c2f35d0f", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646448606, "uuid": "059bd77e-08c6-4478-ab1e-43cb9aaf1fa5", "value": "T12FC2F85AFD41AF11D4D4217AFF5F124933535F18F3FB7202AA245B28278AE6A0F3A815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646448606, "uuid": "61fa43ca-8a44-4912-ba7a-46fc75050e89", "value": "384:+RnUHSR7gcc7YdURdmfMYtFMlp+EhjiK/FE3VrgXx4e1wzqJG5dQIe2V:+RnUY7BDAQmlp+E9iK9WRaAqoe2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646448606, "uuid": "a3c30308-ed05-45ed-82ca-ecc6222f246e", "value": 26004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646448606, "uuid": "bc4785d9-19ba-4f86-a424-ec198fcba1f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646448606, "uuid": "c516c606-d41a-43df-8107-291f375e2d46", "value": "shloop.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bc34320-9caf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646503751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503751, "uuid": "68972775-47ea-49da-be2a-6247dbc94180", "comment": "Malware payload", "value": "6e18f464ed6ee3283af5ead1800a5740", "object_relation": "md5", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503751, "uuid": "c8fdfd8d-5005-42be-b7f8-23eb1be4eb69", "comment": "Malware payload", "value": "1d4729244894266b10afc54042b898ad36236312cf02610bfb2f192dede4c4b4", "object_relation": "sha256", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503751, "uuid": "eb7187e9-11ab-4df5-94e0-31ada81285cf", "comment": "Malware payload", "value": "19178b33274eb83aede936f1167bddfe131071c6", "object_relation": "sha1", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503751, "uuid": "8a3e0b34-82d8-48fa-95c7-304280e283a3", "comment": "Malware payload", "value": "7dc39c378178004c3b4de807c97e00d4380561f5b69fce11e415c108e23240323ffafdf92b4f04d9ac6bf13894907dc9", "object_relation": "sha3-384", "Tag": [ { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503751, "uuid": "ccea8e05-a6e8-4cf8-8582-1ca7f4071ceb", "value": "T15651AB001EE611ECF3334675BBE9F37B4622F4B4E91ADBBD218106A94B24201E871F79", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503751, "uuid": "70670e34-f258-4899-8d81-d5a1a30edf70", "value": "48:8WoRkAQGUfhO7prqs0g2aCYqf4sjiGHAigoXHCus:8L+PGJ7pOs11qf4sjJgm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646503751, "uuid": "714f47fb-cb32-486f-8b94-f7e1d6f151a4", "value": 2959, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646503751, "uuid": "5daa7257-fcc1-4a9c-823d-d8d9f1304086", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503751, "uuid": "ac7b3f55-6ae7-4cb1-933e-048600696df7", "value": "W2 - Rachel Harper.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95fc3cb8-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "22d5a29f-d744-47a3-8c84-93b2b96cf7c7", "comment": "Malware payload (Heodo)", "value": "bc7649b0fbf09d0ac80a6a6533cf7dc1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "46bf960a-ed9e-4f34-afa3-05a376998226", "comment": "Malware payload (Heodo)", "value": "1f322b88b5fb046d4de97ba538140c106e31bb58034135b6c9d05c0817af3274", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "7674f936-c7bf-4403-a14c-e87c82fce725", "comment": "Malware payload (Heodo)", "value": "19426365cfa4d9460021183deef7f520de338ec3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "d8aef743-a11c-4ba8-bd2f-ae8f84935e61", "comment": "Malware payload (Heodo)", "value": "5e74f020aee1bee5d81daed1f87712f57dadac4e27a15231bf1c7c6851982a6d48b53bfee1728e411ea2666e756d3460", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "1748a73e-d837-44d6-91ad-6fae21ec2528", "value": "T1BC94DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "2dca9e70-b4b3-41a3-af84-802edc048fd4", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "622d5103-3fa1-4dbc-b2e0-2c1c052a55eb", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8TCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCraQuiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438565, "uuid": "093b4eef-ebe3-45be-9620-6974a0690e21", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438565, "uuid": "204e94e2-4b9f-425f-8389-3f2d22fb578c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "9b7c4d68-c4a8-42df-bd33-e48c8b436d54", "value": "emotet_exe_e5_1f322b88b5fb046d4de97ba538140c106e31bb58034135b6c9d05c0817af3274_2022-03-05__000237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b426a3e-9cad-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646502918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502918, "uuid": "e2c18eb1-2c3d-4af5-a801-43cf8ca7b73a", "comment": "Malware payload (RedLineStealer)", "value": "e202160c649038776d5ca90630cd04cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502918, "uuid": "f4d1da1a-3b19-4d77-928e-f3c2844dee88", "comment": "Malware payload (RedLineStealer)", "value": "1f4229f4c023da162f9222c0a7b55f3c146c77bb81375f8ae0b375a0e43287b4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502918, "uuid": "7c2e8207-3e39-4cdd-b26b-51d38d996541", "comment": "Malware payload (RedLineStealer)", "value": "ad0981b96d9d0fb35106d98a381fe5de09edcd21", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502918, "uuid": "bb354cdc-d78b-45f9-8046-bbe12edea964", "comment": "Malware payload (RedLineStealer)", "value": "65801b8b83359dd45de1bf214919dd1886dcd7d7c09e8bfb38e275861f07d6d8fc5a27faa5010e5b5266f733f9fbe11e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502918, "uuid": "a1e43070-3954-4c5d-a49c-5c46c9002829", "value": "T18155334566C39A81DEDF2C3621B3BE85EC8E55948725CEDB87FC8BE00730E9CA905758", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502918, "uuid": "bcf36913-9e15-43c1-80a4-0bfcc77bee1b", "value": "7f9fb4358b45ca90c677e7525696c7a3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502918, "uuid": "cc1ac897-9bb7-41f4-827a-0d3e18c455a7", "value": "24576:SeXME+8TQUg/fXCmqTrECe2jrvUvSrenmuHzXiCO2XjPpoBmcoog:S+8D3X/qXjeiv6SymCzXHbjPprc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646502918, "uuid": "afa19ead-0142-43c1-a0ac-67afd4a642d9", "value": 1365552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646502918, "uuid": "e9695dad-9d90-4685-b53b-0e4ceed9f241", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502918, "uuid": "bd77ebf0-e49c-4ed2-9fc5-415ccbc11219", "value": "e202160c649038776d5ca90630cd04cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85503c1c-9c3f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646455717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455717, "uuid": "9c86334f-6bbb-4c15-b654-2f12ceaa128d", "comment": "Malware payload (Mirai)", "value": "c61df5ee4d720be5bf8e65647ee2f71d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455717, "uuid": "819a2cbf-6336-4460-ad15-62fa909b753e", "comment": "Malware payload (Mirai)", "value": "1f4c876846f7d63b90026a1f12e647b738b3d0efc89590b57a0b30661e6ba960", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455717, "uuid": "cf337a48-7c37-4abb-b504-fc4c702e1476", "comment": "Malware payload (Mirai)", "value": "9b048d38d47d71a4d4d3a04a73aa538a9d8fa9b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455717, "uuid": "e45c12ed-c3f9-42a1-a0ab-ef0541a015da", "comment": "Malware payload (Mirai)", "value": "aca266565574436dfa798be99b6f17dd7e5229726118959fea391bb2049a81e634742c490833128b02faef004d6ee65f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455717, "uuid": "0c74b0df-ce7d-40f5-bb1c-c99859142b13", "value": "T13C733A25B9391E36C0D0B57E11FB8B01F6E1228E26F4C51A3DB20E4EEF247406952BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455717, "uuid": "026e05f3-695e-45ae-a57b-d1aa3a1b523c", "value": "1536:1gfq/SnNLlYfpDFQS2OX+msMmsRoe6vfL7rLQU:mE2Md0rvfLbZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646455717, "uuid": "a0dea340-9175-4f07-affb-377e5b6c5204", "value": 75504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646455717, "uuid": "c88342c7-28de-44b5-bed2-e0ac6fe162ee", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455717, "uuid": "f5b9fbd0-36d6-4117-810b-65241cd20625", "value": "c61df5ee4d720be5bf8e65647ee2f71d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3bd0db3-9c71-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646477297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646477297, "uuid": "38fe8ab5-2b2e-4d2c-a0f3-36aefbacec24", "comment": "Malware payload", "value": "672a4cb0339039cd0f3b056de73800fa", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646477297, "uuid": "745ba27e-ba0e-4f97-a5bd-64e308d69418", "comment": "Malware payload", "value": "2044524fe88a8ed1ea1d5428cba427f87763e35ed487d91fe5c1bef12a6d26df", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646477297, "uuid": "23163a1e-df78-4e99-bdd0-f967d60271de", "comment": "Malware payload", "value": "6f6ab0cd96eed0246f883e97461539c52e2328f8", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646477297, "uuid": "247eaa10-08ee-4725-9dae-ca4a0c787dca", "comment": "Malware payload", "value": "ff5e8fda3fd2e7ade7f287cfaec44c72338ba268b1acf6e028ddc46d2bc68b19c76157b8575578415cd949ec6b0eb9ef", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646477297, "uuid": "84e485cf-2846-4945-b58c-19e62f2248b7", "value": "T1EDA533FFDCFCA2886572E07C87C1339B77B55669489379E28132D09DB808456D6ACAC3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646477297, "uuid": "7196676a-dda3-49db-85c3-e218f08e449d", "value": "49152:mJ+H40z9QXEcq6rw7OjXLd+BNpi2cg0HVkNx/TOP9VnP:mJskEcq6rw7O4I2R0HuqP9VnP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646477297, "uuid": "9177fce5-fe74-4c29-8b69-e6f29929855f", "value": 2073487, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646477297, "uuid": "58a60c0a-1f56-469f-8e93-9b944c0a11e2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646477297, "uuid": "dd26d24e-e75e-4e8d-9131-acde4349336a", "value": "RFQ-55014CH.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02613cb0-9cb8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646507466, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507466, "uuid": "f0577697-51a4-43c1-8da6-c348a8aaa14a", "comment": "Malware payload (Mirai)", "value": "f9935a0345640d90796f0185d47948aa", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507466, "uuid": "5eb88ae7-5fa1-4ce1-a11e-a2a8997b3b87", "comment": "Malware payload (Mirai)", "value": "217b2405a55c098bfa7b34cbc9b42d8ca90865467fb5ebad2d965038bc1e5606", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507466, "uuid": "afeb84f1-ddc0-47a3-811d-94d9eac89b33", "comment": "Malware payload (Mirai)", "value": "7f8e6ab206c11b9a307b9d1cc721e91e99e17cf1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507466, "uuid": "3cfe74ab-9e19-41f2-b2e5-38ef9705ada6", "comment": "Malware payload (Mirai)", "value": "82095ac6b55a8d71e9d8c1546612a9447cde8f482b640fbb90916cb4bb7acbd4eb90ff191f82c6db4dd6d7cd787b419a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507466, "uuid": "c5369b76-7a16-44a9-b14a-530255e7dde1", "value": "T112736B31B9762A27C1D1A47A11F74B10B6E117CE3AE8C61E7E720E5EFF216506403EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507466, "uuid": "a68ca1ad-df2b-4c13-99c5-dd85139c27f2", "value": "768:Uoao+BTVXvoaRq9/ZPjrglLgABJ7fZo4lJLRmMLGBZSGizO+DksDQvG:3arBTVXvoaRS/ZPjrgtgg7fOMauuvG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646507466, "uuid": "c5a00565-ff15-482c-9f25-a14a924ffcd8", "value": 76192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646507466, "uuid": "8b7e9331-1797-48d1-977c-b150613aae91", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507466, "uuid": "5dc6124c-6d34-4e60-a5d8-4a7f6d7816c7", "value": "f9935a0345640d90796f0185d47948aa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c72a54c-9c3e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646455273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455273, "uuid": "9fe3e150-6642-4ca8-8f0c-953c5f99ae1f", "comment": "Malware payload (Mirai)", "value": "d75d8abbb084f76cfe997faa83c60539", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455273, "uuid": "5a4c09ea-2059-4c91-ba7b-5224f9262fd6", "comment": "Malware payload (Mirai)", "value": "249bd5255b0d0d933ef5ac2927b7733c364c971c1763bfee1408cadeee301a7f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455273, "uuid": "cf40d049-4b1f-48d7-bc62-894878f13bd6", "comment": "Malware payload (Mirai)", "value": "8c5e1bf54acd17f0590f354b41bcae267c16ebd9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455273, "uuid": "b9e8e03c-b9af-439c-8105-3136a877e529", "comment": "Malware payload (Mirai)", "value": "e3df7fbc6cd1cf5fd3a5ddcb9e1668789dd9a14217bbe062903d96b88363b9c21933f61275063ec9124d1103e39690b2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455273, "uuid": "f41dfbb4-7c44-45ec-9f47-7b7220349b67", "value": "T1C8533A99F4029E3CF98BE5BD84150E0AB92033D851931F2766EEFC937D331A49E51E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455273, "uuid": "1a7a457d-d555-47f7-b03b-c8f73ee20f0d", "value": "1536:A76gTszWCCXIIxwFB0a0hP8/28A5wf8LPX:AegTsKCIM0awVK8rX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646455273, "uuid": "87545e42-fa77-4179-a460-2e1573a1c9ef", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646455273, "uuid": "7cd20274-e16d-4f9c-9603-a0273bb13e0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455273, "uuid": "e10c3d20-625f-4dba-83f3-7649c746053a", "value": "d75d8abbb084f76cfe997faa83c60539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe0de08-9c3e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646455252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455252, "uuid": "d21f00b3-870c-43b3-92ec-77f6a77d148f", "comment": "Malware payload (Mirai)", "value": "faae070b3cffce16522cb3e1a1236c66", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455252, "uuid": "1b59c79f-d9e5-4e6e-9cac-1ce160c81430", "comment": "Malware payload (Mirai)", "value": "25b78a15f1360153c4c97a472df4b98e4f91b6289a9f4f784fc3e0ce2f2d878d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455252, "uuid": "963a1cdc-b58b-4451-94a5-25f3c28a55dc", "comment": "Malware payload (Mirai)", "value": "13f45cc0797cc247a86cf67a012f379d0bbf7373", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455252, "uuid": "b73413ab-b8d1-4cd5-b44e-471bb3db178c", "comment": "Malware payload (Mirai)", "value": "73fda2490b7d557ce4b26052433a3f1b633e1489d912811a58222481a37443657a394b968f6d02a71882d6cf07a4752d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455252, "uuid": "42b48f80-d28e-43ad-b12b-9ae102d43bd5", "value": "T141537C39D469ADE8C0464974B814CE345F53A484C3A32EF69AA083EA9493DFCF419FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455252, "uuid": "901edfc1-6bd0-4c6f-ad06-7364428fc9b5", "value": "1536:jaPzrUMVC7FuwtV7alBmxffs3bHFk/q6LyyGuCI:j+AMVC743af+blmLyyGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646455252, "uuid": "4dd798e0-7bcf-46a1-9c33-1b71f4045101", "value": 65040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646455252, "uuid": "424054e7-38c1-4e0b-a24a-f0db644c822b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455252, "uuid": "867b043a-cd17-42c7-bdf0-7373e2204c72", "value": "faae070b3cffce16522cb3e1a1236c66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f7ddbb1-9cd1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646518441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518441, "uuid": "a23406f9-c51b-497b-b42a-96bdddcbc0da", "comment": "Malware payload", "value": "d4424df49460734b580839605a2c9381", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropperXMRIG", "colour": "#75E729", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518441, "uuid": "97522065-559e-4ca0-8c07-30b336cc197b", "comment": "Malware payload", "value": "26bcedc0e573911a13652aaf2faaad16323b3994dd648ff9a5b6514e388197d1", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropperXMRIG", "colour": "#75E729", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518441, "uuid": "e1a19ce3-92a1-4a57-afc3-1e67f959a7da", "comment": "Malware payload", "value": "f80979ef58477563a5bd00e5e64f94ede4eb6c8a", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropperXMRIG", "colour": "#75E729", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518441, "uuid": "6c06f58f-bda2-4dbe-a582-b3c29ae20324", "comment": "Malware payload", "value": "226d815caea095f0c3f819f90f8de00954b7794dea2166b0ed142b70e29bbedc1bf2b4c743d1f41145ac7d7a846e0b45", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropperXMRIG", "colour": "#75E729", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518441, "uuid": "583653b3-5b1c-4f8e-a02b-784982013f86", "value": "T1994103A3C2E8202AC553FAC5AD1E57447C2BD0B2BC467AD711F85C6E7C07B8A97A140A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518441, "uuid": "3ff0e7b1-e10a-4b7c-887c-bb81f4078c3b", "value": "48:B6iRC8ISUuR7AcWtGR7A2g6I0/57vjwulI0/HNwuQuA7AGGR7A2gF7vjwusI0wT+:BwHSr0tQsmlNnH/OZQsBNXTH/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646518441, "uuid": "7bcec1d8-d9c5-4c4c-a453-541d53278b53", "value": 2008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646518441, "uuid": "855ed3ed-4464-4556-9cc3-907d2c913035", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518441, "uuid": "13054e43-021c-4a91-a73e-c163196fd13b", "value": "FyNVGDDs.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e09539e5-9c1b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646440408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646440408, "uuid": "2a800b88-9747-4188-b57c-433eacbe77d2", "comment": "Malware payload (Heodo)", "value": "40a2b566c703c67f611de1e52dc4c8de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646440408, "uuid": "9ad67b42-03fd-439c-9d95-5ad21177adf7", "comment": "Malware payload (Heodo)", "value": "277034104b9db4d9fdba40dc9827c95462927168d79827f9216a315786eb787c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646440408, "uuid": "70b9edfa-8132-4326-82f6-ec9437733607", "comment": "Malware payload (Heodo)", "value": "0c4e1d8df48e869f8098defa6b24d3c23d85e824", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646440408, "uuid": "0e995943-f9e1-4ef1-8fd6-a219bc54c62c", "comment": "Malware payload (Heodo)", "value": "51dafb5c34d43f43ff820efc6d605426d86ddca6d78ab9c55ab1a718d35ce277780f945a92d12f72ce3040a820dd10d6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646440408, "uuid": "1f0812ce-78e2-4418-b098-8ab7ea2a5a36", "value": "T10494DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646440408, "uuid": "cca12f60-b40c-46b3-b186-f58e42eeffa3", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646440408, "uuid": "6536189f-30f9-4319-8315-1a38f9e55b77", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8rCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCra4uiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646440408, "uuid": "e7b2b694-5bc7-42a2-8632-905e1c8ae14d", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646440408, "uuid": "a8d5264f-7f4a-4196-bfb5-8b8082ed8acb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646440408, "uuid": "903ebd62-5818-406a-aaf5-f827302dde53", "value": "40a2b566c703c67f611de1e52dc4c8de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b35b821-9cc7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646514004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646514004, "uuid": "4cc3247c-61a7-4ac1-93ce-17377925a6be", "comment": "Malware payload", "value": "ec21de427b151db5f8f264ffce7e5a0e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646514004, "uuid": "c388d4f7-67b8-48c0-8acc-8f22c036327d", "comment": "Malware payload", "value": "295fc01cc0b0f65894c9a54a6422177ad5fddd37b0c68371d76acdf74a6465e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646514004, "uuid": "a8557f12-a774-4de4-9343-4fa77544f0eb", "comment": "Malware payload", "value": "a6abde1d32cb232e2af27f12c0e28889983b7838", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646514004, "uuid": "9102092b-50f5-4db4-a265-d0747aa8e721", "comment": "Malware payload", "value": "5ce46e80652304f9f8669c358050d52424670e5376dc48b92b492536293b5e6e0a1b3461239982e2e04a449b109b2e0b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646514004, "uuid": "b2efd506-3772-4e6a-ad54-7a846e6574d2", "value": "T15BB45C46E24391F7D42705B0134BF7BF4630B23594119ECABB94AE5AB9338F26A4D363", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646514004, "uuid": "cb08080f-8c5a-4beb-b40d-5ffa21db9be9", "value": "12288:VeRvuKqiVZ4En5drNK0pPEfJKlHZ8mG97Qxee6yzmxA:VIv/qiVNHNDEfJKHZ8mG9QeeOA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646514004, "uuid": "de04bca4-f1c3-4d4c-949f-3dca6557ff94", "value": 538208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646514004, "uuid": "2eb23914-d2f6-4d62-bffd-087e2dedf175", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646514004, "uuid": "3c43e0e7-0c17-4e6a-a923-609850da615a", "value": "295fc01cc0b0f65894c9a54a6422177ad5fddd37b0c68371d76acdf74a6465e7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "718e3adb-9c3d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646454825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646454825, "uuid": "493333ec-ae9a-4698-adee-2a13e47b02c6", "comment": "Malware payload (Mirai)", "value": "951d20f34a0d955c1a758a1560672f83", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646454825, "uuid": "9d5be5f7-fb54-405b-9fe9-d19d3bc6e739", "comment": "Malware payload (Mirai)", "value": "2a76140f1338e4a1183ca09b44000ce37282d03a2a8f7335f270f8c28db6cdf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646454825, "uuid": "27d836b5-08d8-4f4c-97ab-805c73c00d26", "comment": "Malware payload (Mirai)", "value": "968e04bf38d79e6c5f0ec1cdc6f775bc22e12fce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646454825, "uuid": "bd03db7f-a19b-411b-b532-1f491017b7d3", "comment": "Malware payload (Mirai)", "value": "a34741068aa904c292cfe74550eb0d564dbd87a608b23eb334459930103266e8c59ffce99ff7ec6529764b562bd1d9fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646454825, "uuid": "a1c4c146-100d-4a30-9302-4a37acfd6684", "value": "T1BDE2E0229327E171E5744E77CE1543063BE985B9F0DA24E20AD88B197FB3D9331A1B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646454825, "uuid": "033bb29d-1f1f-4fe6-8f89-9f3a65078897", "value": "768:L/2iWc4fHLeOackndAfXlZxHyJ9q3UELOr:rSdeOxcAdvS8Lw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646454825, "uuid": "6646f6e7-957d-4987-82a3-42de5dafcee2", "value": 31944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646454825, "uuid": "61dfefa9-bf41-4074-af7c-70f3f1d0280a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646454825, "uuid": "83d8a1fe-b3fb-4a4a-a006-d1baec893adf", "value": "951d20f34a0d955c1a758a1560672f83", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a06f33-9c1d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646441053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441053, "uuid": "c4e39901-0fa0-410e-ab04-d99c15cc61fe", "comment": "Malware payload (Mirai)", "value": "723f6e6f6f72e26c1d81c3044685647b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441053, "uuid": "b01c9d1a-5211-4c92-b613-55e04b84bab5", "comment": "Malware payload (Mirai)", "value": "2ae24ea9c712912e5a1ca1c78f1b8b5a1698542150c23a407f43b482bfe16496", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441053, "uuid": "aa0bb29c-c958-4f45-a74e-2076f5628731", "comment": "Malware payload (Mirai)", "value": "735038c831b7736f6f4e4b387ea1fd2a31dfdc6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441053, "uuid": "e7b6e292-65f9-4b60-a04e-aa5c067cc08e", "comment": "Malware payload (Mirai)", "value": "bafabec73b8463ce48301a8708e0b7c1c3546cee626ee5ef9fbc4709a2b0b652df24aede97a103bb109ff308d23924bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646441053, "uuid": "fb9fd8da-db6d-45d0-b1a5-2992b8f7b4db", "value": "T1F9C2E1614A05F071CF704C7AA8BD8613434578B8D99B35399EA08B74BF43882ADF97C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646441053, "uuid": "944d7bdd-cd5d-4c13-9dfc-25099ec6cfdb", "value": "384:7bP1hXu0sSE3asfuEilvrxrT6zwm8WYMQyj76HC90SQyY6fBD2m7jmdGU5Eg:HP1IKJpvdT6zwm8bMLj2HqpG4BP3U7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646441053, "uuid": "b4d47dc6-de25-44b2-aa47-939a0d646c8e", "value": 27020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646441053, "uuid": "fcf4f7f7-5c28-4c9e-be00-405980157cd2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646441053, "uuid": "58393dc3-7254-4ab4-a723-428d3c360c49", "value": "723f6e6f6f72e26c1d81c3044685647b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5bd3de5-9c77-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1646479823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479823, "uuid": "3a23a98e-4b9c-45bd-8a25-b541527d5750", "comment": "Malware payload (CoinMiner)", "value": "3f7303238e5cd70800cc118df00a9fc2", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479823, "uuid": "36431823-6a13-4cc1-8579-6e9d0b071d3b", "comment": "Malware payload (CoinMiner)", "value": "2e0aa995df9b6a99e37601b1d7dea6fb85f6c7130980a8c2a275370efb6f0236", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479823, "uuid": "ccae4e81-ebb3-476b-a31e-09cb9f4a2e13", "comment": "Malware payload (CoinMiner)", "value": "fceb65b6c8c21c058c8875fbc91a49cda9a4a16d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479823, "uuid": "5a24f080-6118-476b-b65d-48fe0fa8f2eb", "comment": "Malware payload (CoinMiner)", "value": "d787b0af0db1dc049dcee6202a70373a967e3b918682ee34b4fbcc91a86853d150bfa244ba59b9b358f5377dfc6b5d3f", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479823, "uuid": "fcd91ed1-e1ce-494c-8803-d6f1bc2c7881", "value": "T11E563390BF15946AF2258A3E14ACDEF1A3F9AE186360E74516FBFD57347D7027200B82", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479823, "uuid": "a9224e02-3292-47c0-b3fb-cf592aaf1c0c", "value": "84bb1ac192dd1d591766b467b12ade64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479823, "uuid": "7b630344-3fd7-45aa-8357-1d167f490877", "value": "98304:gAgDwjZdNH1S38s4UL/IjOEmictoN/cYS0urJYnfG6uBTOBqIx/Hxx8oN:J8SlS337OSfJYnf+TOBqIL2o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646479823, "uuid": "a993bbaf-fd2d-4350-982b-41a8fb4c7e7d", "value": 6064128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646479823, "uuid": "9d6cbe06-ac34-4fd4-9b0b-aca58390bbe2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479823, "uuid": "2cbced9a-184f-4d4d-87d5-5be6ec56daa8", "value": "StormWare.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b0d5f5-9ca0-11ec-9275-42010a9c0029", "comment": "Malware payload (GCleaner)", "timestamp": 1646497243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497243, "uuid": "b71e3c5d-d1c7-4406-b607-7b83e816a98f", "comment": "Malware payload (GCleaner)", "value": "07187aaa44a712bf4d7d6d128c5feb85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497243, "uuid": "2fa9a851-b5b1-45d8-9cdf-58ffca30ed85", "comment": "Malware payload (GCleaner)", "value": "2e71e3bcb39c87ae43d0019b5d62084b8eb2bb0ebe09c05d7cf2ad026082e527", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497243, "uuid": "22abbc38-ed3d-4893-a404-787b956599d9", "comment": "Malware payload (GCleaner)", "value": "c2d446972fe6fe86c6142c07c071c85cae3311cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497243, "uuid": "5b21d016-df95-4800-8cf7-05d54b5a2a98", "comment": "Malware payload (GCleaner)", "value": "38ebeb80c260f21948d8f7ade3c8d2fb254b7172f4e9bb8c06ddea98a04df2e4bb10755a24cd9b0c3cea7184426e0a2b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497243, "uuid": "f31baaf3-1caf-4ce3-821f-317f0ab2eebf", "value": "T15B34B01576C1D072D9A219712470E6B14A2EF9300B62DEEB73C41ABE4F317E1BA34E67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497243, "uuid": "d465b79d-fa69-4d06-9bfc-c533a7a4cffa", "value": "a09fb7ac37c6846f86e7eae4dcb32d14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497243, "uuid": "8c577f4a-3441-4a89-a4c6-2699784be0e9", "value": "6144:4TxLfvl8PmgNJPuir3H6zRF0anOiABjUhga/:4ViPbuir361FTnOiWjkV/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646497243, "uuid": "71b76f8d-555d-417b-91a2-f927587523fa", "value": 235520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646497243, "uuid": "bd1018d7-b054-40b5-9848-4167485550a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497243, "uuid": "e6b01231-59c0-46c9-a05b-3709415b2e35", "value": "07187aaa44a712bf4d7d6d128c5feb85.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a12b3d4f-9c69-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646473803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646473803, "uuid": "a1a3ccf4-7eaf-4c07-a7a8-76ef66cb8ec9", "comment": "Malware payload (Mirai)", "value": "b7225f296bd62c737ed0baf7b42e5c21", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646473803, "uuid": "16561529-a3fc-4dcd-a903-bc1644455e52", "comment": "Malware payload (Mirai)", "value": "2eaeacc642a2a767ad7b45d9f67ee5fc4bf9a037877c94d378172f3984a54993", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646473803, "uuid": "ae822f86-cd29-4e3a-900e-93382b005629", "comment": "Malware payload (Mirai)", "value": "315a6f6f5db7fdfa6d19b3aa27f68a4ec2454ac3", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646473803, "uuid": "1588aeac-00bd-42d6-a9ec-e2f5f4245ec0", "comment": "Malware payload (Mirai)", "value": "2a34be2cf8024115542fec082e5030cd522c1b3abab9389524198f6ca0705d6fa40d64bc5b86053056f7547fe85bb36c", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646473803, "uuid": "8b14232a-fea3-49b6-a7b0-17114b6e1c07", "value": "T19CE2E696B8928D1AC9C953BBBA6F029D331567E4C1DF771BCC005B503ACA92F4E37A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646473803, "uuid": "c758a8e1-6b88-405c-9fb3-f4995abdbd6e", "value": "768:lXF8KIFY9MYK3bp84NXlcsDjgaNjU3GyjKK6cE1rIFHFE:r8KISaYK/ZisDjgaN2GylE10M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646473803, "uuid": "bb658494-dc48-494e-a5d9-86d07a23c0cb", "value": 31492, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646473803, "uuid": "45e5ae1f-4377-4850-b74b-699b24fd9ac5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646473803, "uuid": "58e5e8da-5c74-409f-bf97-d27c8991bbfb", "value": "botnet.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b1b64f0-9cc6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646513521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513521, "uuid": "7cff539e-eea3-43f5-b65a-4a3d84c9aa7e", "comment": "Malware payload", "value": "07b7da86d2f548d18462f8d6d869052a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nvidia certificate", "colour": "#CB2ABC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513521, "uuid": "fc35da92-f318-47d9-90a9-3e989c68cf8e", "comment": "Malware payload", "value": "2f578cb0d97498b3482876c2f356035e3365e2c492e10513ff4e4159eebc44b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nvidia certificate", "colour": "#CB2ABC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513521, "uuid": "4881a0b6-8952-421a-9e3c-ab6863e72406", "comment": "Malware payload", "value": "f9153289b209929130f897ee47710b4c94aa6453", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nvidia certificate", "colour": "#CB2ABC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513521, "uuid": "2d32de4e-7a0e-448e-993d-47c5e113310c", "comment": "Malware payload", "value": "ecb2b4dc597b0d200148da36cd3cd49fb97b62b0c2046e8ef32820146f4066b568bfe8fa26513a6958a29527065539a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "nvidia certificate", "colour": "#CB2ABC", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513521, "uuid": "e321ea1b-0249-4b0b-b58b-908b12d842a7", "value": "T114336D47B6A508F0D6A6EA72C2C55627EBB1B80317368BCF0760C9951F23BE1563E307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513521, "uuid": "aa5fdaeb-3484-414a-bd80-8b4fbf4c6590", "value": "00db1d9dd67485aab67a6d0f00bd614d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513521, "uuid": "2e232541-4e74-4bc1-ada1-15bd16493e76", "value": "768:Tgk3Z09nDnPQ4ASLwBTC7jR7N7/L26YUK3qZJShFr/gy+oyO2wVfruUMr+f:rmnbLwi7j2+K3Lz/7f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646513521, "uuid": "912fe26d-ed24-436a-a9ae-02b454a1f7e7", "value": 54304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646513521, "uuid": "6086512e-1807-4676-96d5-59e3e7ac2084", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513521, "uuid": "c7ae57a0-a5c2-47e3-a7e0-fa22b18c54cb", "value": "2f578cb0d97498b3482876c2f356035e3365e2c492e10513ff4e4159eebc44b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "652bef7f-9c3e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646455234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455234, "uuid": "2bf55928-c265-4f8b-b763-7d9d49af4ca7", "comment": "Malware payload (Mirai)", "value": "51fbf38084f27fce9661bdb6724ff4a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455234, "uuid": "8fcbe7f5-a8db-43b4-a64c-439665e65469", "comment": "Malware payload (Mirai)", "value": "2f59c733ed7c4c2cc8d4542fd23b152211fdb5556901041b829bd2169b4c6802", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455234, "uuid": "33de477b-5c1e-408d-be7a-430620839a96", "comment": "Malware payload (Mirai)", "value": "f6d798cffc6d904481780009b81ac6b7bd6dbe93", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455234, "uuid": "8a88ca18-b77e-4998-9a72-29aabe85f9da", "comment": "Malware payload (Mirai)", "value": "ecdce7f990110b70df36c5d1b73a870475d86983115959de840418b83ecfdd7063e2c4e6cc78ba7753d81c7766df0a9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455234, "uuid": "c292333c-5c17-445f-8558-05e7bc82362c", "value": "T1C1D2D01F5B57B59ACEDFBC35504A0BB15E41A1C33AA61B4A4F454C80B22850DB9DCEFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455234, "uuid": "5feb7b83-7662-4108-92be-4d9b44674711", "value": "768:AVYLMI+v86bUI3ad8L3wbwPu+42yETV1M+JumX5NC/DxpyW4:muMk6YmauL3wbj0M+JRX5gt+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646455234, "uuid": "48c78674-c14a-48bc-a29a-a42c0a56422b", "value": 29980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646455234, "uuid": "aac917f5-2d7b-484d-a7ad-e1cd9e70f090", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455234, "uuid": "e0e7ed00-19b7-4873-bd26-c51d8539ec03", "value": "51fbf38084f27fce9661bdb6724ff4a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2650ffdc-9cce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646516976, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516976, "uuid": "e21d12f0-52b6-4cda-8001-5d01b1e6418f", "comment": "Malware payload", "value": "234e22d3b7bba6c0891de0a19b79d7ea", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516976, "uuid": "3dff980a-4a59-4c7a-a8e3-e7d534fa6b79", "comment": "Malware payload", "value": "30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516976, "uuid": "591a06b5-6744-4bae-b0fe-030fe43e3f3e", "comment": "Malware payload", "value": "9214239dea04dec5f33fd62602afde720b71d2d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516976, "uuid": "621b821b-ae4b-4e52-a6e1-7abc2ab5739c", "comment": "Malware payload", "value": "be75139e2a448a59c26ffcdac4cf12b29cebbff13fb7d92d646467f1af2afec8c838cba9d9fc59bfe94a10898a3fdb2d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516976, "uuid": "cbd4c68d-1516-4de8-8bee-3d2493027ddf", "value": "T170D312B74EEC230AC51003BB4F9AC8116743BEBB26D1BDD32D2991D4534A74AA01A774", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516976, "uuid": "38776058-cba8-46aa-a690-fac684b6a328", "value": "8012281525ae7645e4bef777e0869fd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516976, "uuid": "80074431-f9eb-444d-bca7-f6e95195f754", "value": "3072:vz6jbOpd4hhC8I1kRZKjLSbJ6mP4c5WP+a:r6jEd4XXI1kRZKgJ6mP4RB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646516976, "uuid": "253daef6-136e-490f-8219-ba4a18b5d7a8", "value": 135168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646516976, "uuid": "243babd4-5025-411c-b072-c7768909956e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516976, "uuid": "155ed4e6-6e11-4146-9a04-2ed819dd2b74", "value": "30a824155603c2e9d8bfd3adab8660e826d7e0681e28e46d102706a03e23e3a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ba2b59-9cbc-11ec-9275-42010a9c0029", "comment": "Malware payload (GCleaner)", "timestamp": 1646509534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646509534, "uuid": "129bd62d-01f9-4d3e-967d-7e3c4274f9cf", "comment": "Malware payload (GCleaner)", "value": "b309bbc4c04fbc091f18733f4304d07a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646509534, "uuid": "7e397908-a333-40ab-95be-261c238c0bc0", "comment": "Malware payload (GCleaner)", "value": "3143856c1aa1dd4c1ffcbd7d015c7ffb377ce434590ea4e44423db5778ba685e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646509534, "uuid": "ff1f0b37-e5fa-4f2b-a760-ad5dfdd5b39f", "comment": "Malware payload (GCleaner)", "value": "4762317e341262c11e40357168e86397703a524c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646509534, "uuid": "f692e239-c59f-4f9b-8842-d9b3280c5759", "comment": "Malware payload (GCleaner)", "value": "98671170f4d03ef2061848e343e739164764e0fd6e6bedc33a84ef53be98a5b3f0b77935c6ed608235fba2f9d90ff07f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646509534, "uuid": "77001baf-3637-4093-8ae2-0be2aaa79cc2", "value": "T143F6336FB90850BDEE0DD13C568CB5678BB6828ADF42C8CE6F44C4481FB8C51765B6B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646509534, "uuid": "49328817-facd-4ac7-b896-daf0fbcceab2", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646509534, "uuid": "124a9009-1b2b-42f2-a687-a1e0684140b8", "value": "393216:xQdg29VdVo8qVuahXqzMoIvwpGrNMH5ojz54R5Lv1hjXX:adggVdVXqV1hX9hvwpGruH6H54/jXX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646509534, "uuid": "bedbc781-49ee-4ec1-a010-739821f752e9", "value": 16449860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646509534, "uuid": "a5ae19eb-b00c-4ddd-b9cd-b38c43034b86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646509534, "uuid": "98a327ab-cced-4506-b501-00c42933d171", "value": "3143856C1AA1DD4C1FFCBD7D015C7FFB377CE434590EA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f2979d-9c86-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackGuard)", "timestamp": 1646485998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646485998, "uuid": "2de251c9-a729-4152-82f5-7693d383317f", "comment": "Malware payload (BlackGuard)", "value": "bb5f22fc74149158b637a2bac5064ddb", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646485998, "uuid": "284c0635-1890-4e51-afc9-893b5af66b29", "comment": "Malware payload (BlackGuard)", "value": "31c4edabd35f8a9d0695c96f21acd8787eec68b8028973470d64c4956d9f1cd1", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646485998, "uuid": "c995400c-5390-4c16-9792-8604b042a900", "comment": "Malware payload (BlackGuard)", "value": "f2e45a2d4d25487260f6d18098cd0ec03759d7d9", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646485998, "uuid": "76f66cb1-8b23-43e6-a569-bccc28f64172", "comment": "Malware payload (BlackGuard)", "value": "3196a6133b64b49ff457134259ab4616a2a64b56be8661d648e56c29bf2bf41f7840b2f7afdf4712cd06891c41c805fd", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646485998, "uuid": "3e60efeb-de0c-4324-810d-7b5d1f93533a", "value": "T153A501B52708EDB6CAB90DF4CD54D0F59AB81F72FA5079C76C853F0ABB3024CA916186", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646485998, "uuid": "e166ab60-3d00-4762-86a6-785b9750e2bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646485998, "uuid": "b500970b-3289-428f-8b26-9541ed64f8ff", "value": "49152:FUceq3w+dZrYACactL1X2OCvJBb9vjyuho:HewdBOaOCvJmGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646485998, "uuid": "b17a3ebc-a6fd-4298-9bc6-3e3531352ec5", "value": 2083328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646485998, "uuid": "29a03be5-f245-42a9-814a-18ea7a79410b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646485998, "uuid": "838c81a0-267c-475a-a76c-a30b48903b13", "value": "eufive_20220304-191420(1)", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54b85e6e-9c1d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646441033, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441033, "uuid": "913a34d2-97f8-4685-878e-ce44c185b748", "comment": "Malware payload (Mirai)", "value": "a05857476ac5a8748a187a4159b21466", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441033, "uuid": "e85b1e85-bbee-4103-8b85-52c2c5f8eac9", "comment": "Malware payload (Mirai)", "value": "3261ffb0cc725bf36a1361573f8d9fc2640fcce20b6f0f920df3cabfdb5030d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441033, "uuid": "3b1cd707-1592-4b25-898d-8ddf1eb1d3df", "comment": "Malware payload (Mirai)", "value": "3babc230f62bfaabd38fc40b8665dad8063cc4f3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441033, "uuid": "babb0715-a6ed-4c95-b42e-87ce8ad64410", "comment": "Malware payload (Mirai)", "value": "bf6d008d4452f406a491f853aa689c1a935be3dfaedca0518389b16c9ecaff5fb12fcf628f2c7abcd605789b71625ebd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646441033, "uuid": "3218f8ae-4fac-45a0-947e-86c9b7fec903", "value": "T1CFD2D03C2A132DBEE683D8B6113587506E7D0EA5E016C88B5FE6C3F454126E6E483BF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646441033, "uuid": "c007f26f-d341-41d8-be39-bdd2535c200a", "value": "768:rLyxp+1EH5e4LfdISi3TpL4/IJgGlzDpUYsXI:6xp1OSEOAVqYGI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646441033, "uuid": "e1d42143-71b9-4675-8af8-bf868fb26fbf", "value": 29256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646441033, "uuid": "2e0039fd-4de1-4563-92a7-ef54bf873cca", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646441033, "uuid": "7c5d35a2-b09d-45c6-82e9-7ebf0c66a9f6", "value": "a05857476ac5a8748a187a4159b21466", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "859849ae-9cae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646503392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503392, "uuid": "b3bcc614-f54d-442b-8833-6c9719c3ec93", "comment": "Malware payload", "value": "228528ac96d48c6abcf6137b2c9c1099", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503392, "uuid": "41a5db34-289f-4c5f-8e14-0737628c0159", "comment": "Malware payload", "value": "3542d2fb981f045ae10955dc6c5eadab4d1e1bd1964240a692dc001cc59a4bad", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503392, "uuid": "e915b13e-ce47-43db-8ad0-8492043ecbc6", "comment": "Malware payload", "value": "19acf478d5e081629e22aba1dff87e148d19965a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503392, "uuid": "26b100bd-152a-41b1-8c60-a02afde058d9", "comment": "Malware payload", "value": "7ab686a258a4037cc1f4b15ec5b801279309c23a3ace02a302aafc9b633684fec11a89e427e3c813551cae115fe85675", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503392, "uuid": "b5445cdb-9510-41db-8e79-b98120d75bba", "value": "T1901412B8B1F8598AD5B6BFBA16C6C372CA83DD2C8D44227564D1F0CB36B2C405C62743", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503392, "uuid": "bbaaeb12-622b-460b-8427-021ce5a74d82", "value": "3072:Z/jBnRRwuAGVC8FpBPlHZkHk7kuiJNeB/Nr55eKqxGuRo/XpH/nig13vMYT/KiKa:tBLzrVdrBPNZkHkouiPeBttqxGuyxiM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646503392, "uuid": "b7fbc4e5-d946-48e7-bf15-1f0b46f4f40a", "value": 191144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646503392, "uuid": "c11280a6-9dbd-40e2-a0be-cde4ea40bd1a", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503392, "uuid": "f367c537-a9b4-4633-bba8-3ba74a64af37", "value": "Invoice- INV-121925.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acf06fa5-9cae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646503458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503458, "uuid": "1eb32e74-a149-4fb2-b7ea-d7b7fb1f2ec6", "comment": "Malware payload", "value": "e51564762450f952575d6087b1dc9b5b", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503458, "uuid": "7538e340-0aa4-45eb-9d0c-d7a2198ae8a9", "comment": "Malware payload", "value": "36bd5616fec9430c14a3b7c80af13d7ed24cf506e4e0a20cd6fd3e7d99221f16", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503458, "uuid": "f9844b57-d56e-4dd5-bd01-1b7813695ba3", "comment": "Malware payload", "value": "f5434c6b90fa83b40ac5da49f5f862fb766a38d3", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503458, "uuid": "5694f6e0-6b2f-4358-9019-888e27b49f4c", "comment": "Malware payload", "value": "d52ff8b2889d63f56627e3a328ff2107b17f6d114868317c83211700a46accfd0fb40948b39e18b3fa50bef875781f8f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503458, "uuid": "a837e746-71a4-443b-8e48-ed3604a01922", "value": "T145A43A0077C078AAD7970FB1372FB6E2E56A0C7A2855494FE100BC5069F5726FAF26B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503458, "uuid": "f87c2fba-e24f-430a-9060-d7381eeb4780", "value": "12288:1eP8er1n5Yc7ACEtI/YJ/nWzkjEb6zab9Fct+9cbOBceTj1jYGL:15e55Yc7ACEW/YJ/nWAt+7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646503458, "uuid": "c5b05ba0-4fde-4340-a4f8-1a37b1981e0b", "value": 492032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646503458, "uuid": "ee1a22da-3c2a-405b-9c9a-4b29c095b3d5", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503458, "uuid": "f4fc3e2f-85e1-466f-91a5-4c3ef6ff6b60", "value": "DocuSing_eSignature_j46i10i131i199i433i465j0i10i131i433j0i512j0i10i131i433l5.2269j0j15&sourceid=chrome&ie.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac5678b-9cb1-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1646504581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504581, "uuid": "9eaffa95-f5b1-4c3e-9768-62a1f121936d", "comment": "Malware payload (BazaLoader)", "value": "1dceeca46e8ad9977a39aa91b7f22b1e", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504581, "uuid": "4efae352-1994-4e89-b05b-0389a7d00ca9", "comment": "Malware payload (BazaLoader)", "value": "37debcc0b045cf464526cce4f8d6fb7367aaffffeb5faf6b5b61ea7affd7d2c0", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504581, "uuid": "7c2df17a-0269-458c-8eba-f7f9f72846db", "comment": "Malware payload (BazaLoader)", "value": "4f4b698bfc25731e6eef8d6bed451d79e4e112eb", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504581, "uuid": "da035f3d-4f0e-4ef0-a371-23f6f7405529", "comment": "Malware payload (BazaLoader)", "value": "05058713ff07dd19f85e9ed77b80a8d288136c6a26722fce473718e1a9d54c6511b8b3689ea6fcb31413e9a128bcb586", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504581, "uuid": "5aab5ff0-06a0-4547-b7d3-975e2ddb54c0", "value": "T1C9F4D06A66A837B4F0135474CD674A03CAB17C7127B191EB9793324B8D3ABE4173BB12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504581, "uuid": "22884dc5-3f09-47b9-8ad1-d5521af5feae", "value": "64e5d7cce23479085f2b5c15b028487f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504581, "uuid": "4b698134-d16c-46b7-8f9d-414c08b9867a", "value": "12288:jb2Z46I1dVNykv7csRVVPRWYco1fQTBYPjffcvAFF5tyS7HV:jb2o1dXykDrRbPRWPQfRPL0vAFN7HV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504581, "uuid": "67693dcc-924a-44e3-b903-b4fb71c8c418", "value": 728943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504581, "uuid": "93804907-541b-4966-9ab0-c97dfa7f518c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504581, "uuid": "b633a71b-fca7-49a5-8381-2f5bb8a4ef9e", "value": "1dceeca46e8ad9977a39aa91b7f22b1e.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f12a887-9ca0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646497421, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497421, "uuid": "360275a5-3766-4377-b6b0-c4bb2b6f2893", "comment": "Malware payload", "value": "d31770e09fda5d81d6f0bd5c9b1fc30c", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497421, "uuid": "e14d01f2-6e8a-4c8b-a5db-844f6993a0d4", "comment": "Malware payload", "value": "385083016300c010b3ebbe5bed0959727f0282f0e5bcd833f78957091a5c9ed7", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497421, "uuid": "c55d082f-f4c6-40c4-9551-30aaa758c26a", "comment": "Malware payload", "value": "79634382e1e95c87f8b2fe5b79925860397f3f8a", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497421, "uuid": "7551ec8f-1afa-40bb-be8d-619cd1d15ba8", "comment": "Malware payload", "value": "7809a9b445726c03a034c163252b503f8813cddbec995d12bf8f8b7b36d0aa286aa3d9f6d643d7ecd01db0cb24f6a01d", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497421, "uuid": "446fee81-59fc-42a6-8714-0059753a3b6e", "value": "T19983F109F16088A0E72354BECB0A16F7B109B21442D6FA4F32C0F75CAB5969753AF67D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497421, "uuid": "d9ce7c5c-1b97-44ea-859f-5868103456ba", "value": "1536:R/muTIwKIcBnjn6FSObnnPyrDOLXF/FPO38vfys8TIWLnUS68d7IeNN4MB8:VbTIw4D6FSObPyrSLXJFOMvfys8TIWxy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646497421, "uuid": "b60b55b2-4e4f-4a4a-ad60-a8c8a9312511", "value": 86517, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646497421, "uuid": "8317a09e-5807-4d04-b532-0bc79d947fe9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497421, "uuid": "0fd7aca5-23f1-4e9e-8780-649b6174bb65", "value": "January 2022 T-12 (2).xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b080105e-9c78-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646480271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646480271, "uuid": "716a887d-ba16-4c5b-9693-287d459d296c", "comment": "Malware payload (RedLineStealer)", "value": "516ddcbfee39b8304b14789e2a69ce1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646480271, "uuid": "a3f24496-b356-451d-a69e-4dc160bd23f2", "comment": "Malware payload (RedLineStealer)", "value": "387908fbfd34eb7d61e59518225543db7b5a7aa7beb1b6b8070778dd31705ed9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646480271, "uuid": "6c099890-3356-4fb0-ac94-4dbec9669ec8", "comment": "Malware payload (RedLineStealer)", "value": "1d0902f236e80830d2bed65588bee48ec8e8f9ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646480271, "uuid": "ba4358d8-9952-46f4-a0e1-fbc3a90359bb", "comment": "Malware payload (RedLineStealer)", "value": "f77a686fafcc3c349020ae030933cb0ff78bf27a71e18f568d1f36f931437dcebae65fbedb9769a5542daebc54f96e8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646480271, "uuid": "7b893ddf-a5db-4659-984e-a72ccdf70c79", "value": "T14CC423990580F7AFE0D1A9736E36B65B21423072AD84C84D9E857EFBA03C56E3D0646F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646480271, "uuid": "5de59c1b-088d-41e9-b20d-d9cd0bf98db4", "value": "390d44241890f16bc2697a53156b03cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646480271, "uuid": "78633c64-a683-4c59-981a-94f6e5d17209", "value": "12288:bYqVDrc9rxUbo6nuv9o4yXjK/lGRgOUqmq9kR6lhKXv+wocrV:cXU0Kuv9ojK/cRgOnmq9g66+KrV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646480271, "uuid": "cf155b37-4e79-43b6-8775-18c77a19cb6a", "value": 564736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646480271, "uuid": "266411dd-0773-4167-a75a-d7690789fef2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646480271, "uuid": "0ca47791-77ae-4e19-a322-496eebe74142", "value": "-GTA 5 HACK PANEL MENU.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbc1482-9cad-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1646502946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502946, "uuid": "beb02fdc-c959-4f16-bbfa-0055191ef150", "comment": "Malware payload (AZORult)", "value": "57454d66a2a0c4bc38857af8d67a7b7b", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502946, "uuid": "f7bd8ad7-1c39-4235-83ac-3141914d1d82", "comment": "Malware payload (AZORult)", "value": "396dc145568042cf890e68e3849ea78fd798e72d2f2465ffcea64339799e8963", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502946, "uuid": "094f2a45-344d-46f1-8e8d-73ee0eba128a", "comment": "Malware payload (AZORult)", "value": "a0baee8026b4de524a6ba56e4aa3261a00befaec", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502946, "uuid": "dcaaba04-5d61-443b-8ce4-0449a278e950", "comment": "Malware payload (AZORult)", "value": "06fbc86a0b4abe3b08729203520afb1196f7f34b3a2c1586e022800c2aa25184e1a6514e34c08954fce2380bea8dc6bd", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502946, "uuid": "687d6944-c180-466e-b4fc-4e0c99dee7b9", "value": "T157549DD77AD00071C173017A45AABE2C457EBD26DB7EBEAA1FCF1A4D49782908325723", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502946, "uuid": "ef2a6081-b823-4caa-ad73-84d314eed8d4", "value": "79f55bca14e471c0adcc4631c5bdbbf6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502946, "uuid": "27264147-f820-41a9-aa19-4e95f74db8e0", "value": "3072:XjocGOX2+ttgt8Qg/upGvSWuVJ++Bk3eWQJryUTloK2nLq6gRHnCnBzkQ8xC:8cT2StgtVGun5UK2LFsHC0C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646502946, "uuid": "cb6fed28-caf5-457e-a021-d948369d7399", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646502946, "uuid": "f82baab5-7cba-48b9-989a-4c5be8350b17", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502946, "uuid": "749c7e06-c4e1-47a9-a6e3-6eec83f6af50", "value": "396DC145568042CF890E68E3849EA78FD798E72D2F246.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9a771f9-9ccc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646516471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516471, "uuid": "0274759c-32b9-4328-8321-db41404a9a80", "comment": "Malware payload", "value": "47d108be60702953ea350c527f526559", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516471, "uuid": "6f94a4f6-dd7a-4181-9e0b-72d415aeeed9", "comment": "Malware payload", "value": "3a21fcf23146cd14cfb057188bdbaca9caa8ebf4bed800f5d19c99fd39528a36", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516471, "uuid": "cf58ca69-3750-478e-b94c-9bd92aeb14b1", "comment": "Malware payload", "value": "ca20b6bb96aae66d85e622362fe7a7c2e91a41a9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516471, "uuid": "087a0cf5-eb4c-4cca-946c-f9b52b4df4c4", "comment": "Malware payload", "value": "bae9e4600f8f0615669aa2b5eb184605e7c77cbe14621d9512877e66d6724fcb8af8048db6cc9466cd11ce3d6d5c9966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516471, "uuid": "9a86e971-0c2e-41cd-8c91-94df29193aa0", "value": "T1E3D5F6C0F9DB44F6D1078E7288E6922FAB31460883B1CAC7DE681E59EC5BBD1157B724", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516471, "uuid": "2286eac8-c01b-47e0-8f94-a986e1558bff", "value": "e724bea03515dde29f2b2b282d64f822", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516471, "uuid": "5c68d25a-c31c-4ae1-aaa0-67b5c5538757", "value": "49152:MhZqCS5HTLF2Im6xYLYweQ5iZUe0fiZkXZdCsGjmuye+wKy4oiHexBL7GjU84a8b:qZqRzg6x", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646516471, "uuid": "b78f6983-c2d3-4de9-9670-f4500b303af6", "value": 2911744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646516471, "uuid": "495e4fa1-66e6-41d7-b2dc-908a3b0d4914", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516471, "uuid": "bf72b5b8-7e6e-47d9-9601-3f5407f6e1f4", "value": "3a21fcf23146cd14cfb057188bdbaca9caa8ebf4bed800f5d19c99fd39528a36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dd389cd-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438525, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438525, "uuid": "72c2ec81-5499-4355-9d74-3af3569b5768", "comment": "Malware payload (Heodo)", "value": "a3a59b7cef8a308bfb519b270ecca4c9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438525, "uuid": "c6d23b3c-60bb-4a6a-b46c-44fa0f5c98de", "comment": "Malware payload (Heodo)", "value": "3de2684d6187b2e561bc48f5d0278fcd8c9fa43f5453897e9acebc4b9302ff91", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438525, "uuid": "29fe2c0b-ca2a-499a-acac-5411ef3e6453", "comment": "Malware payload (Heodo)", "value": "c2b4656dea3bd66a029cab13248c1b89d12c4b89", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438525, "uuid": "c3ee2a60-9211-44e9-8006-a9ac8ebf40a3", "comment": "Malware payload (Heodo)", "value": "8811339668931cab9ca9aad2b95e67bb8158065ca5d179c53a39f11229c94badf1060e6b9e71601ba477deefe25bb544", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438525, "uuid": "c344b44d-ae68-46f1-b438-1d6704f8c26c", "value": "T196057D22B9C19172E25F13B629D8DEEC33AE5A3107D1C1DF5AB41ABD3E729E15630603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438525, "uuid": "6d010db2-46dd-40c8-919d-4049b639f792", "value": "810544f6d1cfc4b1abda96d46e502763", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438525, "uuid": "f4e149dc-c931-428a-a217-675894001eee", "value": "12288:78u2rsRwkKeb6hsHN36rXeL09CTZ5X2wiRU3zaEq366QkkOYaPG8Lik:x206S49CTawiMaEq3XxkOYaTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438525, "uuid": "a88c18cb-181e-45df-a1cf-2687dbd978f5", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438525, "uuid": "acf2bfbd-431b-40ee-be30-069dce6e0527", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438525, "uuid": "039ad276-9ecd-4fe0-93f9-b2c7314f2ea2", "value": "emotet_exe_e4_3de2684d6187b2e561bc48f5d0278fcd8c9fa43f5453897e9acebc4b9302ff91_2022-03-05__000200.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58e5e755-9c1d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646441040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441040, "uuid": "5df08629-6d3a-42d3-ba1c-325376fee179", "comment": "Malware payload (Mirai)", "value": "dcd8618f96ccb0d76004f0cab1166271", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441040, "uuid": "fa28361a-b5f9-4c8e-914a-49567f44b819", "comment": "Malware payload (Mirai)", "value": "3dfaae8dd256680f6aee18072a557cdabc8cd794fc59eff0148f1f132baaa9d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441040, "uuid": "7887894a-25bd-4dbd-b93b-da1fa78fa5b6", "comment": "Malware payload (Mirai)", "value": "7994380265100fe8609bbbeca0255c779138ffb7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441040, "uuid": "51bd665f-f4b4-4ac8-8301-331da41775b6", "comment": "Malware payload (Mirai)", "value": "0634e3dcdab72c4dc1e0100c0d2638ecba60944b9e8f35fad70cb16eecf57f61a19436e509cfd34776cb15b165413d93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646441040, "uuid": "f66363fd-6fb9-4e16-a352-85b2b79f2934", "value": "T125C2F1EFF9D4150FC572F0B204BA9875AFD2A588B72B239D9F859C1A43FB12018E84D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646441040, "uuid": "173e7c3a-370d-4b64-829b-6a480657d22d", "value": "384:MmloY2brUbGJzpmcZtENLS3KBm8e6n2BjnpOTuXSWsCl5XtAC2CEm2QCgvAmolsJ:M2GL93km8ev5OUv0Oo2J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646441040, "uuid": "23432ddd-16ca-48d9-939e-4ffdd288de44", "value": 26248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646441040, "uuid": "d1610fae-5f44-4119-90b4-0c294f81e1df", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646441040, "uuid": "475fb3e3-0ead-4428-98b0-af100420f7e7", "value": "dcd8618f96ccb0d76004f0cab1166271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc51b60-9cc4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646512797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512797, "uuid": "00aeb282-499e-4266-8324-771e092b7744", "comment": "Malware payload", "value": "24d0d6a213375eed9769819fd0808d37", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512797, "uuid": "b38bc891-12c3-4b54-b0a1-8b5f669b0dcc", "comment": "Malware payload", "value": "3ec6cd630a66bb6b9aa52794ba1a0fae5295bffa3f99bb5d4322aea82d1c5d45", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512797, "uuid": "72888f15-901b-46eb-bf30-0f896cea1162", "comment": "Malware payload", "value": "2bfc8027d03d1c564c176fb39fcd9e06e8b30a56", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512797, "uuid": "a0ea4ef9-c089-4b85-8f71-0e37dc84bc79", "comment": "Malware payload", "value": "8781557aa328ce6878786d4dc0fc6a789fde8c198aec1b4c0da42bfbffa04cebf92d9742089181ed80675304f81ce1fc", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512797, "uuid": "c5c3e44d-b10c-4790-a860-017f4c85aec7", "value": "T1C9033B67B5D4443ED54EC7708EDFC6330AF6B9896A3232CF29C46AB13F21A190B1E615", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512797, "uuid": "11186267-799a-46bf-ba91-d36b425549fd", "value": "768:i15Tlua8JhxR/bVGE78h5vGkrdVus4BrEVCAE:ivluhD3/bVGN5+k2s5Cj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646512797, "uuid": "da0bb330-a32e-4eac-b287-ee76b363344e", "value": 40224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646512797, "uuid": "01078d28-bac6-4c40-a826-63d5c7781fa4", "value": "application/x-sharedlib", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512797, "uuid": "8e7801bb-c6f1-4da0-91a2-ddeb4764bc11", "value": "test.so", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27db2b0-9cd2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646518956, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518956, "uuid": "76f231bd-5360-4f37-93e4-626d86b8e5b7", "comment": "Malware payload", "value": "53ff72d77d663a2df2ff8d0caa0336b8", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518956, "uuid": "edc50a92-006f-412e-ab65-86012cf17973", "comment": "Malware payload", "value": "3f977d7ecac6ea8f310cba1cc0790afd600b8ae6556cf336eab7bb9a30b22f6e", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518956, "uuid": "f94a6af3-756e-4265-8293-db7d62c7f6f3", "comment": "Malware payload", "value": "42a6c6a20afdabfcee3ae3f0cb64a8527033692c", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518956, "uuid": "315e0522-80c5-4b42-8b21-ef4790cacfc3", "comment": "Malware payload", "value": "2648132ac08e89d2f144958837b199cd8169306888cd64fcf813324ed406008f6bd819df32d8d39d900086f7008addc5", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518956, "uuid": "1526fb23-dbed-424b-84b9-48662e66ab13", "value": "T1E051980AF847D15C9B792367EC97C962FF1B401B9DA2104C71ECC2455F30809A6ACF8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518956, "uuid": "363559d1-ea1b-4b94-8fc4-11fc69bc93ac", "value": "48:A4248iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlU:CGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646518956, "uuid": "30ce076a-9897-4939-ab78-c80dd13f2624", "value": 3131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646518956, "uuid": "5620f4a3-316f-4b45-ba47-f86446244097", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518956, "uuid": "6e93a2eb-bd7e-4bef-afe8-a04ba76ab619", "value": "jMhE8Nhy.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fd1199d-9cdf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646524427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524427, "uuid": "b036ee67-30c2-4ca5-a71c-872690e279cb", "comment": "Malware payload (Mirai)", "value": "6aab16c8bca11a07fbbecd57871e967f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524427, "uuid": "e9978cd8-f094-4a20-9aae-69c26e58adde", "comment": "Malware payload (Mirai)", "value": "40a2b06415310245b59df076e665af0210681af8c57c74911ab1a2303d4fdb63", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524427, "uuid": "393aa1a6-95f7-4d7e-92ee-38c9768f5d90", "comment": "Malware payload (Mirai)", "value": "ce589454d6340cb97ad5e9ef71deaa6aa69bc11b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524427, "uuid": "9caba2bb-04a4-40db-84c8-97cf87834de1", "comment": "Malware payload (Mirai)", "value": "130150154f221a8256f92e300195990700f63f2cc41700062b9a41426d8c8a8b21538dce0339dea5dce05e882149c4fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646524427, "uuid": "66cb2b36-cd8e-4040-afe2-bb94accc6e15", "value": "T17D335B42726C0947D0A62AB1353F1BE1A3EFEE9021F4B584690FDB4A8235E731586F9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646524427, "uuid": "8dd87595-f3e0-46d2-a1a9-91f852f9f150", "value": "768:+91wrhEp9R9U8hGcTH1Z7kIcUbPfJxCxYruY6Lbpx2F:hhEL8kZZHiurl6Jx2F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646524427, "uuid": "a7e82324-6282-40e1-a1e0-6b9e2a7fb16c", "value": 51416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646524427, "uuid": "2f635bb1-ddb9-48f3-b8df-68f241c944cd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646524427, "uuid": "2a2aa857-58ee-4590-931f-d2e7c226921c", "value": "6aab16c8bca11a07fbbecd57871e967f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8eebb651-9cdf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646524453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524453, "uuid": "3e22dbc1-bc6a-4bbe-a9aa-38c175f653cf", "comment": "Malware payload (Mirai)", "value": "8f8266a9727a87a52bd54e01b4c36598", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524453, "uuid": "dd923fde-0a94-49b4-b061-78cc5d15fad7", "comment": "Malware payload (Mirai)", "value": "40c67d74bc46c17093097793989b9aede071ac3e8ea0a7fa5d49657b5a40d8d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524453, "uuid": "036fc794-795b-4f52-b6f9-5f32961b6d0f", "comment": "Malware payload (Mirai)", "value": "73d82fcc91bf609fb266248fcf762237b001e607", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524453, "uuid": "d5ce5631-8aae-4f5d-ac17-efe34f02ba1f", "comment": "Malware payload (Mirai)", "value": "9b484b9a37dcd21a52bb0404f06b56e951ae15a9a224863a33eb9c1638de8ef3f44ef185b29bf6c86eb4899b7697c73f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646524453, "uuid": "5eeb6c5b-3f28-4b28-867c-67c2461d741a", "value": "T15C63760E6E218FBCFBAC863547B74E219648339627E1C584E16CE9016F7034E745FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646524453, "uuid": "f112c902-96af-4145-8ccc-3e31acdbf2f5", "value": "1536:MnCet/3UH7PU9hQ7FNiegiYSlR9MidjuB9RxR:MnTtcbP71gWdjuBzz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646524453, "uuid": "ac0bf285-2a9c-42a9-84cf-117bb3a3b8aa", "value": 69008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646524453, "uuid": "5286d787-d29b-4515-b003-e23d9def21fe", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646524453, "uuid": "c0d81d4b-9dc5-4af3-bbf5-41c967c7766f", "value": "8f8266a9727a87a52bd54e01b4c36598", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc71c143-9cd0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646518113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518113, "uuid": "c1bb16dc-4eff-4d55-829c-d231dae0f579", "comment": "Malware payload", "value": "c3533bff8caa63835424700729aa35a2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518113, "uuid": "17c807fd-54b8-4be4-a183-9ecf83b9222b", "comment": "Malware payload", "value": "40fcafc4e15c0fd2e339c23f1099ce1f58348e21e2348eac680accf77864b5c9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518113, "uuid": "891332a0-2c97-47be-8479-ce2f89252e55", "comment": "Malware payload", "value": "aaeedda8d66c744d7cc2b61736ae9e8c8f3be242", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518113, "uuid": "32a4e421-1f85-47eb-a12c-bc3736c5df4a", "comment": "Malware payload", "value": "52462a78617abba470ce8f2a5f13f5850253c0df8391105c417b6b41a45c8fd466e21868467409559a0761fcb59b973d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518113, "uuid": "01963067-df89-4789-898f-3df586c69c06", "value": "T1C1B41282F3844DFBECB982F3886AF1741582B92E9471461D76D67E2B74F3263115BC0A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518113, "uuid": "866c7570-8601-420a-b36d-f7cc870240b9", "value": "c109afec2fbeb0f805be15b2feefb312", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518113, "uuid": "614b40cb-17b8-43e0-8e67-e32f5f0f61ba", "value": "6144:DsPtB71HSfTlJH9WXMgsY57o1ziBrxbEPdR2qcwKYV5wXNUcNQQKcsHcwLkbnfLu:sAMrlEPdR293pqFLHcwLkbJX+EJlvi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646518113, "uuid": "b32ddc0e-d127-47d2-822b-f361f54790e7", "value": 500832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646518113, "uuid": "358914bd-aade-48db-9cae-1feb7c73bdc4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518113, "uuid": "8df3b90f-b41b-48ee-b2e0-283596e6f6a7", "value": "c3533bff8caa63835424700729aa35a2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "072eabbe-9cb8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646507475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507475, "uuid": "8c09986f-d69e-49bc-b877-78c3f1133e7b", "comment": "Malware payload (Mirai)", "value": "917fcbc36a16a2281102de93236d6bda", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507475, "uuid": "e87e141f-7009-412a-9288-a84026d59cec", "comment": "Malware payload (Mirai)", "value": "43b746240525db2b68c5416146112587fb683acecfedc30d1b297d446e199daf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507475, "uuid": "d2c751bd-dc3c-43ab-9798-ab5aa9cab3cc", "comment": "Malware payload (Mirai)", "value": "c785f645fba840ee30be824791f6280cf7b2a469", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507475, "uuid": "eb8963da-ecd7-4bf7-9beb-2faedb40f872", "comment": "Malware payload (Mirai)", "value": "c5065accc6dde8c483f2dcaab3266851ac233f0d3ac1a12cb250e067daddf40b35034d3273fe85918e0b4f2ab9738d6b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507475, "uuid": "089321dc-40cb-40ba-b2e6-924b5b3fc284", "value": "T111732996B8929A22C6D4137BFA6E41CD372163E8D2DF3207AD201F647BC681F0D67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507475, "uuid": "f221c95b-99e2-46c1-95d2-a437680946eb", "value": "1536:XpXcKpBUlet3DBboJubLCNgpRTZGTkcahWMPiY4g5q9/e35roFp:XpXcKLU1cRETkvhTkgp3WF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646507475, "uuid": "0f7832c7-0217-415d-824b-97ce904a2d7e", "value": 74744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646507475, "uuid": "a330972f-e2ab-4507-8600-528703d44325", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507475, "uuid": "28d71f40-9f2f-4947-a1dd-e66bec3dece1", "value": "917fcbc36a16a2281102de93236d6bda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe31c944-9c38-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646452913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452913, "uuid": "b8afa039-9759-4a76-86a9-05a9c71eca84", "comment": "Malware payload", "value": "9a479987240470c23858458c6e30e55a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452913, "uuid": "44d5d74c-b104-4f14-a68c-ffd0afe80656", "comment": "Malware payload", "value": "46e32108bfab5a5f7cb69ebbc674213d8aa2b72bdeb1a612ebcda1f4d94a92f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452913, "uuid": "1881f6e2-d676-45ca-9231-9344a4165414", "comment": "Malware payload", "value": "e727e1daccb72f65d2330ad2f5f85f1c6b3476a8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452913, "uuid": "94dc0e71-5f56-4337-88f0-d22d91f091aa", "comment": "Malware payload", "value": "2c7013fcc0d4f7ed1d369c26826112961ba73156a324e65c1a3e29132b1cc5c05bd6e5802359a8ddf9080150d8abaa73", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452913, "uuid": "63e7f06a-1e2e-4cb6-8db4-e41808707218", "value": "T16C5294E2B54AEDBDF80EE33E84564502B172B68A11431B3663777D3BDD772841472E0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452913, "uuid": "1c59088c-b5bd-4b66-9903-400480db6f47", "value": "192:9ljg3SQpuvmkmd18kb8MvkG7FOTgykBDoWG11/A9ywAwInz+LkwEs:nqDf1homkGB5N+8HAhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646452913, "uuid": "0a995701-69aa-41d6-a985-f921fc02519a", "value": 13456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646452913, "uuid": "f046ed80-e1ba-46a0-b92e-27c3ea7dd996", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452913, "uuid": "a8bfa323-94c3-4b18-bfbd-9695837d7dbc", "value": "9a479987240470c23858458c6e30e55a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b3622c7-9c3f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646455700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455700, "uuid": "93107799-bc96-47cc-a939-268794c4c920", "comment": "Malware payload (Mirai)", "value": "c68203ba0c1a754c04144e7f43d9fddc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455700, "uuid": "4f4ae4e8-56c0-43eb-8d53-7bbc5384b1d5", "comment": "Malware payload (Mirai)", "value": "48218a9ce5b408ef1d1671b65d362a00eb2b1f1f4710c95a3e5ca08a4b1b2216", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455700, "uuid": "474d0a0f-7d05-4dd3-9bf2-d05773514157", "comment": "Malware payload (Mirai)", "value": "b242c82520cd508cfa336fe6ef8b3d22bdb491d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455700, "uuid": "290e3b2d-e373-4286-9a04-169dd3badf41", "comment": "Malware payload (Mirai)", "value": "506d7cdfc282b7666c50efcd483d7e08f6231c68ff4d6fb669ad5c27be4f57f85139487abcc8c5fd862f57b6e8e5e3fc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455700, "uuid": "85cbc04c-d3dd-4a58-a3aa-347497807395", "value": "T1FAC2E03653A6E6A2E9310937F36EC309B7A40DBC46BA3326D1D0DFE4EDD400604FA652", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455700, "uuid": "5a873d2c-2d0f-4451-80ad-e72b0d5b2b06", "value": "384:W+0K3ccejsacBZZT5YvCLMStV1zbArc/QJP/9pa94URWheEmVlS/MoJhymdGUopA:V0K3c3XM5w+VQc/6C7QheWMas3Uozm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646455700, "uuid": "a3295871-3888-44c2-8e18-b194b0d4e175", "value": 27456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646455700, "uuid": "aa064475-99ee-4728-b0f4-a4cb7c18dcf2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455700, "uuid": "a5cb8770-e642-4172-a4cb-b9c0eab5de61", "value": "c68203ba0c1a754c04144e7f43d9fddc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf1d8972-9cc4-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646512937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512937, "uuid": "901b8c5d-712e-49f6-88e8-f7994490eb90", "comment": "Malware payload (Mirai)", "value": "6879b055e4717832849c5f19b564659c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512937, "uuid": "78e54bbb-307d-48ad-9d4d-a4b4b763da5b", "comment": "Malware payload (Mirai)", "value": "48664558ffebedb3ab650cff85740448783192d3e6c6a0b7b567b47aba60bf7a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512937, "uuid": "ffd54465-f4bc-4cef-b139-c7eb1b9e5949", "comment": "Malware payload (Mirai)", "value": "429bc0805862939fc1212ab5ba5f2783694e12f6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512937, "uuid": "a3ab21a5-e878-49d9-9214-0568a7767a05", "comment": "Malware payload (Mirai)", "value": "67a2666d757b7046cf66608b12fdd7f3d1fbf5dd678d45823e5dda713aeb3c2add14e73c1b4c64fbf959cf103e94ed15", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512937, "uuid": "d34384bb-d1e7-4292-9d11-c5701c5dd38d", "value": "T10A630A85F8C745F5C8074A3460BFF33FDA31E6BA40705A6DEF59AE21DA376015222399", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512937, "uuid": "ab03b587-f77a-443a-9be7-7eb14d6e9413", "value": "1536:+mrxXEwPOIl6HdbINvwkBWwMYXJp6lYKOaM:+mrxfP1l6HSRBa8JoYn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646512937, "uuid": "5d61006c-5273-409b-be3b-f39529cdbc99", "value": 71344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646512937, "uuid": "0db5da22-94d5-4dda-baae-cc20efd291f7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512937, "uuid": "e60ddfb0-dfaf-4a98-9a5a-df4af00ccb29", "value": "mirror1.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "280379c6-9caf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646503664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503664, "uuid": "996fc7f5-acad-44ee-9266-0e45a2fceba2", "comment": "Malware payload", "value": "8f6d2523cd455649e913e38104ee4366", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503664, "uuid": "eb3829a3-f6b2-4164-8857-b348b174e53a", "comment": "Malware payload", "value": "48f32f7cb6a249f64207d9534d0ab47f9bef1de1bb45e251ac23e78aa134965d", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503664, "uuid": "6caf6e5c-98a1-45a2-97d3-fb23f2b820b3", "comment": "Malware payload", "value": "8a332b18fcd2df0028b9d2ac4e0d36424ca4e253", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503664, "uuid": "9d8650d3-be32-4c50-b1c4-abc468f0c343", "comment": "Malware payload", "value": "195fea2d0ddbd7dff3a7918f8c7e9d84a735e45b971743cbb55cac7e6ab573cb33044e40c048f64637ff539be87cdae3", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503664, "uuid": "815dc807-4259-47a8-84d5-fe6a06157c15", "value": "T11A13BF14C101620AC2B3A93ED83984E15C7ADD5361248DCFE1D6B94B1BA5FEB2B4EFC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503664, "uuid": "7d6cbaa7-eedd-441a-bc96-314f9d4387f6", "value": "768:w+uRD4S0JS00SneSnjS0yS03S0IMS0bS02ScxbV+cUs70Nn2srTpxKC6yDsfudHE:w+UMVU7N22Tbwy40zVMMAAe1/K8NytsN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646503664, "uuid": "7764935c-6007-49c3-a9ab-c4767ad11b9a", "value": 43624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646503664, "uuid": "355e1d41-0045-4c9e-ba48-13e854e09719", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503664, "uuid": "297fe3fa-a5ee-4a95-b789-fc96c02e9187", "value": "New Steel RFQ List,PDF.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1409e395-9cce-11ec-9275-42010a9c0029", "comment": "Malware payload (CryptoWall)", "timestamp": 1646516945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516945, "uuid": "7ecf4ea7-d1d3-4c71-834a-b29f0cf7b670", "comment": "Malware payload (CryptoWall)", "value": "4be49972af010a556dd797d74803cc3b", "object_relation": "md5", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516945, "uuid": "eb3469e1-1890-49cb-bea6-48c7bce17ced", "comment": "Malware payload (CryptoWall)", "value": "4a27e09aeb42de72b83261f3f920f80ec1f5f8fd875ef9487ee5d6f81f726fe3", "object_relation": "sha256", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516945, "uuid": "91fa4b4d-bbce-4a38-82b4-1b5c9780cbcd", "comment": "Malware payload (CryptoWall)", "value": "280b0e7667592e5d03ded84ddb901de9f826bb05", "object_relation": "sha1", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516945, "uuid": "3f138fdc-cae6-4ddb-bc18-cff607f55514", "comment": "Malware payload (CryptoWall)", "value": "75c94c3cb04018f7ee60a7ae635e6dec066b4c5b3a2d9b99d57329a924187bfc7c7d6fbdc6b7a5a8d6c87ee474c46b1f", "object_relation": "sha3-384", "Tag": [ { "name": "CryptoWall", "colour": "#40567D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516945, "uuid": "f010a2dd-fcfb-442b-8f75-a9210c682bd1", "value": "T1433402A52AEC4C41F9FAAA361C63090445B77C56853AD18B36DC5C1F2F63BCA82353B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516945, "uuid": "349b1104-f118-4942-94aa-fdbdca112323", "value": "65ff10b317ceea9d7b51db716dd8c5d6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516945, "uuid": "3aa812f1-00bc-4c82-90f4-dbee92924b1b", "value": "6144:3xdLxgFmTHFbGCNEjq/PYhizklDaU44voBcg6JwdfK0f:hdLxljFbGCNoiKPlDaU6iwM0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646516945, "uuid": "04e1bde8-27e8-4c04-86a1-ab524145bed7", "value": 241664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646516945, "uuid": "a58657bf-07b9-4b8d-8c9f-039148b78628", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516945, "uuid": "7dd1a882-8ee2-46fe-97c7-c82b841df9d0", "value": "4a27e09aeb42de72b83261f3f920f80ec1f5f8fd875ef9487ee5d6f81f726fe3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2df2987-9cdd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646523734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646523734, "uuid": "2483df38-165b-407c-b57d-60425454d2b6", "comment": "Malware payload (Mirai)", "value": "f10fcb98132477c0b51c791dd00457c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646523734, "uuid": "9c934cfb-c829-4813-b119-08bdc0f04904", "comment": "Malware payload (Mirai)", "value": "4b2547c94e8151dae5648cdac37ffb9c40894e7c3b7233e4e2b88871b78efc36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646523734, "uuid": "4cea993c-6d96-43a8-892b-f0a875f4cd8c", "comment": "Malware payload (Mirai)", "value": "07ba9f2502c0d49546d91dc385cc930140c3bf45", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646523734, "uuid": "3331edd9-abb3-4f90-b6a5-ed0abd6ad389", "comment": "Malware payload (Mirai)", "value": "ef24c49e009570617b750238e7c50d6ac0eb44dc9131b145cc5ff590bd9de1302b18992fbafff1c7d60a17d4c595d940", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646523734, "uuid": "7e1a651c-62df-4f30-a609-a384069d9e62", "value": "T10C530996BD818F11C5C512BAFE2E118E33132768E2DFB2139E146F24778B92B0E3B515", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646523734, "uuid": "5e97662c-0586-4d14-a666-3df0a4f8f18b", "value": "1536:Q8nbADzDDmNyV5cEFEeR9P0d44W3qQFk66Iwi8QhLyPkR:2DiNS5jF5B14KqXQhLyPk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646523734, "uuid": "5c10e761-3447-40f0-8c48-8b7c91066582", "value": 63524, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646523734, "uuid": "12083133-945d-4135-83f5-a4d211170119", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646523734, "uuid": "6b9823cc-bd6d-40ee-a3ae-6043ded9ee84", "value": "f10fcb98132477c0b51c791dd00457c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0120cd26-9c39-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646452918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452918, "uuid": "fcf93cf0-becb-49b4-a9e5-66dd49a7f709", "comment": "Malware payload", "value": "b5833f152d637fb29f5c32de5d4033cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452918, "uuid": "e3e33205-dbfa-4a11-9443-480de6dc3fec", "comment": "Malware payload", "value": "4bd3a9d4ee61ab9bca4793c4fbf202ba1d38479c4439abfe55dffc3d952aff34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452918, "uuid": "690042ed-91ed-4eb2-9582-24b8d73bb0ae", "comment": "Malware payload", "value": "4a3da21a6e9d59e465947592bcb436a8f840257a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452918, "uuid": "6d2b9fb4-3232-4904-b770-82503a0166a5", "comment": "Malware payload", "value": "c35b421e866cbc468660055b508981c5d465dbb4ba7cd9f8e26c7c2e6545fef79b1f6772f790a80c63a04381a70572a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452918, "uuid": "7aa46ca9-b724-42da-8922-acebfcf7b93c", "value": "T12C32B742731D0867C5273FF03A3F2BD0E75EEE642295E2C4725E998AD1B6D311181EAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452918, "uuid": "0717462b-3626-4534-b0d4-98cc524b324f", "value": "192:5U+JXHM5+ARDH4cvbShYmB2QnE/FhJTwT0fgZGLy98n9H1cTNWUN+:5U+dHXAlhWSmU3TwgfgZWg2gcI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646452918, "uuid": "f97aa242-9c2f-4e97-80ac-10f6f30607b0", "value": 11816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646452918, "uuid": "983fb8b6-03fd-4c81-9650-859297830307", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452918, "uuid": "54601ab7-92e9-4862-b7f2-5bca6a91a5c4", "value": "b5833f152d637fb29f5c32de5d4033cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f47a9921-9cb7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646507443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507443, "uuid": "ffac59a4-acb0-4338-853b-6456cb1850fa", "comment": "Malware payload (Mirai)", "value": "50e06bc222d50d8199be81e96bde8a71", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507443, "uuid": "2222f5fe-6741-4846-8d61-1b406c92b0a1", "comment": "Malware payload (Mirai)", "value": "4c9774523fbabcbb86a577cb15531e0e6c2c58a8715aabfceda9eb826b492199", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507443, "uuid": "391a9562-69ce-4bfa-bdf4-fb1bb2f2dd80", "comment": "Malware payload (Mirai)", "value": "f541c9982445d14e77d647cd8bb1d2f2f57d8930", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507443, "uuid": "f027277b-ae77-4ea7-865d-c2304a5a5337", "comment": "Malware payload (Mirai)", "value": "ceb1d96307054aa652d5b6407bbcd4aefc164003de745356511c2f7a92c016cc6efd24e3696eef482fef4f5ae526f926", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507443, "uuid": "0f83e277-91b1-4178-88ee-6bb3e4b67bcd", "value": "T122330991B9824E6AC9D513BBBA6E55CD332063E4D2CF7313D9204F543ACA51F0E6BE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507443, "uuid": "480a6679-4093-492c-885a-aaa2bc25365f", "value": "1536:m85kQYawggPL6LCgHfjHBSyEvxEy3RCaBy21TJA:LhwgOLQCorHUHvGy3RFs29J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646507443, "uuid": "bb11ebf6-86b0-4488-9531-871914be5349", "value": 50796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646507443, "uuid": "e3f683b2-e46d-4825-9909-f786e3d5e8e0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507443, "uuid": "14529b4f-ec90-4b49-b24b-218ad118a302", "value": "50e06bc222d50d8199be81e96bde8a71", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380d7a46-9ccb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646515717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646515717, "uuid": "0c47a54f-2e23-4246-ad90-9f8204a3071c", "comment": "Malware payload", "value": "3f360ff96102ed34f3034641f6fec472", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646515717, "uuid": "521a4c26-fb4c-4129-a303-d3bec64365d0", "comment": "Malware payload", "value": "4e7a4173d7d5e915c3a12a46037923d8902d10a8c8ed6fd1dc9abf0d98bf771d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646515717, "uuid": "8898b231-6a1d-47f6-9cac-664ac2a388b2", "comment": "Malware payload", "value": "35ba3f25cc5e25f356ec9ce7b5f6758c594bef89", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646515717, "uuid": "4df5f79b-f258-45de-984b-179f0cb55f71", "comment": "Malware payload", "value": "3684c5d982c0a7a356f4e5a5fd4fc1f542d4956a666e9f7a6bb62117b31255e2c8e476f03e4dea9172e17960132ba5d0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646515717, "uuid": "a388b6bf-59f2-4eb9-9770-4a1c5279997a", "value": "T182A4AED57E4A40C8BA03656A21A663470FDC6A460BF0DCDBCF4AF5075F92CC247BB4A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646515717, "uuid": "f6547a83-5ae5-4a27-bb12-07e27fe826c2", "value": "12288:kvi2GsFIyZQPVBpNwX4iOwNvte64g1lWA7eLsuAq6Zujk+:kviZsGQwB7viOAvte64g8Lsxq6ZWj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646515717, "uuid": "24b4bdc8-000c-4ea1-bfb1-39badbb49548", "value": 458696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646515717, "uuid": "76f9d3f2-81d4-423f-9a90-d8cfc5a65477", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646515717, "uuid": "871189ca-b2c6-4879-8abd-f5dbbb906366", "value": "emotet_exe_e4_4e7a4173d7d5e915c3a12a46037923d8902d10a8c8ed6fd1dc9abf0d98bf771d_2022-03-05__212831.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ebd6250d-9cad-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646503134, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503134, "uuid": "1b93c739-cc4f-450f-8f2d-fd2b2cdce93f", "comment": "Malware payload", "value": "3b8bcc8ba7681d3af8b6d3ecb5fdc814", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503134, "uuid": "8b59f2c0-9b5b-4376-9286-811c5b877699", "comment": "Malware payload", "value": "4fe9f04679564d302766e073c01225d0a3715e523aabada12426546a74df1284", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503134, "uuid": "8e41e6f7-81f3-44ca-909b-c72735121c4e", "comment": "Malware payload", "value": "92ce08d96cb493bc8b02c8a308e137fa57e0bc0e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503134, "uuid": "ee4d91a1-2631-40ea-81d1-8192d8535c98", "comment": "Malware payload", "value": "193dfa8541b6464f87f4828ca703e88deb8e2b86c14edb24095c8d460bb4e74bb252d77410b4f95249198a6df0d82933", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503134, "uuid": "73baaab3-4157-42d5-aec3-c98ef995b12f", "value": "T12B9623FD3144375CC46E8830C423ED5472B6592E4FE685AA70D7BAE1BBAF835DA01B42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503134, "uuid": "cf098bda-020f-4171-af1d-892fde2b5ecc", "value": "2f084553d02ee9faa371daf024a1480c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503134, "uuid": "03991f86-58e8-4ed0-985f-4015298ac325", "value": "196608:joaJ1tur5oyPRmLmn5aVZorLDOHjNYsa4ioFr:0qDur5RPRpn5wZobOHjNtacr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646503134, "uuid": "c0ce69b4-431b-4ea4-8158-163e9a298f0f", "value": 8880128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646503134, "uuid": "62d7f04a-d35a-4026-8620-94bbfbd536ad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503134, "uuid": "54d985e3-9512-4bf5-84bf-69eb2f81706e", "value": "3b8bcc8ba7681d3af8b6d3ecb5fdc814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c566532-9c1d-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646441045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441045, "uuid": "b1b31e56-9b6f-406e-b750-52483e7612b1", "comment": "Malware payload (Mirai)", "value": "bc1cd11414780fd1cb1a4f277cd6fb03", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441045, "uuid": "b43badfb-371c-4291-bac9-9ae789e27f6c", "comment": "Malware payload (Mirai)", "value": "508ed54e7bf819691c09f7d936b9d1a148e8a7b9298862d075671eb3df73713a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441045, "uuid": "568e94b3-4934-4965-84bf-84c4eec93e61", "comment": "Malware payload (Mirai)", "value": "bc44a3a26bf02fce45ec593d21a4f54d5e9b8391", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646441045, "uuid": "90c41230-965d-499b-aeb5-7ab27ab41f13", "comment": "Malware payload (Mirai)", "value": "032743c13c9efe80bc0cef3d02c2510c508f352c3649bcc6f3deb3f41216ff3bfc798a8817be39635975a9ee1ee0ad96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646441045, "uuid": "1c873e4b-3e0a-43fa-a07d-6f58e90b6473", "value": "T165D2E15C4A693E4FD9CD257FB08D26A1AE51A1C33B8F6F483B505C44AFDA20779CE0A1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646441045, "uuid": "1e2caf09-e383-47b3-9b10-c5ac53eac189", "value": "768:BegowQxoWwZkJ/ENzoCZvPzX85HS7mlQno/T81eytEWMH:B17RDZkJ8Nzo9HE5o/TmM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646441045, "uuid": "00122e4f-b2fe-45f1-b089-27ea8391daa9", "value": 29976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646441045, "uuid": "1a54e3b0-83a2-49cd-a809-345f5d52bfef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646441045, "uuid": "ebf6fe7e-bbfd-4db6-9b7c-336f524bce2d", "value": "bc1cd11414780fd1cb1a4f277cd6fb03", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0ad3aa5-9c93-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646491948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646491948, "uuid": "6901ab50-7d22-4883-92d5-b6f86e6da035", "comment": "Malware payload (Mirai)", "value": "b63dda3660e8c81ca4ff141cc482f271", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646491948, "uuid": "6c1c216f-d252-4133-80a6-04048652334c", "comment": "Malware payload (Mirai)", "value": "526fd33964544f6021f4e29b93021c0b623b1446f22fdb44111a65de16b0ef82", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646491948, "uuid": "b899c9b6-5da5-404b-81a7-12f704ad2a06", "comment": "Malware payload (Mirai)", "value": "200a5330438c0165a6cb0bc266a949174d929086", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646491948, "uuid": "c5ee5b12-ccd6-4aab-9217-1d2c136ea91f", "comment": "Malware payload (Mirai)", "value": "8d75ff568f066a215461d7f442e430d5cea191ed7312acf5891945057656cd988714098008a7a4231f1df49530712cc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646491948, "uuid": "ea7d6ef2-972c-4839-a013-8ecea6bf8321", "value": "T104F2E1A3765A1209D46A81714DBFBE810C4051489AC06F827FE4357F9873BF96E3262E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646491948, "uuid": "5cb867da-aaf1-401e-975c-5214ed2ebef2", "value": "768:Vtn+9TuCwv/I2vEy+MEtUTOGVopE7MN3mR3Adr0BZHux+FnbcuyD7Uiyqr:zn+RuLPE4EtuGp+I2Vfux+Fnouy8Zqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646491948, "uuid": "10815d6f-422d-47ad-9355-1795ea00985d", "value": 35000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646491948, "uuid": "a168bb98-d180-4ea3-bcc3-5b8e91a832a8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646491948, "uuid": "87ca2d29-7fad-4b56-b2a8-8d62e3adbc2f", "value": "b63dda3660e8c81ca4ff141cc482f271", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4956c132-9cb0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646504150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504150, "uuid": "3da34810-2093-4774-af7e-4b40c4b99c68", "comment": "Malware payload (RedLineStealer)", "value": "607d23f8e79afb35931b4ae5233e8b64", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504150, "uuid": "9a4361b1-8988-4827-b50c-a299c4082cd3", "comment": "Malware payload (RedLineStealer)", "value": "52705396f93e5bf55c8f89fb3ff29bd0836ea1429c6d8f104d713448ca6a03a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504150, "uuid": "9136f50c-c8ea-41c5-8ecb-3d8f1444eb63", "comment": "Malware payload (RedLineStealer)", "value": "438e8c70ad38a98c8ced096a16d422b1e114287b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504150, "uuid": "20b9cf49-6bac-4c03-bed3-983ec34c08e1", "comment": "Malware payload (RedLineStealer)", "value": "70bab53248669dd6a22687c2857b11592699fc80bac8c8aba9f84092360287584e5161266d56024261867865d553717a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504150, "uuid": "74436da1-9c70-4c6d-a01d-c31cec252715", "value": "T1454533934D0314E6F2CB15B8A142EEB31CF591CE48D12F82DBDE91469F96ED1930926E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504150, "uuid": "6a5e8506-6590-43e4-b7f2-2aa432ee1e26", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504150, "uuid": "9abccaba-8093-4500-ab6a-727c2aa29c60", "value": "24576:NGTLTH6Y8IEfFjA4mAG9e+Dj3QJujFpYAX7H1oeiC2spsOFkEaHNYK3VoPDQWd8A:8r6Pn90AG9e+DjASBrZiCrGONaSQWdvt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504150, "uuid": "e56a69f5-a725-4e7c-a1ff-d5448c1c8528", "value": 1206032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504150, "uuid": "8199e630-01fc-45df-a0de-215067637027", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504150, "uuid": "12e112ff-bca9-40ce-95a4-dfc3abdcb409", "value": "52705396F93E5BF55C8F89FB3FF29BD0836EA1429C6D8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6b06fa-9caf-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1646503918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503918, "uuid": "a0f8a07d-2742-4ace-8405-e1ad8bdbfbc6", "comment": "Malware payload (RaccoonStealer)", "value": "6ac07b68a5d473eefb6df7a884d49bce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503918, "uuid": "83c45d00-e667-4db3-8bb0-9c8ad22532e2", "comment": "Malware payload (RaccoonStealer)", "value": "52fcacd0a3ab4a6106aaebf4edc3397bb36e08c0f48ac6eab6460ab9cb1ede6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503918, "uuid": "dfda1ad0-a45a-48fa-be4e-5319fe372137", "comment": "Malware payload (RaccoonStealer)", "value": "97ea9e45a1bfef2858ad3a2ac927eb0dac906b24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503918, "uuid": "7385f4c9-9200-4b22-8e79-6884645d7aec", "comment": "Malware payload (RaccoonStealer)", "value": "7da2ee4c33ed1e538679ebe2450637622684f7fbb1b300d36f53fab30461fd4b0a0ebd9123c03e2e94056f629857295d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503918, "uuid": "883ea63e-c07e-46d3-adb8-5a94fc1a911c", "value": "T169F40210BA90D035F0F712F8567E9B68B53A3EA05B6551CB53D62AEE23657E0EC3130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503918, "uuid": "56f11dad-047f-40c5-9ca8-65f277e3fb89", "value": "da969c9b2899100752633683fc4632cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503918, "uuid": "960ee39b-23ed-4a8f-9395-675b8d87e27a", "value": "12288:FtNylFqxwA4HoM49plTFsCXbEgKKrIR32nxsQVw9x5v6bbaRAFhvUC7LIhey:nAYxTQCrvsCwVMIRGOQVwZSbbaOFhtIt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646503918, "uuid": "424974ee-f8b4-409f-b124-d74c3201cd55", "value": 773632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646503918, "uuid": "6f198484-acb9-43e3-91c2-39c58664cfda", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503918, "uuid": "e3f8787c-5823-4602-811d-da2fdb0f6411", "value": "6ac07b68a5d473eefb6df7a884d49bce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff444360-9c41-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646456781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646456781, "uuid": "49b86208-e3d7-47bd-a583-6cac85872a79", "comment": "Malware payload (Heodo)", "value": "cf576feedd6b93fde41a016a5ad45695", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646456781, "uuid": "febcab4a-1188-4244-b5a0-55e1879343e6", "comment": "Malware payload (Heodo)", "value": "537a66d00b21b702fb72c9da2d181b98c3468547f0e318d6655c83bd53a26ee0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646456781, "uuid": "964dda2f-b0e1-47f5-b99b-1e06a31c6c79", "comment": "Malware payload (Heodo)", "value": "8218952a6d313558775996eb3fa0b14ce9c8a996", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646456781, "uuid": "a720bfa6-cc27-47fa-a263-3361d3f4b1b1", "comment": "Malware payload (Heodo)", "value": "017dfb4348ee1ffc5e75bfa330d3198d3371d804646bc2f51bee3922c04e8935d250f9cdaaa37d2eb1ca58a669e609ec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646456781, "uuid": "d244965d-2ead-4397-ada7-8738bc975cc3", "value": "T1192460958F66710BE84F07718D1CCA48610F87A9B7C092FF17D86E6A67F13E2A874709", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646456781, "uuid": "8d8b2ccb-33bf-4692-9377-4341b5adc5f2", "value": "3072:lta6Bwhvhk/VaBZTX+DXeKmagrd4fvJppTEBM3cEGyVoddybKF:tBwhvhk/VaBZTXdKmt6fxLTEBM3bGx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646456781, "uuid": "dcbe8117-9ecc-4884-9b7e-86b19929094b", "value": 212696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646456781, "uuid": "a90d09db-5fdc-4241-8404-019443108c78", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646456781, "uuid": "66127bf1-e54f-4c10-a5f9-4608495596c9", "value": "emotet_exe_e5_537a66d00b21b702fb72c9da2d181b98c3468547f0e318d6655c83bd53a26ee0_2022-03-05__050616.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e87fb758-9cc4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646513006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513006, "uuid": "169c3ca1-5513-46a4-b20d-a4d3014d31a7", "comment": "Malware payload", "value": "3db4c5dc3c4daf8e34991307fa016377", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513006, "uuid": "bcba51d5-1572-49e1-af66-efb3676ddc8f", "comment": "Malware payload", "value": "5397624f9aeb6f6dbea580af9c1b685d2bd1184e00b6060240975a65fd7b874d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513006, "uuid": "d7c49880-63c2-4c4d-b38f-737dee6c6b23", "comment": "Malware payload", "value": "6fdd42b0455765d5d106b5d9f0d8a09a79e5ab92", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513006, "uuid": "9e594283-735a-4718-b80f-18988f37618d", "comment": "Malware payload", "value": "297ca13c1485a6ef79bb15a2a830094b72f73c671429d50946b02133e900dcf17e2199a847e1ca0db7bf16ef31717cca", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "script", "colour": "#5F818D", "exportable": true, "hide_tag": false }, { "name": "sh", "colour": "#DA83B1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513006, "uuid": "af63a4fa-2aa4-49b4-8ec2-b618b39c9ea1", "value": "T1203161DE31E309B93CA5EDA732AA880434D1E2CB94D56F592CEC78F945CDE087550BA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513006, "uuid": "d4526a36-e6f5-4569-9192-9b20ad00509f", "value": "24:vL+9mJIIc4kfOaseLNIRksTKbpsX/ObgEs+6J:vK9kIJ4kfObesJTOiiO+6J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646513006, "uuid": "821f84e6-566c-47fa-bdec-1f7e58e2e415", "value": 1571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646513006, "uuid": "43c88f1b-f062-496e-bd3d-a688886236e6", "value": "text/x-shellscript", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513006, "uuid": "a72795a6-79b0-47ef-861e-4f9a44a5399c", "value": "bashmirai.sh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "facdd58c-9c38-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646452908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452908, "uuid": "2f097f13-c5ae-4678-a2fc-dfdf6002b318", "comment": "Malware payload", "value": "aae8c3ac1b40e2cf91f2013a68b99311", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452908, "uuid": "dcd1af7b-2e7f-4b7b-8d3a-4e546b216b96", "comment": "Malware payload", "value": "5819fec0706e4138fc1df66a6ab2c7ca1ba64efef97b9de3c2758eae7b922977", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452908, "uuid": "d529dfc1-5295-41ea-abe1-d558f3521ac3", "comment": "Malware payload", "value": "4bc8cd30aa464d0b53252870d94fa7ae60f1cf80", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452908, "uuid": "d074ac6d-330a-4bf5-9509-df7e93608ca1", "comment": "Malware payload", "value": "71d2032d795d1a47a8594a7d34d58b5ae93a94f60ccbb946f019aa4195b3ed793a20658a392170cd2e3e83832f980cd1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452908, "uuid": "78f9f0d0-62f9-4557-9212-91a348b770e5", "value": "T14F7240852E229FEDF66DC63547B34A20A35823D622E09A88E76DD9040FB034D559F7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452908, "uuid": "38c92e35-b10e-4d64-a425-5ecdae8be4f3", "value": "384:5DcjD2MLzNDVE2BCgMgC92yt1nESAOXZ5O:qG2dVEYQ2OJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646452908, "uuid": "8ee1c55f-d824-449d-9884-a61c47e8cb1e", "value": 16000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646452908, "uuid": "a2180632-55e7-48e0-a689-7888f6834849", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452908, "uuid": "412846b6-3dfb-46c5-b2ea-9ca21e7ed5d0", "value": "aae8c3ac1b40e2cf91f2013a68b99311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33f41dad-9cce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646516999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516999, "uuid": "3afb378d-aeb5-4f59-8551-92434e4c030d", "comment": "Malware payload", "value": "bb7425b82141a1c0f7d60e5106676bb1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516999, "uuid": "59c89774-55ed-48f2-86aa-0e4cc4af3009", "comment": "Malware payload", "value": "58898bd42c5bd3bf9b1389f0eee5b39cd59180e8370eb9ea838a0b327bd6fe47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516999, "uuid": "bca38c7e-4330-421f-a31c-f2c4e484d616", "comment": "Malware payload", "value": "9dce39ac1bd36d877fdb0025ee88fdaff0627cdb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516999, "uuid": "b1abe714-93ba-4461-a865-8bed8155687a", "comment": "Malware payload", "value": "2549dad06992405827ce808753a4f54550042b11bd5fd138a456ebaefcbbfd47aee907ebcbd32b9fea0d3624c56b959c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516999, "uuid": "7f1e4f2f-fa89-4aa0-9b70-38f80f5e44d1", "value": "T17C72B44376E51CB1EF2811B6429293FC927DE0604766F2EE78731A46D432893793CADB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516999, "uuid": "08b9cdc1-20de-4f5a-93cc-f871a7fa4a2a", "value": "2b5f75aa75c57ed7c68f7be490d63605", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516999, "uuid": "d2cf301f-f740-4e6f-a774-d5ed41d2a218", "value": "96:1t6Y5CuDzp17S5eVIV2cFL+31znx9+NNoyn:v6Y7117S5ercZ+FznxcNNoyn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646516999, "uuid": "c42aa5e5-8e9d-4cc4-8e80-95d90bb8da25", "value": 16384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646516999, "uuid": "7277023a-7e75-4da2-9506-81fac8cec9cd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516999, "uuid": "df9d3099-435e-4df0-bd3c-1af1915c6d9a", "value": "58898bd42c5bd3bf9b1389f0eee5b39cd59180e8370eb9ea838a0b327bd6fe47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9912c6d9-9cd6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646520604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520604, "uuid": "d33d4fb2-f953-4fd3-8cd7-3dbfa9096a71", "comment": "Malware payload (Mirai)", "value": "d1c6a4473a98908b77e9e86dc7c39490", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520604, "uuid": "63205f51-5165-4229-b728-322831bdd23e", "comment": "Malware payload (Mirai)", "value": "58e687e35ad25a0d2bdb203dc28777ca5102714b594a1784982bc4c58c3cdb74", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520604, "uuid": "fb377de1-f93c-4838-b2d5-ab742697e7f5", "comment": "Malware payload (Mirai)", "value": "c414279ba6b31d30499f29d2a76e9e4202884943", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520604, "uuid": "db61f25e-31ee-437f-8b1a-f49986dfe312", "comment": "Malware payload (Mirai)", "value": "20ec81888f3185efbd3fecdee66751d12ff64cd9a5d953d9df646f966cbf2a9d6a9fb8fd6d85a465c096b0ce2fa2c0cf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520604, "uuid": "301b74f7-8e59-4b56-8c67-5f8aa7bb923e", "value": "T1EA330685BC91DA13C6D412B7FA6E41CD372523E8E2DF7203DD222F50778A81E0E67695", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520604, "uuid": "1f843d53-3596-440e-8e5c-349d95e9514e", "value": "768:7JbhFt0LBYjlTxZpdQKfoH5Q5TIn1xYeZKBM96WrX/PLYYiPNOtaTGEX/t:dhcuZpeKfQQ5TcxYMaWb3MY491", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646520604, "uuid": "96578ff4-1bf0-4d46-b3ac-e7ac20c9f285", "value": 54268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646520604, "uuid": "eaa4b601-b481-4c19-b18b-7b3c19ae709e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520604, "uuid": "a08f8491-93f1-40a7-aba8-ed2b38dcfa06", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b2b525f-9cae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646503294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503294, "uuid": "b6e9afe4-12ab-4be1-9e75-206089343de4", "comment": "Malware payload", "value": "d80813dd6592e17ff5ce40708e421b07", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503294, "uuid": "ef06dbf5-bc6d-4b51-ab18-2268d02937c2", "comment": "Malware payload", "value": "59e7c0d6cce9dd1a524317394a311a71a9b993eb2edd1eb3c29b09f449b5e45e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503294, "uuid": "5cbb4080-76b0-46d9-b8dc-729ab1b41045", "comment": "Malware payload", "value": "c38712b2c4454b23c1bbd38c624ef9174fb2c4a1", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503294, "uuid": "078d395e-cd0d-4780-a04b-d6446cc1858b", "comment": "Malware payload", "value": "3267f4f1db5d4d0389459a5491019668a514d25fa05015a261b18940bade42566230b39b9f9453aa7ae437b7ab0aae3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503294, "uuid": "d2e121d1-2eee-47dd-b0e3-a4a89df3e041", "value": "T164D533978D772EA344C5BE7922337C63CE198A36BC63AE53E157A8E821E375C53E0144", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503294, "uuid": "0eaaddf2-4245-4116-a3a4-bf1aecfc0928", "value": "49152:V4HL/JqJdsQBsmErL4XE+cxy9FPRNXlKjBLW/71C09sqkwFi7ujf2CM/4SE94vfi:6HL/JqTsQBs4U+cxy/PRNXstW/h79s2v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646503294, "uuid": "38fddecb-2835-417d-8683-c2917769e7b3", "value": 2760540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646503294, "uuid": "57740686-ac79-4aba-b7ec-639704aa3c4f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503294, "uuid": "c4af1aef-1af0-4a13-bcde-db85fe6dcfe1", "value": "d80813dd6592e17ff5ce40708e421b07.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6de4afa7-9c5c-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646468133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646468133, "uuid": "8f09a6aa-1237-48b7-aa6c-f28aaed6c5b2", "comment": "Malware payload (Smoke Loader)", "value": "0ede2d638a56e7ae59e3e0036aba37d7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646468133, "uuid": "80f0ad30-1016-429b-a2bd-0aa323c08c30", "comment": "Malware payload (Smoke Loader)", "value": "5a37e85ddf1b693cb2e938710a4fc0cea30062eb784ad5b8cecd0d1170d5da6f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646468133, "uuid": "6fd92358-364d-4dd8-9804-b3b3ff74be69", "comment": "Malware payload (Smoke Loader)", "value": "738f4adb6e863c41e2aeb37fec7ec15f679c8600", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646468133, "uuid": "6cfeb1fb-4bfa-4a3b-b52b-0262d710572a", "comment": "Malware payload (Smoke Loader)", "value": "867ce2132dc5c599c36f7436624bc774e793edb2563fbbbc355a935e5f28043bb3e55967393a22d1ce82bef050f5bab5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646468133, "uuid": "860635d2-64bd-4c6c-834f-9fe259371f99", "value": "T1C7649E40ABA0D03DE0B312F8797983BCA52D7EA09B3450CF53D66AEA57346E0ED75217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646468133, "uuid": "756d2bb3-5541-42c8-9d34-55ac050c7b8f", "value": "2c887c56b61583b8aed837e04b41e87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646468133, "uuid": "a73dd70a-080f-4673-9f86-22ec4182c465", "value": "6144:mHPN9av5mRa0W8Nd9rTmNGuH/zwuybcC3+QaQGWYhkCoyWPn8:uLav5wHW8PdTmNGizwuygCO9QGnk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646468133, "uuid": "809cbc26-9b73-4002-9a68-7896dfee20dd", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646468133, "uuid": "59ee90cf-c345-4238-b127-22ffa2dcba25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646468133, "uuid": "5625a056-804c-4798-ab8c-fdfd3bd1492f", "value": "0ede2d638a56e7ae59e3e0036aba37d7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7949a60a-9cd2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646518833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518833, "uuid": "349e9f9d-6c1b-4917-81d7-c0b1d10d1caf", "comment": "Malware payload", "value": "bbae81b88416d8fba76dd3145a831d19", "object_relation": "md5", "Tag": [ { "name": "BatchDropperMEMZ", "colour": "#26DBCC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518833, "uuid": "a6f12959-8680-4ba9-af53-45a0c7a9ca1c", "comment": "Malware payload", "value": "5c3fde60c178ed0306dd3e396032acdc9bc55c690e27a926923dd18238bbd64c", "object_relation": "sha256", "Tag": [ { "name": "BatchDropperMEMZ", "colour": "#26DBCC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518833, "uuid": "72bafeab-dc88-46df-8558-bb92a755a293", "comment": "Malware payload", "value": "42fa0e1b90ad49f66d4ab96c8cca02f81248da8b", "object_relation": "sha1", "Tag": [ { "name": "BatchDropperMEMZ", "colour": "#26DBCC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518833, "uuid": "5852dcda-f4e4-4d88-a93e-b7911bfdb25d", "comment": "Malware payload", "value": "9b0bf99855b046d367c636e6ec5e59514f8691eea87994ff164c17a74cdcc0384fc47638d74c1821d03f4c164eae617f", "object_relation": "sha3-384", "Tag": [ { "name": "BatchDropperMEMZ", "colour": "#26DBCC", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518833, "uuid": "d68db4d1-6b5b-4ee7-9742-53fb966d7e99", "value": "T1A8129C7678A092A950776ACB1CB4ED98BA32445F3101BD7EA4078CF706567E030FE72B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518833, "uuid": "59a856d5-84d0-4a50-bda8-29995f7627df", "value": "192:XBOTDzoOgdlf7MAdTyQuHq2b1vXei2SLca5icrLJlz3:ss/tDyQuHZddL5Jlz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646518833, "uuid": "ba4776f1-748b-4436-a248-619acc2da728", "value": 9732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646518833, "uuid": "b12a0056-4c3e-48eb-8d62-7234b87fbed0", "value": "text/x-msdos-batch", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518833, "uuid": "143ff39b-6ba5-481f-8e9a-a699d1b5913a", "value": "HqS1nZ19.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e74ad69-9cd7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646520962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520962, "uuid": "a5a9ac78-446f-4190-bf8f-132a73ccff52", "comment": "Malware payload", "value": "a6651dc499e0b9141a6fa0f411f885ea", "object_relation": "md5", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520962, "uuid": "2810baab-24df-4914-9e9c-503d188b8957", "comment": "Malware payload", "value": "5ce632f1f10c96a7524bf384015c25681ef4771f09a6b86883a4da309d85452a", "object_relation": "sha256", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520962, "uuid": "655c03c1-3948-4473-9a86-f15242baa7e8", "comment": "Malware payload", "value": "a421e5753596d4c07ee8df06c2080c03507f7a37", "object_relation": "sha1", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520962, "uuid": "def70a09-36ee-45f9-a716-3a5539416150", "comment": "Malware payload", "value": "feb8e92fdf16b0130ebf7f3d5e0c2a190625d120ac591287bffa5960f91b561632bc95eeb4e997704a4e1cfa7c4d0d8c", "object_relation": "sha3-384", "Tag": [ { "name": "BlackGuard", "colour": "#ECAAE0", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520962, "uuid": "023d0b0c-1209-4959-92d5-0e55784f257b", "value": "T11316238E57053D01FA3DA1F6C52F218D888DFA94870606C2FF9A1CD7590D1B9A287BF6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520962, "uuid": "22dcdb75-8f63-43d2-ac9e-07446b138709", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520962, "uuid": "b459ff32-5b4c-4d8d-b4d8-58dd9ccea5d9", "value": "98304:XNuSZTKA0t9FFPEnEjdGSQYVrsk9N8ivyhAdsPSQxY5jg:Rbk9fcaVN8iNISb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646520962, "uuid": "e5872e79-7d47-42d8-90e7-c3eb3ff613fa", "value": 4151296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646520962, "uuid": "89d8003b-7858-49cd-9adf-2469568cf8ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520962, "uuid": "a6b9453f-2b7b-4e74-82fa-331d2bbbcad6", "value": "Leane.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ab822e5-9cce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646516929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516929, "uuid": "2ff078e6-ad91-48f0-a96d-604d89a56b1a", "comment": "Malware payload", "value": "b6244650e0f4c783d2e06f030ba1c248", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516929, "uuid": "74731128-87be-40a8-a723-9f3498eceda7", "comment": "Malware payload", "value": "5d74919198834de59ddbf74322fc291019df6bd42319a9eceb8c4a9a932870a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516929, "uuid": "3c0b637d-5fca-4ea4-a149-4245e4a1cba7", "comment": "Malware payload", "value": "6813ad0f381a2e5d3e93e6ce75642f013106eb03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516929, "uuid": "0b7faf09-1527-46f8-b2da-5eb3d1ce77ca", "comment": "Malware payload", "value": "731ee61c6cb73c397d0fbb8c8a85ae3ebaa5ee5039f712f0454838ce227f13f9d0ec27423a26dc215cc63c1e2d082fe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516929, "uuid": "19ffcfe3-42f4-4285-94c1-4e891c75556a", "value": "T1E3B52320B7828073C26725B44AE5F7B85779BDA22BF299CF17C556F80F242C1927731A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516929, "uuid": "c4bb123d-cc84-4b29-abcd-63457d3a607f", "value": "28fddcffc23c8d6bd8c14acfa01b5fae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516929, "uuid": "4df86be9-0f09-43ef-925a-a9d353101a39", "value": "24576:Pe6u/p6D3RSYGP/aTfHCvZaaJLwsparXMIUegpE1PAfORMMKrxhkEeTv:POB6zY6gU4sVrXMZzpE2Tlhx6v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646516929, "uuid": "fc6e1702-74a9-4334-b065-37d62777a506", "value": 2296963, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646516929, "uuid": "cb7ea03a-3364-4ddb-93fd-8ad26014c89b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516929, "uuid": "70371a3b-118b-416a-9ef7-b314d4eb2ab3", "value": "5d74919198834de59ddbf74322fc291019df6bd42319a9eceb8c4a9a932870a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf7a6922-9cd0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646518118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518118, "uuid": "a10183b4-d251-4ff1-bd0b-33d9f02f29f5", "comment": "Malware payload", "value": "2d53560c3db3f656cc3c21d352c24d5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518118, "uuid": "6cb8e726-3aa2-492d-bcd1-6dee13eef9b7", "comment": "Malware payload", "value": "60fc9267ff51de1c8910f5f4b8a393ab3290838c461eafb8189db587cb33f822", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518118, "uuid": "9064df7f-fff7-4eab-9a43-eadfe1936200", "comment": "Malware payload", "value": "8780245969c19f605a5dd8f5b6ec3160c019c73c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518118, "uuid": "5b6bdf6e-1e6b-4680-8f95-9b819f28f7fc", "comment": "Malware payload", "value": "9787048c3729b2306ccc61466aa527fe1ffeb224a13c95b6c7ebc3a3c961744c5a706154ce94ebd44f9e6b633b6f1028", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518118, "uuid": "8d756df0-8a45-4c21-b9a4-8c689074bbd6", "value": "T1E15533093B83822BE4826633D27E1C0E22B6D163E1BEA5596B4D5F565E723DD32533C3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518118, "uuid": "761ebe5c-9eb9-46dd-a782-88979c05b0f0", "value": "b68e8a63f2ddefd72ea0e3bc1eebb357", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518118, "uuid": "f3fb29a1-5827-432a-8971-12669cd35588", "value": "24576:zukT86u72uCKKJKVtZ9yA8xgPIJWq/RXcjynQvxQCaaw1wOfV8V34aWWLMTcOr6q:i3z2uno08WYWGRXX8OCzNOeXWwOriz8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646518118, "uuid": "c513245c-1c43-4767-8be5-3b965c7da6b6", "value": 1372032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646518118, "uuid": "d7f7d689-1101-44a6-8706-b1d5f390bd86", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518118, "uuid": "963adc7b-6c4f-4172-8a30-2a685ee8af25", "value": "2d53560c3db3f656cc3c21d352c24d5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e17f86e1-9c7d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646482500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646482500, "uuid": "bffdd13e-5c8e-4f53-871d-cc7d24436f63", "comment": "Malware payload", "value": "34e42e58915fe698fe1e64e258a10f10", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646482500, "uuid": "cc6a7059-0936-45d4-beda-393dc1f5f187", "comment": "Malware payload", "value": "65f55372475721c5487dd6c960010a5ee1de6755f1f350ebc5e2efbc5665beee", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646482500, "uuid": "efc2c27a-2d77-4dea-930c-302c005d76dd", "comment": "Malware payload", "value": "16762415b94235868d724f1026a3f63370b075bd", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646482500, "uuid": "1067831a-5e43-423c-b3e8-044107215735", "comment": "Malware payload", "value": "07cb13207203828be6518a9262182fde990c6e567e66ec688d6bf0374eead2e1257635a7c87ee95b7387b5298224399c", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646482500, "uuid": "a40a33f4-ac90-4073-b488-47bfc680f390", "value": "T160953B8DB2537466A263F0F9443F110AB23BB459F4888E6CB69AC9D52D34C9D113BF78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646482500, "uuid": "3c28ba73-d5cf-48a5-9a53-11e7337d6b9d", "value": "12288:dM/xAXoXlPzB43Cu7MISJHIQuf2EOj6ZQCkVWmSuXic:dweYXlrM8HDuf2Ee6ZQCrm3Xic", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646482500, "uuid": "cb416d7d-50d2-4dad-bd43-ba48da5c8d9e", "value": 1885542, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646482500, "uuid": "2c03e3bb-c992-472a-a7fb-3b53b5f423b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646482500, "uuid": "eb3a3e18-607c-4274-8a81-ab49b5c733d1", "value": "base.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33202415-9c35-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646451284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646451284, "uuid": "afcae689-9f74-40f2-b472-58e9a6bb1b0c", "comment": "Malware payload (Heodo)", "value": "5ab60704144c313438fe273445d566d7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646451284, "uuid": "759e0ccd-dcfc-4192-9bb8-80f84bbb4231", "comment": "Malware payload (Heodo)", "value": "68c208ca5c3aa15cc76d1f12c12124684c28c05ab20807428b3cc883c9f675b1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646451284, "uuid": "8b01cc39-6aed-401f-86ac-b81e497199f4", "comment": "Malware payload (Heodo)", "value": "0204dac8548f8cc1fa0b6dbba53b4d62cfd92607", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646451284, "uuid": "13b44aaf-1bcd-4119-b116-06b36b2e2c05", "comment": "Malware payload (Heodo)", "value": "9e5f40c97573a03610ee171d2bbff71a13402873d7e6e6ee93ea8d9e32ac7403fae137b37ff6fc790ee10f1d83fd04ca", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646451284, "uuid": "f361500d-23c1-494b-b953-c44a5205eb4e", "value": "T194D41840B259D1F9C4CA3CF83C1A9299625D6CBC7B8960F377BE36AD6B74D70132121A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646451284, "uuid": "5ad1d193-a3d1-4516-98ec-74fb1a056911", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646451284, "uuid": "34b48fae-5a71-47f5-abb2-888d2a562b93", "value": "12288:C2Y7Kg+5zhHHq9xT+oDWIGUcItvhFDuEPF:g2nHIxT+oDWucItvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646451284, "uuid": "cfcb4794-ac02-4ca5-9195-dfaeac676f57", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646451284, "uuid": "8eb7e0af-12e5-4a9e-88d5-db1404e00814", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646451284, "uuid": "090fe857-d694-4735-a5a0-845331d580b3", "value": "emotet_exe_e5_6be44583ae33a4d5023886d29dc30eb10a8219b074710b0026562fb704ad228a_2022-03-05__033439.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42780817-9c35-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646451310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646451310, "uuid": "967fb5c8-6c73-4741-9f53-59a78f9565c5", "comment": "Malware payload", "value": "b579f548e0ecb020dad81ede75e2d70a", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646451310, "uuid": "0af3760b-6997-442b-ab37-7a5b602f3ae7", "comment": "Malware payload", "value": "6a104eb00408deef8de6f9ca6696f6684d499412ed3c6111a48ab661dc96480f", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646451310, "uuid": "19c074fd-7c9d-488f-b3a4-37ece3845742", "comment": "Malware payload", "value": "2be399ccb18eda87bfdb9efdb48d485ca680c0cb", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646451310, "uuid": "1023bf1e-4fb6-4caf-9d35-2e277959197b", "comment": "Malware payload", "value": "dee1d95f2ffe15a27f46a944fc6d4938a3c526132841c816773a34997dae5be60897dd1404721d9fb9256fdab4eb1872", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646451310, "uuid": "036a4495-297d-415a-9f49-a13769336ba7", "value": "T10B51851AF847D15C9BB9236BEC97C562FF1B801B9DA2104C71ECC2491F20809A66CF8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646451310, "uuid": "b27886c4-1c8f-4904-94c6-b792ac56fa54", "value": "48:Axx4jiLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlp:5GhrffvIypvK0elkEYZ85zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646451310, "uuid": "7b40403f-0ca8-4fa0-89c1-e9318455c5d4", "value": 3144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646451310, "uuid": "790cf129-0507-4568-86ad-df428594d013", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646451310, "uuid": "777f59b2-f630-44f8-a916-d6ecb639a9de", "value": "1LxQv6Sn.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb5ba21-9c38-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646452889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452889, "uuid": "3cb8991a-42ca-4884-b6e8-bf63e36827ec", "comment": "Malware payload", "value": "da5321f43cf8ca620a43b8435de47740", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452889, "uuid": "a06f9883-3c22-408d-a05e-71d5ce8b2197", "comment": "Malware payload", "value": "6c5f05e58f1bc4b8485e01dc9e13c3daa89db50fa84c9be1770fd7a4d0aba883", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452889, "uuid": "3e695060-43b9-40e1-abcc-4b65fa440e54", "comment": "Malware payload", "value": "5f1530274ad9ebf716c0b867ea10be85f636f627", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452889, "uuid": "2bd038df-d5fb-44fe-831f-bb852d8a4b62", "comment": "Malware payload", "value": "dec28c1d5447f9c19b7ee05512041d2d6e3d968be3d68af9869cee0bbf9ff0c5544951809238a19a56535dd8a22f8164", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452889, "uuid": "43cdcfbd-23db-4314-940e-419d2e762b90", "value": "T19E32C8A28E693F94E14CD17271318E3D5323D51AA64B5FBA113B8624D003ECCF65A7F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452889, "uuid": "336d3e04-b2e1-4433-a530-3ab1419f387b", "value": "192:E3/+ql/geC1maMzPEXA6X6DlUqhQBqnQd0HJ7tvADU/NsqBl6Gra7PXa71EbYBcO:EWql/geC1Q6X6DlUqhEq7V/uqB+w9pL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646452889, "uuid": "06a3a4c3-0be1-4445-9522-1c0c8f06f2b5", "value": 11012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646452889, "uuid": "3b14aa8f-1f3e-4075-9918-9ded118f122e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452889, "uuid": "8c78a2b8-85fe-4986-8e93-497451638a0d", "value": "da5321f43cf8ca620a43b8435de47740", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96071db6-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "c78a000b-4ef0-4fce-89b4-da43801de2fd", "comment": "Malware payload (Heodo)", "value": "42d78ea5fb39caed50c2635d49e620e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "9b9c8007-5605-4aa1-bc1d-5b0c0ad26e84", "comment": "Malware payload (Heodo)", "value": "6c81b4a721e89364f11abe9aaf13cb225ea6cd9ca0aaf2108f71b8e8c5a905d9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "d4633571-ec86-4b30-a373-50538856376b", "comment": "Malware payload (Heodo)", "value": "ab7be28a09c3616ff39aa2c0b7745b1d8868e511", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "dd2c6085-b0ed-4f2f-9f61-4c5297f8267e", "comment": "Malware payload (Heodo)", "value": "e2de56ab755c67b0e2b85301803e8d4d128c453b5d53d4260f51fa763e06d3d3444b6a0752d167ff6501cd167d663f04", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "04e34802-7701-4003-be90-eff4c9f7dac9", "value": "T166D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "4d551cf0-2a77-4195-98df-45ea6928ebc2", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "3481ccf0-23dd-4315-8f83-960ee1817cfc", "value": "12288:J1U8sNY8/z0rYebzwdoCoGEAbcVBLku8w:oq6z0rYcMdoVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438565, "uuid": "27437102-c019-4f4a-8490-1e80578a3e45", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438565, "uuid": "82e43532-48cf-4af3-b483-2d08bf5df004", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "daed4d61-aef8-4683-9160-34f3ac877c73", "value": "emotet_exe_e5_6c81b4a721e89364f11abe9aaf13cb225ea6cd9ca0aaf2108f71b8e8c5a905d9_2022-03-05__000239.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97f2bcea-9cd6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646520602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520602, "uuid": "576fd79a-22b1-4b9b-8790-240d6e3cbf98", "comment": "Malware payload (Mirai)", "value": "f46bee7054b3106691f71f8aaa5d1697", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520602, "uuid": "244b08db-d567-4b8f-9718-b6d29c2a93db", "comment": "Malware payload (Mirai)", "value": "6e80c7f713520104d9d2b009ad2dea387972060671a4b3b41da75aecfd3f9c11", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520602, "uuid": "8ea04dd0-8777-45b4-9690-a68ae7b8927c", "comment": "Malware payload (Mirai)", "value": "f4ef8c3143fed3722f1f8783bf5e230a1af2ae0a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520602, "uuid": "6f1a6fa1-19be-4050-a2c8-017e61c5b3eb", "comment": "Malware payload (Mirai)", "value": "05e519a5edb56854a8f080fa297145798a5bed5650d537e1c048bcc9a83f3675247a2635c45c233e9885b3ce729eb27b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520602, "uuid": "ba28e3b9-f349-4e31-958a-8e2cdc15dfb3", "value": "T14C234AC89993DFF5DD110AB53177AF328B36F03F216AEDD2C355A932A942602E50729C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520602, "uuid": "2bda89f7-7c67-4f0c-9c23-f6d2468fce8f", "value": "768:2Hs0IKoqqwOMi1/aUMQozES2U7E8EHyt2/1PKmrrr+AlxAKn+Gqixfzh65:2HsXqqJMi1/aUMQjXA2/1Kb++/i9zh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646520602, "uuid": "533bc1ac-1f05-4ebc-b3f5-5370fbfb54a0", "value": 47216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646520602, "uuid": "8ab77199-5734-4eaa-a56d-5cb1d1f5d1f1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520602, "uuid": "d8ecbfc1-38a3-4663-8173-26176cc72dc5", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6011cd90-9c3e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646455225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455225, "uuid": "40e0fbcb-b94c-46a9-a304-bcf05cfa9657", "comment": "Malware payload (Mirai)", "value": "a8aee04f2a9cb9ec89005d92efd5ef2a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455225, "uuid": "795fcdf2-1a18-4cc1-a22c-4a5617a0108d", "comment": "Malware payload (Mirai)", "value": "6f4df159db4d3fb81e5eb808044dfe2a98d38712d93dd4a7ef17ab4d8a3790f9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455225, "uuid": "7978eea2-89ac-4846-bd04-43a792ade2fc", "comment": "Malware payload (Mirai)", "value": "94d18af0396fcc0b0ac814a9ee3504e2bfd5d528", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455225, "uuid": "d901d8ae-8639-4f4e-a1a8-e9195a26b079", "comment": "Malware payload (Mirai)", "value": "483e0a4192edf6c5073907312f4b96774417bcf4dca8cccb3fdb4a55ce427d3f286fdabf4d801b573ac9e1ad0a9138c4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455225, "uuid": "2e9d09a5-4d23-446a-8856-b42c2db6fa49", "value": "T11AC2D098D028DB41EFAB79B49C30DFE43F952FED36F14B9B544ACF550A2B50A51488C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455225, "uuid": "3f2039a4-991b-4e49-a7ce-413ddd6d13cf", "value": "768:Qpa9m7xu14kRbj+8CrEt8p6a6wP54uVcqgw097:wwmCSlrEuowP54u+qgw097", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646455225, "uuid": "73aa845c-5092-4caa-be8d-cc5fd50e48b8", "value": 26252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646455225, "uuid": "5f678733-7051-4593-9fe5-f1ad98579ed3", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455225, "uuid": "efcfe5d9-9fa6-4dd5-b363-695b91ce2c1d", "value": "a8aee04f2a9cb9ec89005d92efd5ef2a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a07df11-9cd4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646519586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646519586, "uuid": "118ca64d-913f-4445-a643-a62b65587e35", "comment": "Malware payload", "value": "486b90fa6968080ed2fb566b116bf6ef", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646519586, "uuid": "7ff257ea-7f3e-408d-accd-91e21e8dd1e5", "comment": "Malware payload", "value": "70248dc203e5e13ce97bf865443b1fd75472edcada0c893083a4228317e5961c", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646519586, "uuid": "51a719ac-1e69-4a27-ad25-75b49ea93145", "comment": "Malware payload", "value": "3fb7f25377d18e404b17a7b021b3d4e80119a3f1", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646519586, "uuid": "d9a38a8f-d2ad-4c36-8649-39ea8d30e063", "comment": "Malware payload", "value": "d0e21aefb1d6eca1e992f6276f072ccbf745d2b1fafe0619b9df055be1cd19359e163a10bcdef1c3ef8d18f6f63b6788", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646519586, "uuid": "b9b301a7-cdac-4297-a369-708aff5640f2", "value": "T1C8518519F847D15C9BB9236BEC97C562FF1B801B9DA2104CB1DCC2491F20809A66CF8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646519586, "uuid": "9560f5fb-25b0-4770-b10a-38893a77b31e", "value": "48:Ayx4jiLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlp:2GhrffvIypvK0elkEYZ85zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646519586, "uuid": "4097292b-02be-4d65-a908-f4ad0a6f90ab", "value": 3146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646519586, "uuid": "1ea74f3e-b423-4dc7-ae2f-55c8384efe15", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646519586, "uuid": "a36398d8-61f6-4440-b696-5324cd99d3e1", "value": "sqbta925.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69dc124c-9c7e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646482729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646482729, "uuid": "c7d74022-5db8-4b55-bfc1-96c021d1d52d", "comment": "Malware payload", "value": "6e82a7fe685de1d93574d468b9d00dec", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646482729, "uuid": "f0672e2a-9e7e-4347-916f-676bc730fac2", "comment": "Malware payload", "value": "7108e585169760601db776a30687cc3a28342b7e4ae8e94b654645ab7200e0f5", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646482729, "uuid": "de8903d8-f78b-41a3-9428-1e9cb9c59ed1", "comment": "Malware payload", "value": "9c40756ca612d67ea0225e02fe03f9d0ebbf4154", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646482729, "uuid": "6b2ab211-9f58-4720-9071-1bcd52c72fc7", "comment": "Malware payload", "value": "4f1edbd33572638c3cd9195e8441045dada855c4fb82e1d67441fc60ae17bbd35f460ed30c284bb326b600dc09dbd9a7", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646482729, "uuid": "771cc48b-22ea-41e6-8476-d6e38f23ad1f", "value": "T16B860142F758A93BC8F78332167A5635217BCD668B439787191C723C68B79EC0B49BC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646482729, "uuid": "17346d0d-f537-47ff-877a-d53289e0c9e5", "value": "196608:BXVQGXGxPIzLi4V+3JiUi/HaudhHZyK1ZrMltbhSpRfg70a4:BlSxP+id3J5pupVmltMHFb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646482729, "uuid": "d4a50e34-3c50-4b1a-b02c-feed51597f6d", "value": 8296919, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646482729, "uuid": "162e53de-f41a-41d4-8201-b077d96b5524", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646482729, "uuid": "acdaf890-40f0-4867-b58d-6ea32ca3ffcb", "value": "Blood Sugar Health.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da27990b-9ccd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646516848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516848, "uuid": "82465aeb-429c-425c-a105-3523640c8fec", "comment": "Malware payload", "value": "799f87d6b7a622f13ddcd57b82f8e51d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516848, "uuid": "d82d5efd-3753-4d9e-b3d0-50f4d5f5bde4", "comment": "Malware payload", "value": "721fc592907ebd7164e3152b160f4d33dd3afdae084f596adc48c5d9f3a4fa4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516848, "uuid": "8bebc40c-8a91-46df-bf44-feed156638bf", "comment": "Malware payload", "value": "40fb1f8dd3ddf6e74516889cac621a8a89c55025", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516848, "uuid": "a1f5c026-397e-4e56-9d0b-be73ca5c6f96", "comment": "Malware payload", "value": "d9f55afb22975c75f7f6c6baa753289ef46e20e18e58655ffd1f17e9063a6f24f33f2949e351c90ac8884e7070427409", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hvnc", "colour": "#BE58D3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516848, "uuid": "526f5e94-0faa-4fb8-9b01-d3756f96181d", "value": "T188234B26AD5099A3FDA24030A0FA5B57969BEC2887291EE75B51FFD074306D22F3C3C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516848, "uuid": "a7ecc768-e71f-4052-a973-701a52bd2e16", "value": "b8140c7ce0c1d0103caf5bad49ee20b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516848, "uuid": "4401d4d3-56ec-43b6-989e-854520744e8e", "value": "768:LeEB0Xa/s2p8gG+XjBhF1+vDU4ZbgG6GorYPsPeHg+B/+AQhSKeeVbAESJX:LeEB0Xws2dGQn+A4WlrYw5+B/+AQhSKQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646516848, "uuid": "b56320cc-f63a-4858-9918-2e5f662984ef", "value": 48128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646516848, "uuid": "088c6346-f675-4cc2-88c9-1071cc80ceeb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516848, "uuid": "ac09d68e-ae85-44eb-80a9-a4e91a74ec91", "value": "MIX1h1_20220305-213635", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df219923-9c75-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646479061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479061, "uuid": "edde85e1-6643-471c-844a-2fca3fd3056b", "comment": "Malware payload (Formbook)", "value": "fadf3fdd5080c4e3d83bf28dc1aa5010", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479061, "uuid": "998e40e0-8a2a-4dbd-8c3f-d952513db1af", "comment": "Malware payload (Formbook)", "value": "7245b04ae7337f9de53816e0fa24245b1c4a1c2191e7363d3f7ebe8f47c7c28d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479061, "uuid": "cce83ae6-073f-4ec0-8108-818606820208", "comment": "Malware payload (Formbook)", "value": "ac534f58fef989cb1dff47d0582e619be8377de3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479061, "uuid": "f0f7b8cf-1aee-4cb9-af7d-d820c3c58c6f", "comment": "Malware payload (Formbook)", "value": "7cbeb850d276d106d6fd431e76678eebb3ffc7283e32a61b7cc5fb6f601014d3f484cb82ab37cf3f9d99ccce5048ae71", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479061, "uuid": "7724ef87-c2ff-4bd9-a0ce-35a76cfce074", "value": "T189D423EAAB40B9C8C1474BB07291631BCEB5E5A0BCC430A78265D6D751C46F7F6EC24E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479061, "uuid": "9a0a9481-66b2-4293-92cc-92eab112c284", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479061, "uuid": "6eebe0c6-29ac-4bc6-bba2-056d03ed52c7", "value": "12288:LttxRwad8PbDB5uS8KocEOXFVQS03ULaHNqrxlKIQNoNz8K/dLyASgtmqW+q+w:LLwQCBDBxXFVkEaHNYK3UYuMsnw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646479061, "uuid": "842905ed-02dd-408c-abad-430c8386964e", "value": 599856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646479061, "uuid": "ff175d27-f341-4114-985c-d7dc44cd378c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479061, "uuid": "82a34a2d-13f4-46b2-b340-a3383884b8af", "value": "Hack Loader.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2001d693-9cb1-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646504510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504510, "uuid": "269db317-2548-4c44-a0b2-788ce48e1d0c", "comment": "Malware payload (RemcosRAT)", "value": "5b6b523c7e728cf6afcea64f58efe0be", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504510, "uuid": "052cc58a-fb66-4964-a7f1-789ce811715b", "comment": "Malware payload (RemcosRAT)", "value": "72bb4a68f56282391552f33e3f32415ca046081b1823049778a6522f2d5f0e43", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504510, "uuid": "2f6394ee-e13d-4f38-829c-1198d06da475", "comment": "Malware payload (RemcosRAT)", "value": "dbe730192e15e97e1e7cd2ad10789f461e12e205", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504510, "uuid": "9578aa76-6bf5-4078-b319-3224a7071b54", "comment": "Malware payload (RemcosRAT)", "value": "394dd377e73d88faa205904e09a5920ee24bc19a5e1feb88ce38bc2b2560c7395b5dd7aac56fd52536aeea51dca041ba", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504510, "uuid": "403b362f-7a84-4e81-ad6a-5c171a6cdba2", "value": "T16C14E00056A0F857C8A13630DC3696F5AA799D13C5B59B430B83FE6B3AFF28149DE126", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504510, "uuid": "177fe5da-1d7e-4fe3-bfa6-1e427fae5b41", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504510, "uuid": "5bf95d42-6994-486f-a317-a58ae6323750", "value": "3072:9vbG7N2kDTHUpouY7lMbOG7mhaOyt8hoVybG8auk2AaVkZoa2BPYRhPH:VbE/HUolM/mk38hom6h2AaVkZKBwRhf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504510, "uuid": "daf7213e-5cd3-47fd-9e48-917e8705605e", "value": 203672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504510, "uuid": "33bfcc54-2d0d-4435-b50a-f2394af19a11", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504510, "uuid": "d3ce6319-58ed-44a3-bc12-91d676eaeec1", "value": "5b6b523c7e728cf6afcea64f58efe0be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98182f05-9ca8-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1646500846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646500846, "uuid": "f3fa3557-b522-4bda-a061-7637df445006", "comment": "Malware payload (Amadey)", "value": "06777de46e46ddf54d0dec2794ee292e", "object_relation": "md5", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646500846, "uuid": "f54c8b43-d631-4b0a-9944-6c7245561ea6", "comment": "Malware payload (Amadey)", "value": "72cc7ecb49837771303a8f567a2b7dd2e7f5ad7790c5b3aa0011fb981106cb31", "object_relation": "sha256", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646500846, "uuid": "2d1bba10-265b-4ce2-998d-13ab5b5d574f", "comment": "Malware payload (Amadey)", "value": "ad05474b996e88be045de557af5d58238210b4ce", "object_relation": "sha1", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646500846, "uuid": "e464e5d7-8d3d-458a-9708-c60c063e6f0e", "comment": "Malware payload (Amadey)", "value": "6d87de25745f289286366900b1d784856b1aaf8bbac6702a2b7055e13a51bab79d1b6a7638418694c605a6d031e46cb5", "object_relation": "sha3-384", "Tag": [ { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646500846, "uuid": "a47efcd1-5ca4-4cbe-9451-c0c2f38e4756", "value": "T1B3A5E03175F36827DD4B81B5FEEE8478AC9268828B9D41D718386B6604362D0C6FBF47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646500846, "uuid": "e91279ed-577f-46d7-9adc-3ebe90b5e79c", "value": "9ff929da3eb68eb1da18682759fb0a41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646500846, "uuid": "1587ddb1-9aad-43c7-b8fe-63b8458cea09", "value": "6144:dHe7Lpq8VRcnqNLVCSBuq69KGv9rpKTmsFx883Do/RWoFiSP2Re8J2xiSP2Re8Jz:d+7kiRsKQkwKeoTmsnUkk8k8k8k6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646500846, "uuid": "88bd36a0-a298-4795-93a1-41e46404d8e9", "value": 2187112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646500846, "uuid": "435ad05a-febb-451b-a8af-b645964eabaa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646500846, "uuid": "8c85c2aa-f375-4487-be5c-66a180516543", "value": "72CC7ECB49837771303A8F567A2B7DD2E7F5AD7790C5B.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b642b95e-9cad-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1646503044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503044, "uuid": "c5515437-08e2-44db-b9c6-72a7713e67bb", "comment": "Malware payload (Socelars)", "value": "094e1a24e4d58abc7a30bfce07b48c51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503044, "uuid": "ab0571ce-7678-49a2-8c7a-58fea51c0b6c", "comment": "Malware payload (Socelars)", "value": "74aeaf1160114dada3c74d066fd1d0a294aca6f4cc7070462d7a96fa7c16014b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503044, "uuid": "3f918e62-7fa8-49df-b155-d7d2e3333602", "comment": "Malware payload (Socelars)", "value": "eec7e74c6ab45f5689ab5bcf0c86cc9fcfc113a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503044, "uuid": "1f05477c-4082-46b4-8eed-dfa35a566531", "comment": "Malware payload (Socelars)", "value": "96f70b3256f6c5d3383102cca96642b5bfe31b58e62a2814edd2c6018cc17066ca4fa9f69d0ba9791d004fbd1b2d6fb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503044, "uuid": "8022fdde-4dda-4193-8af2-7b627106fb95", "value": "T194659F11E6426236E8E30072C1FF4AFA8D686E21931894D7D3C43DAE7B655E33637A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503044, "uuid": "b36227b8-9af5-46b8-a5f0-8e7d50543200", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503044, "uuid": "08bcf501-dd64-4a9a-985e-bf94e64c8516", "value": "24576:cwpk4V9rRM1oDb+enGs2Q6E9ZBJRPHJYrFSJ84ufUKKFqug:JpRc1OMcV8sJjAUKKMug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646503044, "uuid": "9c0b16e9-51be-4e56-9813-0837f208d427", "value": 1514496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646503044, "uuid": "836a7ca3-da6a-4c5a-b876-e3aa73635692", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503044, "uuid": "303ba25b-7127-454a-bcfe-bd22b49e92a1", "value": "094e1a24e4d58abc7a30bfce07b48c51.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a216659-9c3e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646455242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455242, "uuid": "b25b9d88-8ee6-4d4b-a56c-98b3ceb9c6ce", "comment": "Malware payload (Mirai)", "value": "c6fce3ef6152d2c7f1d0dfeebbb6ae7b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455242, "uuid": "8aca4c86-13d3-47ca-abee-94faa8291421", "comment": "Malware payload (Mirai)", "value": "75ad1f73adcb076bbb92797e72add73294068a2ddd26f413a953c03ede6a605e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455242, "uuid": "aa5cada9-e756-4d23-86b3-dd0393d4dfdb", "comment": "Malware payload (Mirai)", "value": "d74fc35dca9d356a74ff3facee1391b330d9a7f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455242, "uuid": "acaaaef6-e431-427c-8475-a85cf122fbea", "comment": "Malware payload (Mirai)", "value": "111ee38c5d5341e9dff57c40e5e531156a190c37cf1fd83b476bd6915711ec7c6088875e16afd468a3631f663fbca919", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455242, "uuid": "08bac603-7ac9-4eb0-b849-e326373d9968", "value": "T18BB2E164EF512C71C730193EF62E94893A9702F8A5F931362AB54638F7C640B49B13C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455242, "uuid": "f9bd86c7-a067-4046-a8de-1d938d2f5679", "value": "384:FlKfFJz9lWUcx5yu4nl95FlGrgx5p9rJgm/K3asLhymdGUop5hKg8H:FY7GQuQjFG299gm2s3UozYg8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646455242, "uuid": "26d0e099-c34e-467d-bf8a-63518e734a14", "value": 23788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646455242, "uuid": "3de7e2b6-b30e-44fe-9591-e1b64ff8054c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455242, "uuid": "bbddbc47-655b-4c51-8cb0-add4332c3117", "value": "c6fce3ef6152d2c7f1d0dfeebbb6ae7b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ca2b21-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "c25197f5-1919-41b4-b2c5-ef362da75ebd", "comment": "Malware payload (Heodo)", "value": "767799a5db348cc0d174164db7ef2c07", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "490f1e9c-2c3e-47a7-889a-173aff1123cb", "comment": "Malware payload (Heodo)", "value": "768e11658429299a8b54c21f21e3186be0d32f34294ef2836260683432162d9b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "59a3e64d-fa73-4ab5-892b-37dc68a048b3", "comment": "Malware payload (Heodo)", "value": "49ee1bde806dfa6213dc36aac68c6d3b901e2f2a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "7ae90394-4672-4637-ae44-e6a3a14b68f5", "comment": "Malware payload (Heodo)", "value": "9f6879031dfffc234abd0697126906356fd19e9d761a54206f224479b4bfa3e975e63aaa266286225fa7a1ca82d6ce05", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "d296694c-3524-4814-b5cc-4de875039bbf", "value": "T15094DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "62eb7f5b-7076-4daa-932a-a8da8b0fed84", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "0fce848b-02c0-4df8-9715-0cff499c85dc", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8cCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCraNuiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438565, "uuid": "42e3e551-0bcb-4f09-9336-4a433b617e83", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438565, "uuid": "c1b0e080-2e0c-434b-b07c-82df1ca4b49a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "18e0d446-717a-4c35-b052-7ecf896e03ba", "value": "emotet_exe_e5_768e11658429299a8b54c21f21e3186be0d32f34294ef2836260683432162d9b_2022-03-05__000237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d30f6056-9c22-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646443392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646443392, "uuid": "076f033e-5905-405d-aba9-be949ac92d3b", "comment": "Malware payload (Heodo)", "value": "3b03928e273b494693a0c82d511f6ee1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646443392, "uuid": "caeed226-869f-4463-8796-295e5ba4decf", "comment": "Malware payload (Heodo)", "value": "78b06c97d96e8e85ee35ee3f01b0da837b357cdb39ab128514e39d80cb0f6135", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646443392, "uuid": "1fe1da2f-3694-4f66-bcd6-721e896056d6", "comment": "Malware payload (Heodo)", "value": "c30114cc9b2ba0750b48e036c101ee3a1e7bf90d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646443392, "uuid": "dc57730d-fd34-4c92-ae11-66e98db3114c", "comment": "Malware payload (Heodo)", "value": "3fffdbfe094cc06ff3819d12439f34b711d745da4bcb729267664685b15c463df00b2f9da96f9032f3eb40cb58c2af23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646443392, "uuid": "66027c38-5981-4e9e-a954-a916e0f6270a", "value": "T1DDD41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646443392, "uuid": "2a8ebb9f-5a19-49ea-8eb5-605c51f877e7", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646443392, "uuid": "a7b1dabe-1281-409b-b41f-4bbf64137784", "value": "12288:DjN/Z2wkRrA9CRDCvElAjHDsndSyHOrNvEP0Oua:dEHR+CRpyfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646443392, "uuid": "c0f6163b-c2f4-4d02-b31f-48a25237155f", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646443392, "uuid": "0afd0bf3-2745-46d5-8231-598c210037ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646443392, "uuid": "57d1a8e9-f434-4193-ae91-9ba2d42dcecf", "value": "3b03928e273b494693a0c82d511f6ee1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98515218-9cb6-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1646506859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506859, "uuid": "927025f4-dd0f-4d5d-a3ae-675fb3c832df", "comment": "Malware payload (njrat)", "value": "8d9d1213f2efe07e84341ca3997ca5ba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506859, "uuid": "40fc3fd1-971d-4dcb-874c-5d7fb6ed1eb1", "comment": "Malware payload (njrat)", "value": "797e4fb918a10e74cd484f57ffc9963a5d57e1b534dbfd72a11b844568de85d2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506859, "uuid": "7a909f29-0a4f-4531-918a-54e617486ea9", "comment": "Malware payload (njrat)", "value": "329087a04f87b4c92497138e182ca096937afc79", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506859, "uuid": "92ed3870-04cf-4796-bb28-d8105f1bea97", "comment": "Malware payload (njrat)", "value": "d2fa02264055a5b12a25f85e38b4b08401ccc3c1e96b4b5643544fbe11132259f717be5a70e23d2be086fec756a7da3a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506859, "uuid": "4610ba99-6b88-474a-a2ee-56227667565b", "value": "T182A34A99736AEA22DB6C43F5427B5F090374428B6302913F5CC999864F2B6C5DF09FB2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506859, "uuid": "74b43598-7158-4221-9ffa-80fd6d8c9c4a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506859, "uuid": "c6ab3f62-fdca-4f9f-94f9-1ad3d18bb831", "value": "1536:SyNeFIuAPtr7gS3ppOTLGwBPLepVL55MZ3zzXUUf29aXh1zRHUyyGyQVQ:SEeIR5pSRBlXkyXjRHxlyQVQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646506859, "uuid": "dacdbca0-bf2d-4067-aea6-7410f148d63d", "value": 104960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646506859, "uuid": "9d68894c-be41-4ffd-bb90-7acec84fdc30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506859, "uuid": "74ca5ded-2494-49ff-a7dc-101b96d154d7", "value": "797E4FB918A10E74CD484F57FFC9963A5D57E1B534DBF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b02e11cb-9c47-11ec-9275-42010a9c0029", "comment": "Malware payload (VirLock)", "timestamp": 1646459225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646459225, "uuid": "33d85b72-ee88-41cb-8a0c-10e077efdfe1", "comment": "Malware payload (VirLock)", "value": "5756392cd673a5c62ffd3c20dbae4ad5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646459225, "uuid": "4da7948b-89b5-4e84-a9e7-87dbb42807e8", "comment": "Malware payload (VirLock)", "value": "7a92e23a6842cb51c9959892b83aa3be633d56ff50994e251b4fe82be1f2354c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646459225, "uuid": "924771d5-9fd3-4dbb-b00b-bc56b197bac6", "comment": "Malware payload (VirLock)", "value": "ce3556f1e84e992a6de4819ecb00cc6b11c2aa81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646459225, "uuid": "2a255235-8eb0-44ba-b870-91fa78f49b96", "comment": "Malware payload (VirLock)", "value": "2ea4b61b25edd3fe98f6e9bb9ef39ed3b558d5081f3f199c202bdfe874e1d557b93650aeabc0a2e566429a8e0d667961", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VirLock", "colour": "#148CF2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646459225, "uuid": "d51b3de8-f167-4cf8-9e2e-0ad5dd220531", "value": "T199B41258C57397EAC77C783351F3BB805A13C108AED23E9008E77669A78DBEC416DA58", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646459225, "uuid": "95e81d5f-8244-4567-a5be-63d10a5b5403", "value": "b1a3ab46e694bf6dd30696debec90c69", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646459225, "uuid": "f4ea314a-e4bd-4f90-b34e-661661175a2c", "value": "12288:TMuPy/4yKHWFcyC9+9MiQGqeZVHn9HmzJCHP:AQyKHWO9ONV9HYSP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646459225, "uuid": "a628c5bb-c4f9-4a2c-ad52-ca0ae459183c", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646459225, "uuid": "3430ad49-003c-4032-9094-d461f239c5c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646459225, "uuid": "b19473ab-3c80-42d6-b604-3fb26110d807", "value": "minecraft cheats v1.0.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bfc2404-9cba-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646508342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646508342, "uuid": "88fbffc4-69a7-44f7-88b9-892d81adf783", "comment": "Malware payload (RedLineStealer)", "value": "a59438ede72b2b5723b1508e7f8b7bbc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646508342, "uuid": "65119eac-01fc-490f-b144-082d96710b07", "comment": "Malware payload (RedLineStealer)", "value": "7ac0bd2fd0b3cc4bef390d3830ebe9d125b99e7f34f63b8db96e5bb40cfbf708", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646508342, "uuid": "8b4d3e02-80bc-49dd-9aaf-0cd9cd2687ef", "comment": "Malware payload (RedLineStealer)", "value": "8133be8e8ff0383b2655014dcd08db475df2cf17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646508342, "uuid": "a72ae7eb-b6af-4186-b74f-7293335caad8", "comment": "Malware payload (RedLineStealer)", "value": "0e2bd81c1c4ad4d8685b0f5cc40e0cf4c9ae997f5965e49574b44ab5e3717cddd40e5c2a81fd86e1cba8e559ded4a7cb", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646508342, "uuid": "5041fa14-a03b-404d-9760-191b9721c95d", "value": "T1A9F38D1832F9C072D1AB15764435C3B15E7BB8B61F366D8F7EC52BB90F252E18A2530A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646508342, "uuid": "335a4489-a059-4e46-bf2a-6d88f17c20f9", "value": "5ed2bba8dd6d67921a51920bf446a033", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646508342, "uuid": "6e348396-4cc1-4d6a-a73d-fefcf880af68", "value": "3072:aZZVgLWTYEyJi9T1Aj3LGVow8dGD8F6fE5wvpJ3:OVgLWcET1w3LGMdGDecvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646508342, "uuid": "cbf8f9ca-4cc3-4395-879e-17ecbcdf5ec9", "value": 164352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646508342, "uuid": "9cc78530-e09b-4fd6-a834-6fec871d47a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646508342, "uuid": "4c0f0e41-76dd-4795-bb53-22548d5f752a", "value": "a59438ede72b2b5723b1508e7f8b7bbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e81384a-9cd2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646518761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518761, "uuid": "fe658e83-aaaf-4030-a3e0-34c5dbc6ce3b", "comment": "Malware payload", "value": "1e881034fc3dd0d0be03316c22e315b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518761, "uuid": "de3c2c6c-aad2-46b0-b2a4-0e6c6198f121", "comment": "Malware payload", "value": "7e34adeb2640784cbcd5118058ba4c1f3adb4f7712bb5cfb6725cee1cc8297d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518761, "uuid": "1c876ed9-c392-4457-8206-390f8c12314a", "comment": "Malware payload", "value": "c5bc967811e9ed403e5e1c2242d74e8867b21001", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518761, "uuid": "051be060-7d07-4be5-95d0-7274e93674a1", "comment": "Malware payload", "value": "e340d6e4f72c347b2fce3f6de4c7aa3e2af081499690b006e0098353b3940d738e45026891a87ef7724a44223bf9ae3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518761, "uuid": "855dfed4-c2a5-4081-9b06-9d8ed7644007", "value": "T16825ADC17CD1AD0BDE472EF60515BB482B7D2FAFD9F1A829BC70EF0EA8318941505A25", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518761, "uuid": "533fb2cb-3d85-4997-848a-eda6a38730cb", "value": "cd80e26d5dd7037ab6ae6c1d15bac26c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518761, "uuid": "5f647a9a-2e85-42ea-b465-f13cf11f69bf", "value": "12288:rIl9rrzT4BCZeFGR/AjPkX//dVhMyQT2VI5KSOMwvTuFj/ZDoDdYARhD8:rQ9fT6qeK/sQXdVTQD4pvWiY2D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646518761, "uuid": "41b6769c-dd87-4a86-a98a-28372b14f098", "value": 1027744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646518761, "uuid": "1e49d1fc-47f0-4f0c-9b5d-3fdb95ede212", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518761, "uuid": "bfa606f8-7cd4-4275-8772-ca2b4f8159e8", "value": "1e881034fc3dd0d0be03316c22e315b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f76709d-9cce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646516937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516937, "uuid": "214d97e4-6969-4981-ab66-3e2109a0f5e3", "comment": "Malware payload", "value": "e4de737535ca86984df5b881f9d005f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516937, "uuid": "04261e2c-f0c9-4e09-93de-9a23929983b5", "comment": "Malware payload", "value": "7fd0cda9395aea226447c9dd8a25caddb71e6b72001d9a8565e43f7a00332f7a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516937, "uuid": "0210486e-ce96-49bb-810a-ff9f8942eb32", "comment": "Malware payload", "value": "78adda99cbd3c0a7c336bb1d2082738f650160db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516937, "uuid": "8091f18e-8df1-49ff-924c-7577188a0bd1", "comment": "Malware payload", "value": "7d66c3218c00aaf09ff953d8f945f8b94bacac0823e4b23b455da05c32c163aef563e679ff8ad63ed536bcce3a7f08d5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516937, "uuid": "f8e1f070-d393-455d-8916-0677032d973c", "value": "T1B035D7A38A850A33CAE903F61C614407AB967DB61339D1F70A3B17DF8EF1CD52824310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516937, "uuid": "3f7018f6-1166-4add-8a42-53c691c0e180", "value": "6917a0ad1f780cfb5562f698345f9b24", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516937, "uuid": "716ab269-24d3-4ada-ac7f-d13f7f83545f", "value": "96:8ufPG/bXeyV0UYDv92+uA8JvU3j4JOYtAUnIgQaDe:dfPG/lV0UYDvfuAovhauIgQaDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646516937, "uuid": "48c162bf-0e67-4145-a5e3-1e9d927afe66", "value": 1082720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646516937, "uuid": "ee0f5641-82ef-49bf-8f94-b1b7fefc334e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516937, "uuid": "d01eab69-941b-4dec-adcf-99af9726f82c", "value": "7fd0cda9395aea226447c9dd8a25caddb71e6b72001d9a8565e43f7a00332f7a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6456fe45-9c35-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646451367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646451367, "uuid": "a3e78881-98c5-480e-a1ef-715b9b17b6ad", "comment": "Malware payload", "value": "542a81b1584380a3528d2f51a531d381", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646451367, "uuid": "e28a690c-1008-484f-b327-7b80cb7d40dd", "comment": "Malware payload", "value": "836f8cd0dbdd9706261c1018ab75897ed8b53dd9522817f187684d6b4e6f3d1b", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646451367, "uuid": "a0b5e4f6-083e-4a12-a60d-2fc89a4fa8f6", "comment": "Malware payload", "value": "5847cbae62fe02c8ae75abc1a531e6472a139cf2", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646451367, "uuid": "c9d99d6d-7e86-4dcf-9005-0483ae07a2dc", "comment": "Malware payload", "value": "1e4762597532730983f3141435b24c9b3485f3526fcd9cffe00d0a5ae9219fcf85b04fcb8b8ed6ca9ae648cdeb4ceb29", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646451367, "uuid": "3d86f716-0dcb-44f0-b20d-04b935efa44b", "value": "T1F361860AFD4BD14C6BB9235BEDD78522FF1B801B5DA21048B5DCC2495F24809A6ACB89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646451367, "uuid": "ea305f6a-24b3-4caf-98a6-47d0749b4790", "value": "48:AuA4jOjOLuDQjvUKmc4TQ7QZE96pAUYRAGqqsUoyWKLrj6l1CelkEJmZVoQBozlU:X9WChrffoypvK0elkEYZa5ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646451367, "uuid": "52e68f41-226d-4826-ade8-9c016aebacef", "value": 3185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646451367, "uuid": "c00a28f1-995f-4aa6-bf37-8c11f89ecb02", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646451367, "uuid": "0f60fbdc-9ede-4d15-9a63-b7731f2e8c9e", "value": "auz4PUHE.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e83609e-9caf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646503729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503729, "uuid": "e4ec5c42-3ca3-4872-b5c3-e86e14434544", "comment": "Malware payload", "value": "fa05c59eac2e34f3126afdc468c89ced", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503729, "uuid": "242c344f-f2ae-47de-b4ea-853cec0e3f7b", "comment": "Malware payload", "value": "844019f06ff12d2dbf99f26b77f336448d4efa893036ef917784172804e39356", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503729, "uuid": "96ea352e-5428-4434-a533-05158266a8fb", "comment": "Malware payload", "value": "60ba00782d242f44f81c4cc726497c745c309a5e", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503729, "uuid": "b2b1ab98-3810-4ed2-b264-b838e2304ac4", "comment": "Malware payload", "value": "3241a5835780af7d72d7baf1ad1ec8a29474ba98fef02e7765e2be2e3d1bb8291c00d288d2af13329ff8ba12ffa71695", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503729, "uuid": "e5ce807a-63e0-44e7-b468-d5cef872b6fa", "value": "T1B1F55A13F2B4653BD46A0A3A4927E658D9FB667D25228C1BD7F008CC8E3D44C6B3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503729, "uuid": "5f79808f-d033-4f27-9059-09d2496a3a66", "value": "49152:gZGY8Xny0znrSPo4In//khK8eTxA/Bk9H7OY2EA:tMZM8FBg7OYxA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646503729, "uuid": "0adad0aa-5c54-40d9-93c3-5c5ea8d73005", "value": 3486720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646503729, "uuid": "cd52864c-8316-4b65-a1a4-549da18797f0", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503729, "uuid": "9a1468e4-dc01-4673-8e2f-277e84fc4c74", "value": "Nota.IplaceGlobalNFe04032022.Danfe.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22bc4866-9cb5-11ec-9275-42010a9c0029", "comment": "Malware payload (TeamBot)", "timestamp": 1646506232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506232, "uuid": "b34ffa8c-90ec-42d1-81c5-7772d5221eca", "comment": "Malware payload (TeamBot)", "value": "7e43434df7b3d71a0004abe7ce7abba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506232, "uuid": "3de9262f-af4a-49a8-bf7a-f443c9be2199", "comment": "Malware payload (TeamBot)", "value": "84b3387d512191b0764fde9a03d827cb42ffe33d864b115b959c61a0147aa64d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506232, "uuid": "c197a89a-4ae9-4ba2-b9d5-e15ea65e3aa6", "comment": "Malware payload (TeamBot)", "value": "174e1cc76b437dd864748017101f1f836c732201", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506232, "uuid": "d24c4dde-5783-463f-8206-f90e3ab9bfc5", "comment": "Malware payload (TeamBot)", "value": "6bc0a135a799fb8956b3a1c9257e4d371605f520494624553e2c0a8462100952e093c35dfe34eb97ac2312290ac3c21b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506232, "uuid": "97d6647d-24bd-4cfa-bf76-8412fa3036bb", "value": "T18616334B32769073CE920EF40512FB551FEE82B27415873D9398CF09255AB76B3A734A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506232, "uuid": "3fa832c6-6bb8-42fa-b678-d78afa98e08f", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506232, "uuid": "41838548-6c53-48ed-8c5e-03d95bd9b300", "value": "98304:JCj0Dp3Jn2U9xie2r130PmFt25FqjfW1tU:JQ8l39xieq0Pmuzqi1tU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646506232, "uuid": "f6649d94-d474-4322-96ba-f86e92eed3a6", "value": 4065987, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646506232, "uuid": "feaf9bba-19c9-4967-8f49-f0b752a83b68", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506232, "uuid": "c54c3c9f-a415-48cb-a65d-a941e6f251b6", "value": "84B3387D512191B0764FDE9A03D827CB42FFE33D864B1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59e0108-9cd0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646518102, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518102, "uuid": "eb6d2343-06e1-40f2-a827-8895b40208df", "comment": "Malware payload (RedLineStealer)", "value": "81bfa7e8b69620b342a579d2b576d181", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518102, "uuid": "4d2d7aa8-12f7-4116-a2d1-d1234c270f5f", "comment": "Malware payload (RedLineStealer)", "value": "8767c133947047cca37a18b58c3fbe4ff7db940fb7529b84202f4a9391a120bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518102, "uuid": "b8dbd88c-e89e-42e7-afc0-df8fcb677ad7", "comment": "Malware payload (RedLineStealer)", "value": "11e5b67b3bc5f4ee9dc198f360f4a0c7cc2d9288", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518102, "uuid": "5883cf2f-6620-46ec-b906-1218ff0b641d", "comment": "Malware payload (RedLineStealer)", "value": "10d80d670be051f700553b1a83cb8ba55a861996891576df2fb2fb3db05c18524ed06372e4d632ad623e348be2759b75", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518102, "uuid": "2a04df20-bb94-4ff6-8877-98201d76a945", "value": "T122C422D1BE18B62EE4217135688A4972833E2C2EFF57563F2278FE1D37792912E45243", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518102, "uuid": "caa79cbc-f985-4d7d-be76-0b04d096ecb9", "value": "e7a61cc82aca8668f87ef339e83bdd14", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518102, "uuid": "ee5399f5-26bf-490f-882a-adb8f4f43f03", "value": "12288:mwmYD/tZ/RoL7qWpkX/tM2Qqt27sWxNGqiiXWSngCEWoAwRwqtSe:m3qtZ/uqWmDQqtQs0ziQ4Gqr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646518102, "uuid": "5bef565f-958a-4430-825c-4cf1ecc6c010", "value": 546960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646518102, "uuid": "860512d6-0c6a-4210-87bb-fb9ab66a96d1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518102, "uuid": "472c0b17-160a-491e-b1af-3c834b523d7c", "value": "81bfa7e8b69620b342a579d2b576d181", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fce2642-9c7b-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646481478, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646481478, "uuid": "70d5398f-8821-40a1-9c76-f6c197cd1168", "comment": "Malware payload (RemcosRAT)", "value": "e9a9ed0a66d9f632e1dba322f5b9c1cf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646481478, "uuid": "2a76bb7b-a10d-48d7-9377-ed942a661cb2", "comment": "Malware payload (RemcosRAT)", "value": "8dffb14c55c2880b40767aadf5615a6652403d59f357b0b77da3e00b875a0e32", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646481478, "uuid": "bb7cf8f7-fda4-4b2d-b77e-70c6b2cf94fb", "comment": "Malware payload (RemcosRAT)", "value": "e34797f028d0440373897ab579f4902caa9a2b0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646481478, "uuid": "f2d797ec-be6a-48a5-b7e0-d1c76aa9d232", "comment": "Malware payload (RemcosRAT)", "value": "d069a5ce5f5e77a66678ffd81488a6f2ccff73b5b39fb88a7eea7a74ce68b9175d5a53df42df3098af49f86c14356964", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646481478, "uuid": "5e58147c-81fb-466d-83f9-f45c225e416a", "value": "T16A154B52B16DC8F6D42219394C6A966495A9BE303E356D0736E43E0D7EFF2C03D2DA83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646481478, "uuid": "e110265b-c7d8-4df0-b4e0-7183b0441a5d", "value": "9eee0aa5a8fa1e2c5aa038d471edcf98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646481478, "uuid": "3180cdf9-31ca-4fb0-a031-89639b2c310b", "value": "12288:rQXbVWn5JSVgxB6IHeHMHOPrK56eXloSE2p8VMiqCG9NJ:8XxuagxB6IHesYrqTySE2p8V/nc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646481478, "uuid": "4116d174-466d-4822-9879-13dba5829099", "value": 936960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646481478, "uuid": "239c2e56-73b2-4875-8a24-3bb83421a130", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646481478, "uuid": "ba9085f5-afad-4648-b2b9-b5f6eefad211", "value": "Urgent Purchase Order Mar5_76543,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f91d3a9-9c9f-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646496912, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496912, "uuid": "d12b7a77-7287-4e68-9310-24e453e4c15a", "comment": "Malware payload (RemcosRAT)", "value": "e8ad16abd488ff9d5a0bab08316bee19", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496912, "uuid": "019f26f3-9daf-4f8f-b2b1-202739ffdabd", "comment": "Malware payload (RemcosRAT)", "value": "8e55c2aa8d84e6e7a065a78a916cbb4d03404ef93e742425e2fbc5e771eed5d3", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496912, "uuid": "e8ac56a7-f3b1-41c0-8197-b5fd2105c81a", "comment": "Malware payload (RemcosRAT)", "value": "f49ee91c9f8294eeb38ab72b0ace5eb3c2fbc8e9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496912, "uuid": "1ea359ac-75d9-4f67-9ae9-37b961c25552", "comment": "Malware payload (RemcosRAT)", "value": "505d1eff2ac636b4b11538b4ed4f6ea92d9b0e51ad28b73ee0d15a491ddafc53f610757c43656ce225ad86826be723a6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646496912, "uuid": "7e217790-6c2d-4cb5-ade7-76fb7904598d", "value": "T1FB655A52B16988F6C4162A398C6B826454AA7E307E396D4736D43F0D7FBF2C03D2D993", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646496912, "uuid": "b55596c1-9daa-424f-a4b7-db6e2890fecf", "value": "12288:CQXbVWn5JSVgxB6IHeHMHOPrK56eXloSE2p8VMiqCGTNJ:HXxuagxB6IHesYrqTySE2p8V/nG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646496912, "uuid": "1aff5912-5ab9-4cb6-8794-098b3fd3ce32", "value": 1507328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646496912, "uuid": "65bb5ed0-e4b1-4405-89e3-fee9fdcaed62", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646496912, "uuid": "817d1563-3966-4f47-b474-6581746e8ffb", "value": "Attachment.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0d9a286-9cb0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646504431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504431, "uuid": "fc607c94-639f-4f5f-ad73-37f084704015", "comment": "Malware payload", "value": "d5a8c9d807590c3393509b276c8a11ca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504431, "uuid": "b23efe05-6f9b-4047-8458-e536fa9b8066", "comment": "Malware payload", "value": "90ac445f282c66552b08d176d123635537170009fa83988ce5011aef18ba5fb9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504431, "uuid": "52f03e51-d273-4865-bc3d-7df1f5fb2159", "comment": "Malware payload", "value": "2f9d8cc749619e2d73ba635600766979c052ba47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504431, "uuid": "0bba289c-b63a-400b-a04f-1891471e2b7c", "comment": "Malware payload", "value": "c6d1ac6006ac0fe6690c93427642203dd8f05777fe764d6bb81e082585533119b94278d031352f67f88010e2729e306c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504431, "uuid": "d6ae4c44-7c47-4b75-9665-c783550dd332", "value": "T193450240B6A0D03AE0F311F8B57593B8A53E3EA0573195CF43D62AEA26746E0EC7535B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504431, "uuid": "0e54489e-8990-4328-9693-199ff755c8a6", "value": "f91ad443b18170923c51c058a6c9fba9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504431, "uuid": "c1de6082-204c-4583-848d-139857162179", "value": "24576:er0df4o7h0gLpx56nRXzC1qLBRnHWiXj7D+YZUtI:er+CienXHfvaG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504431, "uuid": "8c4bec93-4d9a-478e-9c45-450873760b6e", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504431, "uuid": "b80b0a2f-1342-4098-bcb6-cd9018b15d42", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504431, "uuid": "26cb8dce-56c9-48d5-b556-2aeddf0c5e86", "value": "d5a8c9d807590c3393509b276c8a11ca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4db31a0c-9c43-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1646457342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646457342, "uuid": "0b149604-0ca8-4735-9390-106066b56642", "comment": "Malware payload (DCRat)", "value": "ac991f009709b6c2e3baf4fec4f2b6df", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646457342, "uuid": "36e8c399-7341-4d9f-8a32-ad7fd60f2bbf", "comment": "Malware payload (DCRat)", "value": "917ae3fd7b456d824242ac467ac28917d5397451882c69aa9a06aa0826bffd02", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646457342, "uuid": "1335f5b0-e4dc-48f4-a2bd-3fe7a5af8c74", "comment": "Malware payload (DCRat)", "value": "19f3e031bef87455c06e0a0febbd55d0bb3168ee", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646457342, "uuid": "d1484fcc-6fef-4135-9257-701f93f7e724", "comment": "Malware payload (DCRat)", "value": "01b8879017bca1058d35527b9dff016bb264c14dab29d4a34eeb4b61f650ec9b57ebe894ecbeb4df0304c6ab38bed68e", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646457342, "uuid": "45a763b5-0212-4806-b06b-9334c92830fe", "value": "T1FBF4E502B648CE12D4691677C5EF412CC3A8BD527A66DB1A7E5B33AD21023A7DD0E1CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646457342, "uuid": "3f9a5abe-8653-4d46-9937-eb385b5deb12", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646457342, "uuid": "4288d290-5199-4e24-82fa-1cd4c28935dd", "value": "12288:Nm1ohDv0AXL0LKnXkMpLvcHPo9gNkMJr+FUdJ6eDRV8TBgu:IuNv0pLKXkQcHPkMJJdJ6eDRVUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646457342, "uuid": "8e243888-f596-481b-8d56-507cd4d8cffb", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646457342, "uuid": "95afb814-b1c1-4e69-a904-593fdeb3251c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646457342, "uuid": "c8831f2b-8b21-4d79-93bd-f76b70650f85", "value": "ac991f009709b6c2e3baf4fec4f2b6df.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9611f02f-9cd2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646518881, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518881, "uuid": "167e91ed-066a-4028-be0a-3a5acf8ae69b", "comment": "Malware payload", "value": "b16438dd7d3c0fb22cbda6c7c84bfd5c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518881, "uuid": "9d525d84-3775-48d4-985b-eeb43dabb247", "comment": "Malware payload", "value": "96a4a64f5ba45a2388c15456199bdce221f01ff7298467f2f909ad2f471c48c3", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518881, "uuid": "77a2fedf-be17-44bc-b8e2-401f4a1cf221", "comment": "Malware payload", "value": "6cf177eab6471b3a784fef1e99e3a8c40e70bb77", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518881, "uuid": "30a41d0e-274f-4c66-abe0-cce503515f59", "comment": "Malware payload", "value": "da6c74e7522278ad935f456ad937e8ee41305ccd89cb4a0cd74bae13523db901a224dc3fb61ca4547fdc9c8b4aaf61f1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518881, "uuid": "61c2dae1-0245-41aa-b408-a834687cf6fd", "value": "T11505CF41BE9A80E9F6072935107693660FED75124BF1C8CBDF85E81B6FA1CC182798BD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518881, "uuid": "41cc87fb-b801-4e3b-8d03-48ec5b1e2374", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518881, "uuid": "3ae19cdf-28b0-4b56-8192-91e50065588b", "value": "24576:kviZsGQwB7viOAvte64g8Lsxq6ZWH1vO5yb9DYxQfFII:1ZsYB7vLsnZI1Hb9DrFI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646518881, "uuid": "79b6e5bc-d4fe-44ed-8788-f7a881301988", "value": 851864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646518881, "uuid": "1ee0a6c2-bd57-4db0-8900-641b6be4413c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518881, "uuid": "c6c06ac6-046f-4d93-89bf-063391b26a72", "value": "emotet_exe_e4_96a4a64f5ba45a2388c15456199bdce221f01ff7298467f2f909ad2f471c48c3_2022-03-05__222116.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aec449e-9c2a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646446734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646446734, "uuid": "bf10732d-fa91-4cc8-a9b1-fd5ac2a4e75b", "comment": "Malware payload (Heodo)", "value": "37df4758e8a510150dadb1992df73107", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646446734, "uuid": "9632f44d-bc8d-4d6e-9929-a78185ae822a", "comment": "Malware payload (Heodo)", "value": "96f3d7536cdffd082f61c28a8700a63b95294f48d2d9a9787bd1c0d57679c1a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646446734, "uuid": "3513e6ba-888c-444a-bc9f-4b65b13b3b95", "comment": "Malware payload (Heodo)", "value": "82cd7065296ad639a40846f12e67e221cdd691e2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646446734, "uuid": "f7078113-acd4-4498-9df8-df7baf8ee542", "comment": "Malware payload (Heodo)", "value": "b99757f576b8a8ff214ef77f98b16d05991ab833e2a221103abe5a91afdf3bf90629be9ffc2f919184b158667f386a0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646446734, "uuid": "082b3a82-f11d-4e41-b015-fd494d7da21b", "value": "T115D45A3073A2AD35C3E6627A4FED939509EBAD604B3241BB727D756D49334C20F70A29", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646446734, "uuid": "32ce2dd5-506a-498c-9c5a-91dd3a78ff3c", "value": "bb2e319682f72745317e92a26483f973", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646446734, "uuid": "7f7f3412-df5a-4b8e-b9bf-3456bce988e0", "value": "12288:J1U8sNY8/z0rYebzwduCoGEAbcVBLku8w:oq6z0rYcMduVGEZBLkuF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646446734, "uuid": "9b1ae217-4e37-4200-960c-29f22bbe2ce5", "value": 626176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646446734, "uuid": "83943f22-32e6-40d8-94f4-2e43956dab66", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646446734, "uuid": "c8c8106c-f475-4f37-a0ef-c8c3c124acee", "value": "37df4758e8a510150dadb1992df73107", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a72e599b-9c2d-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646448043, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448043, "uuid": "d580c30d-4e7c-4061-b95d-e924facf0913", "comment": "Malware payload (Smoke Loader)", "value": "93d9c0583c469cda954625e90ed22c6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448043, "uuid": "b3b62bcb-f930-46ca-8275-3cf2f8d003fa", "comment": "Malware payload (Smoke Loader)", "value": "9747e83b05e68775b541df2c4cde7b579e608ef55e88a74a75981a5f0ba7717e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448043, "uuid": "fc9388be-f9d6-4930-b618-b9b1f3c60abf", "comment": "Malware payload (Smoke Loader)", "value": "d9ec9f4d18249c2340c0c1eaf5f9526c76fd7eaa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448043, "uuid": "b019a622-635d-43ab-995d-58f787fe9d9c", "comment": "Malware payload (Smoke Loader)", "value": "4bc9f939836c787d0f538f87ca7ec4676048dcf7dbf1acfd012df11f505524ad8e93f542009ba8b4aa42ca53b9163632", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646448043, "uuid": "65211146-2215-45c7-bd2d-1acf9d0bc04a", "value": "T173649E40BAE0D03DE0B351F8797A937CA52E7EA19B2451CB53D62BEE16346E0ED71207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646448043, "uuid": "712f603d-84bf-4294-afe9-dd577b654c1a", "value": "fb47a0c49571b404f0af055a9f8d98c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646448043, "uuid": "69d6df7c-68af-42be-9dbd-d486f00b6e7c", "value": "6144:8SXEiacQHTtOSOxkG+GPbcQ5nLJritn3aETJeQSEiWj3:R+cQHJ9OxkG+Gz5LJWTTgS3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646448043, "uuid": "83a04fb3-c7c5-4cd8-82ac-264f74223736", "value": 334336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646448043, "uuid": "aaf53067-3c35-4a83-b1ee-f2839a865f43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646448043, "uuid": "20f863af-80ae-4cae-8aa6-8aab0aeea68b", "value": "93d9c0583c469cda954625e90ed22c6e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc5324b7-9cb0-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1646504450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504450, "uuid": "d38f6b0c-e0d6-42c9-9a95-d526a318d292", "comment": "Malware payload (DanaBot)", "value": "37d695bde598b2e9746c4fbcf48a51db", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504450, "uuid": "2d8233d4-60b7-44ce-b829-af9ecb2ac7a3", "comment": "Malware payload (DanaBot)", "value": "97a1dadc6e1ccaa807240649c63f175169b0badaf65be530e98ad7790d69fc1e", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504450, "uuid": "257264b8-ae4b-4ca6-8cbe-927658ffa8ee", "comment": "Malware payload (DanaBot)", "value": "1d706c3518f2a58fea103475fa9d4f3a000a1a1b", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504450, "uuid": "5df25e86-884f-4027-a147-95b10e16e725", "comment": "Malware payload (DanaBot)", "value": "b908e204147523ba45da5ecffad78fa1be98b415bc64a128357a20f212f9eaa148e00ed3aac110606dee874b979588ae", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504450, "uuid": "4d9623f2-f482-49da-8b15-76ee55056d2c", "value": "T18E451250BAA0D039E1B351F8B56593ACA62E3DA05B7450CF22D63BEE57309E0EC79317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504450, "uuid": "67a167ea-bbda-4b30-9ee2-7c0b7b3b3141", "value": "2c887c56b61583b8aed837e04b41e87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504450, "uuid": "516fc413-3860-4fbb-8faf-5a0834b074d2", "value": "24576:nsHM7Rt18CTtJlwx7RDKZFqOHRxDyix7re0b:nsu1RTfyx7x4xuix1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504450, "uuid": "9d4ff0d0-db11-4252-a6e7-67052b77430f", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504450, "uuid": "88d4cd7e-d295-45cc-a27f-2f61a6768f46", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504450, "uuid": "1de2a94f-e777-473f-98b4-869f80e7d8d3", "value": "37d695bde598b2e9746c4fbcf48a51db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c24901ab-9c1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646439928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646439928, "uuid": "e0af8e72-e6a8-4dff-ab34-e6013705a69e", "comment": "Malware payload (Heodo)", "value": "fb6c16b7be4b7f9d6c80c70afa28ac27", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646439928, "uuid": "f3432108-74a4-4ead-83da-7962df3238cf", "comment": "Malware payload (Heodo)", "value": "9811892a1a74e8d0cd3bc672b4573bd00177bc2e57c858269ee17ab99a966f23", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646439928, "uuid": "b6d4d97d-7729-4a24-8e55-a8f14d7c9194", "comment": "Malware payload (Heodo)", "value": "ce4896f0fb038a802e6250a0ef035560c9f52d12", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646439928, "uuid": "26b0e4fc-6af4-4f00-99eb-3b941e961b22", "comment": "Malware payload (Heodo)", "value": "a04bd3ccc655ad8aca7a6a75e4c60f369023d6195a2a65f2c283495c5ffd33df0262feb971279defe79fe7619517fe8a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646439928, "uuid": "e6964a4f-1ffb-4cf9-9fc5-a21adc472991", "value": "T12BD41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646439928, "uuid": "4bb8d97e-78c6-44bf-aac1-59c3197cbf8f", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646439928, "uuid": "635d5ca0-d211-43ab-b8c2-a384eac70bc5", "value": "12288:DjN/Z2wkRrA9CRDCxElAjHDsndSyHOrNvEP0Oua:dEHR+CR7yfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646439928, "uuid": "aa2df815-e1e8-48de-bbb4-cf5417bba4a7", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646439928, "uuid": "396addb1-d43b-4c6e-b758-d081c878ffcf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646439928, "uuid": "b3de4985-8845-48a4-9dc1-e4682103ef2f", "value": "emotet_exe_e4_9811892a1a74e8d0cd3bc672b4573bd00177bc2e57c858269ee17ab99a966f23_2022-03-05__002523.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d771e3d1-9cad-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1646503099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503099, "uuid": "93fe2ac0-5411-422d-a635-a5bea3a345bf", "comment": "Malware payload (CoinMiner)", "value": "08265e2c32d85f94abe9963b8de1b9e6", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503099, "uuid": "90de317a-e4b0-4ba8-9f42-c03cfd7a280d", "comment": "Malware payload (CoinMiner)", "value": "9bb401bc546e77f52cfd109daca9553d64e9192b105ea22788f9db68672ba739", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503099, "uuid": "36d7e3d0-2032-4586-8dcb-4e5e2242dd45", "comment": "Malware payload (CoinMiner)", "value": "0fab957c7b5175ea2a731eb59f81922e217f72d3", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503099, "uuid": "79514b08-6c0c-4cd4-8706-7757183da7e7", "comment": "Malware payload (CoinMiner)", "value": "d2f30f26651b4dfe6803ae03b624a72d13828c5d72250de02f74f679895ed5cc1a94457f359622939cbfec82d55a695c", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503099, "uuid": "d11b7a12-60cf-4a17-a98c-0fcf47004c77", "value": "T1D014459D766072EFC867D472DEA82C68EA5074BB931F4203902715EDEA4D897DF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503099, "uuid": "2edfe923-face-490a-be40-ffc9131cb18a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503099, "uuid": "a2c0798b-d811-48cf-b7aa-e3a890cb7202", "value": "3072:qEDnBYrzWIdceE/52EUx9Fw/Jy6v7ZPYU9CefOrafshkWkLOpuIclSnT:PzBYXWIuPM56/Jy6v7ZPYU9CefOrafsB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646503099, "uuid": "00fa9c44-3fff-4242-b128-263c80bbf5f3", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646503099, "uuid": "2d5be19c-543a-4ff6-b21c-0dc5344f87cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503099, "uuid": "ad4808f6-8ee4-45d2-9116-4b328d9b2c99", "value": "08265e2c32d85f94abe9963b8de1b9e6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08d18f6d-9c39-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646452931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452931, "uuid": "34d3f500-4825-4248-90b8-7502ec9ac19a", "comment": "Malware payload", "value": "0a5b0823d4c039c5d6547c9a2fd0ce8f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452931, "uuid": "a15b028d-222a-46bd-81bb-88280a6274fd", "comment": "Malware payload", "value": "9d7981407a1abbf1406acbbb530444436a225a22dfec7a3a2b170b7749bc7c5e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452931, "uuid": "09e78766-be23-411a-9ca1-c586d9d9bb64", "comment": "Malware payload", "value": "d7c06e4e555e0158122f405f11bdb2de032c190d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452931, "uuid": "909e94a4-5132-47dc-a3db-5790cb75c93d", "comment": "Malware payload", "value": "51b28c8678893ae51721939881f072c11a0f6506a75633137a43ec266f2a438d88957885914ccbd1af387290be5af6c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452931, "uuid": "502e5f41-c72e-4db0-ba14-4850e6e5b6cc", "value": "T13F42D9567AC18F11D5C08239EB0F228937135B6CF2EBB71727252F54A70797A0B7AC1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452931, "uuid": "af1624ff-fe21-4683-a4b0-3346d49f6b01", "value": "192:hczne5yL5iH9WIrurqq1HEz7VWlROji3GPDV24HwdgmEZx4eO:hsneC5iH9Ww/VWOjiGwdgXx4e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646452931, "uuid": "c4f71cb0-7c27-451a-8828-8764f8d31713", "value": 12608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646452931, "uuid": "617f6421-e937-4e52-aca1-a39095c5cd59", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452931, "uuid": "e63d9b73-e001-49f3-a3fe-1f00a511c498", "value": "0a5b0823d4c039c5d6547c9a2fd0ce8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7a90a0f-9cb0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646504415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504415, "uuid": "f86b0092-0870-441f-b86d-eb6fec5c4d19", "comment": "Malware payload", "value": "546a5a09ff2e43a8b8989321c12cc95f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504415, "uuid": "801be592-1b67-4613-825b-f52260eb9fa0", "comment": "Malware payload", "value": "9ff6891ef4465e0a3ee08520c57c133ea47ea72c408c165d2aab578b007fadf9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504415, "uuid": "078cc29f-4bfa-406b-b563-cf45efeb20d6", "comment": "Malware payload", "value": "e6e9dec075e25687291ad4741e374c74f0a60298", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504415, "uuid": "cc94a655-eeb0-43a1-8d6e-daaa84a8141d", "comment": "Malware payload", "value": "b22d4453257064506f21d310e3661a7b7b56eff4d1d6e44ef5b255ce2c1c0b549c6e1c266b7a91ce0a0baebd6443cfc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504415, "uuid": "71bae621-11a1-4027-92f0-ef86d39148a3", "value": "T13E451210BAA0C03CE0B315F83175D37DA51EBDA1876591CB22DA2AFE66345E0FCB9257", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504415, "uuid": "34e5464d-c9fc-4477-ab09-ea7f81927ca6", "value": "0e7fe55f005b449b96d57439d1b37307", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504415, "uuid": "55048d28-f793-44da-bf2d-b1581932ae02", "value": "24576:UIscSKINDNmfjaNVg0iVJcQa8HTxAEnopoE1ETRPvF:UIkPmfjOiV2Lae/eTpv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504415, "uuid": "09654d95-3fa2-4b5a-981e-789147be88be", "value": 1169920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504415, "uuid": "c1a803f3-8160-434e-9f0d-4a49854c2cab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504415, "uuid": "d9b868b5-cdd1-412f-93ae-7e49746e1e46", "value": "546a5a09ff2e43a8b8989321c12cc95f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77d9cd90-9c9f-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646496926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496926, "uuid": "e7731129-cf45-4a99-8b89-454f48b41e15", "comment": "Malware payload (RemcosRAT)", "value": "dac2d228738044594db0056a0a6fa2fc", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496926, "uuid": "bfd3d057-978d-4649-b6e1-4edc7ac70d3a", "comment": "Malware payload (RemcosRAT)", "value": "a02d52f23eb9e8a857c9ed01d81e6220e787a1e2838d42c2734e99bc73cff250", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496926, "uuid": "15fa550a-90fe-4898-be00-aa537616344c", "comment": "Malware payload (RemcosRAT)", "value": "ca25e837884d3355ec369ad121d39cbe762e9844", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496926, "uuid": "48cbec6d-5b0f-465d-9547-a66304b961bd", "comment": "Malware payload (RemcosRAT)", "value": "0e86588729b3a3bce1a1215c0b845722de613bfcac961bb254b6a06a5ee40cee94985f7a2f80bc70f1741b5dabf4107d", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646496926, "uuid": "0ff7999b-aa60-494f-9be1-792c658f3f1f", "value": "T1BA154A52B16988F6C4162A398C6B826454AA7E307E396D4736D43F0D7FBF2C03D2D993", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646496926, "uuid": "50e7ff2e-0395-4962-8831-06d44f5b8390", "value": "9eee0aa5a8fa1e2c5aa038d471edcf98", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646496926, "uuid": "a5f00bfa-20f7-41ce-a11d-38f6b5a083d5", "value": "12288:rQXbVWn5JSVgxB6IHeHMHOPrK56eXloSE2p8VMiqCGTNJ:8XxuagxB6IHesYrqTySE2p8V/nG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646496926, "uuid": "6724d7a2-fa52-4a4c-af42-d4f02d6544ac", "value": 936960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646496926, "uuid": "4b0582f1-cf2e-4128-8a7b-88e9b9552d20", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646496926, "uuid": "fb2ba912-7787-4b81-9ab8-78aef048ec12", "value": "DELIVERY.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "745e3fc4-9ca6-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1646499927, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646499927, "uuid": "d143c155-b8f0-4f3b-b306-8c0a15199a1f", "comment": "Malware payload (DanaBot)", "value": "2372042f8edf982e3137dfc5f7030c7c", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646499927, "uuid": "8f49835d-45a7-4eb2-8cb3-b9a710dc23f7", "comment": "Malware payload (DanaBot)", "value": "a229aee8edf8ebb3b5e3e418879641216f49d6e00f8358a0debd4c00ddf825e9", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646499927, "uuid": "385b7c6f-5469-4d59-8494-013e88b337bd", "comment": "Malware payload (DanaBot)", "value": "1091b1b2754d16c610f7d8363dee3b9eac69f7d8", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646499927, "uuid": "1e8f4260-1414-40d4-a8e5-9fdb162e232c", "comment": "Malware payload (DanaBot)", "value": "b5e65e2a18c09227ff6cd32034c92847d8d10f6f4cd04a8ed701e57cfbacead1a39e80f0c5c1d6db948706965dd88e2f", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646499927, "uuid": "069615b9-cf6c-4350-a67f-2be92d5b803a", "value": "T1BD451201A760C035F5B351F8997A836DA52F3EE0A76460CB93DA1AFA17756E1EC3034B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646499927, "uuid": "01942dbc-1381-46ad-b230-cf82edf7ed03", "value": "da969c9b2899100752633683fc4632cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646499927, "uuid": "8e71c8c7-557b-48af-a005-42f8a8e5adce", "value": "24576:7zmFiIdQu2KixxUB0OWTRdR2fcGgenyOukd4z8AI:7zw/DCdTRdR2fcRp7kd4f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646499927, "uuid": "7d103bdf-3a46-45dd-bab0-d2b586427db7", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646499927, "uuid": "50c56bfd-ca22-4df4-9bf1-0f6854ac671e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646499927, "uuid": "c103c775-6d9a-4033-9251-e1261702e990", "value": "a229aee8edf8ebb3b5e3e418879641216f49d6e00f835.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300f117b-9cc4-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646512697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512697, "uuid": "21cb29fe-43b8-4041-95fb-852889dee77f", "comment": "Malware payload", "value": "2beec704e22c5dd9b49b033b87eb4680", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512697, "uuid": "f3cbe15c-199b-4cf7-81ca-c49b7f902b79", "comment": "Malware payload", "value": "a2b7e3b08affc659ec9478f6225a48bc0e045dc48e50496f20b87d52a911c94e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512697, "uuid": "0ff766f1-6d4c-480a-8fb7-d465d7f6b3fe", "comment": "Malware payload", "value": "4d813ff2bf6365677703dc2c79afcc0b99f59ce6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512697, "uuid": "32a18bf4-3faa-4f48-b6dd-d4629cb6b69e", "comment": "Malware payload", "value": "8278e68e1391f676388afeb4e60fd87e7470376537307a4c6d2a2db7c4c6b7b36857abbd49b70be8434469eb6ceef4d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512697, "uuid": "5f95053e-77a4-447d-a1bd-289b56216fb4", "value": "T12F941303F217AD2CCBFB58725A64CE31B9595A128F476F621CD2E03C70A5B46E964F42", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512697, "uuid": "b405a57d-e133-43fb-bcb3-d2f4638f464b", "value": "90d588408e2561b8a1b7fd8f050775b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512697, "uuid": "0e22f783-fa5e-4a06-8a5d-a041edfd6716", "value": "12288:+HX+P7EpefSGhq5SAJJNoRo/eYDLYH7Bx+Oh8Q6HA:s0euSGh+poy/eYQbf+H1HA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646512697, "uuid": "24c10d5a-4940-4e25-b09a-2a40ec15a9f4", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646512697, "uuid": "b456dcbc-c698-4489-a643-74e055393d6c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512697, "uuid": "0b651f27-2776-4f22-8f5d-156ec7f5c6ec", "value": "xware.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04afae3f-9c39-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646452924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452924, "uuid": "59017975-73d5-4e72-8136-8944ad37e186", "comment": "Malware payload", "value": "36e34d5a6308fc26d2421f1bf4a93778", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452924, "uuid": "357dd904-3ccc-435c-9917-6090d1b110f1", "comment": "Malware payload", "value": "a2d629df611028c9a4c7641047f78613a5cb9ef00e7d09997b9497eb58853377", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452924, "uuid": "16294e64-9b0c-41c9-8803-e364c8ba6343", "comment": "Malware payload", "value": "5b9a440d72b2be92ce1a1ef0b0d30f3ac9ffd6b4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452924, "uuid": "4a4480cf-87ec-49d1-b57e-3ea05aaf5008", "comment": "Malware payload", "value": "3aab363527c4a18e8c99b3e181d3bd4d9fed76bcd0958662b81ff4901681700cb60a360bfcf009e08ed6388350b347ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452924, "uuid": "ac95d5d6-d1a1-43a0-b832-07b9f2ba9c21", "value": "T158C2084AFE81AF11D4E0217AFF5F124933535B1CF3F77212AA145B28278AE5A0F76815", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452924, "uuid": "f8726f6e-99a4-4909-bf3a-2ffe343284bb", "value": "384:2Rns31OyCcxlDdp5bdLM53tqlWVOjilsZgckV5gXx4esw6FT5+QIeF:2RnscSpdgqlWV8ilsgckHDBAeF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646452924, "uuid": "c4ebe898-c107-4233-9742-a13b7d1162b5", "value": 26004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646452924, "uuid": "cec36b76-8152-49f9-bf27-533a5bbcbc0f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452924, "uuid": "aa18d24b-0737-4b00-892e-a0650ceab948", "value": "36e34d5a6308fc26d2421f1bf4a93778", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2750f5e-9c99-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646494474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646494474, "uuid": "75b62597-fc37-4f2d-9950-ffc72b384c1f", "comment": "Malware payload (Mirai)", "value": "ee6da25426a18e06201b633af2d2aa74", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646494474, "uuid": "ccde9d76-1317-4a95-8989-5d58f9b0e8b2", "comment": "Malware payload (Mirai)", "value": "a32feb226230769563aea2219980ae5ed7a944efe97b6527051275d97da77309", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646494474, "uuid": "a11ddef8-509b-4c49-b1c1-afd6afd0c4cd", "comment": "Malware payload (Mirai)", "value": "5562ce86bb396d8243e6a791b3822a0d76bccc38", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646494474, "uuid": "bc718024-0db6-4b38-b1b6-ebe54e0250ff", "comment": "Malware payload (Mirai)", "value": "f8ca438b7fa67559c49a9051e98b508d485d01782bc825cda5525b9039a5ad21783d48c7a70c529796cc79327b353db6", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646494474, "uuid": "0c6d0e32-eb9f-4e4e-a553-c3ed811a8fc1", "value": "T1B6D2F2A117532649D762CBF93D7A301EC43C506732AA0E402DD3A29ADA0FF1448B6EFD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646494474, "uuid": "4f6b829e-5a07-4404-a3d0-1f55506bb943", "value": "384:yb2eX3zAKuiNPZRwwqdvrrduMXbCAk6Y5VvCYxy0kJXPav63BNjbCAEnaAUK:/kAKuobq1rduMGAXSEYEYv6DjbChaAUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646494474, "uuid": "e1e1c148-1a7a-4ef8-bd66-710c8787fff3", "value": 30660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646494474, "uuid": "fce65a07-a0d3-446a-ae4a-69705884e29d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646494474, "uuid": "edda9dd0-5ac0-4e2c-9cbb-8a6a66456ecc", "value": "SecuriteInfo.com.Linux.Mirai.6522.20487.9730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "558ef712-9cb1-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1646504600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504600, "uuid": "55b35c70-1c9d-4597-9019-5748f2ec42f3", "comment": "Malware payload (ArkeiStealer)", "value": "eea90d204e6c8b313769826dc942e3c8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504600, "uuid": "1a6ef7a9-b1ad-46b8-a894-ae667b040a43", "comment": "Malware payload (ArkeiStealer)", "value": "a35b19ca3578e65646b822f0367806c708ad890ba7414f863ddfbd00defc7c5f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504600, "uuid": "39423378-12de-446c-ae57-a6b69f4fb56a", "comment": "Malware payload (ArkeiStealer)", "value": "196d4b4d46cbfd50a027b199e2f521466359eaf7", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504600, "uuid": "7c3ac84f-514e-40eb-b9bb-c1e721aedcd2", "comment": "Malware payload (ArkeiStealer)", "value": "6a91e846ab420598b964de01ce9c28494944aa441fc921371f7b6b579b58c8f9b489e17bbc883399107bd732d1eb20d3", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504600, "uuid": "b722223d-7af8-4595-980d-e0680acace6f", "value": "T18E548E00E690D035E4B712F84ABA937CB53E7AA19B6464CF53D56AEE17346E0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504600, "uuid": "7c2f0420-bdef-4fc8-9625-fb615bba9323", "value": "da969c9b2899100752633683fc4632cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504600, "uuid": "735503f2-9bdd-4975-8582-4865bc655983", "value": "6144:plwJ6oW4CWHwNVj47KJ85/ndnJY3rjhUz3I27sNF:DjoWtUwNVj47d/dnJcBW31s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504600, "uuid": "ec80ada8-462f-4b87-a1ed-007f0746fe63", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504600, "uuid": "08bbecee-598a-4fad-b0c0-1eaef775c3dc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504600, "uuid": "972d6677-38b9-4199-9a46-3c08f2353b0b", "value": "eea90d204e6c8b313769826dc942e3c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150622fb-9cb8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646507498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507498, "uuid": "e0f5913b-9d4e-4a20-bf83-8b18715d85ae", "comment": "Malware payload (Mirai)", "value": "eae562720847ef6280ea7e8e7a25d154", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507498, "uuid": "fdc02814-2eea-4614-bdab-5dbce52e19b8", "comment": "Malware payload (Mirai)", "value": "a3e3bc2cb7847df4579b10abc072e2e96007ec612cf743c43970a048872dac6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507498, "uuid": "46c1758c-780f-4712-9599-e757a7e52bab", "comment": "Malware payload (Mirai)", "value": "457ea0a9b06c38716e8be92f4b7894d33a46fcda", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507498, "uuid": "dec312fe-fb3e-4a87-b544-be8101819a73", "comment": "Malware payload (Mirai)", "value": "d79aac2ee5791ba8667d527876d650f7dece8a75796704770366c87334fb9ace545623661fa238c0e231d67788a1bfc7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507498, "uuid": "edb116e7-0b5f-43c3-a89d-7db8b44f35a5", "value": "T11E634C02B2280A47E4931AB0253F1FE057BFEAD025F4B685695FDB568635E372086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507498, "uuid": "f999aca0-d713-4a7e-8cda-189fc4b46f6a", "value": "768:JcM3+VHuQYRPbMlxkSC1yHyx4cDzPH//1ZQV28uGFzpTYqHH5eKnsbmqRr4sGpM1:Gw+fYYC1yHyau3/Od9mREsvkI6wDMw0c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646507498, "uuid": "82e38c4f-f4e1-448d-b48d-42efa311fd4b", "value": 70744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646507498, "uuid": "226b2d23-7b10-43cb-ae68-b711ef1831fb", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507498, "uuid": "cc88d6d2-6090-4e76-a432-12f00d10fd05", "value": "eae562720847ef6280ea7e8e7a25d154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d44b35-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "b6fe647d-8980-4425-9cc5-ed888c6a2585", "comment": "Malware payload (Heodo)", "value": "bce011944a8fdcd0e1e05d65402600f3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "9f59a3f3-8f1c-495b-ad75-f48ab07f4ecc", "comment": "Malware payload (Heodo)", "value": "a48f51245976e9718e54187bcfd9b58706744061b83bb42a02b7068ac9f11523", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "bbc2e032-e777-4e20-beed-743ec24074b2", "comment": "Malware payload (Heodo)", "value": "52d4f04739b069bc622d061aea81be15d8bc4f59", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "db4b691a-0995-45fb-8402-80f963177a06", "comment": "Malware payload (Heodo)", "value": "6c451b3363fd4c1cc9b2ca7e458b2abd734e5bd059186e9f78a3286d544f33007e5e39dfc4bb4885e3691d8783a6b78d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "c0f03e47-4942-4f46-8694-85726502796c", "value": "T1C994DF007AC6C433E1AA063949A7879467FDBD52ABF1C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "ef20d907-fedf-4dea-814e-b30ea25703f8", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "a4de5905-2ca9-4018-81ee-fdaf7abb461a", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8JCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCra+uiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438565, "uuid": "5b3531f5-ac32-4b54-ab8d-d3e667506e65", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438565, "uuid": "c279e4f6-2a9e-46d5-83d4-88c10899c4ab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "998b31e3-cf1b-490a-8238-58bd5c0a6e29", "value": "emotet_exe_e5_a48f51245976e9718e54187bcfd9b58706744061b83bb42a02b7068ac9f11523_2022-03-05__000238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f0e773-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "65975867-d7de-4e9e-add3-22bfaff610e5", "comment": "Malware payload (Heodo)", "value": "605f9204dc15e22fd24c7b597a431ece", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "6c1b1610-6626-45d3-ad3d-452fb372cca6", "comment": "Malware payload (Heodo)", "value": "a4bc011c66e07ad3fc30dd625fb3e0a966431e873761ed82c8e8545c203d5da1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "2ba58e02-b1ce-4fa9-b0ec-487545edf019", "comment": "Malware payload (Heodo)", "value": "658b2f02d1240798c3dbc45d233a110fce63f08d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "2393e4a0-71c1-4650-a682-576cdc246338", "comment": "Malware payload (Heodo)", "value": "053aced304a9aa1de9888342d5d11280c66e462b268877e53898e798fe828d99beec5e531dca3d28d507d5f2a9a4a329", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "01d2e4f7-5855-4340-b6c7-019f7571408e", "value": "T1DB94DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "6da973c2-54f4-4c02-bca7-998246d50527", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "46586dc4-de30-4428-b234-86fbc37d9410", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8ICtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCrapuiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438565, "uuid": "ac1c2f5b-c600-478e-91db-63105ed50b8f", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438565, "uuid": "5f7a2d6f-4962-4e87-b871-24bc2b4eb05b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "12379f31-e94c-4e8f-ad4f-e9df7a485757", "value": "emotet_exe_e5_a4bc011c66e07ad3fc30dd625fb3e0a966431e873761ed82c8e8545c203d5da1_2022-03-05__000237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10acae34-9cb8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646507490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507490, "uuid": "693a128d-9361-4f4f-b68d-64b50e87938a", "comment": "Malware payload (Mirai)", "value": "cace48e7dd57b8af7770e410f7143034", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507490, "uuid": "0c56b492-ae01-4d76-8edc-40fcea59d57a", "comment": "Malware payload (Mirai)", "value": "a50f7f42277ad15befb4c53ca5cb54a269dbe66c3d0e7f043898421397b3edd4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507490, "uuid": "c1a576fc-4a66-43c7-813e-5e942bd3d902", "comment": "Malware payload (Mirai)", "value": "a9aa077a20106859276c3440c3fcfb41b229fbf2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507490, "uuid": "90ca4269-a9fe-408f-9e07-5a50df1d1992", "comment": "Malware payload (Mirai)", "value": "bf5e14fdbbfa35dcb8002e6fd3a5abad05219523f566e501b5c10be28f00ab811ecf9a07b4f94f7cc840402ffb569d06", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507490, "uuid": "eaec30be-d2e0-4289-9d5f-49f646824b59", "value": "T11A632995F4029F3CF88BD6BA94170E05B921638547C30F2BA6A6FDA37DB3054BE25D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507490, "uuid": "a87ea5ba-7800-4b9b-84ee-5620f5800bd9", "value": "1536:yKYDydkSp116PU4I58Ok/Tgp+nTuRbygNY:yKYD/S/1QUNM/xTwyV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646507490, "uuid": "8d8bfe77-840a-457f-9522-2fabca18e142", "value": 72332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646507490, "uuid": "932b82f7-3775-4fd0-939e-6ebc00303d51", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507490, "uuid": "ecb0821c-f3b7-4705-b0cd-c7ff8ca83938", "value": "cace48e7dd57b8af7770e410f7143034", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd3d1a83-9cb7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646507458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507458, "uuid": "51ae442b-e887-44e5-a91e-20f9841706a3", "comment": "Malware payload (Mirai)", "value": "bacfc9799311e62224f9e41e70b1505d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507458, "uuid": "7dabcd5b-c504-4fef-9141-030f4a203c8c", "comment": "Malware payload (Mirai)", "value": "a5d773248683e2c8e33b02363f5e194c5fe3512c661b95b8b1018284ae77cd70", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507458, "uuid": "6a4a52c3-d13e-4ff6-94ce-6933acac06e9", "comment": "Malware payload (Mirai)", "value": "347409f85fe335c4da4f08bef91a5fbe1dec9527", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507458, "uuid": "1a81d406-0d9d-4dc3-be1f-a8ff123eb9bc", "comment": "Malware payload (Mirai)", "value": "f3e6fc777ad925523b53cce1e0d92ea7d39ed23c6c19daba57063af42cdda7e64c56ab0d8d41e89be06e1d59b26fb75d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507458, "uuid": "465f3ef3-be70-47ba-909a-1b4cf86391ad", "value": "T117639D36E41A99A4C0424634B0E5DE351FA3A9C043272DB6AFE446B61803EBCF55DFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507458, "uuid": "b50ad633-26dd-4d84-8b2a-a1e2d55ec362", "value": "1536:YaGrdgbyFJxwtHYJ1rMTfqoI/NL/7vCpuh9C/g:Y3ebynxwCHvguh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646507458, "uuid": "aa5416a1-7f21-4207-a816-8efe185b85f3", "value": 66964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646507458, "uuid": "c71e0cb7-ff29-485e-8383-3194432d4015", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507458, "uuid": "0f0e3cd0-6f0e-41ac-8ed9-d2b8ea91d031", "value": "bacfc9799311e62224f9e41e70b1505d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da687cda-9cdd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646523720, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646523720, "uuid": "f1ea06d0-9986-44c0-ad43-b9c8f1103b50", "comment": "Malware payload (Mirai)", "value": "9604c111985f6ad6725b989c862125cc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646523720, "uuid": "75d3fd73-f6cf-4231-934a-48e9405d3311", "comment": "Malware payload (Mirai)", "value": "a77ddb90e6fd30369ab0caa7fd6f41756ffe29295b0469a840b347430abd0fde", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646523720, "uuid": "b78aa700-33fd-4d76-8358-7b77ea51b0ce", "comment": "Malware payload (Mirai)", "value": "4907eca4e2ecefbbccff11025e99ae22e723d38d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646523720, "uuid": "a613627c-f4e8-43ce-a7db-e695e45ce851", "comment": "Malware payload (Mirai)", "value": "a15e104105060cc2a1879fbfea527922e38c5721ae465af1baaaeceda837ad3108a8c1f579ad709251a201e9b94f4c1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646523720, "uuid": "acf9db87-d2a4-4b3d-b893-896aed3c3434", "value": "T1DA3339CABC01AD7DF94FE7BE44070A0AF621B34451930B276377BDA76C321A45E16E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646523720, "uuid": "24938273-0a24-4119-8265-d5cc36ad19a8", "value": "768:rUeya45uuq0hPmZMUkxdgrlmFb48QkGz1VuAXIeR75tcS0duXac80Ut:A2ErEZAx9b4zkGz10aI45tcSeuXb8xt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646523720, "uuid": "b10a362a-3979-482d-9510-6ed09600238c", "value": 54128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646523720, "uuid": "95f291c6-fcbe-4621-b616-e1aaa143bd73", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646523720, "uuid": "7511ca09-1917-471d-af68-cfc2aad51cf8", "value": "9604c111985f6ad6725b989c862125cc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "957b0432-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438564, "uuid": "49205524-5890-4090-8fe0-e39a16ef365b", "comment": "Malware payload (Heodo)", "value": "c81437e245655d5ff54354df490d9b1f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438564, "uuid": "99df98e3-61b7-4301-82ac-124d68b34860", "comment": "Malware payload (Heodo)", "value": "a9159f4b964b894c416db4575b8019d956cc8dd5d938dd90867f64a968ed59ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438564, "uuid": "fc3dc3c4-b925-400d-83b0-54c19356668b", "comment": "Malware payload (Heodo)", "value": "9c5941c0d9e82b99d4de0bb8dfc9efe15ecd42da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438564, "uuid": "31fd375e-ff69-47f6-9bd1-3856d7f99263", "comment": "Malware payload (Heodo)", "value": "22d346a080e89257f0d6c8889675f340adac257028557303b12a3fbeb2c45d45bb938a4c8353911a931a9882218d2449", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438564, "uuid": "92ce45a3-3d58-4681-8cab-59387245d681", "value": "T13094DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438564, "uuid": "294634c2-a6e0-472f-a515-83bd156d908d", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438564, "uuid": "89b34ab0-1772-4ec3-9742-ba4f5a589991", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8gCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCrapuiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438564, "uuid": "75f61349-2b89-4d7b-a261-7cf6277f6512", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438564, "uuid": "93c99198-add8-41ef-9130-1160c2330826", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438564, "uuid": "e0ab153c-acb0-4922-8c2c-736531d2581f", "value": "emotet_exe_e5_a9159f4b964b894c416db4575b8019d956cc8dd5d938dd90867f64a968ed59ff_2022-03-05__000237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "153d4da9-9cd6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646520383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520383, "uuid": "70f38c91-b467-4a4a-8a47-215823d433ba", "comment": "Malware payload", "value": "1b190ab4c717aec1c2c2c9a3e118bc30", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520383, "uuid": "cbca75fe-c60c-4d1b-bda0-18d39fcdd0fb", "comment": "Malware payload", "value": "a9438ea837b5171f0b71e67a20cb7e01cc1f5d8c2ec31ccf09ec1b8503e8d9dd", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520383, "uuid": "b07c6a89-4dc7-4e20-93b1-52ea939b7fef", "comment": "Malware payload", "value": "8ef7ebeb8eda8beacb615886cd1bd53b7a9fd046", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520383, "uuid": "f327587a-fbe7-4ef1-a2c9-d57c62d788d6", "comment": "Malware payload", "value": "57706209ee446639301eef3a2255769ec5874eb0028736aa750c79fe56839e0d91aa144264f65cba01ed3a1d5567c565", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520383, "uuid": "ae0d2138-275c-4d36-b66a-a2226ab11b00", "value": "T1DE51961AFC47D15C9BB9236BEC97C562FF1B801B9DA2104C71ECC2491F20809A66CF8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520383, "uuid": "e550eea5-29f8-493a-891a-44b5a1227af6", "value": "48:AxGX4jiLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozf:D4GhrffvIypvK0elkEYZ85zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646520383, "uuid": "438ee0de-ec56-425c-b7e3-2a488eeff1d4", "value": 3143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646520383, "uuid": "5d3681ec-fff5-46a6-b25b-c64682b2186b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520383, "uuid": "f6a5f331-57d7-4efd-b2d5-01d657f30c50", "value": "YFPUFJfD.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d7d02b8-9cce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646517015, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646517015, "uuid": "be6afa53-a97e-45b9-9c2f-a08eb372651a", "comment": "Malware payload", "value": "213ca4db4c2abd3b631da00c299d75ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646517015, "uuid": "1dbd80e7-cebb-4113-9210-d76fe459d57b", "comment": "Malware payload", "value": "aaa2afe68852cb76bccf7dbb0b541a5d62b7f0b15e47f0a24e63f68f50af167c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646517015, "uuid": "8a63ca3f-9e9c-4ad6-8bab-c005aeaf003c", "comment": "Malware payload", "value": "7f3a60613a3bdb5f1f8616e6ca469d3b78b1b45b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646517015, "uuid": "12dd1c5d-849d-43e4-abed-ece1e77083c6", "comment": "Malware payload", "value": "da2c39370fc19180670db5c24647db332ffcf87e2441c71465945161c5adfa775b8f7ffb154f314aa22bcece7ebcfb45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646517015, "uuid": "5e44fd1e-f908-4314-9316-44d3ca88eed2", "value": "T1B2D42208E7BF21E9C9F253FC8F765209E97878181865B59F0B6892193C319CAE977334", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646517015, "uuid": "2e18b374-54ac-4135-8c45-e337af6052ae", "value": "f9410b77f2ed92c5538775ecf2c381c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646517015, "uuid": "c586c86e-15a6-4d1c-865b-eb8433f81dce", "value": "12288:8ZKWQJbuMwG4stlF1LrbXNlyHmnc3IQjZlVm+RJGOuiDgnAm4Xg5OlmpEq:8ZKWUBt5fyL4QXRJPD1m/5OMpn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646517015, "uuid": "3b571d03-e355-4534-ade4-c8bd60818d4f", "value": 646144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646517015, "uuid": "a3f4b822-dce4-4a3b-9aa3-2ddb297557ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646517015, "uuid": "a331b340-b5eb-4682-9c7a-c37a08693492", "value": "aaa2afe68852cb76bccf7dbb0b541a5d62b7f0b15e47f0a24e63f68f50af167c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a06196-9c2a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646446745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646446745, "uuid": "9059ef38-70ab-4a1b-8cb0-03127796d704", "comment": "Malware payload (Heodo)", "value": "164f2f2b521669c3468112d368427e38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646446745, "uuid": "eb697453-6db8-4efc-8ce6-68b59cbef4ff", "comment": "Malware payload (Heodo)", "value": "ab206098688367a045b6a4fdfe98f5d0bd137b7ffadc26567ea45d821aed3925", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646446745, "uuid": "724c87bc-bc60-47e6-9823-b510d5b1067b", "comment": "Malware payload (Heodo)", "value": "1fbe2a0ea630a5e40458f50e5313139419349bcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646446745, "uuid": "30607179-c4f6-4764-8b87-899cdfbee5df", "comment": "Malware payload (Heodo)", "value": "25026a9dcb8fc5b7268f85af4099ced72c936b992863af4e46486c9e5f83cd7009b511f9f5c807c3e2bc3869abce6194", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646446745, "uuid": "9defa267-3da6-4ee4-aaa0-2d4af04fa942", "value": "T10DD41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646446745, "uuid": "0996e79b-8019-40b0-bdfd-dbef7ee35765", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646446745, "uuid": "ace0e692-0b40-464a-a309-72807640c2e6", "value": "12288:DjN/Z2wkRrA9CRDC3ElAjHDsndSyHOrNvEP0Oua:dEHR+CR1yfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646446745, "uuid": "5dd6d447-a329-418d-95b4-21921f1a318b", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646446745, "uuid": "7eee656a-634b-4303-9dd8-b14e97a6850d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646446745, "uuid": "8ccc4dfe-4b02-41ef-baca-bcef6640ebcd", "value": "164f2f2b521669c3468112d368427e38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f29a03aa-9cb7-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646507440, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507440, "uuid": "c698f99b-7707-4130-b59c-da5d261faf16", "comment": "Malware payload (RedLineStealer)", "value": "97091c5988d5581df6ef51ab3ec59066", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507440, "uuid": "36beebbb-ac94-4e85-ad72-961dbdcfbab1", "comment": "Malware payload (RedLineStealer)", "value": "ab8c7a4d60db36aa57fd21a8fbbf5d8229cce4d3ffd8e3ab7c9c0832e446e725", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507440, "uuid": "38718d4e-bccc-4f82-b72f-bc11e2dc80ea", "comment": "Malware payload (RedLineStealer)", "value": "2446b6920faf88bf9198b444fdb3b52ded7cf475", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507440, "uuid": "652ccb9c-9b57-4fcf-aa39-300d9693689a", "comment": "Malware payload (RedLineStealer)", "value": "6308ccb2937f5498658b906f5fdc30eb98cf26165cae28d9972945fcb101fb678d6a6331e09935ccc3d713b8aacebf64", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507440, "uuid": "6b0a3c37-7ae5-4359-b24a-ad0b58c54a79", "value": "T138049F1031E5C032D1A715364474C7F94EBBB8A61A762A8FBFC42BBE5F256E1973430A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507440, "uuid": "9004952b-a292-493a-ad3d-620241a288d5", "value": "fdc337a25282d3662375292d95cfcd8b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507440, "uuid": "d1cae583-0f08-48df-8629-c524982b485e", "value": "3072:puK8LWz5xCJisN5g4JboP6NHneaQbTc0GC+LTnRgos0J3:QK8L4y+4JsP6de9bAdT254", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646507440, "uuid": "6f084a60-4d14-43ad-a84e-e8774e4311b1", "value": 189952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646507440, "uuid": "c78b75d3-41e2-4470-b918-cf1392cbce81", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507440, "uuid": "38786a65-9c90-4d74-9ae1-81fec78e5ce5", "value": "97091c5988d5581df6ef51ab3ec59066.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12827a92-9c47-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646458960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646458960, "uuid": "79016b7b-d260-4ea0-9f0d-f78333a1b202", "comment": "Malware payload (Heodo)", "value": "49651a728ae207bc39e4b4aa8e4f622e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646458960, "uuid": "6dbb5ca6-f1b3-46cd-88e9-2b65dc0ac4c6", "comment": "Malware payload (Heodo)", "value": "acbbf83a63e34e2586f0b91a0efad87dd0868630dcf27447af1ce76dcf345a47", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646458960, "uuid": "34db37b0-10dd-4641-839a-fb810c1f853b", "comment": "Malware payload (Heodo)", "value": "918b0a82c4c8c3c8facdad42b54f6ce608bdaad4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646458960, "uuid": "edd0b735-edfb-4a2f-aab3-676b1650d0eb", "comment": "Malware payload (Heodo)", "value": "7bc7da79356b6de4f891a25ac430c7c282c0372b313ec1eb63984b637766f73d7440f1fcc0c23e7d12ead54f58b7e40a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646458960, "uuid": "203afabe-a57d-4559-a2de-8f540ae354bd", "value": "T1D2D43B52AFA2E03BE05F1370490DD668629F96747B9052EF67D81F2E5BF03D29A34309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646458960, "uuid": "63e6aa6f-e06a-4272-b977-c118cc33d3a4", "value": "810544f6d1cfc4b1abda96d46e502763", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646458960, "uuid": "813db7c2-8d7a-4a6c-aa14-7f0e8a4aad70", "value": "12288:zuZ0VaBZTXdQfRTBZP0SBK6DjNN6+Yyd9gHgfzUXv31K5poRoT:wdKsxejNNZbugfoA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646458960, "uuid": "181c601d-9b6d-4fc9-b03b-66c7746cb922", "value": 608746, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646458960, "uuid": "ddf915bb-4a68-4078-8217-e075d66a4f00", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646458960, "uuid": "9afb7cd8-83c9-4fff-ac71-b88229b2244c", "value": "emotet_exe_e5_acbbf83a63e34e2586f0b91a0efad87dd0868630dcf27447af1ce76dcf345a47_2022-03-05__054235.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e515e9d-9c46-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646458685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646458685, "uuid": "f4b3326e-3385-4f06-86b5-84b0c0446e40", "comment": "Malware payload (Heodo)", "value": "24a5470aae1f86bb9015d17509c38f05", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646458685, "uuid": "3cbc56d3-bc40-4e4c-82ff-7b1749a5a8a1", "comment": "Malware payload (Heodo)", "value": "ad659f5fd611fb50bceda7d9377c5f2ecf211ddbdd97cc8bbf67927aac374332", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646458685, "uuid": "cc4ba881-252b-4dc4-953b-a8dc4882b01d", "comment": "Malware payload (Heodo)", "value": "8a80d70c91bb8098c60a69550b6a2ab601cf5927", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646458685, "uuid": "8eeece27-50c7-49df-9e2c-4051461eea07", "comment": "Malware payload (Heodo)", "value": "39efa1221733fee33c1e8c0223c9870d676fc10672db07ab38f8e9575c1cf19c57d56f1ec9aa1f8cdc66e9d1e3898a32", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646458685, "uuid": "5eb4ad88-1ebe-429e-8da2-243a95ccac76", "value": "T1B944C495CF66710BE45F03708A1CCA48610F8769B7C092FF17D86E6A67F13E2A97470A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646458685, "uuid": "020f1603-c4cb-4597-b8e6-6dc647435211", "value": "6144:tBwhvhk/VaBZTXdKmt6fxLTEBM3bGyPNcLP0c/xSBE:zuZ0VaBZTXdQfRTBZP0SBE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646458685, "uuid": "59c9063b-59c3-472b-83b3-a6d45dcb7a0c", "value": 263245, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646458685, "uuid": "fc3e52b3-df62-41af-8b4d-743c3d72b47f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646458685, "uuid": "dd747b91-a945-4808-bf70-ec796f4d92ca", "value": "emotet_exe_e5_ad659f5fd611fb50bceda7d9377c5f2ecf211ddbdd97cc8bbf67927aac374332_2022-03-05__053800.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "88e25691-9cdf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646524442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524442, "uuid": "4b613a71-6af1-4ba1-9c21-e75bbbe91115", "comment": "Malware payload (Mirai)", "value": "056118e1ded7152ee06a2868a1af8218", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524442, "uuid": "056548ff-5137-41bb-a78a-156785b59c2f", "comment": "Malware payload (Mirai)", "value": "adbd792de2c8d256140723d50e9d1e4c762ca85152ca7b1f50a1b28c82de7110", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524442, "uuid": "1fd28fca-0366-4248-ba18-42bc91c836d3", "comment": "Malware payload (Mirai)", "value": "8b7ce3cd810b42b7528a9ac36154496ba1b85dc3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524442, "uuid": "1d461da3-f413-4691-8e0f-903f05571633", "comment": "Malware payload (Mirai)", "value": "0f2394f8c02200a6cffa22a143ee8d321005ac5d99ce414e3c27e9801b0d67c5cc335c7390e2ebe9c4c51c9c7348def6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646524442, "uuid": "dbe57804-77a8-49eb-aee4-7a9dd05f3496", "value": "T185131895BCC18A2AC6D0227BFE6F519D336063ECD2DF7217DD241B10B6CA61E0E67A41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646524442, "uuid": "eedf74b0-f89a-4d1d-bade-5a889ebe3df9", "value": "768:2Ak/lp35TY9SEM7t0pSIhYlhVRekX23rtw8L1psavm7vOCJrX/P5RCSQPNd:29z31I+IhchV7X2368LHsavuJb3rCH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646524442, "uuid": "a7f43274-6b53-47b3-a394-8d7dd7eaf73b", "value": 43196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646524442, "uuid": "c2b534a8-bc61-4761-be6c-9e50eebe4ea2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646524442, "uuid": "1581e142-a954-449b-9f13-060e9a679bc3", "value": "056118e1ded7152ee06a2868a1af8218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bfcf1fff-9c1c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646440783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646440783, "uuid": "94e1bf36-6f80-4b7d-87f4-5725e1504929", "comment": "Malware payload (Heodo)", "value": "f5f52de69372a0d06c812b94481c7442", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646440783, "uuid": "9540ad4b-a618-4cec-9cf7-d392918a7ccf", "comment": "Malware payload (Heodo)", "value": "add5ee478e3f9fdd5d3167c08056b0e4a65c4559599d4bdaa44ea061dd9eb61f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646440783, "uuid": "8bea5221-48f1-4fc0-837a-11c46d403da6", "comment": "Malware payload (Heodo)", "value": "1125b23d16874cb54b03b17f4a338e504d32545f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646440783, "uuid": "58bc5586-bbac-46ee-932a-3d0fe19899b4", "comment": "Malware payload (Heodo)", "value": "8ec4d29ef28deb44bd006e748d271f4b7141aca2bf1d1705173b0234e28f60c78a50c7f85679eb12dc4c9397f2ac7a45", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646440783, "uuid": "4b64ee37-babd-4bba-adb0-e13ba4533433", "value": "T1EE8429A2DF62A12BE45F13708A0DC654614F8775779092EF17C82E795BF13E2E93830A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646440783, "uuid": "b638f2d1-a47e-4a63-b523-f193472c8e56", "value": "6144:tBwhvhk/VaBZTXdKmt6fxLTEBM3bGyPNcLP0c/xSBFEpT7OKIzDjNN6FsYyd9Uz:zuZ0VaBZTXdQfRTBZP0SBK6DjNN6+Yyo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646440783, "uuid": "120f1e18-c815-4ac9-8eca-bd009e797af9", "value": 384960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646440783, "uuid": "5ee5b71f-e909-4e69-9451-4bbbed9f305b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646440783, "uuid": "5380bfc9-c74f-4485-8418-dde229e6e3b3", "value": "emotet_exe_e5_add5ee478e3f9fdd5d3167c08056b0e4a65c4559599d4bdaa44ea061dd9eb61f_2022-03-05__003938.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4a5de8f-9c38-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646452897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452897, "uuid": "d36b86bf-2c39-4931-9917-2eaecc2f5407", "comment": "Malware payload", "value": "321d67bb01aeed63e467649a5752a12c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452897, "uuid": "5d02adbc-9e8f-4603-9731-5cb27ef00073", "comment": "Malware payload", "value": "aeb7fda892e9a44207866a57b938276ec12af8802b998a40c52599aefb55908d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452897, "uuid": "1b5b665e-897d-4dca-aef5-f1f5dd5f99bc", "comment": "Malware payload", "value": "ac6df1f92982ccb9a6e9aa453bb24cf343f26c21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452897, "uuid": "089c5a55-09a8-48ef-bb7e-d23e105b851e", "comment": "Malware payload", "value": "7bdf3d16aaa4a6adba167543bceb98ffb381c50c9c211802b8308f2f19a50580e8995e346784d4d6c07e1cc399be1e30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452897, "uuid": "54a39b46-5d52-42a9-92fc-eaf0fc5f490d", "value": "T1C0725119EF948E37ECBFDD7745A90B4630CDD00B22B96B1A2274C82CB65F54649E3C98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452897, "uuid": "671043ca-8c53-4a13-9fb6-3c0791ad7f9a", "value": "384:HB/Ze4YbY0sZYuiDyoXisMSeEcXefo1w3C/:Hp846mZYprXiHSeEcXefIwa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646452897, "uuid": "3a2ef96e-fcee-4a3a-a995-d5745adb50e6", "value": 16064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646452897, "uuid": "e0d74bc8-7aa7-476a-bdf2-1a2474fe86e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452897, "uuid": "1b977a60-82d4-4e94-a0ea-2910f1e53bed", "value": "321d67bb01aeed63e467649a5752a12c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d54cd92-9cb6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646506787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506787, "uuid": "b70c20b4-7c58-4e16-947b-bf10e8d51f51", "comment": "Malware payload (AgentTesla)", "value": "bae79df945de69c043f4254c57b84c6b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506787, "uuid": "620bec4d-2362-40bf-b855-891758d9baf8", "comment": "Malware payload (AgentTesla)", "value": "b0b76dd42f55fa8548c02c1c3703ee27e45afe4073ae88918e4e6f8c562c3d21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506787, "uuid": "7d0dd469-8f17-4176-9e87-393bbf2d64e4", "comment": "Malware payload (AgentTesla)", "value": "febb0e822c5b20e3e45fb383e27ddb88cbd16199", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506787, "uuid": "c0b41396-bb04-4040-b6b6-0669edb4e11c", "comment": "Malware payload (AgentTesla)", "value": "1e20a010cc61311c70617c51734a7473bea083a554721021f1f38d646443c9d1efb26be387d94730321b25b8b57fe4a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506787, "uuid": "43c6bcb6-14c9-4f4f-ba2d-5602e8275017", "value": "T190D4F2227BC9155CC62D037184BCD9D1B3F8954AAA03D77F7EC603681F63B7AA70258A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506787, "uuid": "094bb60e-eb15-4f7e-945d-c0a729fe0373", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506787, "uuid": "62d6926f-60cd-4d95-8e24-671cf5c11eb8", "value": "12288:TU5znbveSXs7k9K0k+Ut/4pMwejU7N6Cp:I1bveSXsiGGMwNLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646506787, "uuid": "e135de0f-8dfc-4e49-80e0-de23e91da26d", "value": 613376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646506787, "uuid": "46865a46-f0c0-4d9a-ab6e-b3f50ba898f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506787, "uuid": "f7dfa26d-b756-41db-8710-e70b3820f8ca", "value": "bae79df945de69c043f4254c57b84c6b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45551b0e-9cb1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1646504572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504572, "uuid": "1b3695cd-fd2f-4bb3-88ff-116b7cec925f", "comment": "Malware payload (Formbook)", "value": "43e8fd8ee37c0c1fe8487e2f4568351d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504572, "uuid": "69506df3-8cf9-4ef0-827f-fb151b9576ab", "comment": "Malware payload (Formbook)", "value": "b134ea31888ab5ab523e7aa34ce702c461b24cfc22abb2ae8946d0b4e1621ed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504572, "uuid": "8c25b38b-0328-44b7-8926-36251a941a75", "comment": "Malware payload (Formbook)", "value": "532c4722ace8c9879604a9384680084d03093023", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504572, "uuid": "7e4374d3-4e5d-4d62-9420-a89c87dbcd73", "comment": "Malware payload (Formbook)", "value": "197db2321161edffd658e99dcca70f73cc0fd2fbadb79455ce60922e94b3ef3fee6eed3a25153d6b887ec753413894a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504572, "uuid": "53214e9d-acd7-4e58-8760-17b3e55d1189", "value": "T1FBC4D0252AC85A54D47D4B3195F8809013F1350BEB12E7AF7EE012AC9F23B9A9723797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504572, "uuid": "6322d9fe-c1b7-4df3-826f-2fb12a58d62a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504572, "uuid": "01fd5605-6c91-47ea-acec-fc8707c5bd59", "value": "12288:o0VNTOqghqwcrvtkr4OqtPs92JOyvCdLq6CDE6cLLy+v7:9VNTOHhq71krgNNOyaBq6CD16ys7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504572, "uuid": "cf787b09-483f-40fc-b7cc-43da68ef1acb", "value": 556544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504572, "uuid": "ee75d27c-4c94-4d99-b13a-91ca4cf63d43", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504572, "uuid": "180654bc-21ab-46c0-a88c-185185e9f6be", "value": "43e8fd8ee37c0c1fe8487e2f4568351d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc41d848-9cc5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646513389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513389, "uuid": "aab4e199-ae4e-4847-b7f1-8779e899e7e5", "comment": "Malware payload", "value": "aeca45af1acc153af8059b0b45cc796e", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513389, "uuid": "f3121bf3-d2b8-42e4-ab54-7f1ee6c06a9a", "comment": "Malware payload", "value": "b1be5ea484bcd2312fafb7fef39c3ad0a04baecbe0fc3be6a7233377b19fae8d", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513389, "uuid": "62ae8314-d974-45b4-a82f-f2f8250f7b5d", "comment": "Malware payload", "value": "149c09386056e4751e753d4c4e06c9000e0fafb1", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646513389, "uuid": "179744cf-e45c-4475-8864-161476c7bc98", "comment": "Malware payload", "value": "39ddefd64a86b5975ed925be618a5b67674091864154bd10c3ede5fc168c930d264da37a51b7cc10a8cc02e7dd021dd4", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513389, "uuid": "345dfac0-7e5f-4b2b-b4d6-ca0b8a3c80f3", "value": "T19914D66C81DEA1AAF59DD0766A09C187E031B2DC83FD5AFB53ACD52B6140CD40B349BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513389, "uuid": "da164ef7-c5cf-4718-97e7-0c9e7521c43c", "value": "27abfd9cfda7519d5efb3f08a2a4f3ce", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513389, "uuid": "2d54a89a-8b00-4183-b3d7-b19cf95420bb", "value": "3072:PezQJ/B1ULt7Yq0XjsJ9e4SFuvICDWEr1RsfhWFCm7+Gz:Pez6zUJ2sDe3MICDWQRsfkC2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646513389, "uuid": "15453edd-0128-400f-99a9-05fe4cc35b6b", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646513389, "uuid": "fde931ab-cff6-444d-b586-a22250394437", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646513389, "uuid": "c98762ed-d3c7-4db5-b920-af54416fe7a9", "value": "bz.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27d2d0e4-9cbd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646509677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646509677, "uuid": "ad7a0978-60f1-4552-9d01-f8ec328ccfc7", "comment": "Malware payload (Mirai)", "value": "320cecac5a1b5e5bbe575c9b22bfde08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646509677, "uuid": "efcc7511-a236-4b38-b914-c460c0e8fa6c", "comment": "Malware payload (Mirai)", "value": "b341e2ace5a4726cf67c8eeef80f9774be2047870415ec0ad0978400f739a390", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646509677, "uuid": "f390c647-06a9-4170-a4e5-ea4778e7d145", "comment": "Malware payload (Mirai)", "value": "1947720ae1b5c46a06e5a1fe85803ec3a52a5bcb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646509677, "uuid": "102158cb-9f6d-4a2b-9485-b8575a44c540", "comment": "Malware payload (Mirai)", "value": "7a6420577b25b5eb79d15bb1f25ff63e56e06a092a1ab3cb83ef0dd2652ae823f0109468eb0cb9239597f6b7d29a8e0c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646509677, "uuid": "5d30f738-7f13-4906-a7de-2aca2498d1e2", "value": "T186D2E1B1D10E9963E2B0497AE45A404B51B7F7F0C4EEFCA852AF9BB8B62310115BF503", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646509677, "uuid": "91c183b4-40ab-4354-883e-351ebf28c1e4", "value": "768:HMN/DZyoehYBQZ5ZOOxq1TykrDp4p5q3UIXl:HMFV3mBZ5ZSfrDpyW1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646509677, "uuid": "ebdb9ebf-85c3-4b72-95ed-651f4f58d2de", "value": 30944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646509677, "uuid": "636c5f95-e419-437f-b10a-15dffc546e75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646509677, "uuid": "24ae1d9c-9944-47f1-a1ad-6d4655961196", "value": "320cecac5a1b5e5bbe575c9b22bfde08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48fbcd35-9cb1-11ec-9275-42010a9c0029", "comment": "Malware payload (DanaBot)", "timestamp": 1646504578, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504578, "uuid": "433f00d3-bdd0-49be-90f0-f7f8a903eed9", "comment": "Malware payload (DanaBot)", "value": "a37de6afe10192eb8e7abd2bcc7e1598", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504578, "uuid": "c024ceba-4a71-4484-a3d8-26cb25a2473e", "comment": "Malware payload (DanaBot)", "value": "b7a5e33f49be015b0ae053167f2883fe4f4b487ea9989592b157e3280b97bd53", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504578, "uuid": "a9ab92f8-5382-41c5-b3ec-e67188005363", "comment": "Malware payload (DanaBot)", "value": "43be56aa5ff5225a1f0166af5343201c39fdf603", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504578, "uuid": "69b2b344-49e5-4e53-b55d-84254d26e92d", "comment": "Malware payload (DanaBot)", "value": "f20e421188e9108288a38a9c0c72c84fcbb141801900ecf6fd9abe9aea97e8ee2e8933e0f23011c6387a9cf3f69b0f99", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504578, "uuid": "449a6315-fbba-4986-837a-94b9ae454eee", "value": "T1EC451210FAA0D03ED4B351F8B56593ACE12E3EA19B2490CB57DA2ADB1B345D4EC7520F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504578, "uuid": "3dbb2d25-d18b-443b-9f21-471279492204", "value": "0e7fe55f005b449b96d57439d1b37307", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504578, "uuid": "7a93e178-4dd6-4110-bab0-859a59f0a67f", "value": "24576:ltYIpHA1R/mQJuKkHlbAWq/Ph2WlnJSwhnCSOO66+7BSbGxpYrh:lte/FuneWCb/5ndOOm0GxpYr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504578, "uuid": "884fedb4-2ca1-4bc6-a2c9-4c024a1e5fac", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504578, "uuid": "957ec77b-1dba-41df-bf99-0567dd5512ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504578, "uuid": "2fc01b90-8563-47a8-a5be-dc2e19f1b6ee", "value": "a37de6afe10192eb8e7abd2bcc7e1598.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94e6fdf7-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438563, "uuid": "ddabc1d4-e2b4-47ab-9a01-0bfd0a72bc1c", "comment": "Malware payload (Heodo)", "value": "d39b537a61b33049a14961ca0b710c76", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438563, "uuid": "e547da7f-1e21-4476-a808-054b4809c7ee", "comment": "Malware payload (Heodo)", "value": "b7e9f2aa6a0d34cf08ebad6662dade5b54c60b87844209657e83d4d42a5b3235", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438563, "uuid": "7c712f76-727e-4031-a068-37581335ed6a", "comment": "Malware payload (Heodo)", "value": "6b0827f79ae5beac56dc8f5f8298b73ae01ebd38", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438563, "uuid": "3267abaa-42fd-442c-8080-793a83c4dc04", "comment": "Malware payload (Heodo)", "value": "d8a661b955118ce265124f4e8676ae36db94bd0ee4df835b7197c0cd6660edc7c7fb9b9ff35f2874e719525b20473058", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438563, "uuid": "a4aad76e-ad6c-41d1-bb70-459e257fad70", "value": "T19A94DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438563, "uuid": "69bcb3e8-c842-4b87-bb15-424f0e06db1f", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438563, "uuid": "f5ccf8fb-43e6-412d-949b-dde240bbf2e0", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra88CtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCraduiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438563, "uuid": "1c39b0b5-2897-4ec8-a70e-f4e3e3d84811", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438563, "uuid": "94ec3fcd-ad57-4f36-ab13-fd9d4f49a73e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438563, "uuid": "31cbb39b-3e00-4acf-bfb0-1a07a21f607d", "value": "emotet_exe_e5_b7e9f2aa6a0d34cf08ebad6662dade5b54c60b87844209657e83d4d42a5b3235_2022-03-05__000237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "749d982e-9c3e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646455260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455260, "uuid": "a7387351-8cbb-4259-9391-cf55fc327e73", "comment": "Malware payload (Mirai)", "value": "0c5cfb1b69277f308e05e54cea585988", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455260, "uuid": "2a57c19a-189a-4937-a82b-c346dd4c01b0", "comment": "Malware payload (Mirai)", "value": "b89bc791b7aba75f400aeb167851571e95d5912b4f6a951d441f44d97b45e88f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455260, "uuid": "27654a79-a5da-4650-b146-1a129c29dd80", "comment": "Malware payload (Mirai)", "value": "65dfbaad1d4d5eea30b3e6a8746208ee5afc4456", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455260, "uuid": "ab6ffdd5-3af9-4d21-98b1-58eac2c2c69a", "comment": "Malware payload (Mirai)", "value": "4fbd80e6c3a0e047ae9b12157ac79743a9fd17d95b1acec2b76d290f5394d00acb059507a5415d7226e53705cc94d9a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455260, "uuid": "37f304f1-390f-4377-97f9-b7f7298b6d9e", "value": "T1F433F237482C15AACB317A35AC6542C0398F4BDC429D3623569DE7DD4EC76132BF9D42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455260, "uuid": "180a123b-73e9-4167-9f17-e5c7c039c3e1", "value": "768:v3TdvknEJHX4SsNzBk6b+Xo28MQwa1MzhA2fL2A3V9q3UELCFKoVHytRcB/LqWuT:bSEnsN1k67n4a+PfCLUZStRcB+WxQT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646455260, "uuid": "ecbed8f6-4458-4536-a954-70b95d6aea25", "value": 51536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646455260, "uuid": "1a00bace-e461-4838-88a5-3f5d5897ee75", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455260, "uuid": "4070baa1-c7d9-4550-a2bc-eaad6aa061ac", "value": "0c5cfb1b69277f308e05e54cea585988", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "959fb12e-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "c51a103e-5a18-4ce3-afc6-71ba1aa473d5", "comment": "Malware payload (Heodo)", "value": "2b50c32a1ed829f975c69ff2550f8e2c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "dfbc6b46-aa3a-4f1a-ae43-8e187b59a52d", "comment": "Malware payload (Heodo)", "value": "b95ee1d3a082de565cfee33af31036068da18418b0b6c22d76fcad7a506ade02", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "fa8dbe09-6a1b-4325-928c-ceedbe9d7758", "comment": "Malware payload (Heodo)", "value": "99e606a953fcdb0a94befdf24b57abc329373b55", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "836ac6e9-d7b5-4d89-b98e-f490ac23b041", "comment": "Malware payload (Heodo)", "value": "14743d98e1325a8f421f9fb223b7bca137a469470ba2ae7d6e5c25fe94f83f2c838305e5fa7ee3cb2fb1452c346cd523", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "8882eb6a-61ad-46fe-88ea-e747ed2b355d", "value": "T11694DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "a3210611-aa7e-485f-aa4a-1268440fb468", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "e352cc2d-596a-4d58-87ee-a8513314b936", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8nCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCraguiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438565, "uuid": "2354093c-0621-49d6-b42f-0043687a4e79", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438565, "uuid": "a01001d9-a647-43ef-9f83-27c30ca42aed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "4588a712-69a7-4ac5-9803-6b7a7dadea6f", "value": "emotet_exe_e5_b95ee1d3a082de565cfee33af31036068da18418b0b6c22d76fcad7a506ade02_2022-03-05__000238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9920b84-9c9e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646496714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496714, "uuid": "292188ad-92db-4e0c-b3a7-9d61b88548b8", "comment": "Malware payload", "value": "9e4965d0eacf20c08e7e32d226d1316e", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496714, "uuid": "2cf63731-c7ba-4765-a5f6-68472a234427", "comment": "Malware payload", "value": "b9684773a0b03e03a37ad4658ce512e2d3a132b44ca2a0297569db56f6d85c03", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496714, "uuid": "a5b728cc-4b41-4345-b21f-bc8e1640a8c3", "comment": "Malware payload", "value": "c0346485ea761af1f9f251e9a764e238f51c8091", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496714, "uuid": "be07eebb-781b-4d91-9d9d-7b3b988c9834", "comment": "Malware payload", "value": "5294c1c2ef8da3a2141ee8b7882cd1e68aa938170ba001ed6c7594b058660902ee20f2c45ee6996feb0cc61ce58a39ca", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646496714, "uuid": "ce60e6a7-aa72-450a-87a7-f1b59accb200", "value": "T1156533A05F251A71C24B763562F60E1D377F2FB362899E2A1564B0F8CE23DD94AF3640", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646496714, "uuid": "668b5613-de48-4af8-a748-2b0d1eeb2713", "value": "24576:NMXOwGefJ4Qs0C/39+NteE+i/g6uBhnlJaC4/bwtm8kgsYKtvN8rYzdIL6gz5Y:2J6H1+NF+XDJL4/bL8l28ES2gm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646496714, "uuid": "580e6d12-9f1e-471a-a003-580e66cb2dc6", "value": 1485009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646496714, "uuid": "aec492cb-0379-45ee-bd7e-dff6b93e55b3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646496714, "uuid": "3f197371-54b9-4827-9bdd-6847d058f884", "value": "Portable Power\u00a0Station\u00a0Pricelist \u00a02022 110V.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21bb490d-9cce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646516968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516968, "uuid": "ecbd3b8d-9d1d-4ca6-95d4-17d8985a4b55", "comment": "Malware payload", "value": "abab0fe8d247c02929f781bcfe4a2eca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516968, "uuid": "c5ff53cd-e1a9-45ba-9ba3-35b435916cbc", "comment": "Malware payload", "value": "be554e706f6b8ab8f4bbea209b669e9dca98bf647faa55c46756f322dadab32f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516968, "uuid": "b47890e5-2ad7-4a16-bfac-b3a729e5eeda", "comment": "Malware payload", "value": "a5a20bc333f22fd89c34a532680173cbcd287ff8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516968, "uuid": "6df8c9d3-098e-4cce-9b01-fd3428d62c9c", "comment": "Malware payload", "value": "983129fe46850d3165261752be99d1ef26ebe0173b5fdbf4469c6390ad82a404beacdc84ee0680268d689869a82116ea", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516968, "uuid": "8987a5de-e094-481a-a79d-89831dc97aea", "value": "T17A237E1BAA0D8032EEA6157071FED64A483E5E11631C59FBEFE02C6D2BF49E16170273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516968, "uuid": "11f91efd-95de-428f-9b72-50e4c9682bac", "value": "86b8e189a2e8a966c017e6749439850a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516968, "uuid": "e00a7619-afa8-4aa3-ab0d-96dc681120b3", "value": "768:PXZneiJhGoKwKO5KYVwVU55r0ouXoWQQS4FtnYA19xTutf44SDwvb4Y5znAL99Jf:1bCDuwYSVwr0oui6HnxZGQKvb4Y1nAL1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646516968, "uuid": "15db7bb7-8395-4f21-9b47-868bf4dbbbff", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646516968, "uuid": "576bbafc-92aa-4554-ae6d-4e08f2c01152", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516968, "uuid": "a0f83954-059d-4057-aef5-adc590e927be", "value": "be554e706f6b8ab8f4bbea209b669e9dca98bf647faa55c46756f322dadab32f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6f2994-9cb8-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646507483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507483, "uuid": "1a88a6d1-b8b6-4ff3-bb75-eff6dff2d1c4", "comment": "Malware payload (Mirai)", "value": "6f89058b8b5577770611e830954e6cde", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507483, "uuid": "c74d0184-e2d0-48e2-b44e-3c90173d2e28", "comment": "Malware payload (Mirai)", "value": "be7383c7d2959200b395f60877d87adada8c1bc826a045e4a5a5873361fad238", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507483, "uuid": "d7fe2eb0-6ebf-4f90-911a-e33954c47154", "comment": "Malware payload (Mirai)", "value": "469ba5a3f105060ed1877511f04869455f1c89e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507483, "uuid": "dbb94c6d-0c16-4db4-9c47-15944caa94db", "comment": "Malware payload (Mirai)", "value": "0192fdfb6261b1070716691969b32bba18158aa5439fe9354cd9c9c2eff0290b29f5e57a081648fc744cd6a9c4c108e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507483, "uuid": "8e2f9e80-6a35-4a65-b2a9-29bdedc31b81", "value": "T1D2330861B8936A1BC6D0237ABAAE558D332063E8D2CF3217CD601B147BDA51F0D67F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507483, "uuid": "c6705b5f-9a9f-4c22-abba-f8ea8080b9c8", "value": "1536:VvmyehDi86b9vUwmkaqXDBnww6Ioh+kWIi:VvmyehmYVw6hhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646507483, "uuid": "0dc365d1-0b6b-4fbb-96ef-91c6157f4cf5", "value": 54648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646507483, "uuid": "2a00995e-eeeb-4c0b-a172-89da13028a0b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507483, "uuid": "f3289e0d-e801-43a3-b902-bfc5294a73b6", "value": "6f89058b8b5577770611e830954e6cde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6283a5d7-9c9c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646495602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646495602, "uuid": "7910dc0e-54d3-49b1-a226-e1534c3b0306", "comment": "Malware payload", "value": "e45cc08c947250b27be10b23e7ee04c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646495602, "uuid": "652251fe-67f9-4a83-b87c-74cc803534f7", "comment": "Malware payload", "value": "be7445fcea2908a4755bc89ab529dbb630374a32e2cd37d6aaab0134e136b04c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646495602, "uuid": "60202cc5-c131-4a6d-9eb8-95afdc763dc0", "comment": "Malware payload", "value": "19b91482f278a2420fe72d44c2753f99470ff1a7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646495602, "uuid": "173c9ac3-4ae5-432d-8260-cf9ab6f9420a", "comment": "Malware payload", "value": "7e60249417bc02855fc1ac3d56de95b5fabb5d837abc5b5aefc29bf9931140694d9ba979ae90fab939dd98f881f0c893", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646495602, "uuid": "fa82b86f-6cfe-466b-8ceb-b3d2c4b49ebf", "value": "T1597733373237854EE0BE55B197622F5AB421B9150A2DC7094E99BEF9F4B3ED08F22344", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646495602, "uuid": "8f6cea0c-f36a-4599-81f6-d7fdcd2f1e11", "value": "d1de500e42d2702177623521d4e86120", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646495602, "uuid": "76117708-dbbc-473b-a36e-d2ac91c3d16e", "value": "786432:n/bD+iTzMjBUQz/CKkj5sDDsXlK9Xb5tXVO9623T0w4o:n/bDAj0KCKN5291ll", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646495602, "uuid": "335a4633-f099-4a3b-9ca1-cfdfd926bad6", "value": 35833648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646495602, "uuid": "427cd4c5-c5a8-486e-88b1-ea8cdc9d9e79", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646495602, "uuid": "a3f5edb7-773d-4244-a240-c7df06e2c60c", "value": "Exoblast_Setup.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c387ea0-9c39-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646452937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452937, "uuid": "18a32329-5b42-409b-8250-303c1fd5c08e", "comment": "Malware payload", "value": "5b702502b043556c5941953447b59d2f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452937, "uuid": "1f168679-5325-4858-8fda-eed437498a9a", "comment": "Malware payload", "value": "be933100b1a4b720bc6891a523dfa199533197e3bac463ed49d8cd031bb75f94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452937, "uuid": "a1105e58-02ee-441c-8986-3cee10cdc070", "comment": "Malware payload", "value": "125e1c7da0b245d46added8412bad50d20e125fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452937, "uuid": "01fe8952-7128-481b-bbe3-9af4300d5b8a", "comment": "Malware payload", "value": "9ad699f864fc8e79c4103c0b65f8b1eb8c6b0f852292e9155d09255d92a446bb7ff9be8e65c90cd814f3ab2e7ca401c8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452937, "uuid": "d879cae5-ac7c-46f4-98a5-72c15f7c3ebc", "value": "T1BF42A6D1B9558A17CAC44233FB0E83DDBB26574CF2EF3303671B6F9162079670AA6419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452937, "uuid": "b21691a1-0a0f-4629-a1d3-38cd81f710d9", "value": "192:Yi/8QnOgi5hsSag/BhIMFneoazG5GgaVVkEZx4e5iE:Y2OgIegfI6eofOVFx4e5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646452937, "uuid": "127b02ce-e2b7-4221-8529-4584df546fcb", "value": 12408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646452937, "uuid": "3bc95245-f4d1-41e7-a49b-c2058a856ef1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452937, "uuid": "175f707b-be68-4f55-b830-4dd24f34d5db", "value": "5b702502b043556c5941953447b59d2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e344f4-9cce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646516921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516921, "uuid": "6b886aa0-3fdb-43b2-ab4a-98e086fa85cb", "comment": "Malware payload", "value": "049e015067c96440b07ba840a67682a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516921, "uuid": "065a4723-137f-4e3c-9379-3752a28daa13", "comment": "Malware payload", "value": "beac700139a77c70a36ecc72c9546980318f8e7147301535412dd2e3a56e122f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516921, "uuid": "5b390723-12a6-40c0-a9d6-ebe67f7ca9ca", "comment": "Malware payload", "value": "0fbb8f1d7d751426991420d6c2250601c74b44bc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516921, "uuid": "8b04c68f-7379-42db-a059-6b0c5f8778ca", "comment": "Malware payload", "value": "673658549d38dbc1c66bef4b2a9d615bad260312e2d26b9634fad4bd016ad42ba7894de910f130a0beb7db423e8ee945", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516921, "uuid": "1a076e82-16a0-4c02-81a3-ab4e2789af89", "value": "T163A5211787B420B1E5574A7226A786A571BDA9300329E4FF0E376D1F9820DFF2938611", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516921, "uuid": "ee082028-bfd5-4338-acb7-661fe9453b26", "value": "c337e3e746d83f1ea80b95242710ec11", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516921, "uuid": "72da5d35-06dd-4d5f-89ea-4c86fef173cc", "value": "48:aF2k+IYYTAxB5EC7BWnVxAiidlxav2trgtQvh2v:cCMAOED7a6c22", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646516921, "uuid": "f049caa5-8a30-4d12-8a21-af7507ca5ef1", "value": 2135585, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646516921, "uuid": "7d434bca-1252-4aac-86f2-8f1f7d722023", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516921, "uuid": "fb3a507a-9f90-4e0e-84b6-cc204fb78121", "value": "beac700139a77c70a36ecc72c9546980318f8e7147301535412dd2e3a56e122f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1db458dc-9c37-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646452107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452107, "uuid": "9c06729b-5151-49fb-a5d0-6e9ef2d1310b", "comment": "Malware payload", "value": "a8d6d8fb5718ad19751f57bfd3447d90", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452107, "uuid": "f3300595-626f-4db4-8135-381f581cfcd9", "comment": "Malware payload", "value": "beb7245ef89b5faadc7facc88c37bec4dcc41e19ddcba0f11347f083bb18f662", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452107, "uuid": "4537cb8b-9172-4382-bfd7-db0b2ae252ce", "comment": "Malware payload", "value": "37f2a6caf13ae7527751d0f940b41476953c1064", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452107, "uuid": "6adb9fe4-d7d5-46ed-8217-073630496032", "comment": "Malware payload", "value": "2835d9014a6c0bfd9efd313bf645262b9a785716baf6974e6ac2f4dd77c36d7f19de7e80e95a973fbfd5fb603daae1f5", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452107, "uuid": "6730a7dd-531e-4e6b-a54f-35684dae5aba", "value": "T15412F92A4592E5FCCC6EC3B9056AF979C233B80D23A672093354FB37DD9EDA2652D101", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452107, "uuid": "e9345385-f524-4931-9e9e-e63724821711", "value": "96:GC8ZSah/w7i6G2lND1HFlgN/naRXv4zMB9RY420E7XnqtVIaAxijYb/52AGm26wb:Gd/w7VlXl+kcMB8Du0fI4k49m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646452107, "uuid": "2daeef93-2def-440a-9e4c-d8061c5209ee", "value": 9736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646452107, "uuid": "761f35b5-ab97-4520-ad30-3f57abf37982", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452107, "uuid": "81f1680e-0256-46c2-8643-48c6a7334cce", "value": "a8d6d8fb5718ad19751f57bfd3447d90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dca5dde2-9cb0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646504397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504397, "uuid": "3ed736e2-1cc9-4e31-8f65-6e7a0cf37794", "comment": "Malware payload", "value": "71b7f48af385bb4ae1221c17197ddd1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504397, "uuid": "de50bbbc-5273-4b52-8dbb-e568fdbffe3c", "comment": "Malware payload", "value": "c025fab76e053df6abc1c6a5186920f5c34e2cd7d3a650998983dac479c8f4d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504397, "uuid": "a8beb0bd-4b6d-4abb-ae6a-e8399c5e732f", "comment": "Malware payload", "value": "972420eff0a215549139fb1c6359bbddf9a09db5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504397, "uuid": "14657369-19a8-4f51-9f2f-db2eb2a6b508", "comment": "Malware payload", "value": "a74df31f2a201d28d9e87df9b81e23630274f22fb180907766cdbc23fd7d93547f29fd153b80364ce12925d7fbfa3bec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504397, "uuid": "97fe8e4d-d8de-4160-a9b1-4ab7cd857e41", "value": "T12C450210BAA0C039D4B311F87976C3ADB53E7EB05B6411CB53D66ADE66396E1EC3120B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504397, "uuid": "d763934c-fc29-4a92-b38e-8322d8126bb4", "value": "c1925c046b559a9fd93a9b8151eefcc1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504397, "uuid": "681e4cac-330a-4e39-8a91-e820bfbf79fd", "value": "24576:q1NVTTCvhbhZEh6nboNNOoJisMWbnkVQB4ZOoHiu2:q165bhq6nMNNO2fvzkV7p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504397, "uuid": "609cd555-4954-4f51-b211-98b189e80cfd", "value": 1169408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504397, "uuid": "cbf3f260-65de-44a4-ac39-76433c1d80f2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504397, "uuid": "649df294-e558-4d62-b990-1beb79244e25", "value": "71b7f48af385bb4ae1221c17197ddd1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9fa048c-9ca5-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646499641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646499641, "uuid": "e57516bb-62d8-4a29-8a2a-8c53295b86ba", "comment": "Malware payload (RedLineStealer)", "value": "a9c63f792d6eee1784924ba712adc68a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646499641, "uuid": "63d71690-6c5c-4100-8bbb-9e5f7443b2a4", "comment": "Malware payload (RedLineStealer)", "value": "c0887fac0c1921b6678e81a90619bda7f0ffb9abee99583fe9f32107e0975e0b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646499641, "uuid": "ee2ecd9d-c8a0-404b-8dda-40562a819c89", "comment": "Malware payload (RedLineStealer)", "value": "8283b232fd8be508043b5d151e1655dc4caf7769", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646499641, "uuid": "bf6694bd-8335-4bd2-b06e-47667ac03340", "comment": "Malware payload (RedLineStealer)", "value": "a2d3f17e1108d6ae7ff466dc300f5796e3dba0a5a1bc0f37391ba8698fbaf6e89dffb62f94190180e38996b2095ae36d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646499641, "uuid": "9510b019-5dde-4e26-ad71-7992643e696a", "value": "T15DC42386E181FE55D80D0AF87832AC87707ADF3C5CE8A714E55B8ACBE87548777180B6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646499641, "uuid": "cd3c004a-bacf-464b-a6b6-3dc846504f81", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646499641, "uuid": "d283d878-8b7a-4cb8-8d7d-8d65fd586a65", "value": "12288:xyvjysbjCfWaPJw7e99uv3QS03ULaHNqrxlKIQNouU0kozS2gwvApi:ajy+sWaBwa94v3kEaHNYK3NUPP2s8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646499641, "uuid": "784a1b58-a699-484c-85bd-031db561f0bc", "value": 575488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646499641, "uuid": "8ad4b3c5-7316-4cd1-b924-a4a472c17ca3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646499641, "uuid": "f597800f-9bbc-4a2d-b865-044cb5cbc619", "value": "c0887fac0c1921b6678e81a90619bda7f0ffb9abee995.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f63ce5d4-9c2e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646448605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448605, "uuid": "716e75ef-8e63-4091-9597-d13eb833d6de", "comment": "Malware payload", "value": "35c45420c2d0e9953b1cfd35f72f4885", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448605, "uuid": "d0b83de1-bb52-4e29-8fdf-0bda780d0aa2", "comment": "Malware payload", "value": "c0d401eb8649035ef0bc1f5ae115a3288d3489b1ba3936bb307caefd07012adc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448605, "uuid": "8da41b64-3e61-4d3a-ad29-4d142296fead", "comment": "Malware payload", "value": "9afe71012df74f4dd674fa1b1519cda7224c22d6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646448605, "uuid": "a11aecf3-5beb-4969-a87b-e197aaf0069a", "comment": "Malware payload", "value": "ebaf2db28862b116770b68e382d22b2212b011040a9629ca09665e6f994fdd8b87b066fca2aca8367797cfe1f2cbd1a1", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646448605, "uuid": "c5422e0a-21fb-45c2-a73e-d27b1f910366", "value": "T15E32FA264A92D9FCCC6DC3B8445AFA39D232B81D23A771057764F727CD9EC22261D414", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646448605, "uuid": "eac020d2-1157-4375-a396-0598605531eb", "value": "192:GbZ19qWlzl+iOODyTrB7QDsNkjFJs7hWMTvccc:yZ19qWlzlN8rJQN6Rvccc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646448605, "uuid": "a6c5c01f-4769-4d36-9506-8cacf9ddca5f", "value": 11200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646448605, "uuid": "bd8728c4-1421-4ebb-ac3d-58fa96a4bf30", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646448605, "uuid": "00e03e67-d4fe-495e-9425-68ea3abb2e2e", "value": "shloop.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95d40adb-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "a5b91bf4-447e-4be6-926c-7315419e40c2", "comment": "Malware payload (Heodo)", "value": "7f023e1874240180c0e189c00c472a34", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "acfa07a0-52a2-4d3c-a80c-9b04c00db0f2", "comment": "Malware payload (Heodo)", "value": "c42e241734eeb0c0a34528ea405e145e2b16e8963677b7e694f966005f5f83c6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "9f1fcffc-d114-4a91-918e-a1a6ceb198f2", "comment": "Malware payload (Heodo)", "value": "16328aa932458918dc26332d3164afdaaccea72d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "72327d2a-5c40-4652-ba2c-710f89397758", "comment": "Malware payload (Heodo)", "value": "b84f7e174ea3d8a174217e88ddfce968524dfa0b9715200f17c25915f0c9e0f615875b7730b96aa3780cb72a1c6e8c32", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "1a44eed3-5036-4d6e-85f6-423c4e1eb885", "value": "T15194DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "e7f4c667-6674-4eba-957d-31a21358d394", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "90ccf433-4b02-4a1c-9239-93f0c0936897", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8KCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCravuiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438565, "uuid": "228c4463-c248-4b65-9a34-859d590a59ae", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438565, "uuid": "2f49c956-7557-49ba-b8db-bf88182dd6bd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "5d3b2ba4-362b-4ad9-85c1-96bf0e60ab61", "value": "emotet_exe_e5_c42e241734eeb0c0a34528ea405e145e2b16e8963677b7e694f966005f5f83c6_2022-03-05__000238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dec936a4-9cdd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646523728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646523728, "uuid": "66c35501-885b-4884-8af5-d9c08095dbac", "comment": "Malware payload (Mirai)", "value": "0921a47bd22aed9a78b12d56b70f74a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646523728, "uuid": "bf2d5d93-c4f8-480a-976e-e1a09e4bd858", "comment": "Malware payload (Mirai)", "value": "c5a1ed12fa0df722359a33b9a557fdab2c18a363388a014988c6656d30b98df6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646523728, "uuid": "a6e6af5e-6b7b-47b7-80f3-24ce2142d148", "comment": "Malware payload (Mirai)", "value": "a2809e270b88a023649cd036a94091bb2c809dd0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646523728, "uuid": "e5a9ebfc-3983-492f-84ad-bf95bff35f73", "comment": "Malware payload (Mirai)", "value": "d5221069d19a32aa21df1f85eb44d3886e14d56822e7be1d2d7904e791e4bbfad7fc5b96a3f884ab8c6c67efd2e6dcfa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646523728, "uuid": "e9d8ddda-2bd5-486f-97be-ee63d6302a01", "value": "T13563B309BFA11FB7ECAFDD3749A91B45248C610A21A93B757934D428F34B24F19E3874", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646523728, "uuid": "f3400ab7-83a8-4936-b9e2-dbdf0af90999", "value": "1536:FpwAOW140yVdlXXtXZvBfCwc35ZcRWOgVv:FpwAOW140qXdw357", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646523728, "uuid": "537af4cc-3837-401f-ad23-fe5b57cc32d1", "value": 71840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646523728, "uuid": "17cfca22-a5cb-4c4b-ab67-051b4b1c8961", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646523728, "uuid": "728888d2-b035-420b-955b-5ee2f0f5f7cd", "value": "0921a47bd22aed9a78b12d56b70f74a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "963fb941-9c48-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646459611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646459611, "uuid": "5fb7e759-0d1b-4903-b653-01b3f2d0c15a", "comment": "Malware payload", "value": "cdbf798f602ff128ad174b210f5abf84", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646459611, "uuid": "ae71670a-89d9-48f4-a398-33ddaae23aa1", "comment": "Malware payload", "value": "c6abe0e7baa55b4f13a2bb09a004e8dafbd0b4b0bef93572d8507d861d999425", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646459611, "uuid": "0ae50bc6-fd8f-4980-9381-f32378aa650d", "comment": "Malware payload", "value": "6d29ba43bae0cbc2a686b30aaae8fb4e614f2e5e", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646459611, "uuid": "45ff5f2e-7464-4733-9aa6-6d788db0a6ba", "comment": "Malware payload", "value": "5c08c6ad2ed0a90b0d38fe3fe82a396c05b35baa605897c03a65bf1b87c2fa4ff810c5f915936c57501d84e5fda59883", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646459611, "uuid": "c3f60ac9-b7ca-4ea3-9420-3d37a6fc2ec9", "value": "T11E940244D09324389D49BF46E6DD64E245E432D2C60B9D4FECB4B3B39735A22FA7087A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646459611, "uuid": "33cc8aea-4ac1-4f6d-b78d-e26be1157744", "value": "6144:pvF9I0JMga3H+C41IjwZp995gpRxwt1AFCHr9i4iDi7i5iaixiliqi1i7iV:5FS0edmIjqpD5gFVIL9BQcunGcX6WI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646459611, "uuid": "6c8bccaa-f8d6-4ff4-9f46-2ee49ef104ce", "value": 441999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646459611, "uuid": "2068480a-a662-4994-abf8-8d3156358f45", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646459611, "uuid": "09c4633a-763e-4cd9-a35d-893592a087b9", "value": "test.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dea73c05-9cae-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646503541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503541, "uuid": "8f676776-dd21-4df4-b74b-5cabc37846b7", "comment": "Malware payload", "value": "b3f0f44235f81de626a3f0c26d1ecd48", "object_relation": "md5", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503541, "uuid": "a15b49c3-13de-41e4-a14c-939c4ff0b7e9", "comment": "Malware payload", "value": "c7482bbdc01e03515591cb8904af5b231d3a8894d7cc9cde3ef2f1735655edaf", "object_relation": "sha256", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503541, "uuid": "b718c3fd-a36c-431b-a588-d000ed7fd0c9", "comment": "Malware payload", "value": "ed722db05c8db4e239b7108bce868b53d08884e7", "object_relation": "sha1", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503541, "uuid": "9db8b6ba-a016-4cc6-a4b6-e89a5c1a3325", "comment": "Malware payload", "value": "ac88858bcceab191c9b0e8a7227bc69de0659d61e5c7615db167fb87515801a4defb0f2b279549a1423586c29601dc58", "object_relation": "sha3-384", "Tag": [ { "name": "aggah", "colour": "#8F68CE", "exportable": true, "hide_tag": false }, { "name": "hagga", "colour": "#856BEC", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503541, "uuid": "a8ffeb3b-fd5f-46ee-8fd8-3ceca4fdd2c7", "value": "T1A513AE54C503641AC273253DD83D88E119678C1B65118A9FD6EBBE470B68EE73B0EFCA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503541, "uuid": "cf46985a-b7c9-416a-9bc6-84c88edaa97c", "value": "768:nzPRD4S0JS00SneSnjS0yS03S0IMS0bS02Sote9YRuOjXHXQDjcfHTgWYpNNLj4N:nVceqfHXWArgrjpd0mgrAgX1/K8Nytsh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646503541, "uuid": "7d1acf92-eabf-4c89-85a2-2cc9203abd2e", "value": 41604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646503541, "uuid": "7de291a9-fa19-4592-b781-7fa35ffe3e26", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503541, "uuid": "3b849053-388b-44af-a2d6-e67032b167e4", "value": "New RFQ Oder List Scg,pdf.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d42a9d8-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438524, "uuid": "a34a2f68-debe-48c9-a842-6cb40954d755", "comment": "Malware payload (Heodo)", "value": "de29558c683cf8cd9d4fc17185f6fcc8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438524, "uuid": "1d439f12-9787-49fc-b8bf-14e54737d21f", "comment": "Malware payload (Heodo)", "value": "c7b3dc997befe4373aaf74587eb9c0055c214bbad2cd4826ea14fca78a78cf4b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438524, "uuid": "a9dd3069-e610-4323-8966-2f575d53ad91", "comment": "Malware payload (Heodo)", "value": "97ccf7dfc0f4615e4e30707f2d88028d9adea8ae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438524, "uuid": "c1d3da61-f185-41eb-8506-56c42f5db9b7", "comment": "Malware payload (Heodo)", "value": "af8ba239f5c2cd91847a2aa39480fbafebfd793199ac8efcd634b0f1c5fbff86f34dfed281d3d5fc8d3e407263b695bc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438524, "uuid": "d3241998-35cd-432a-9833-7bb64446f5f0", "value": "T128057D22B9C19172E25F13B629D8DEEC33AE5A3107D1C1DF5AB41ABD3E729E15630603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438524, "uuid": "9ab49185-afed-4bd9-a126-867785f250c0", "value": "810544f6d1cfc4b1abda96d46e502763", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438524, "uuid": "2f9dd327-c3e2-4a29-a152-81bca45150d2", "value": "12288:78u2rsRwkKeb6hsHN36rXeL09CTZ5X2wfRU3zaEq366QkkOYaPG8Lik:x206S49CTawfMaEq3XxkOYaTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438524, "uuid": "cfdf3ab7-f1a5-4ae8-8f19-2dc37eebb68c", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438524, "uuid": "8f3451ba-6ec5-47b6-9191-c281e512cc97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438524, "uuid": "4db1272a-542b-47c6-a13a-67038f347fe8", "value": "emotet_exe_e4_c7b3dc997befe4373aaf74587eb9c0055c214bbad2cd4826ea14fca78a78cf4b_2022-03-05__000159.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "964dd044-9cb6-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646506856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506856, "uuid": "900cf0fb-f976-4269-97cd-2f341b20d01a", "comment": "Malware payload (RedLineStealer)", "value": "909e09ccad29b047cb8de4f99e2e07cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506856, "uuid": "e39dfcf2-9128-47b4-a2e4-d5ddb06bcc60", "comment": "Malware payload (RedLineStealer)", "value": "ca27c07cc9fddcd8bc07b2b9aa3406ab019fb54797bf2163b190217e9c17ce6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506856, "uuid": "02468f2f-2c9b-4272-92b7-6547eca7bd2a", "comment": "Malware payload (RedLineStealer)", "value": "7d874ab389be635073f478a09ad50413d3a7c876", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506856, "uuid": "8aaebff9-c819-4100-8325-dc5b2f521624", "comment": "Malware payload (RedLineStealer)", "value": "c8dbf5400b4acd0f3565d19b0f62d5b152bd7e623fcc4bf3be9709cf3e13773edaa9c13fd934bb81f1e0a45097231d8b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506856, "uuid": "18ea44cc-630a-423a-a493-934f268a5dbe", "value": "T1294495453FE6A671CAAD2BF8206387416B38E00BBFC3B71345A5162C3D423DB5D958A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506856, "uuid": "d02d78a0-52e9-4d34-b0de-6b3f7aea8bbf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506856, "uuid": "e7d68466-5d18-472c-be61-9b7768335315", "value": "3072:pKQOXi4t8UIMjyXVRs+IdFz95lMXbZHzOc+Q61PsOIHANI2Y:pKws+IzR5lMXbZHFm0OP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646506856, "uuid": "d1f4bde7-7092-4282-8c77-6084114422e4", "value": 258048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646506856, "uuid": "d97ec0a2-ed3c-4e2a-a7f7-e74b636a042a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506856, "uuid": "a51f0ff9-0385-491b-9c7f-d45dea16003a", "value": "ca27c07cc9fddcd8bc07b2b9aa3406ab019fb54797bf2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0efad980-9cb1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646504481, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504481, "uuid": "cd936a5b-8205-4b8d-a314-8ad9535556fc", "comment": "Malware payload", "value": "e9af2f3d5c511c197a61a304f28c59e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504481, "uuid": "2331f2f1-5d8f-4a71-a0a1-a42fcc88334a", "comment": "Malware payload", "value": "cb64837983ad6cdbc07df3dc8272a72b4d1b41314b797cc4f9bb67cd37f7b0f5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504481, "uuid": "22d8b36d-3cb4-439a-9706-a0764f1d4676", "comment": "Malware payload", "value": "b18b26dae8e7b8d4ecc239d6fc724818bce12a31", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504481, "uuid": "523e1735-d1f5-40cf-90a1-1427dc2c1a58", "comment": "Malware payload", "value": "5c1215c82ae3b6fb24c4a7805c1361a9181a8cfc14e3e0f2856d580def43ea72c696e45f5ca87bd77e85028015439f94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504481, "uuid": "74e44d57-d32e-4cab-a58a-1ef4a4bedb56", "value": "T11B45E0983650B5DFC957C832C9985C24EA60B87B530BD203B0677AACBE4E58BCF155F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504481, "uuid": "5da8a019-9c82-4889-9cea-592200f55296", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504481, "uuid": "85dec3bf-49ca-4bda-85a9-e1ed58e660c0", "value": "24576:RI6zQg11NvdsKsvNIReyIg8QA2fhcAhmY/Y7ZAZoot9A6D28cSE:dJ11NlsKsApfhcqm9AZK6CSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504481, "uuid": "97a80a2b-534d-4ff4-accc-b078e3b8a0f5", "value": 1191936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504481, "uuid": "6b5daecf-ab83-4e0d-b484-6294b95d2195", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504481, "uuid": "7313fff1-8fd4-4efc-8dbb-510f899bb04f", "value": "e9af2f3d5c511c197a61a304f28c59e8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef1fccf0-9cb7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646507434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507434, "uuid": "8eb0ebdc-49bc-4b37-9f7e-d82821f9cd36", "comment": "Malware payload (Mirai)", "value": "8ee75c4653fd00dd9ff1a2f381af7616", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507434, "uuid": "4b991cc0-5c2d-4439-86ff-794296977f61", "comment": "Malware payload (Mirai)", "value": "cb8f34b4a4e0d248348ab786f0104d5aa3c5901e49db52847f2015f4d190c4b5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507434, "uuid": "9175f53e-8290-4b02-b9ad-439f0c82d6bf", "comment": "Malware payload (Mirai)", "value": "28527ec6341062e45a6c9022fe8b1271d25db359", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507434, "uuid": "0200aa24-907e-427d-aa7a-978c414999bd", "comment": "Malware payload (Mirai)", "value": "2fb1491d97bdb22d0989b934cbf33a9307fcd226ab026b431233eae7e18c6f161c9e3f34fbbe452398734a89b6b19d8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507434, "uuid": "de433b1e-d57e-487e-84b4-6ffac6678415", "value": "T1DA93A51A7E258FBCF799863507B78E22965837C62BF1C141E19CDA015E7024E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507434, "uuid": "b4b7c369-0aba-468e-a6a5-d2cdee12e364", "value": "1536:AKzqmzfphPukFhyx2XgHw3eFz0HDDZ5KHZXvEY2QPSH:AKqYhueXWw3eFwHp5KHZXvEzIC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646507434, "uuid": "3b3fe9ec-9417-4c99-960d-778bb87a23ad", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646507434, "uuid": "358fce7d-1d2a-47ce-8bcf-a1329476d47d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507434, "uuid": "a149367c-4fbe-40c6-a4d1-4c3fc8ba71e6", "value": "8ee75c4653fd00dd9ff1a2f381af7616", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2ba7e4c-9c69-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646473805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646473805, "uuid": "34c5300f-2ef7-46c5-9c16-96e6181ac0a9", "comment": "Malware payload (Mirai)", "value": "836bba40cc30603d10bf1c669158b056", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646473805, "uuid": "bfb4a42f-6969-4d2d-b7d8-95c2a4f128fd", "comment": "Malware payload (Mirai)", "value": "cd0daf7dee30a883bde762b85f66fe9ed066ff7074d22f523c89a8722a01740e", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646473805, "uuid": "8466e66b-eee4-42c8-b2fb-4714fc6d06f0", "comment": "Malware payload (Mirai)", "value": "4ad66bcb6925ff9c79057f1293b199b2e2be6771", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646473805, "uuid": "1375f469-fd0f-400c-93fe-defd96896dfb", "comment": "Malware payload (Mirai)", "value": "34452700977ef3858e0903c602cdf563e032f18995bb43d223a41e0703fd57eae0242b2b20d05cfa353d27e8c96857b1", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646473805, "uuid": "82edab4e-84c9-407d-8342-097874e2a710", "value": "T1B1E20956BE929A1AC5D063B6BA6E41DD3310A3ECD2EF3347CC141B047ACA95F0E67B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646473805, "uuid": "338e33e2-4d16-4511-904a-d496b1eb95c9", "value": "768:MFHp4Kql2u/wN53c27HYXLyHRZfl+hl8V6hrKK658e7kGd0NMNRC/nPNhg:M0K4/k53c2DmOHRZfKl8oh+8tnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646473805, "uuid": "10f50a95-9caf-4798-a18e-4cdaefa276b6", "value": 34020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646473805, "uuid": "e9555dec-7c6e-4edd-9d0d-10e14354c4e7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646473805, "uuid": "2bfaa227-c086-420a-a6d7-6663067943e6", "value": "botnet.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f83dbf4-9cce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646516991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516991, "uuid": "f1982470-9607-4b61-9f5a-a23983673197", "comment": "Malware payload", "value": "d506410f5f13e42b47fc0d7f95eaeea0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516991, "uuid": "4ee5bf84-99d3-4c63-8185-76e2c861fae9", "comment": "Malware payload", "value": "d147faaa185cb188a6d981e0e495ae7b9c979d9a5020075e7a590b1e45f96eaf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516991, "uuid": "800e2c67-8e34-471f-b30b-8dfad2aeb71c", "comment": "Malware payload", "value": "2d243f046acad45c15f4e4ede5eabf222ae076b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516991, "uuid": "c5f1eb30-6c27-4c5d-ae62-4e5c0e9a2a98", "comment": "Malware payload", "value": "8ca538c82d0e1dd7914993a872a52da0398e89889562332d96b2c7a230a01fb6b1c53bc002208a23a280822cc80c9031", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516991, "uuid": "8060ee04-8549-488e-a8fa-4366d1f8d344", "value": "T175141216CE523EEEE1892034054B56B27BB04B602A8C26D58E78F51FCF14E97BD419FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516991, "uuid": "73673e99-3d83-442d-b12a-97b9af89f0e3", "value": "66705cdb56563b943c0625fe791d561e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516991, "uuid": "41ecf863-6a00-4064-bf94-22b382f1a3d0", "value": "6144:mHPloeSI3+MjisaN/Jmt1ydN1xDet2jThjxLp:mO/BMusa/41ydrhjxLp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646516991, "uuid": "24e4a4b6-679a-409f-a1bc-e2fed2dada70", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646516991, "uuid": "c1b5b9ae-b241-4acd-978c-5ce0e9c98e7e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516991, "uuid": "c1ab9db2-be39-4537-9ce7-ce39213243aa", "value": "d147faaa185cb188a6d981e0e495ae7b9c979d9a5020075e7a590b1e45f96eaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3760a9ef-9ca0-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1646497247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497247, "uuid": "1bc47b3f-a4ab-49d7-9748-959bfa871051", "comment": "Malware payload (AsyncRAT)", "value": "26018ed12cfcbeb8371da659483a0125", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497247, "uuid": "a44c27a5-353e-42b2-ac74-e0eb0d0e845f", "comment": "Malware payload (AsyncRAT)", "value": "d1e709c8f098e39e71930e04f385c6997ec2a84425d57a70476baf71c9fc72b8", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497247, "uuid": "100453da-a40f-455a-be1d-e8114495be2a", "comment": "Malware payload (AsyncRAT)", "value": "b85b6b726a21e5fbd9e4793165f1e67d6c756a95", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646497247, "uuid": "36013455-720e-46a7-934b-621c6eaf20db", "comment": "Malware payload (AsyncRAT)", "value": "072a6f3f2030dc0bb1a77a8cb4347c11fc86e0edd170a00b436d97f99db769b3af4bc8ae2ab08bde05213821d79de98e", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497247, "uuid": "035ee9ef-b472-4f67-b7de-b1db665577ea", "value": "T18A44B7A0F2B5C8DFE86552B09CDAF81021936D6E9461960F34D67F2EA8B3353105BB4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497247, "uuid": "4cc74a24-9d1e-41ed-89ac-724ba870990f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497247, "uuid": "75c69963-4bb4-4de3-8dab-ccb30a703c04", "value": "3072:euIeTYUy2nBIXKYgbSMLPC1K/5G1NmggfyTj0KggLV0FyBJirBwtHwwEJx5EhF/i:euI+/mKYgb1Onl6tA5I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646497247, "uuid": "199a866f-924e-43eb-bab6-609a64a731d2", "value": 260096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646497247, "uuid": "f468832d-8681-4471-8d44-8dabe5459495", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646497247, "uuid": "bbeb9657-4906-4039-b41c-f12163a0a297", "value": "26018ed12cfcbeb8371da659483a0125.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a30facfb-9cb3-11ec-9275-42010a9c0029", "comment": "Malware payload (Hive)", "timestamp": 1646505589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646505589, "uuid": "10ce46bb-d5bc-431a-bf32-083a9b0e3a48", "comment": "Malware payload (Hive)", "value": "2b36656c27281aded15c0a2f37e4932b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "ReverseShell_Encrypted_Win_x64", "colour": "#09A4BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646505589, "uuid": "56c87803-dcf8-4d91-a3a0-915dc8a7c106", "comment": "Malware payload (Hive)", "value": "d3074cf95eec9d07e6db415cf1ec236fbe9d7cc8857107bb96e0b86bb52ee298", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "ReverseShell_Encrypted_Win_x64", "colour": "#09A4BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646505589, "uuid": "c09fe826-8314-4785-92f2-1faaaddc9e3e", "comment": "Malware payload (Hive)", "value": "632eed575b215dd76314449045e070708a5cdff5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "ReverseShell_Encrypted_Win_x64", "colour": "#09A4BC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646505589, "uuid": "ec4147ea-a513-4479-ac7e-8ec6c0022ff3", "comment": "Malware payload (Hive)", "value": "f24d29a49d9c2a247d51c3073fdb1fa7dba92f97424f120e79e8b62d54e9e13b88ede1e85f99faa28167ccf25fdf83c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Hive", "colour": "#21FFDD", "exportable": true, "hide_tag": false }, { "name": "ReverseShell_Encrypted_Win_x64", "colour": "#09A4BC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646505589, "uuid": "0fc1aa39-359f-4470-b9a9-afdfaf589be7", "value": "T123E52816F8E614E7DBFAF1314CA2666276B27069433137C36E54466E2A1ABF43E3D304", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646505589, "uuid": "39e0abd1-c4e4-43a9-bb1d-46b2cc990d99", "value": "96c44fa1eee2c4e9b9e77d7bf42d59e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646505589, "uuid": "6e8192ab-3545-4a27-bb0c-53ba81d68765", "value": "49152:ssHV8UymSDqMm5sppgvmf4jGbZqa3OLudk:wmIqG6jw+Lu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646505589, "uuid": "d16ee050-d356-4414-bdab-bdcd8175be2a", "value": 3249152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646505589, "uuid": "f396946b-162f-4755-9bdf-a2e8ee16c8e2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646505589, "uuid": "f89c7c34-50f5-4bf1-a188-30dfb89c3fde", "value": "d3074cf95eec9d07e6db415cf1ec236fbe9d7cc8857107bb96e0b86bb52ee298.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a202b9ac-9c69-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646473804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646473804, "uuid": "47074151-d0e1-4a94-bdd9-adc2511e66b0", "comment": "Malware payload (Mirai)", "value": "22a79c6217065d45b87b9d841bcac0a1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646473804, "uuid": "c8843145-56dd-4a1c-baa8-d301467c4133", "comment": "Malware payload (Mirai)", "value": "d4289bf95f96fd5c875e145d67ce80b4b3a57f03b82665a395aaba6b9d878e22", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646473804, "uuid": "c87c02e2-19a3-47cb-92a4-e4e47c7e8e8a", "comment": "Malware payload (Mirai)", "value": "03deff03fee5d1182beb237c91157873c8c788c0", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646473804, "uuid": "ed8f53f0-94f6-499e-8d41-52317d8ee53e", "comment": "Malware payload (Mirai)", "value": "fc8271b7b52b22555d784df294386cc6b556d8e4a96d482f8e149a77eba3deb5e2a8b01fb2ccf1933ed2e0934304f798", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646473804, "uuid": "2bd212e8-5ea2-402d-a82d-f1d77da19e6b", "value": "T1E4233AC4A683DDF6DC1506B53077DF7286F7F87A2117EAC6D398A933A842A01920739D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646473804, "uuid": "e4cf2a89-a258-4c99-805b-ae3155acdfe2", "value": "768:vSwFkQKLX8Tmb9fo+AR4y0aDO2efoOClnBaUcQABWezLyAc:vSwFPKLX8Kb9aECblAUcQABpzLyA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646473804, "uuid": "57aa98c1-5884-469f-a850-445c68b92526", "value": 49936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646473804, "uuid": "a05d6d96-a766-4fcb-b68d-cf0f21935f2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646473804, "uuid": "2aeaa96e-6738-40e5-a331-012e4a295958", "value": "botnet.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126a8664-9cb1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646504487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504487, "uuid": "8719d365-6b31-481c-863d-e8d549b93146", "comment": "Malware payload", "value": "2470b220c0efaa397d6aeea18abdb0bb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504487, "uuid": "94d51bf3-64a4-4536-833b-73f1a618f1a0", "comment": "Malware payload", "value": "d5faba20007266314cf176b9e49ccbc35c3fd2b0982fcd73f7b5794539b42e89", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504487, "uuid": "686a263b-d862-473a-9a00-2aee877ec368", "comment": "Malware payload", "value": "099629a545b4c01401f779e3d0e1a5ed452ddaac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504487, "uuid": "078f4596-60dd-434b-a0a1-5edf082dff44", "comment": "Malware payload", "value": "7ac3331c55f8fbf0e0330fb79cd019d5897cfa61bc16747aed1202b66378a55abc8e5accf37de28fa883d50abd3cc0c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504487, "uuid": "4f250ccb-9027-42c3-8ce3-b3e0934160e0", "value": "T169450200B6A0D039F0B746F8797AC3ADB12D7EA15B3058CF62D93ADA16342E5DD7121B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504487, "uuid": "226638d1-3f6c-45e0-98da-37081af05d75", "value": "fb47a0c49571b404f0af055a9f8d98c4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504487, "uuid": "8c62de0b-e789-4d40-846f-cbe4d1404cb7", "value": "24576:R8PaxNrmX7xzc+60sQ0FORcA5+JcxH8veLj80eDY:Ry77RV1/RcbJkI4jbE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504487, "uuid": "5f86f920-e6dd-47f3-854b-3c2558cec16e", "value": 1170432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504487, "uuid": "bcba8489-b262-413c-8e99-7c470a8a5f28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504487, "uuid": "4af0e098-0483-4822-a4d4-f05d4a6b31c6", "value": "2470b220c0efaa397d6aeea18abdb0bb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3aea1e3-9c78-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1646480330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646480330, "uuid": "42e25f3b-ed10-4d47-9b6a-5ea13559f41a", "comment": "Malware payload (AgentTesla)", "value": "c3d67a917a73b7bb223616fcfb70a9d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646480330, "uuid": "41292408-3771-417b-a5fa-b58b2437646a", "comment": "Malware payload (AgentTesla)", "value": "d974dcb65417b82c84aa8d1382dc731502039bab290b6d0ebed10f34074e76d7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646480330, "uuid": "14f91ba7-dd12-4e6e-a628-ba997c108914", "comment": "Malware payload (AgentTesla)", "value": "adad0ac620cb8b44e68fff3cca1c74d027090f86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646480330, "uuid": "9383d995-fa1d-4c42-868d-178a20470d5f", "comment": "Malware payload (AgentTesla)", "value": "cf8ce11f72366dfb52f7c0f1f7c560392d8a6292be6101c76d9b93619438bdece20d80a9d145c0d2f562465c7c701def", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646480330, "uuid": "60f4c41b-2073-4dd0-b1b7-4ab74c1fe637", "value": "T141030897667F15E1C654873BD0A785FC0B20AE2A7C53DB1B384A332D18333AAF749A15", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646480330, "uuid": "bb83f5a7-e499-4b92-9e6b-35a340779a39", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646480330, "uuid": "053e6c1e-aae6-4920-8126-d6fe2404113f", "value": "384:fTHLc4eJRUeSZQF6Fj31sNEXmiHJdsOKMA5Oo9IWAuuQ6O9G8bqxCNJ8veGEjZ:fuI7R1sNYjpyO2Oo9k0KCNJ8veG+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646480330, "uuid": "08589e33-7840-4c98-aec4-40f89b328f0b", "value": 38912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646480330, "uuid": "d9299556-1b1b-4f78-86c8-2ac3ca2423aa", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646480330, "uuid": "c690ed59-7099-4618-9981-76f4c87481b2", "value": "874093401023.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd4d3546-9cd0-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1646518088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518088, "uuid": "65a6419b-e9e1-4719-9539-2c6a57f923b2", "comment": "Malware payload (RemcosRAT)", "value": "8d31daef4c7bad17edcd2e08adfceb27", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518088, "uuid": "7dc3f3cb-8008-4765-88b9-a4bbe1e48ce7", "comment": "Malware payload (RemcosRAT)", "value": "d97645f56a185c3501e768694cbaa8d1b6b9c2f134a6d4d465052e0ccd7666dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518088, "uuid": "29ef4e45-8bbe-4a68-a801-7d6942f2fa5e", "comment": "Malware payload (RemcosRAT)", "value": "97c1901550f02893f81be8532e5d50a801569589", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518088, "uuid": "3edff7e1-08fa-48be-8ca5-bc8e0fd14092", "comment": "Malware payload (RemcosRAT)", "value": "42933a20b87ce64530c306417a185be10612c19613cc93cdb0cd5bf79d807d4a8832810ef285512266994c4e2a782051", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518088, "uuid": "b9cd8417-1839-4c2a-a606-f1e918a53c97", "value": "T1F4A4BF11BAD2C072D97251340D29FB35DEB8BD202935857BB3E61D5BFE30180A72A6B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518088, "uuid": "4dd3244e-29c0-4cc0-a91f-ed7152e763e4", "value": "029a987f21e33b48f24d21b6f9ff1129", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518088, "uuid": "9d21d39c-5f52-4e32-940a-75ef2a24840f", "value": "6144:HOFBH/FMNjt18F+9a/NgAeDB4CcOtKp03b13a4LJ+sAOZZPWXbTcUgyg:HOFtiNBuFgawDB4NOmuwsfZPzyg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646518088, "uuid": "8ceba6b1-f7e9-484d-9bd1-f99dac5e0060", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646518088, "uuid": "c02443fa-56cc-4a01-a268-1c93a51102b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518088, "uuid": "8aca60a0-0738-4653-8df3-04e85029d9aa", "value": "8d31daef4c7bad17edcd2e08adfceb27", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "962110f2-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "003d5ac7-1bb5-4766-bdae-9a1769a38bb9", "comment": "Malware payload (Heodo)", "value": "29fcb492d03e175c83ba7400042758dd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "d8f5dbde-4f0f-42ee-add8-f57fe7bb0677", "comment": "Malware payload (Heodo)", "value": "da96e2485275e982de18b5cf7caaa0d67ceaae543a7c4cf96088d7f06a6a601b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "9ec5b573-1d2f-43cf-a3ec-ab08950d143a", "comment": "Malware payload (Heodo)", "value": "29e1fe8c85c4070248fab9860bb79aefa59cf8e5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "0e7b1300-0b1f-490d-85a5-61210be6d28b", "comment": "Malware payload (Heodo)", "value": "afcd3f35ec4c4701a6bfb04d7fbd861baca163385d78427baee8a9c5556d15cc3e150a7614026ba5bf39f359470dc5ad", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "9bdc7f58-a272-460a-a390-27da81435984", "value": "T18794DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "633bce5e-d24b-411f-ba8d-71777d549156", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "857fa169-f1d5-4907-a98c-7a29ee0c7111", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8CCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCraTuiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438565, "uuid": "d5bf226d-6de4-4fdf-8eae-84585afbf77f", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438565, "uuid": "58495f96-4cd6-4665-919a-29538f0168f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "986bff55-4af4-4676-8d66-d0edab7687e1", "value": "emotet_exe_e5_da96e2485275e982de18b5cf7caaa0d67ceaae543a7c4cf96088d7f06a6a601b_2022-03-05__000241.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a31642-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "773cbe50-e060-43e8-b79b-84755d36fe21", "comment": "Malware payload (Heodo)", "value": "d1a5ef83bd87b359420c8ea337a30ddf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "4b7a764b-6c70-4688-b41a-2c9dfe85962b", "comment": "Malware payload (Heodo)", "value": "e05b17cfa53636e28c99c3c4833734523b633a7afecb77f4d27fa9b120ba6707", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "a73ed4c9-5d25-4025-810c-4a4b113b2c1c", "comment": "Malware payload (Heodo)", "value": "8025760989a5bb9427d86cea40f9ffdb91693ca8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "4244f26c-86b2-42b2-9b4e-00afdada92ff", "comment": "Malware payload (Heodo)", "value": "9515c67b8f829451bbb3c77072c92f1f705146dd012a9a88983abb82ee5d0452d288bdd94287fc53d711f610cf2b908a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "06e734c9-ccd5-4b1c-9ee1-822de92f8b71", "value": "T1B094DF007AC6C433E1AA063949A7879467FDBD52ABF1C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "d2975aac-3feb-4c61-9cd0-7b5297dd5108", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "a4af5aa2-8dac-49e7-bb01-556c967f6357", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8jCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCrawuiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438565, "uuid": "bee2a14e-19a5-45d7-9fdd-42683aa1551c", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438565, "uuid": "327b8761-854d-403b-ae1a-3c75b3e409de", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "b188a4f0-ad2b-49f5-8c72-1dd66b933da0", "value": "emotet_exe_e5_e05b17cfa53636e28c99c3c4833734523b633a7afecb77f4d27fa9b120ba6707_2022-03-05__000238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "117b25f9-9c9f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646496754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496754, "uuid": "698636e0-b503-4eab-8e15-61b5b6351629", "comment": "Malware payload", "value": "a743fa049485d8a9c54d15b36cbfb2da", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496754, "uuid": "66dd6f6e-ee7c-4cb0-a97d-3f11aa01f253", "comment": "Malware payload", "value": "e0ccaf097725852d4ff0a8c6f0e33b69ee2a002282810b37090976baabbb6686", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496754, "uuid": "220d83bf-73d7-424d-b774-7faccf3bce0b", "comment": "Malware payload", "value": "39852c1d32172e443f0a0ac194a7c81c1660306f", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646496754, "uuid": "76480a13-3e67-49d9-8d84-e61078f2d26a", "comment": "Malware payload", "value": "fe270384105fe6e45d674496931cb7b8aaf946bd4477080b4c4b3979ce430e485d8dcb8a0dc1048cc0bafe6bf3972f07", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646496754, "uuid": "044dd972-4b4f-40a6-907b-8b978cceef07", "value": "T1A0063300B1048EF1D646E63E4FB6290ED113D412392A6EFD1F18C65CCDA6AFFD982C56", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646496754, "uuid": "6802df25-8372-4ef9-b8ac-bc228258f6d8", "value": "98304:1ScEmroLwfhqTk4zK6cHIamVJKMqa49GD+RR:Smrrfp6fM9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646496754, "uuid": "ba9af847-0f15-488e-8dfd-164d5b2658ea", "value": 3669684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646496754, "uuid": "01bb6276-fc7f-4f0f-b50d-2591c9678b31", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646496754, "uuid": "2ac46dad-fcb1-495b-b4af-8ad6fc77fe3d", "value": "Portable Power\u00a0Station\u00a0Pricelist \u00a02022 230V.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e97f0c24-9cb7-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646507425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507425, "uuid": "53cfa1b2-baab-4929-819b-3790f2a5b462", "comment": "Malware payload (Mirai)", "value": "f0ed9add682e3bd99513a8a212964146", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507425, "uuid": "2f4cfeb0-a23b-4c30-899b-ff9d88e3f0f1", "comment": "Malware payload (Mirai)", "value": "e131454a6be6b9a20cfcace62ecfbfdbd04bc803fdfe884dddd6311ee0567fbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507425, "uuid": "98c55c59-9875-4c61-9c3d-8d24483605c8", "comment": "Malware payload (Mirai)", "value": "9f4202e62a365603fb5ae35d41d7e29afb3a5be2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646507425, "uuid": "a5d6fbd5-b9ad-4f17-b4d8-a5b029cb3510", "comment": "Malware payload (Mirai)", "value": "235a60d122058817039fd344105dfcf3cd24d646c4bbe831c2f8533afa350c0bc699c7c3fbe25eac60e7de4f48568e21", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507425, "uuid": "8f77b1b2-fb75-4b22-b650-8743c63de289", "value": "T16B534BC0B643E9F5DE020674306BEF324E37F6F6211AE987E3E49573AC425419643A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507425, "uuid": "c6aefee1-1038-4bd9-8de2-3afca1ecec62", "value": "1536:mX23TSwlS4keBfrtOVqlQzYnnmKBPKlo2UWmsvnt05nFEid:1jSwY4keBfrtOCQsnnFkmWBV05F3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646507425, "uuid": "bf5fd6ac-f74a-436d-a01b-e93cc5d5b241", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646507425, "uuid": "bfd7e230-35e4-476e-8e8e-32d86b1bcb57", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646507425, "uuid": "5c727558-ea88-4868-94b3-65ed08bb6a29", "value": "f0ed9add682e3bd99513a8a212964146", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9598c5c1-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438564, "uuid": "47314992-a68a-470b-aa4c-dd49ea31be83", "comment": "Malware payload (Heodo)", "value": "418707eea0b75747c525e85279316181", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438564, "uuid": "527dd998-0cf9-46d3-ba07-b5b4f7ede049", "comment": "Malware payload (Heodo)", "value": "e47c80b80f7b163a82fe464fc3783e5093027210e86db43bd80b651220e1e7f1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438564, "uuid": "4b310113-5a85-4a53-93ff-320256580adc", "comment": "Malware payload (Heodo)", "value": "c51d1a02c6ff39107839ef12f3ce92013919b0ec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438564, "uuid": "a930f96c-2964-42a7-a8c1-c7d86138d62d", "comment": "Malware payload (Heodo)", "value": "b1b662a28ad327495b572b40bff068967315d8f47fdfaa653d7c8d2c442f29b1dc63285bcc46f4820ef67db8f2ba9342", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438564, "uuid": "e01db248-4b8a-48af-a1ed-c395c2968c2e", "value": "T16194DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438564, "uuid": "b8708b73-789a-4902-ab59-3760a63ea833", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438564, "uuid": "52ecde8a-eb7b-450e-9c70-31fc0e56bf2a", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra83CtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCraQuiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438564, "uuid": "df8babb7-475d-432c-a168-79b851ae8154", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438564, "uuid": "fd40d274-223f-4fdf-9e23-db543f44c5b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438564, "uuid": "67b11bb9-6e30-413d-b099-11466ca52493", "value": "emotet_exe_e5_e47c80b80f7b163a82fe464fc3783e5093027210e86db43bd80b651220e1e7f1_2022-03-05__000237.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c1b747-9cbb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646508943, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646508943, "uuid": "a0586289-2559-41cb-ba12-db9237ea088b", "comment": "Malware payload (RedLineStealer)", "value": "b3182c689bd32b6f479e1f7a763b853a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646508943, "uuid": "f28de6f9-cb3b-44ac-8df8-8ed600bd41b5", "comment": "Malware payload (RedLineStealer)", "value": "e4e83da67fd3f55e11731966f74fcc95a418ae4c0e93711bacd5876d6f768eaa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646508943, "uuid": "6bf9a798-7a2c-46bc-9a84-e850e35fa3cb", "comment": "Malware payload (RedLineStealer)", "value": "58f3a1007b3d8359678d5152f4f15377bab96d7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646508943, "uuid": "2b6f56de-ede8-4b5f-92ab-3256cc821b10", "comment": "Malware payload (RedLineStealer)", "value": "3faeb85204bedb33179023e00698302a9dfaab7215d25a29b8ddff0f50a5399b0962d9c5e368c9d78c16f63d5e88f96d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646508943, "uuid": "96594884-8827-417a-b1c7-518709efebc3", "value": "T10BE1D710E7F85233DEAF8731BC63974013B0B7A1E927CE6E6C8C624F5D266950562A72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646508943, "uuid": "1b33ed89-bc3d-4de3-b332-db7e3e4c5e63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646508943, "uuid": "0cd372b9-40e5-4082-940c-48b1361fdde2", "value": "96:wyr2gYIQkcOJwj0lqwG2RiJtP1H7c4+YskurCdtPSXguAzNt:wyqgYIBxXqwGoiJF1bcIsbrwqC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646508943, "uuid": "e6f2d849-1eef-4d63-a343-5e9a41bd2247", "value": 7168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646508943, "uuid": "82379fca-618c-436f-a666-3e2f2381986e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646508943, "uuid": "7f15aab2-7ef8-4926-a327-8985665d44fa", "value": "e4e83da67fd3f55e11731966f74fcc95a418ae4c0e937.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "474d4ec9-9cd2-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646518749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518749, "uuid": "f788f731-3932-4e21-b888-7a4e14f6f203", "comment": "Malware payload", "value": "4320c4418fdbd5b344c9eac1c9399019", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518749, "uuid": "6b780782-88b1-4f47-8818-4049903f3cfd", "comment": "Malware payload", "value": "e51c6aaeedb70a59c6fa06badecb8b56282561e5cad6925257a1bae99ea37845", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518749, "uuid": "825ac191-79c7-4041-a8bf-602962fbc05b", "comment": "Malware payload", "value": "3705daeb07581e12da9b4314b2b24d3be591e14f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518749, "uuid": "649efbfb-1837-40c5-af9e-fed5b47b8e47", "comment": "Malware payload", "value": "1f7e36cbc9ba9dfcc06a61e30cbe30a3f9738d02dc4ff53b22b1037fc06f0e36a82b38e400c2f63e3720be14e458f1d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518749, "uuid": "917af71a-16cd-4378-82f8-b5866081bba7", "value": "T169A503089147E27BFCED08A3445090D0C39C7FAA7B528DCEE97AD58A151F482F7B6D86", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518749, "uuid": "0d432f68-ab54-4deb-bb96-d31e123b42fb", "value": "ae9f6a32bb8b03dce37903edbc855ba1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518749, "uuid": "b66e067a-6389-4aa0-bf0e-3c9f64fd8a2f", "value": "49152:H6/6u8zWZ70+vyUNrdcOJbFJVu/CJtl19dSn:H6/SCZxvyUNrlJJD7rl/O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646518749, "uuid": "30528997-72dc-40d1-a352-3630ebc6e6c3", "value": 2069497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646518749, "uuid": "6e0030cb-4620-4d09-b450-9d0eb9a1609c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518749, "uuid": "ca4b0348-0506-4417-8788-ff0ba79bc5fc", "value": "4320c4418fdbd5b344c9eac1c9399019", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db4bbc72-9c43-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646457579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646457579, "uuid": "1f919971-5484-4fd4-aaa6-c1881e9a519a", "comment": "Malware payload (Heodo)", "value": "29970559528218b64c0457a32986fe65", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646457579, "uuid": "61fc026e-e554-43df-b08d-e45d8b430ccf", "comment": "Malware payload (Heodo)", "value": "e5726f029febfaabde9b31c4ca6fbd578eda5b4b19c46d71e75eb9739f0f48e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646457579, "uuid": "64b72b28-1455-4d65-83ed-9da079cfc48f", "comment": "Malware payload (Heodo)", "value": "0e99dafdaf29ade5660f7787de24c6bda319acf9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646457579, "uuid": "b6547fce-d36f-441e-9ddc-11fedb4e7856", "comment": "Malware payload (Heodo)", "value": "34a4c29423c6806bb61cb8936c1719568ff8576fba73b4c5679e3944e562d5ec0ee2cd70ccc6cd850e06b15a5ff6f86a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646457579, "uuid": "f610fd0b-fd07-4b84-9623-ed0f27aa004d", "value": "T17A94DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646457579, "uuid": "b1386ea3-c26a-479b-a974-04cb2d4043f4", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646457579, "uuid": "b56e9190-87d4-47fb-99fd-9588313bbf7e", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8DCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCraguiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646457579, "uuid": "1646ea34-1949-4992-b061-deda487ed05a", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646457579, "uuid": "c7610f42-7793-47a9-883e-468d5ab4751c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646457579, "uuid": "800c160d-211c-436e-abb8-d4938aaa0494", "value": "29970559528218b64c0457a32986fe65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c3f197-9caf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646503600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503600, "uuid": "3e69d476-abcc-41f6-a2a4-87c237192422", "comment": "Malware payload", "value": "012fd36607a0bd80405024a823e81496", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503600, "uuid": "eab9cda9-a8a8-4d45-a970-ef44c50e083a", "comment": "Malware payload", "value": "e89ea054615a049cfc74ceb6142bda587594347c040eec0df98bdef519614046", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503600, "uuid": "d3dad4d0-74e0-475e-a9e2-e01a6f7829d3", "comment": "Malware payload", "value": "a0ea9dfbe55ba1e1745fb1771238a49128a823a0", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646503600, "uuid": "7853bb42-3284-4ebc-a8c8-43c93c4dd470", "comment": "Malware payload", "value": "5582887193071f10ec6703ed948b46ad76edeca8df8d01de9d76b98b53f57d7441aca2b57ec36e26e7c76294268dafbf", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503600, "uuid": "498f8360-9b50-4ae6-99d5-f68783ca0be6", "value": "T1FF1454545E0E6FC0C73065865C297F283564F982E2FA0743D2A917DF9FAECB2699308D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503600, "uuid": "18446c0c-436c-4e1c-8255-9c736e1fd109", "value": "1536:yEcNbwLxu2Rh3R3YM9ixIRNYbNMc+p5PC1+yPcAhaIKdILNHAqUT3Uf09m+s/xzd:yEsbYB7VC17dUja6GzljeWp60mny5j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646503600, "uuid": "8bf8514e-d58a-4ecf-a8c9-8d57e321a666", "value": 201609, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646503600, "uuid": "100d1c9a-8cb2-47a1-b7a2-b85b03741560", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646503600, "uuid": "8fcf50dd-f922-4d2a-b9c4-d19c3c548701", "value": "RE Draft Shipping.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f72f27e-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438527, "uuid": "8b698223-dee3-41fa-b898-25d35d6ee412", "comment": "Malware payload (Heodo)", "value": "8bdfc2ea9378ffd9a6ab3aadff4e77dc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438527, "uuid": "1bfeee2c-93b6-4220-8a45-5444633b7e52", "comment": "Malware payload (Heodo)", "value": "e8c547d76198409717a98ac2e8a1f86bcc0e8bd134c6ab3e108d7be8f5460ba2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438527, "uuid": "0bb94415-80a7-425f-94df-4d248a0446aa", "comment": "Malware payload (Heodo)", "value": "480e26932f27a19934aa94cd36c365377e143050", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438527, "uuid": "4524e7d6-8795-4a95-91ad-ca7acfbeb145", "comment": "Malware payload (Heodo)", "value": "1838384d2d430c3eb43349c4200bed3de8a722b01f0f4b69dee9429f834567a356fe6d083dc3234a820c233675a21cb0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438527, "uuid": "d6efde69-04d3-4f47-9d65-222fbda11fdb", "value": "T1F6057D22B9C19172E25F13B629D8DEEC33AE5A3107D1C1DF5AB41ABD3E729E15630603", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438527, "uuid": "c1f18813-f491-45ff-a4a0-03b25cc14f63", "value": "810544f6d1cfc4b1abda96d46e502763", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438527, "uuid": "8bf7592b-ca5b-49df-8f2f-760329ec8e74", "value": "12288:78u2rsRwkKeb6hsHN36rXeL09CTZ5X2wWRU3zaEq366QkkOYaPG8Lik:x206S49CTawWMaEq3XxkOYaTi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438527, "uuid": "51df1923-6876-437c-a8f5-270a07186177", "value": 837120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438527, "uuid": "b8a52183-21a2-4504-a21e-fb29892713a7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438527, "uuid": "30e84562-b351-410f-9312-536fb77301a4", "value": "emotet_exe_e4_e8c547d76198409717a98ac2e8a1f86bcc0e8bd134c6ab3e108d7be8f5460ba2_2022-03-05__000202.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c23bc4a2-9cd0-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646518096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518096, "uuid": "23d67328-edae-4b95-ab93-2e6eb10c9f86", "comment": "Malware payload (RedLineStealer)", "value": "4c2467d5a7b2c311a1b91914e48d2482", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518096, "uuid": "ee9cec6a-0ab1-4c5f-89e1-63d04bac3cb8", "comment": "Malware payload (RedLineStealer)", "value": "e95cf153e4750bed773e6538a3aae637220049c51f39091590606f820fecade2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518096, "uuid": "1b24566f-db20-4126-9d55-ce3e693ace04", "comment": "Malware payload (RedLineStealer)", "value": "ce9ecd9a6fd8023eb032775742b3d3da400cd715", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518096, "uuid": "12f18127-f23e-48cc-8d80-842164d19857", "comment": "Malware payload (RedLineStealer)", "value": "b19c6a074bd73db847fb3872c35291a25b867510ef0e14e0b3e25e9cceb37062c3ffdb15f443647a6abeb6e6c4fd4e77", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518096, "uuid": "18ddc6e0-c507-4d49-ae75-dbf3447a7ee0", "value": "T10BA412504715BC36F2668975E18B6A60D5239F992F32917E12B33F313EF038B9942A32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518096, "uuid": "070c6528-79fc-40af-8634-6b45c7893441", "value": "79be7b9f03136161a531d7bcd90d4708", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518096, "uuid": "9fd9f57b-4049-4cd0-8f46-7805635cfebe", "value": "12288:m2kX/1MnQTX2m1zH9UnHC5tzj8WvntA1ZXg:mdSQT22anQh/tA1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646518096, "uuid": "b569ee0c-6c6a-464c-b6f4-902adfcf8944", "value": 488736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646518096, "uuid": "68b9ddb2-1eaa-4034-a6fd-b0ee1b733bb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518096, "uuid": "8a14962d-1128-470e-84d9-e9e79d7fdb5c", "value": "4c2467d5a7b2c311a1b91914e48d2482", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80e6ee0f-9c3e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646455280, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455280, "uuid": "37b2807c-7d55-425a-aff1-e8a87216dc9e", "comment": "Malware payload (Mirai)", "value": "eb0a5ddb5676598e4f9b46f51a956361", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455280, "uuid": "57c95560-f568-46f3-9e00-90365968004e", "comment": "Malware payload (Mirai)", "value": "e96733719718e2d182e4246c7f4f5c6f2499d625dfabfcd62c5f3905df833969", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455280, "uuid": "520ff28d-49a9-4f34-8212-4d52bbc57dc2", "comment": "Malware payload (Mirai)", "value": "2e8055fe19fce106d675181e23c21f2e6d7329d1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455280, "uuid": "8a58ddf3-d249-4841-bc0d-b96f189e3b0e", "comment": "Malware payload (Mirai)", "value": "843e3d467bb4d90572b444fb0cda0eeaaaf0e6b2def5510a8aab2001ec69dece9055d7e96cfa1412530b8d81a710d021", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455280, "uuid": "ff9c4c40-6852-4ef4-85e7-8ac829684ba3", "value": "T182C2E156DBF5DEEEE415833F24498D56209AF8E343DE12332B9D072131AB5600265EE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455280, "uuid": "f73d0845-15a4-4d8c-b303-e2571a2a473d", "value": "768:VFjC7WUARSpqU86YKzQmtV8tv3YDgmqO9dXr56:VFu7bAQpuKsmstv3gVn56", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646455280, "uuid": "2830761e-a2e1-4275-a2b8-230fd4dcbe61", "value": 27736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646455280, "uuid": "a03a2cfd-7304-491d-8ea7-8a13a61e54ff", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455280, "uuid": "f967aa74-dc8d-4079-a5d2-fd5adfd97faf", "value": "eb0a5ddb5676598e4f9b46f51a956361", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2aeb92e9-9cce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646516983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516983, "uuid": "3e0a10d5-c1b7-4dab-9d0c-ce69117e0af5", "comment": "Malware payload", "value": "d13efd9d9a3608ec751b3db713f30882", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516983, "uuid": "4bd93b4a-881d-4955-ad2b-78179bdeed15", "comment": "Malware payload", "value": "e9952e1e48f30c612a36beb04117065ea1930a4fa42201a3d6882fb3a550a0a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516983, "uuid": "88d41d79-b819-44f5-beb0-c855ab2f3c32", "comment": "Malware payload", "value": "f4be7583ee4b45b01d72436ca8c7bb58660b5db2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516983, "uuid": "7a7c4202-9aba-4890-a5db-2cca84ca02a0", "comment": "Malware payload", "value": "f4e1a0598e49f99c214bbba1f5344619581d1adb90797224a287b1acaef5123c64326d5793138ab2ba7b9d833ab16570", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516983, "uuid": "a53ec103-fde0-4a27-b32b-64a17a3b8f7d", "value": "T1871412088F823FADF58220351A8B1B73AB605F647B8827D95671B215CF10F8B7D4795A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516983, "uuid": "e9fb7ef1-5550-4fe0-a657-9f41450747c8", "value": "66705cdb56563b943c0625fe791d561e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516983, "uuid": "9413e05d-89c0-4bdf-8cd8-5d5ca67b324c", "value": "6144:mHPloeSI3+MjisaN/Jmt1ydN1xDet2jThjxVqwW/Z:mO/BMusa/41ydrhjxVc/Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646516983, "uuid": "5c07bbcc-ce80-46b2-9fe7-6c09427fc7bb", "value": 198656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646516983, "uuid": "ace96ef8-b3f3-4825-a466-78b7fa8fb7a3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516983, "uuid": "bb3199d0-0e44-4334-b4db-965062bc999d", "value": "e9952e1e48f30c612a36beb04117065ea1930a4fa42201a3d6882fb3a550a0a1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84304a0b-9cdf-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646524435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524435, "uuid": "65858796-2def-4f35-b021-73e372b080cb", "comment": "Malware payload (Mirai)", "value": "b671af4195398ed4547a5296e726c186", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524435, "uuid": "3c290646-d47c-4ad7-bb08-b274f5ac9357", "comment": "Malware payload (Mirai)", "value": "eac734849fb299938a828cc4593b238f48e41dcb82c8f2b09ce7966f317d3631", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524435, "uuid": "7540952e-5264-4ca9-b986-da0cededc1e6", "comment": "Malware payload (Mirai)", "value": "ba1179917bf4f04a2b46bb8422b59bff1485c7f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646524435, "uuid": "145eeb86-4b4f-45cc-b703-376fa2ec211c", "comment": "Malware payload (Mirai)", "value": "74a92455ab55fe151c686db2925c2ce5cca225628753fe9a15a3aa2b044e71a8844ebd41934e0fcbb16363a49bed1413", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646524435, "uuid": "08ec3a2f-bc55-49e4-a8ee-99200f327a8f", "value": "T14F23AEB6C069ACD4C20546B4B624CB790753E50595A72FF15B46C6A68043FECF32D3FA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646524435, "uuid": "60cffef7-c6f0-40b6-b65f-8d03f989248f", "value": "768:/cahNHL1mc4tq8eYn/1hKWj96msN93HCCoINxo25Cvx:/cahNrwpr/vKWj96msNJCINV5Cvx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646524435, "uuid": "d8820040-739a-467f-9445-2098e0d53d31", "value": 47632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646524435, "uuid": "479b25d2-24c1-418c-be8a-e32e245cb88e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646524435, "uuid": "24012a55-019e-4133-93a7-8ee235605d24", "value": "b671af4195398ed4547a5296e726c186", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d80ed7c0-9c75-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646479049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479049, "uuid": "8fa72b0c-6d7f-4496-ba29-c6cdcdfe409d", "comment": "Malware payload", "value": "c15b65b99da31f886512e366921256e9", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479049, "uuid": "86519fc7-8b43-4ce1-b4ea-223b9b72958d", "comment": "Malware payload", "value": "eb1acafcd068747295beee5df8460f063f23a5c10ef795414408029ed2642941", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479049, "uuid": "f8e49a64-1341-4c82-9c7a-dd07183adaed", "comment": "Malware payload", "value": "05e51fc66f0d6d125d9db29c1bc2d6cf7c4194bd", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479049, "uuid": "53dbf774-94d1-4d14-a100-793af7dcbafe", "comment": "Malware payload", "value": "fa54f6ea01ce754fdb66f8317a54d717291acedb0d1e06a7b0ec61c9413a8691743e9be9f7a9d7bc5b584a13db12e32a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "joker", "colour": "#3BEB24", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479049, "uuid": "a282d585-76f5-4261-af27-27139d01a7a8", "value": "T17EC60143E76979BFD4F2873249796236443ACE198B43938B590C737829B79E81B85FC0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479049, "uuid": "ecf47bae-521e-4b6d-aed6-9aa013cd34bf", "value": "393216:eQEOjiAUQysskB52t3IPhmVUenK/LSS+Kk8ptpAX:eQdNyoAhIPgNKcGpPAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646479049, "uuid": "b109cf11-858e-4d55-b743-73e38c0a3d29", "value": 12590331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646479049, "uuid": "15364a7f-1e60-4d38-968e-e462d5929965", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479049, "uuid": "85acfe9b-56c0-470e-885f-75533e24c0ed", "value": "Love Chat Message_v1.02.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9889671f-9cd6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646520603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520603, "uuid": "73b1cfa1-81d2-48c9-92f2-ffb71d453deb", "comment": "Malware payload (Mirai)", "value": "6228098c492a2b41229b7cfac239c47c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520603, "uuid": "27ed72fe-846c-417d-a5b1-6e1a3a5c61f7", "comment": "Malware payload (Mirai)", "value": "eb28d586b5bf5b43bea9ad03bb4487081c01c49dd0b6967429d1988c601c1433", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520603, "uuid": "d83d1681-0481-4df6-89f7-439637e4a428", "comment": "Malware payload (Mirai)", "value": "2122157f7b19c1cca483b8c4577bf7db04dc867c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646520603, "uuid": "6f48a0ba-a57e-44be-9492-56bec6e8e2de", "comment": "Malware payload (Mirai)", "value": "8bf1f48b2d33d397d9bc54c9b8c993f5f48def531fa7f498d6c27898cec965760693342cdbe22c8b2bd5e3406a0590ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520603, "uuid": "131e4a58-fc93-44ef-8f13-11f64dd49d8a", "value": "T1AFC33B46EB408F03C4D61776BAEF42493323A754E3DB73065A289FB43F86B9E4E62505", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520603, "uuid": "aad2e9ff-12a2-4288-a597-74ea649fbcb1", "value": "3072:vDKIrBonb7iioszj9Gn89d12nNkOfuTPqM/9SKSG52:bKIrBWbeK9Gn89dknNtuTCM/9SpG52", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646520603, "uuid": "7c0e6731-a5d4-4c3e-87a6-1779639a71b7", "value": 129567, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646520603, "uuid": "b45650f2-565a-4414-8689-11352227c5dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646520603, "uuid": "abbff828-ecb6-4459-831b-7105c328ac28", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d34f7f4-9cce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646516960, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516960, "uuid": "c9a2477b-fdd5-451c-b8a0-d05a9bdf6f58", "comment": "Malware payload", "value": "f7b41076dbdac0979b7ba7cb18894ad1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516960, "uuid": "8e5eb848-d5fc-4dba-bf95-d587eaf25420", "comment": "Malware payload", "value": "ec1590bc310ba82de73e3da49e2224513d7c57fa4031b2836665f889a905a419", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516960, "uuid": "137ee4e1-a6db-494a-b01f-fe01133bb24e", "comment": "Malware payload", "value": "d4a7eb9333c1719e8c7b07af4201cb5d3b3a553c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646516960, "uuid": "fa8e0181-c38b-4a4a-b1f2-9e8a82bea534", "comment": "Malware payload", "value": "5d5400749f7a5f9f1b8731f82557373ad1eb2ae93a2c795e6410008dc345c705b2d9fc064f6a61cd834817541a39b467", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516960, "uuid": "a9c9fddc-b311-4a0d-9918-60b677c26ad1", "value": "T1DC23CF4797EC6949F0395A3C04B3A0026869BD715DB2C9C176C03A5F2946AD0BF7CF2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516960, "uuid": "b789c2a6-0136-4e2b-8709-c86a4d529acd", "value": "ade1474206621a72b6899480330f5e90", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516960, "uuid": "65713a89-caf8-4448-990c-99b42aef3d6e", "value": "768:y8mLJDbX25I1nUnNVoI/OtxvJKSk0abTWLvCr8B7mrCzfRr3K5a:y8ewI1nUNeIuMSTangNB79Kg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646516960, "uuid": "c7946d74-aa38-44a4-a12e-16e23fd44c18", "value": 48132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646516960, "uuid": "bfd4d9b2-ffb7-4370-91c8-679a2f45722b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646516960, "uuid": "0abe2b1a-f25f-473c-8895-1328f0a8e6df", "value": "ec1590bc310ba82de73e3da49e2224513d7c57fa4031b2836665f889a905a419", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e46218a8-9c77-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1646479928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479928, "uuid": "8c152915-8e86-49c3-86ed-0135373447f4", "comment": "Malware payload (CoinMiner)", "value": "a2719fcdabfceba2c805e0849f1a0173", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479928, "uuid": "8740ed9e-19e8-4e2d-9b19-0a20748b7072", "comment": "Malware payload (CoinMiner)", "value": "ec86b00b3f187f93e86711f82043af2ec359861bd60497b53998b0a28bc20d3e", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479928, "uuid": "72dba9ff-5055-41a2-8452-50b5d9547335", "comment": "Malware payload (CoinMiner)", "value": "31643b42aa8394c3488fb6dde1c150d5bcde4be7", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646479928, "uuid": "88d26bb1-4c07-4593-8fc7-f7b7d142f4e7", "comment": "Malware payload (CoinMiner)", "value": "7758ccd188924740c2d8f72b79a139268200f93dd65ffae73bd69788f24cb29d8a9f197189b2a2e1e1105bae602af870", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479928, "uuid": "853b8858-f1fc-447f-ad03-419c317258ec", "value": "T1B80633656F0214D5DE5EE4B8227669B072BEF2D63A30168A0638EDFDF6C14F18DE7018", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479928, "uuid": "02ce17a0-b8ad-46bb-b308-8a016d645a8e", "value": "84bb1ac192dd1d591766b467b12ade64", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479928, "uuid": "3130ae9e-dcd0-4bbd-8f43-7964beeb1c8f", "value": "49152:sB5KxGSzfgSHXNeWLrb8RKXmXbaQ8Z4LvHY4zlzpxAe9Fajo06hrnKPhIFrkxeDR:sBIrj3NeWLqXbaQk+vHYAk7duK2yuzP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646479928, "uuid": "633dd0c6-f63d-427b-82e1-75310be36a38", "value": 3935232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646479928, "uuid": "d0a73a6c-30f5-4c3b-be44-510a1aa4fecb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646479928, "uuid": "2cc7c39f-c1aa-43d7-8d30-dc7e3c83964d", "value": "mapper.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18fcd599-9cb1-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1646504498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504498, "uuid": "b9df87f4-8602-4674-801b-e7a1eaf0b791", "comment": "Malware payload (Smoke Loader)", "value": "fd68374b79182d936dc3b661de7bd104", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504498, "uuid": "662fbdf4-0712-4731-a8cb-a8690d056d23", "comment": "Malware payload (Smoke Loader)", "value": "ed834b2118524e0abe4a5bd48be5b2c1bac8b0b6c9430b87dc14e50fa915eda7", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504498, "uuid": "a9d509d3-fb36-4ceb-9214-7afebf39a526", "comment": "Malware payload (Smoke Loader)", "value": "61c4bbab9406395c8257fef4be855f4f603bc311", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504498, "uuid": "70af9d24-0e4c-40b5-bcd7-404b799f14c0", "comment": "Malware payload (Smoke Loader)", "value": "4e1b36c5e201b731c0291f85b912b75d523147b96d0519fc693aeb69acd2c1496945cd7d93c52006466dc8903240b91f", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504498, "uuid": "4e090b23-989f-4574-8104-099950263a08", "value": "T17A548D10AA90C035E4F312F8957A836DB92E7AA09B7554CF63D52AEE17346E4FC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504498, "uuid": "08031cad-c0ba-4c3a-8e04-b80770c3a781", "value": "74c91f6c2795156c5c810dd2bcd960ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504498, "uuid": "05a8b4fa-daf1-47d3-9f26-58d12a623d02", "value": "6144:u3S2lKCYNd5FDUO5WZYjfkfMC83YEwVlwuYTer8ZlW6sVjT:eShCYNdr4O52Yjfm8IEM4/X8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504498, "uuid": "9bf9ad1f-b07f-497a-b13a-6a0614dda5ff", "value": 294912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504498, "uuid": "ecf1819c-28d3-43d5-af74-1f15cfef918d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504498, "uuid": "6ba27558-09cb-44f2-ba98-8e80bd6f4ac1", "value": "fd68374b79182d936dc3b661de7bd104.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a68040-9cc9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646515148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646515148, "uuid": "b0cc8a9e-fec7-480d-8687-af6c641c535d", "comment": "Malware payload", "value": "02b75b59888947d9f39b4088042759c9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646515148, "uuid": "fc806bed-67e3-426a-adbc-5c48c45e16ed", "comment": "Malware payload", "value": "ee957b46fd21616c1ff4dcd2c7f6bf5a57b3caecbddb5b6033b48fd70d03f216", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646515148, "uuid": "3fd6a7fb-1fd9-41d7-b1df-4ad360c05fb4", "comment": "Malware payload", "value": "fa1abf070a0ecda5ba9f641271a659b2a1dc1109", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646515148, "uuid": "83ef78a0-1b02-4a36-a093-580285b921d0", "comment": "Malware payload", "value": "622d8a34e632b1514469235f46adef66ec1faf657d3c5a6aacb03594cdf534eb9343ece3c868a6fc2c0f79d521240360", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646515148, "uuid": "e636b0d1-d094-4d53-ad0a-a7867704e121", "value": "T1A8451211AA90C031F5B727F8997993ADA22E3EA19F3490CB43D51AED13396D4ED32347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646515148, "uuid": "1e92d512-33f6-495c-942d-f8da6d4f74fb", "value": "74c91f6c2795156c5c810dd2bcd960ad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646515148, "uuid": "781b7ad8-1c92-4d1c-95e4-fbc1eda83b36", "value": "24576:17RVz3iQF2AK9jF6PdXyx7fsoiBE2xDgeOQ0tEFlAj1C:17hF2fjKrgC06XAs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646515148, "uuid": "2b7d66bb-2e60-4f1d-bda0-0c505e48dc52", "value": 1165312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646515148, "uuid": "2a4bd66f-d9d5-4022-bc21-55373a9bae91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646515148, "uuid": "58361a1a-b870-4324-bee0-3ed03360e4f0", "value": "02b75b59888947d9f39b4088042759c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9ed6d91-9cd0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646518082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518082, "uuid": "b8fb9dc2-2a8b-45ad-953f-d072ba2f7979", "comment": "Malware payload", "value": "0e77d73b64785a908e390c8f4b6047ad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518082, "uuid": "8f096833-7bf0-4b54-a186-e738b79aa859", "comment": "Malware payload", "value": "ef0c912d5230f909bd9f29c2e4f1bccb570e5ab0005dcfd61f1d80de826a1fb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518082, "uuid": "c22c4767-26de-41a3-b109-11d72cc185f0", "comment": "Malware payload", "value": "cf4be4f89da845490375b5a8fd128e88157fda1f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646518082, "uuid": "2d0bfd99-8573-47f6-9a38-e86621077fc4", "comment": "Malware payload", "value": "2d2dbca40a20982219a6ab00843f39d123e92f3eb0b6c8f013efc58268d0ccbbc1143b12b22d362551889f6f3950a92d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518082, "uuid": "4df04454-d9d6-4e98-93af-a64e3e9dd244", "value": "T1275533A85D924E51C1F86C398E939142A63DEB66CD0CD740BAB603FD9F2DF50686D32C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518082, "uuid": "28edc95a-8168-459c-86bd-2b4e7b68239c", "value": "d2ad65ae4b104cc8e10244124781ae80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518082, "uuid": "e389ea1a-40cb-4eef-b66a-ab615f2ab0ca", "value": "24576:Y4CVOtE4hdztXszjgrRq6Pg+n1EOKreewYV24CKkB3jK7s2pmuHxKZbmoOlFnQ:YFs3/zlsgrRq6Pg+dKCVYV24tKwPYCxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646518082, "uuid": "82080f7b-7562-47c6-bd3c-682dd5782e91", "value": 1365296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646518082, "uuid": "f6e887d7-b657-4608-bebf-6030f1ba12f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646518082, "uuid": "93011016-4960-44c5-8e13-04038562351f", "value": "0e77d73b64785a908e390c8f4b6047ad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d9032c9-9c37-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1646452322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452322, "uuid": "72c6f848-abe9-4b01-b7d2-a275e299bab9", "comment": "Malware payload (GuLoader)", "value": "5504f13d9856d0e3a363c2f37571da52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452322, "uuid": "3b740318-9e6d-4b8b-9372-f8b19b68150e", "comment": "Malware payload (GuLoader)", "value": "f186925127d7929fde55e8c6b9af05dc11abfad21dd3f60c00bf978f960fb41e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452322, "uuid": "184c48df-6688-489b-9973-c2816411948f", "comment": "Malware payload (GuLoader)", "value": "83ba70f97870eab5ed066e296d32727d9065fb5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452322, "uuid": "f26e3aa2-77c2-486f-8a2b-a06c2f3d11b2", "comment": "Malware payload (GuLoader)", "value": "472e2fd65f63e389fd77f15e88ba108b87790f633feb2d477344451c549bb09dc647d30f9edb5e7ce74ee99518330ca8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452322, "uuid": "543f6f58-b1e7-432d-b417-054401836e1a", "value": "T1FE83AE137C18C543E105C9F06C63A99526276E268D036E4B3186BFDFEE31B867DE522E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452322, "uuid": "787d6100-5c13-458d-815f-ed97d566e65f", "value": "9c3bdad674eaa3ddb1c848329f51b37a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452322, "uuid": "5ebc404c-8938-4360-9eae-ac96953099a7", "value": "1536:er8ysFY6TjM9Yq/bdHH7hp0goKKk3QJRWzZXXrAz:elxuQ2q/9neJRWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646452322, "uuid": "0ee608e7-0fc9-4931-8923-c2bb5386ccf4", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646452322, "uuid": "80c3bda4-ab14-48a4-ac6c-43c48265ff89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452322, "uuid": "2906981d-6345-4ccf-9832-d1d194314e52", "value": "Urgent PO-29394093.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2b2d45d-9cc3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646512594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512594, "uuid": "79af0c5c-9f12-4ffc-a99d-96ebbcbd5203", "comment": "Malware payload", "value": "0632c534089bce22467d6a49c46fec11", "object_relation": "md5", "Tag": [ { "name": "crasher", "colour": "#7E2A91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512594, "uuid": "17f62e80-4c39-45be-9e1a-21710ed0dc5f", "comment": "Malware payload", "value": "f1e6657c4eb47b8e3fbd4c88a53913bf5ddcfa697096b54b3c6a097ae5d2099a", "object_relation": "sha256", "Tag": [ { "name": "crasher", "colour": "#7E2A91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512594, "uuid": "ff0c9c37-3052-43ca-917d-83f9f1393840", "comment": "Malware payload", "value": "e1f070db44142fc0182776b7ee97c4bb6a8e03fd", "object_relation": "sha1", "Tag": [ { "name": "crasher", "colour": "#7E2A91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646512594, "uuid": "cabe0c6f-6ca4-4848-8d6b-14a58829ccb1", "comment": "Malware payload", "value": "bb5ae2664cbed028d3e14e7fd4941a43bfde4d1a22e55c355912ed48ebbb5a9e7e05cdc550db1bc0209342384cc4c5b2", "object_relation": "sha3-384", "Tag": [ { "name": "crasher", "colour": "#7E2A91", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512594, "uuid": "3af40d93-60df-4c52-b410-4bd7e9acf3e1", "value": "T1EFC39D41F2D242F7E9F20A7100A6612FA73576248724E8EFC34C3C939953AD19A7D3E9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512594, "uuid": "db69603f-da36-4b1e-9431-e6d97959d80d", "value": "771106f54fcc51d1aa3989e528332f80", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512594, "uuid": "293b1378-5156-45f3-813a-e42e7f5e0fa3", "value": "1536:X7fPGykbOqjoHm4pICdfkLtAfupcWX50MxFY+yIOlnToIf7k33xL7HqXc6hYvn61:Lq6+ouCpk2mpcWJ0r+QNTBf7439Kg61", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646512594, "uuid": "68e309a1-f93d-4297-b2e4-01474cd25ea6", "value": 118272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646512594, "uuid": "e7b6a121-42d2-4749-a692-aec3181502a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646512594, "uuid": "5ae34a2a-e8bc-45fe-8e74-f68f5b1052de", "value": "mbrtest.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a73c5118-9c48-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646459639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646459639, "uuid": "73989e25-5388-494e-8b83-791c58825f4d", "comment": "Malware payload", "value": "2377c82b0a298229fae1cadbccc99c90", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646459639, "uuid": "cfb34a4f-c327-4042-a480-dcb5d020715b", "comment": "Malware payload", "value": "f31577fef733509a4b60bf368d910efd7631aad8411bda09e559310c2b5cba60", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646459639, "uuid": "a59d7b4f-23a0-4711-985d-c9ae8e14a4ba", "comment": "Malware payload", "value": "9fc2e90a30ffe256ee0da1bc92b72d4ce65476d5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646459639, "uuid": "63c1c59d-3d78-4042-b397-1f4e93a6318e", "comment": "Malware payload", "value": "c9915b8ac5d0d6619e49343af549e019e9ce7d5aa559c1c85173f3388fc0bf509084e24e7605c8cf24181036b29f2f5d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646459639, "uuid": "55156898-10d1-48fa-97ac-77b42b2402c7", "value": "T18BE2AE223B5D8273C103003163BAA6221BBD593270EF2997CF671C4A6C7A2D53D79BD6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646459639, "uuid": "85983327-006e-4276-ad57-37fca19a5cfb", "value": "78e397a561f0c355666a0cce61d5c812", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646459639, "uuid": "4899d994-1f1c-4ecb-86ce-693b13c2ed66", "value": "768:VkWUAohfjiT5edii8mcOw7c0MsIHaq4/nWsi6pYtaP:u0qfWT5M7wxvMsv/U6pY0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646459639, "uuid": "0695909b-0a72-49ec-a450-92de609f3ae0", "value": 33792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646459639, "uuid": "58856de7-aecc-4ea1-abc0-0d53ecb4629b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646459639, "uuid": "ae50da57-85eb-4b7a-8209-931fda0dacde", "value": "lpk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ab5f87-9c17-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1646438565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "857859dd-51a5-4b64-8314-7967682871d9", "comment": "Malware payload (Heodo)", "value": "40babfda8c8a5db54d74d23108b0b163", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "c767e70c-5be8-4a49-bae8-76e4ebdb6a0b", "comment": "Malware payload (Heodo)", "value": "f6dc51f300017ef8b4c71bf83faaacfc581447d6946c441e095f0f573566c493", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "9bd43883-b75b-474c-86d7-5b597ef5396a", "comment": "Malware payload (Heodo)", "value": "327c1b17589a3cf99ab83f944cf832dc7fa3ab70", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646438565, "uuid": "be59d93a-6104-4986-8525-416ef2ce10d3", "comment": "Malware payload (Heodo)", "value": "2ff970bdd89db0a68029cf90348cb8e0be571994efa2153d6c8d22627cb6106a179f371f8961b5f06f4cba37cc083b3f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "e11416e7-0da1-4265-9e06-1986e4dfcbf2", "value": "T12094DF007AC6C433E1AA063949A7879467FDBD52ABF5C74FBF807E4D5E314828A35362", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "0a4078b2-c18a-47a6-9755-0aee3c7a9259", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "4916f44d-8b2c-4d3f-90e6-757d12db344f", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8bCtS08OB8xS4GE/mFCo3QkgqbqAT:tFpMOfeihCraMuiS4zCCo3QkvqA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646438565, "uuid": "c5268a87-9698-422b-9653-8fe875cf2dd3", "value": 421888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646438565, "uuid": "8ae10752-6898-4000-b586-04c2bcecf420", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646438565, "uuid": "2fcf17de-ad0e-4f97-8fdb-bdc855bd5e2e", "value": "emotet_exe_e5_f6dc51f300017ef8b4c71bf83faaacfc581447d6946c441e095f0f573566c493_2022-03-05__000238.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8ac09f1-9cb0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646504444, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504444, "uuid": "41a23637-51a9-449d-8786-5e3f23816f42", "comment": "Malware payload", "value": "03aa4c816e13b32fa818d585aefcfe99", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504444, "uuid": "dd66c63e-37cb-474c-932b-8643b4d3f27f", "comment": "Malware payload", "value": "f90f328890fb0dafb94c5f00a520854a3d48799744184b18bce7a5a527d685dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504444, "uuid": "25a066a4-ba2c-4606-ab8f-5a04f3cd86d0", "comment": "Malware payload", "value": "3d19a14ab012f70ad529ee11fa4003d7186a9a46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504444, "uuid": "481166a2-063f-4d79-be72-4feb8142fa97", "comment": "Malware payload", "value": "42dda265359786e1f28765f1925d0971b88d01e68ccfe364f009e83cf419ce80fa7572e3ea463d44cb0d1816ff3ba98f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504444, "uuid": "12e20a18-5914-40ef-a270-7df8e6e5adf7", "value": "T127B5E07C266E6E4CF794947CB1758EFF27A2BC2F01A774F7900CA1D70AA9BD05502226", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504444, "uuid": "1e9c3edf-85b2-4803-9e3e-394486f8297a", "value": "4443ba86c457722dd58af4e4410113ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504444, "uuid": "e8983ee3-2fcf-4a86-a0fe-78ccee6c2eb1", "value": "49152:XpEuW1sPapJLiNnscG9EONjeSpsZ5Ruh4c7tPOFlu6JJ2O+Ac:XpEdtLiNZG93jfpSP1atPI/nRc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504444, "uuid": "3cc71f08-5720-4f5e-9eb4-4edef7d75bea", "value": 2395104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504444, "uuid": "68ed752f-74ca-4199-91f1-31eb31e92745", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504444, "uuid": "ec610736-186d-40b5-b587-ed98a09bac61", "value": "03aa4c816e13b32fa818d585aefcfe99.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38bf9050-9cce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646517007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646517007, "uuid": "bcecf3cf-5e79-4a90-b8ad-92ebdbd7e99a", "comment": "Malware payload", "value": "1e02d6aa4a199448719113ae3926afb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646517007, "uuid": "5bae147d-547a-4153-a22f-f3040eac9f15", "comment": "Malware payload", "value": "fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646517007, "uuid": "af605c66-b870-400c-8921-a185e8fdcf6b", "comment": "Malware payload", "value": "f1eff6451ced129c0e5c0a510955f234a01158a0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646517007, "uuid": "04ba4858-6315-4540-b4f3-0e67ac8aa9c5", "comment": "Malware payload", "value": "62be51b334cee63e4bd5185850c65b27bef7e305f6a3e49fe7f475813cb315287fc08ad284b14eb3c985b629186cb5dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646517007, "uuid": "13adc8cf-3d29-48c4-b855-5b229b5e7a22", "value": "T1C235231333E1E96AC1190B70A7DBD7B62772F3E22319874B7B0443AB5C252096F21E95", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646517007, "uuid": "400e920d-9e8c-4049-89eb-a78774f53715", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646517007, "uuid": "e789614d-af53-487e-a0c3-56da92033124", "value": "24576:eLMeYSiGTpTLDxxwqQcqOj5eyHox6ZGmAuXE7ZBlbT:+PbVvwqQpoLHontDrlbT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646517007, "uuid": "af17566a-9880-4978-bb28-32ba33ab39de", "value": 1078591, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646517007, "uuid": "44b2e06e-f07e-4e64-8f83-e3f68c114aad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646517007, "uuid": "62fc9962-c273-4ee9-8fbb-7c5d959dfc26", "value": "fb6b1171776554a808c62f4045f5167603f70bf7611de64311ece0624b365397", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d946d6-9cb1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1646504540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504540, "uuid": "28132b4c-f3a2-46b2-af0e-12c43175fa1a", "comment": "Malware payload (RedLineStealer)", "value": "831bbd8461518993bde2c512023954bd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504540, "uuid": "50821d91-70b4-4de6-aa3d-0497fa506230", "comment": "Malware payload (RedLineStealer)", "value": "fb8eefbb37ac7128e2c50d69050129f3971f280104bbb66fed8f6c69c129e1b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504540, "uuid": "51c66fde-b669-4a3f-ad57-d05814e7ca47", "comment": "Malware payload (RedLineStealer)", "value": "8e6e4c45c28d23fc91bd24c3a7aefa59766639da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646504540, "uuid": "24f4d6db-5496-46c8-a7f6-e4a81f213876", "comment": "Malware payload (RedLineStealer)", "value": "4b264ab73c66f63d18dd842e11e322b30f4514cac0a65bd7efb7857b2227d736654acd32f5eb6010ad4b89e7c78aa89a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504540, "uuid": "2f358145-3083-4385-972b-0c9130141c42", "value": "T10CC4239F2A815A4AC24C03B03DE1292ED1EF3E7DA4CC6766F94399CF4E64465AF180F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504540, "uuid": "41632e27-bfd3-4322-9074-e0959c2f509c", "value": "445554923421947cbff896012e27345a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504540, "uuid": "9fcbdae2-5d50-475b-9e38-86f5a40bd511", "value": "12288:0nXROal8WFfzAt/PorQnRR7SWJaQS03ULaHNqrxlKIQNo4I1mcOeOvql/Uq:0IU8WFfM1PosRR77akEaHNYK3C1ZOeQW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646504540, "uuid": "0b52718c-fecd-4e9c-83c3-5e8fc976c263", "value": 567296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646504540, "uuid": "2557d336-2290-4b00-88e9-69889da6d833", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646504540, "uuid": "c0206a1b-6c1b-44f9-adf0-aefdf4f66659", "value": "831bbd8461518993bde2c512023954bd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19cd06b6-9c37-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646452101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452101, "uuid": "417e9ffc-5e93-4862-b7a9-b12c84dcc2b6", "comment": "Malware payload", "value": "0f9f851a14889b18de9fa0d3ae404ee4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452101, "uuid": "2d46b30e-a149-4365-befc-0ce630640779", "comment": "Malware payload", "value": "fc05f4603ef94b7586f2a4f3343298b62e397503f2d6c99fd8bfd0e13111a77b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452101, "uuid": "3d28b13c-5068-4775-a5c2-0c9f5467a208", "comment": "Malware payload", "value": "f51405656ddce0114626b09f9c59f0f33d523431", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646452101, "uuid": "d68849d4-52f6-4880-8c80-6d42f438b3a5", "comment": "Malware payload", "value": "880aa0f85676c2d8ba7965dd923946ff2341424083ff541b665cb9033e5a1db86332847f15c05620504c7c7d4eba70f3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452101, "uuid": "c9959e98-5e69-4615-bdc5-5448d7677e5c", "value": "T11A42A6D1B9558A17CAC44233FB0E83DDBB26574CF2EF3303671B6F9162079670AA6419", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452101, "uuid": "ddb380ba-b0f9-4435-bc43-50c73c30e326", "value": "192:Ci/8QnOgi5hsSag/BhIMFneoazG5GgaVVkEZx4e5iE:C2OgIegfI6eofOVFx4e5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646452101, "uuid": "55026267-30ee-4d3a-9039-fb65681e0dfc", "value": 12408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646452101, "uuid": "30190ca6-9167-4e45-b469-bd4aefe978be", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646452101, "uuid": "92845566-26f0-4896-871a-08681ff9dc0e", "value": "0f9f851a14889b18de9fa0d3ae404ee4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7aaae913-9cad-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1646502944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502944, "uuid": "6f790cb8-d894-44c8-9461-c3d00bfac365", "comment": "Malware payload (CoinMiner)", "value": "772b5b1321a4343c95125fd41f36c80c", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502944, "uuid": "4451de03-f50f-41fb-a3aa-f9d842be9885", "comment": "Malware payload (CoinMiner)", "value": "fc7c0979e0a7b2f95d8e50177b844166ced49a0c78de4adcedef75090dee4dd9", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502944, "uuid": "6700bfd1-1747-458c-952c-18e85f64103f", "comment": "Malware payload (CoinMiner)", "value": "e6899048984813fdecd7d92863d387259dbd088c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646502944, "uuid": "d25d22f4-e9fa-460e-8c93-9679edeb7398", "comment": "Malware payload (CoinMiner)", "value": "3ff88664a78d57475296377a7d8dd7d10df9345a568309dfcca75f960a557f2fe4de19254f81878cabfe6a1f5722944d", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502944, "uuid": "c402a9de-4891-43a6-9c46-baad64cd0748", "value": "T12714559D766072EFC857D472DEA82D68EA5074BB831F4203902715EDEA4D89BDF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502944, "uuid": "b2a98c90-a373-4479-b309-87fc7e8788a2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502944, "uuid": "f6991fd6-8a11-497d-aa06-b7eda5f1dd69", "value": "3072:dBgDQ+7AvxB/qpfG/XXiGK9/NPqXvQZlq0v2kmYwtertwIMptWz873LPsV6Jdx4U:r0AZJie/XUs/4lq0v2kmYwtertwIMptC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646502944, "uuid": "8db73d39-abc1-49a6-b058-17937dc88b7c", "value": 194048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646502944, "uuid": "1bc607ff-3144-4827-8f2a-72d8ddd23b5f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646502944, "uuid": "3863a457-a7ee-4a58-bc39-f8aba7ffc567", "value": "772b5b1321a4343c95125fd41f36c80c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84e3adbd-9c3e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646455287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455287, "uuid": "b4ca7d14-d13a-47ee-9c81-33cd7771d79a", "comment": "Malware payload (Mirai)", "value": "8c58caccf247a81741f6e9ba411e43c7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455287, "uuid": "12b091ff-3caf-43a5-8b79-27d9a549d5da", "comment": "Malware payload (Mirai)", "value": "fdca7b61ab07c00f1a70bd65750f6e446361b9a2dc2d80f700e0b461d9466c80", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455287, "uuid": "2c548c0e-a656-40f5-87be-9f492eb0d919", "comment": "Malware payload (Mirai)", "value": "dd34af26dcf2bfb3e4407ac54542e60e1436fb5c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646455287, "uuid": "225801ca-2ffa-4087-91cf-e849e30c387e", "comment": "Malware payload (Mirai)", "value": "b6b665ac0147b38f83ea9eb5432b2b13a8ecf40d7548931a4f41e2c411995e7b08861e50c5cb7c2b1f6f11709a0e1278", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455287, "uuid": "34314810-ba50-4747-b2fc-a7120f139cc5", "value": "T15AD2E1742D6806C6D938E5BD6BD5A3493D7C36EAB243CD1A90087EC3CA5E9B81D03BD4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455287, "uuid": "0bfbe2ad-9a88-4a72-a852-2226787e6de9", "value": "768:47W9lR3h4CibL1/yGgFVSYF41nDn3VrrjBJgGlzDpbuR1Jn:Y0r1KJBnDn9jTVJul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646455287, "uuid": "6e632e29-f6e1-400c-8253-6fc3480136da", "value": 28932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646455287, "uuid": "aa84c177-4807-4c4d-b6d1-f0d317cf08ed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646455287, "uuid": "9dc7b4d4-19d3-479d-ad8e-adf8af1fea53", "value": "8c58caccf247a81741f6e9ba411e43c7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5df853f-9c4a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1646460496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646460496, "uuid": "7d3e3547-496e-427b-b43e-b19b561a5549", "comment": "Malware payload", "value": "6e11616e95e4f10e5da4cc983acab01d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646460496, "uuid": "5cffba97-05ec-4873-a901-5a1bd7965ba2", "comment": "Malware payload", "value": "fe10c84ba3db8cc22dee229c7fe5d4e0c25f263a8d6274456544c7b1208ac6c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646460496, "uuid": "52224425-d4f5-4914-84e0-f8896a23f03f", "comment": "Malware payload", "value": "7c2f888082bbd717da381d20a6ace6ad854dc688", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646460496, "uuid": "cd8aefb3-2d07-4ebc-b36d-bbf099e2ebb1", "comment": "Malware payload", "value": "4bd7736463a1968b640df8f9e4b8a348b56356859299ebea9f8547d4e824100792eceba1497133662a123d230ce07638", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646460496, "uuid": "e3f4f5ee-e187-4fa4-992a-d853b7142a3d", "value": "T16B15F1A8B472F283FCEB437282862F77C70F7851E6D41D1ADE20806C7943C5A5BA5697", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646460496, "uuid": "e8be8af1-975a-47ad-b480-420d24686a0c", "value": "3072:7wx7RP6oCcUTPPh7xWlJadNaIXIbYYNr8Nw0:UP6oC1JVklNAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646460496, "uuid": "328336a6-c0c2-4102-8354-bbd994d6eda8", "value": 878590, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646460496, "uuid": "aacb11f8-fdb2-4ef7-9d8f-593700828012", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646460496, "uuid": "d8949ea9-3f34-4b55-9a6b-ebe016263105", "value": "Main__Setup.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e0b5bb-9cb6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1646506773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506773, "uuid": "c8895cdd-9938-496c-94c3-e5c079675a1c", "comment": "Malware payload (Mirai)", "value": "853807d7f7dc02fdcea798878f3b47df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506773, "uuid": "e464ff14-3a5a-477e-bb17-b1ceee183734", "comment": "Malware payload (Mirai)", "value": "ff116964ac8e19b246a6a7c23c4dccd4109d9446f640748f37b29b28ffe5897b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506773, "uuid": "7ef0cc15-d2a6-48f6-93d9-5457ccc69fe3", "comment": "Malware payload (Mirai)", "value": "cd562a01b127c54af632416a73dad16cb237f76c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1646506773, "uuid": "63d0ea36-ca7b-46c8-96ed-f62926a03f5d", "comment": "Malware payload (Mirai)", "value": "1132745e5318ebc2628259550bdc7bb6747f0a253c52184cccff559878b2c847ac9e45c79c44f694f8ae8ba68655ed17", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506773, "uuid": "bfd4ac34-f987-42be-a6a9-81aa479b224e", "value": "T1A093E709BF610FF7E86FCC3709E91B05198C550A22A97B367A34D868F64B65F19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506773, "uuid": "173ff3fb-3cfa-4759-aa61-f13346d88ebb", "value": "1536:nSITUINkErQWG6fZnH/zoSAkaI91rFSEZa72PRI:nSITRNgWjtHUibSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1646506773, "uuid": "4db9bf2e-120d-4da2-a6dd-0e5576d5d0b3", "value": 97568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1646506773, "uuid": "cfc62930-d2fd-4e6f-ae58-41778b29d586", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1646506773, "uuid": "4d449ed7-8273-46c2-9f9b-0505325bc186", "value": "853807d7f7dc02fdcea798878f3b47df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }