{ "Event": { "published": true, "date": "2021-11-26", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2021-11-26", "timestamp": 1637971381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "eeda1521-ea59-4442-892f-f3eabe1ad06e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bc0db03-4e5a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637890972, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890972, "uuid": "3fd830c8-0eab-4794-9c57-c9366b08f192", "comment": "Malware payload (Heodo)", "value": "0a81ff0dc65e7b064dab9a209e4a998e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890972, "uuid": "7c2bf738-999f-42ca-99ad-87fc7688e51e", "comment": "Malware payload (Heodo)", "value": "00260eeb409283beb06114ce7a322598903d52528f7c4c0608a8c3022fe45e15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890972, "uuid": "6ac0ff68-fece-4b3b-9672-fa0d0eefdb15", "comment": "Malware payload (Heodo)", "value": "18a4feb01b2f8bcc5d0c94460edbed0db8dcc835", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890972, "uuid": "e542ed62-d453-4413-aa41-88ce86d3d73f", "comment": "Malware payload (Heodo)", "value": "ba6cc3a7dd4b2ac99e49b25ada013ea9d9e2378bcc325590be967b7600bf0aacb7b250a0ce970ab528c812c0ad218877", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890972, "uuid": "34738355-b2d0-470d-a3dd-88cb9151c529", "value": "T150B4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890972, "uuid": "b0572daf-2dee-4af7-9f13-b28554bc4437", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890972, "uuid": "7407995a-0637-4850-af9b-80be3c6a1527", "value": "12288:smVdIG2GDNBtIlD987snnrkZW+mw3ffEPy:sm4GDNBtIl6w4ZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637890972, "uuid": "9d1fde1d-1cf6-4643-9e2d-949b0d4cfa2a", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637890972, "uuid": "3f34c673-36b6-4c74-9aaa-2454cd0835c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890972, "uuid": "77a1c450-4aee-418b-813b-562d12d68f77", "value": "0a81ff0dc65e7b064dab9a209e4a998e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92c2faa9-4eb0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637928082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928082, "uuid": "4dd2a6a8-0a73-4024-b059-6bb5af11cb3a", "comment": "Malware payload (Mirai)", "value": "46fa185014ef65404b1ed0cea6f7779d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928082, "uuid": "8fd52f77-5b42-4b17-b2d0-00efdc620132", "comment": "Malware payload (Mirai)", "value": "0066da356cb6e36705896641e6c5a60d3944f389af94d2b0e35a3d55ef5bd0fd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928082, "uuid": "2d2c8324-b5ba-489b-bf6d-27a721fbe0be", "comment": "Malware payload (Mirai)", "value": "3acfebccee7b0dd8fe89b897ac48b21313561137", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928082, "uuid": "cf62312e-364c-40eb-9676-c784a307d5c3", "comment": "Malware payload (Mirai)", "value": "6773aacb70f789e21975c25a9490c4598f661d82a3e7b877f7ab6d56152714a03227e9d8bd3df7beff19940e706b9e01", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928082, "uuid": "6fa019fd-919b-4ff6-8418-6509628b9706", "value": "T14A731986FC81AB29C7C007B7B96F109E3310A7F8D1DE3246DD115BB4768E80B5D66B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928082, "uuid": "62ef455f-98cc-442c-a8c1-5f4c64925f2e", "value": "1536:uODrBygxiPGVVRTSZelsfLoP8t46Th2/xwi97TgzZ:vDdygX8Lm84acqz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637928082, "uuid": "02bf570a-84d1-4bfe-bb3a-1a4a40dd2fe0", "value": 79236, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637928082, "uuid": "1444e507-b515-4ec1-ad85-d6fabca9f0dd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928082, "uuid": "02720491-a52f-4c22-b893-a96acda929ef", "value": "46fa185014ef65404b1ed0cea6f7779d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b84a4a-4e84-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1637909020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909020, "uuid": "86150ba2-e83d-44ae-ba3f-d35c1c39f80a", "comment": "Malware payload (RemcosRAT)", "value": "e04d958c16df00046fe516e6ea187321", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909020, "uuid": "5f4504c5-ac04-483c-9f43-f95d056f852c", "comment": "Malware payload (RemcosRAT)", "value": "00d0dcc155b889107ad32e90f8172490dc32280cc62e762bfa5e7deecea1099d", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909020, "uuid": "41b65310-2bce-4959-8d21-624bd9aa3110", "comment": "Malware payload (RemcosRAT)", "value": "c142d74d6d585550af9d810f73faa8418d6045a5", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909020, "uuid": "c77bb363-2898-43dd-88b9-56f22331aa0f", "comment": "Malware payload (RemcosRAT)", "value": "841186341e11e89e8b17dd8567126adee652e1f9b3a1f6c722316fb5240727dd9329e5f78d2efb6986f335a40fd90004", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909020, "uuid": "1242db40-3c62-4548-8639-b4b61a7e0096", "value": "T1AF555B11B2919C72C1771679DC3BB6A45F39BE806AF47D963EE439480FB8381742E392", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909020, "uuid": "fa71a6d4-e746-4191-bee3-3e9d8b6dff32", "value": "12288:I+3V1iARDZ1Wv7GFdc6v8cnr3pB7PeDhxYjAKJtWcpEL36U:I+FrZ1Wv74d9lTrbeDhmxJtWf36U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637909020, "uuid": "a6cc44cf-b21f-49ba-9673-1524076d5e03", "value": 1376256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637909020, "uuid": "c2123e26-834d-4908-b078-bf8feb5c52c7", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909020, "uuid": "2eabdb49-4169-45ae-977a-070546c717c7", "value": "attach-file.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70fe24cb-4ed6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637944346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944346, "uuid": "7c4731eb-7698-468a-bd65-384c62f487e3", "comment": "Malware payload (RedLineStealer)", "value": "cd010f1e988177030eb5ec1718491121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944346, "uuid": "87c29240-9564-4046-945a-8ebb6c570a51", "comment": "Malware payload (RedLineStealer)", "value": "00d3cc8ec1a3bde00ee57cfb6dd238ec935fe9130b4e97c45ae4b89eef6a0b87", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944346, "uuid": "3860c92b-b15b-4a21-9372-1127827e54a3", "comment": "Malware payload (RedLineStealer)", "value": "2385cbb3aee388a8f469926510ea65007c34bbf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944346, "uuid": "3d205cf3-eca5-4945-9845-fade193033d4", "comment": "Malware payload (RedLineStealer)", "value": "3b4b7a6bfd1ed4a2fd9610c0fc24a9405dd8d02e46b9d797f5ae249ac797080339f5982d32b29dfc49fe715395bcc296", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944346, "uuid": "6e71b623-ee5a-4ea2-a533-b3772cb73100", "value": "T10F841528687FC05944E3EEA62DDCA8FBD99A95E3640C743301B4633B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944346, "uuid": "2d738b8d-aad2-4021-9f58-0d7d5e9d7fa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944346, "uuid": "70f16c68-ff05-45ea-b682-002601502c29", "value": "12288:WvETik34rg+FmEk+eUDzTkNpdX4QfsQTYlG:WIiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637944346, "uuid": "a44f1e47-180f-474d-8d42-94b4e67b3a63", "value": 399360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637944346, "uuid": "0a312068-8a08-4dd8-b29e-bcf33ebd7aae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944346, "uuid": "841f9a71-b83b-433f-81cc-e7d38447f724", "value": "FLStudioCrackInstallerV3.1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1499b92-4ed3-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637943139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637943139, "uuid": "0da0aadd-fc42-426d-b9b5-91d30440ca12", "comment": "Malware payload (Heodo)", "value": "1410b878fc1f3c3690d6bb34539a5b0b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637943139, "uuid": "1aeeb85e-1425-4f75-9e28-5981628d33d6", "comment": "Malware payload (Heodo)", "value": "0128a46b27937b6fd89524747b4c5fe7102b95ae61ac67bf386e5c44e0c42716", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637943139, "uuid": "5609b6d4-e453-469d-9fe5-107da2f99ac5", "comment": "Malware payload (Heodo)", "value": "169d3618143d5d94b2ab81f8ea75cc614b9591fe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637943139, "uuid": "fb5b52bd-6b41-417f-a64b-759b571df55b", "comment": "Malware payload (Heodo)", "value": "ab59c532d85aa139684361ccfc3d9e1bd02e77ac1864891f5a9e8e1118cfd33b6375385a2209bfcd02a4e955a669c506", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637943139, "uuid": "c7d1d3d5-0abb-4849-8403-b040cb26af18", "value": "T1E803AE1EC221B8E8D235D93A819845E5521D2E116086FA4934C0B58CEF776FFABDF36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637943139, "uuid": "a355bb36-d173-4c00-92f3-bc8f026c8c0a", "value": "768:Ih/I83jpRrjevZCwVIUUqgBZVWpf/wak8y0VIF/:IhnjbIIUekpw78XVIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637943139, "uuid": "220a7144-2580-46ca-9ecf-af1484aa0888", "value": 37974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637943139, "uuid": "6eb1b686-1aa9-4363-8654-a8574390a9a5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637943139, "uuid": "92cec63f-49f0-43a6-8ff6-97d04b74227f", "value": "FILE_9879313624616860.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee4bef8f-4ed6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637944556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944556, "uuid": "7dcb38aa-a62d-44d3-99ef-055ff294e3a2", "comment": "Malware payload (Dridex)", "value": "7664270bc87d7d2f52cedb41b8c9e29e", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944556, "uuid": "76c9964e-c517-46af-a961-480eed052325", "comment": "Malware payload (Dridex)", "value": "015d09fb88aab01099d2aa61c8916bd3815e424b74b46022e004c398886ef739", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944556, "uuid": "e300e656-7a48-4e17-a857-ea2f04377f0e", "comment": "Malware payload (Dridex)", "value": "b480173002afe29e7f21ee5958d8b821f3ff4e48", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944556, "uuid": "505b5575-1bec-4ee3-bbf6-bb205a155c47", "comment": "Malware payload (Dridex)", "value": "9261b58b8553127dc37358b5738d6007cc844471bb2584e8e1e5806652685392cfd976fce36c88300623cb555c466d20", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944556, "uuid": "6792bd14-40cc-4a39-8834-7a2f570741cb", "value": "T1A663F1ADC195F059D753CDBEDB294CE4A3020D92B559C68F18ABB70C7EE638B0BE8114", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944556, "uuid": "5f90ffac-8d48-430e-a165-a9b5d5fc25fc", "value": "1536:UWhPuALLImemeKHqeK7YncMMleCGQCwh7yTILFpEaHjgdR:VA80XKUY3M8ElhIaHjgdR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637944556, "uuid": "e1d1b7ad-45fe-42c1-8fb5-7e41b52b8272", "value": 69010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637944556, "uuid": "32d0e291-d131-4f70-9229-9a3b040c2a1c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944556, "uuid": "99b47184-16c1-44df-b56b-a5ccf4d69535", "value": "Booking-13474.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d8efaa-4e77-11ec-843c-42010a9c0014", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1637903416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637903416, "uuid": "dae7bd53-7121-4ea7-94ed-5bf42cf6a54c", "comment": "Malware payload (Gh0stRAT)", "value": "893b78d1ca183b91cfba1e578340f715", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637903416, "uuid": "cbdc0955-75a5-4af0-97f9-7c7b4535ee98", "comment": "Malware payload (Gh0stRAT)", "value": "01b6902ab0179123e76d72184f38c96d3afc8fcef9aa5206920d228e8e9691a8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637903416, "uuid": "6881b5a9-68b7-4bf0-8599-70a3d0fe5835", "comment": "Malware payload (Gh0stRAT)", "value": "77ef70d6ec93cab673ce0ed207874e7cd9bf3fec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637903416, "uuid": "0e2a24c8-74d5-4b97-ab35-68af4210d045", "comment": "Malware payload (Gh0stRAT)", "value": "2c78b0a89f661aeea2bd299da61d74ef6dcd8409f4f52509eb3153f69b7e2817fb7cf1446f906364cb22c6ac1eaecabd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637903416, "uuid": "236b955d-4c32-4f89-8681-47ef22ccc444", "value": "T13B046B708AC8A232CFA0C2764744D7D3D2EEE65DEB007049459ECB794EBF7996624F60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637903416, "uuid": "2647a28a-7230-4a3f-8177-803e2164d044", "value": "07cd32fe06d43febfbbba5706c9ac01e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637903416, "uuid": "5b1961c9-727b-472f-97c3-7e1f773ad128", "value": "3072:otGBk6WFmHlXXYomqOZ2tLJ0L/LhtLRU3XnXdbiGcY:8GBk6WcqoROotLyzlPJGc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637903416, "uuid": "165c9309-a55a-4206-b270-8303ddb5a054", "value": 180224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637903416, "uuid": "8be3d0a8-5d95-49f3-8586-fffb7e9f0dfb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637903416, "uuid": "76fc2e52-0ff5-47a6-8fb4-2f311df09bb9", "value": "893b78d1ca183b91cfba1e578340f715", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "169146c3-4ea5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637923149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637923149, "uuid": "568c910a-4425-4250-a6fa-f8fb4c6da37b", "comment": "Malware payload (AgentTesla)", "value": "52283687e4e202869c0f3a562224c4af", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637923149, "uuid": "4225558c-cf89-4d55-be36-b683eccbbe1e", "comment": "Malware payload (AgentTesla)", "value": "0216d083f25a06068c25a4e36967050e68c36b67d6b5cc7fc7be82862f9d0afd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637923149, "uuid": "f6b48515-544d-41f3-a9eb-9755fa5012d9", "comment": "Malware payload (AgentTesla)", "value": "81447a4507d041b16b4ab4a7aad6e53bec5db256", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637923149, "uuid": "4dedeb25-624c-4eb4-9335-8bdad05e4fe9", "comment": "Malware payload (AgentTesla)", "value": "6c0bc8379a616eeecff9b2113ee0b83409730006426d3c689c982c3ef819565440b6e5a73ed17aa04dcc4966141b94d7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637923149, "uuid": "1aa7431b-b786-4a36-8d52-f6205d943123", "value": "T1A6B2C546ABF91A69FAF77F716CB424104E37BED62D06C21E1184248E6931B85CDE0F32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637923149, "uuid": "40d7b744-43a9-49b7-9d02-59b93f3458ed", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637923149, "uuid": "6c20aa22-ee10-4c86-af2a-07fad9c210b5", "value": "384:LARfkJGzRvrQRkKA4rsf1t2kV5qSpciCjFortND8QobS58/pJbouSbx0Ci3HzKQ5:8fkJGzFrQ/Bajf5GiBDuf/pJbouSbyCa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637923149, "uuid": "3212d430-f447-4e3c-be79-ddcaecaecf58", "value": 24064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637923149, "uuid": "538d4da7-20fe-4412-b7be-79a27da48329", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637923149, "uuid": "e8a26250-6669-4669-a250-d4651f8c98d0", "value": "52283687e4e202869c0f3a562224c4af", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4490bdcd-4ea0-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637921079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921079, "uuid": "c92243cc-e211-42fb-8bb6-7aac7a5d069b", "comment": "Malware payload (Heodo)", "value": "197defc0a362b91049df8756261403da", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921079, "uuid": "4b923829-2eac-45b4-8835-24cdb7281ac0", "comment": "Malware payload (Heodo)", "value": "0322686b9ac65125d635834845235a56a9daff061e39dcfc4390b002d6237be0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921079, "uuid": "1f084077-894c-4a43-80c3-2b79f527adca", "comment": "Malware payload (Heodo)", "value": "e3a5dbb3cf59589a0f93cb0c50c9e722f92a0412", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921079, "uuid": "d38e9722-7038-4610-89a7-0acd0ce72dd4", "comment": "Malware payload (Heodo)", "value": "924ee9d3266c7f5a771eb79a1f0cbf2088d6897322063ccb0f76538da8a6669d87cd9dc4939eb6cb46c75da1c9aec177", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921079, "uuid": "d2184693-044a-4d3f-bd2b-1ed0772f7dd4", "value": "T1D7C4BE11F3D2C436D0AF01357616DB9927B9BE61AE758293FBE47B4E1F314C28A38642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921079, "uuid": "724ff0a4-4e04-427b-bfd4-92beee6b421f", "value": "43031315f82b6fa0235c2c3dae2afd94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921079, "uuid": "5454cd16-b3c8-4099-8162-04e447f8d632", "value": "6144:fJ4kSRXCb0GNf0QNR+hbspY72fZ84iP/MaDO3HLXqD/hN4+XWrS4raGIKRCBKh:aC1R+6PfZ8l/Mz3HzvTO4p8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921079, "uuid": "349ed124-1f73-4191-9792-857d174f4258", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921079, "uuid": "6f60f8d7-b1d7-4a54-91ea-588c084085e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921079, "uuid": "fe1c3fc5-de1b-49e4-ba79-dce21755a275", "value": "197defc0a362b91049df8756261403da.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8709d36-4e61-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637894188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894188, "uuid": "bdeba734-9309-499e-8056-2889c49986da", "comment": "Malware payload", "value": "9a9f5366c05e242042d9e603714a92c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894188, "uuid": "356af13e-d2d0-4570-a377-f034217e7b60", "comment": "Malware payload", "value": "03d53434cad05ff9062ad6c58178c86319f7e167908bd4631077a455882160f2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894188, "uuid": "54341c16-ca7b-46cc-9e6b-a8812cd08d82", "comment": "Malware payload", "value": "2f0930318113089e818df2c3d1faa74005e91356", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894188, "uuid": "f1b70d17-d098-4f5d-a954-82465b68bd08", "comment": "Malware payload", "value": "df37cd8b33c9828a17d3532783c786ca5cfd94c093541a3a228a4ab85307b16184278b87e990cc6ca5ea7ba85f71cfad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894188, "uuid": "f7760c0a-c19f-4386-a8d5-87681771a2d3", "value": "T10F13F012781C5DE4CBB66386EEBF77F11371128C3B2AE549A30B2713E9595B302909CB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894188, "uuid": "bd56d2a3-bcad-407e-8aa9-a1fb4ddf5ce4", "value": "768:YF91PI9faku+93MjFF4u4iI28qgV9g4uVcqgw02NWXLLx3l8RQas92C:YNGf59OCu4iI2eg4u+qgw06WXLL1eRQh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637894188, "uuid": "3e611daa-80d6-4d68-bc48-ed4bd3f2ea5a", "value": 42920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637894188, "uuid": "c769ab00-8b45-4cf5-a3d6-455267cfcd46", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894188, "uuid": "dde4ccbe-f5dd-4a39-a70b-257e9e0e2978", "value": "9a9f5366c05e242042d9e603714a92c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7db0229e-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637919027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919027, "uuid": "5ace658e-831f-4dd9-a9ee-97824ad9fdaf", "comment": "Malware payload (NanoCore)", "value": "9d3471ffa8ab4ac45b8507974acf11a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919027, "uuid": "1de7b244-375a-49ba-ac30-512b38151eb4", "comment": "Malware payload (NanoCore)", "value": "044305a632290e7da0d7315942c2225f9b206719c0430265b6872dca895df8f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919027, "uuid": "ce867abc-8c0f-42a7-9671-a9c6690eece6", "comment": "Malware payload (NanoCore)", "value": "9825bd0d39f5a104115933645a6f5c1ecbb48fb0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919027, "uuid": "35a2d488-39cd-4f6d-97cd-930840329421", "comment": "Malware payload (NanoCore)", "value": "a44efea9ecdd1e1e8cc3fc7fe469e723aa6fecc32de4104a15aa29b081536924dcf8347b8896dd99f49d1b11bbeecf24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919027, "uuid": "ca49991b-d898-47c4-85f5-222238e12dfa", "value": "T1FE45BE02B3D5D036FFAB92739B6AF22256BC7D250123852F13982D79BD701B1227D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919027, "uuid": "2e07e874-f08f-4ffd-ba53-01d9fe21f20d", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919027, "uuid": "d5c3a3fd-5328-45fa-9f22-9a6085606fad", "value": "24576:9AHnh+eWsN3skA4RV1Hom2KXMmHaFZyrh9QI/C+EZCBqUIYXmf8MuvWz+:ch+ZkldoPK8YaFZyri7QPIYXLMG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919027, "uuid": "1963a8e6-83c3-4a66-b9d4-afe776cb4f77", "value": 1254336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919027, "uuid": "044e99d7-697e-4533-9a2c-52666ae60e4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919027, "uuid": "7dda33c5-a560-47d2-ad50-af02feeee0d0", "value": "044305a632290e7da0d7315942c2225f9b206719c0430265b6872dca895df8f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df956745-4ea0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637921339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921339, "uuid": "d6e3dcf4-32af-4c8f-bfdc-f0df69d6732b", "comment": "Malware payload (RedLineStealer)", "value": "e42cc9210e70fcd4d4eb547ed690f922", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921339, "uuid": "9af6e6e2-6352-48ae-88ee-d83e7291d26e", "comment": "Malware payload (RedLineStealer)", "value": "05298ffd3da1eeaf8c65744a53d8f1c99129142f548b967925c20e824232ee33", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921339, "uuid": "0a9dd038-e4f0-47cd-8ae8-1d22f5811acc", "comment": "Malware payload (RedLineStealer)", "value": "faa9eeda33d279eb8cc3ab87c724b1e07039177c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921339, "uuid": "5a51a32c-5852-4f3d-b077-c9a2aa71beaf", "comment": "Malware payload (RedLineStealer)", "value": "e0e4e79e9ab00a2609af3eb70298b2a2544b4e475f32aef3b67403c129aa2c1a3a182044b6265331587f2a47fa732a4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921339, "uuid": "39ebcbb4-2447-4dae-9ecd-237ca3f24ac2", "value": "T18A05BC60F8D077ABDEE7BF7C506E9C0442077D35192648AFF1587DAE92B2982AD03352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921339, "uuid": "2cc9a7cb-c6c2-416e-bc48-92e5b6bd421a", "value": "b4e82a935080d6711f6a31131836298d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921339, "uuid": "11f261f4-7b5f-46c8-b90b-b6524f947cf6", "value": "12288:lVDoJtMbxB0VaIqXxDXPsK2GlvaI6WCmcKCmuXCFDdmWX:roXsxB0Va1hDXPsK2GlSISmRuXCFDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921339, "uuid": "6976dcce-ec7a-49ca-b265-8b1a97e6e361", "value": 870368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921339, "uuid": "d1a48ed1-5fbd-46d9-a774-796f48da7cd1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921339, "uuid": "af29fbe8-4189-42d8-995c-b5b0d4ba58c3", "value": "e42cc9210e70fcd4d4eb547ed690f922.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66a5dbe8-4ede-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637947765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637947765, "uuid": "73f8c651-61a6-4c71-8337-b8d212b0d304", "comment": "Malware payload (RedLineStealer)", "value": "9b229fcaccc54ac92ec048aba15e0fc1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637947765, "uuid": "aedbb2b5-89a9-4504-9cf4-8d9e28d19e61", "comment": "Malware payload (RedLineStealer)", "value": "057ff01b1f4ec1999bdfe0561f4dede6c6e1a115154a5754fbef9019f25599ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637947765, "uuid": "c370dd45-eb5d-4636-a6fa-7f3c94976655", "comment": "Malware payload (RedLineStealer)", "value": "b1324d9df5937d41c8eacd30fe9d28aa3b89eeaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637947765, "uuid": "178ee9b6-89d4-493f-87be-75b190b15ddf", "comment": "Malware payload (RedLineStealer)", "value": "68cf31da44484cfdd01aeb9f0ace825bdb537d70e15e2c61b8155706b7a1143ff251d511450033b6f8a61310d4ebcc2d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637947765, "uuid": "ff43902f-ca3d-4463-94c3-64f7a6605753", "value": "T1FDF3AD1436E3F071E1A7977024749BA03A7BBC331670819B2BA4233E5EB06D09AB7757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637947765, "uuid": "30edb955-c802-4926-8e3c-68e188ee9f95", "value": "0870c1337a760ee1593b3bf581332ebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637947765, "uuid": "6f53e8ff-eb23-423c-98fb-fd49f074f5c8", "value": "3072:0NeuwwwF/zAzpy34ySH5b/J6RAXdPh2wue02qXd2:PuwwwF/zAz83mZU6VaF2qU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637947765, "uuid": "d6a035bf-dae0-4030-af57-4674ef9e51a3", "value": 161280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637947765, "uuid": "08303c21-7898-48e9-aea3-68fcf14cc2f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637947765, "uuid": "27dd6699-94ac-43db-990d-4ba5a99c2100", "value": "9b229fcaccc54ac92ec048aba15e0fc1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30c40f84-4ec0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637934790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934790, "uuid": "904b7124-122a-421d-afdd-3f2c3bde083a", "comment": "Malware payload", "value": "b3bb91ad96f2d4c041861ce59ba6ac73", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934790, "uuid": "7a742367-473f-48ad-9609-c61f046b2b37", "comment": "Malware payload", "value": "0581160998be30f79bd9a0925a01b0ebc4cb94265dfa7f8da1e2839bf0f1e426", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934790, "uuid": "a2c5ff6f-5c52-4f8a-9390-136b349a6c44", "comment": "Malware payload", "value": "e18c6fd6a0d0d5c124c9ef6972a76c47c28c80a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934790, "uuid": "8b936120-d638-4959-91bb-439dac0b6891", "comment": "Malware payload", "value": "ad9bd0a2b5fd4de55ecf5e1601c9236189a99cba6a10ac7d00b9b9be4ea88fda86d3d03756e9018909bedc4b7359f471", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934790, "uuid": "a3029cd0-ad3b-46ec-9d91-38f0e48689f7", "value": "T19A45BF0BE29400F9D47DC578CB675122EA71F8C90A35B59F17E457222F72BA05F2EB28", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934790, "uuid": "6cb6bf2d-7ec1-45c9-adb2-d09eb07d0e93", "value": "13235f12bec0089819abb93d2e545004", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934790, "uuid": "6a2c66fc-175d-4861-b34c-97bbb08317d9", "value": "24576:+wIEES7sjMc3EQVdEDvLJPjraFLR5ROwwC:+rE/7MMc3Xajrkp/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637934790, "uuid": "115f5755-df44-4f19-8fdc-17bbc4b39581", "value": 1273576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637934790, "uuid": "baf124a2-8f2f-4d38-aeeb-36cd3a922d72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934790, "uuid": "f8fd348f-186e-4811-b8f4-bbe5ceb033e5", "value": "77_1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e9df19-4ef7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637958332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958332, "uuid": "afc2fbda-847b-4382-86b5-472f670ff459", "comment": "Malware payload", "value": "4f6da5f58bca4fc5fce65f6ebbd7abb8", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958332, "uuid": "33553e15-f410-4313-a4c0-c8b855318d20", "comment": "Malware payload", "value": "05a8d2290cfd5e949a18221e83859004e3f03ce762023573e301c089ceb1c767", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958332, "uuid": "203394c4-d6e6-4f6b-a5f9-a1069f829fa6", "comment": "Malware payload", "value": "d18898a6d508d6394c7928a33f00ab98a105cc24", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958332, "uuid": "1aaedf8e-de11-425d-a6e6-c2e67ad7cfc7", "comment": "Malware payload", "value": "2292ac159f510058a6a442a1890d76be3453fc4df1c8f362f8d44ae1e4bef9dcdfed7a0bbb5c3b508ba22eb29049a29f", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958332, "uuid": "8f418de7-1dad-4264-af4c-9b53f7d0d077", "value": "T12465D012EFC0D1B6C173D3FD5612D33761044B6CAE069013CFE1699A19E899FBB21B9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958332, "uuid": "d86edae8-ab71-4625-9b92-927a29968911", "value": "24576:Gnd1sHgjk/d8CT56WvG8lXkkFE1hqDmPDn60PnhZoQ6XZw31+ug3L:6LsHgw/d8CT5NG8lX3fDmbnBrQKbA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637958332, "uuid": "13e8fb93-62a4-4753-9cf9-5b2b05738801", "value": 1419977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637958332, "uuid": "5207e470-54ab-4973-ac37-82a45108013c", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958332, "uuid": "5d0f4ded-efdd-4812-a56a-a00992b3a6d9", "value": "SkyblockDupe1.8.9.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44a93c88-4efc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637960593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960593, "uuid": "14feb099-0309-4a4d-a2d5-71c89403fa0d", "comment": "Malware payload", "value": "6eeede5fa5bdbd46bb362fe50d2d097c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960593, "uuid": "cc3b9ece-2fff-45f4-8507-b9a4b7bf67e9", "comment": "Malware payload", "value": "05e53ece9d0242cbf17466c6746fcad32c0b97f8dd1dbf07fda951802e9bdeba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960593, "uuid": "56f25ed2-697b-4dee-bca9-f7332617f6ab", "comment": "Malware payload", "value": "73b004e35b6a1196bbc86bca7bc0486b6cbe3d83", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960593, "uuid": "59b6bef9-98bc-4d04-aa1e-2d13b27a4429", "comment": "Malware payload", "value": "e73da93ba9de99e742e0b88adc4b708c3af68dc3d34079cd4fcee8cb39d3353454dcbf3fcc360e95da70adb773bc0b8f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960593, "uuid": "f5d390e1-ef1a-474d-8ca6-038cc80f18a0", "value": "T159941201317D6F72D2388BF598A2325053F2626F65A4F74D1DC270DE1EB6F054AA2EA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960593, "uuid": "e1868abb-4057-4933-9261-7ec668f72786", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960593, "uuid": "8745eaf3-4fda-40bf-8b67-82e18192db25", "value": "12288:gNLaoLAixBFmzKGALr+iR0baMmDfXb0vh6uW53EzqZ2Y:gNLMi1Tr76PuDdUuZr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637960593, "uuid": "bfaae696-338f-4773-96ab-0d0ed98b0229", "value": 447488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637960593, "uuid": "bf1d1523-a622-4038-b06f-b40554c78736", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960593, "uuid": "57b94555-73c0-46ff-8222-d6f234824234", "value": "OUR RFQ. 40.068-21 - IMPORT KUWAIT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0337366-4e61-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637894228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894228, "uuid": "7a2f738d-b492-4072-87e9-7494ab0986de", "comment": "Malware payload (Gafgyt)", "value": "358bd9c38f644dd5f416cac597e8e630", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894228, "uuid": "5d94daa0-3f3c-4ec8-917a-51a6f79539ac", "comment": "Malware payload (Gafgyt)", "value": "0615226186ac23079cc0314f7523c388e7b86723b10bfe5602331b522fd61072", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894228, "uuid": "90d13864-1d1b-4c9e-96ed-3e239cd89e84", "comment": "Malware payload (Gafgyt)", "value": "1488504fa7c7ce80ed8765e2b179134da351bf21", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894228, "uuid": "9f72f94c-9249-42b6-b2fe-13c9b9792209", "comment": "Malware payload (Gafgyt)", "value": "bfc97a09693d7cdf40c602947f083713ac29f4253fa625ba82a5dccb7e219a0d366af2d08b85f37c8a3a98e4472c2537", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894228, "uuid": "03ae934c-2465-436f-ac5d-5913ada75091", "value": "T18213F18949D897B9CA6B647F1DBEF5E64C00D71769288FE073D875B24423B482A6C3C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894228, "uuid": "f7e2c6a2-1f9f-4cf6-8ba9-18f23af39ed7", "value": "768:8FnH/gBaElJp34OBxfCboZXgBCgBVR4gOnx2OtnnbcuyD7UWyqYLlwmC+ieNk:8JH/TElJCOBxfMo2ly2ONnouy8Nqolwz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637894228, "uuid": "541d77ca-94b9-4e23-aef7-4bec498c4873", "value": 43544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637894228, "uuid": "a9d77378-454b-4e00-b1f7-ef4e0fdb4724", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894228, "uuid": "5e0f650f-099c-44ae-84fa-64465c9e5d75", "value": "358bd9c38f644dd5f416cac597e8e630", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f83a8bc4-4ec0-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637935124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935124, "uuid": "a3384b2a-4ef2-4fd5-97da-a3f5b37cd403", "comment": "Malware payload (Heodo)", "value": "17ff4b87e56d4241c48f3ce57bec0df0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935124, "uuid": "0b3c7be1-27f2-46ef-9a9e-c6b999e8e07c", "comment": "Malware payload (Heodo)", "value": "071705ee88a194adbd48409ccc3a026f127dc43a1ce7c804454e77232ff733d8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935124, "uuid": "f1bedc50-fd50-4e1b-9d78-f5f5557a136c", "comment": "Malware payload (Heodo)", "value": "eded39f3ce156d69ec370c1e7a91bf2ff9b878de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935124, "uuid": "3f14987e-6a98-42a2-8887-2abd767c30bd", "comment": "Malware payload (Heodo)", "value": "aff49cbdd2abdd62554a606b7363422c02f23edd0b1522cd01abdf93b593d5ae865405af84302f8048cfe8d96dd1424d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935124, "uuid": "8c10ea6f-fc97-45c2-8306-e910677ac953", "value": "T1A3B4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935124, "uuid": "c084b0ba-0805-4226-9cd3-5c21544f8f2c", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935124, "uuid": "1730601b-e0b6-46ad-999f-699031955e11", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDau3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjlXC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637935124, "uuid": "6d3f5d36-edc4-4a06-b508-dd3da5a519bf", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637935124, "uuid": "fe998a89-c822-4ae7-a33c-facb264a95f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935124, "uuid": "b68045e5-a4d6-4184-ae61-09db5bd665c9", "value": "17ff4b87e56d4241c48f3ce57bec0df0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad5b3d00-4e61-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637894196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894196, "uuid": "2a31d810-e56b-4906-9594-8db63cc34158", "comment": "Malware payload (Gafgyt)", "value": "fb46b987b4f057d7cf21d3edbb12b562", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894196, "uuid": "69461265-aa5e-4795-9a3b-395aba0563e5", "comment": "Malware payload (Gafgyt)", "value": "072cc92801f05e4180046a13e5f67ec26b8b90becf9ddd157d90451c8325de01", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894196, "uuid": "c13b5a00-907b-4bd0-9bac-e4769c3bafdb", "comment": "Malware payload (Gafgyt)", "value": "b4283ef13967ea4ffc8951d45f657e34d602b140", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894196, "uuid": "d8803dc0-3e47-4896-8bc7-df45123329f5", "comment": "Malware payload (Gafgyt)", "value": "7710e819ad97f4cbaf930c7e28623965d12f8ec77e2a9fc36e5c7e068e23bb752776a1354dfb3e70fb1e002bab577211", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894196, "uuid": "4fa5ba08-b7ed-47bc-b52c-c9f48cb6e23f", "value": "T1E423F2A73113E8F5C0FD74724CA4E90CF55D995978354BB30AC0F2A94DA06C2E985EBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894196, "uuid": "674338e3-95c8-4368-80dd-0492c0832f9e", "value": "768:dNj4WTx5vDkVifAq1xsNM0hOWH4ZltGrRXVri6Ss31kJXcwYUM2v9sPcixC0DSiH:D4WTx5vYgfAq1xs+wOm4ZIRdizoklcEo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637894196, "uuid": "f2db6a5f-f8b3-4e6c-b4fe-5fbcc16982b7", "value": 46796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637894196, "uuid": "12781c85-f812-4a32-afc0-3c6f8f5e9c41", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894196, "uuid": "31be226d-77b6-4600-bc17-cff6ecac6cc4", "value": "fb46b987b4f057d7cf21d3edbb12b562", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e9d3282-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918948, "uuid": "5621959d-9811-46b0-a232-031c8674107b", "comment": "Malware payload (Dridex)", "value": "a5d99a124590b06e72d07c3371875c1c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918948, "uuid": "ac7d6cd7-8c30-440e-bed1-83c04c6b3f00", "comment": "Malware payload (Dridex)", "value": "076e78d17a3bba27225ed654145b83f73563a85d568287fd22fbcb3f6aaed049", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918948, "uuid": "4541b55f-05c4-4a44-8566-ea022c6597dd", "comment": "Malware payload (Dridex)", "value": "9ec7c5ed0795e3631bd8445428b3385586789a62", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918948, "uuid": "66d26d73-8d37-4677-9ccc-cb2c234a62a1", "comment": "Malware payload (Dridex)", "value": "396180db8a0c747a6344c96b06c4e03080277ea960289cdc6038b9842bc8e43ee7b9d99bbdf9f9841cceced95f03fffb", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918948, "uuid": "ae4b1666-e0b4-4d0a-9251-a7fcee8368df", "value": "T1E955D162E36871E4C5739A31D07F151F0AB66D2268598205FB723A740D3FBC9BFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918948, "uuid": "4ffce31f-8281-41e1-89da-2e300ab537c5", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918948, "uuid": "c25d5d00-db7f-4a02-9d8f-8123c9ebf123", "value": "12288:TGVNJAvuPFUl/faxuVlBLXKCgFfEK7JRLeHlX//ve7:S3JAvRl/fKIKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918948, "uuid": "fb1230b1-238d-4100-82d7-cafd7566b72a", "value": 1331200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918948, "uuid": "7d5012f1-73f9-457b-95cb-c02b295acbd8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918948, "uuid": "1663be1a-6082-47d9-a422-14687203035f", "value": "076e78d17a3bba27225ed654145b83f73563a85d568287fd22fbcb3f6aaed049", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "334cd78f-4ec0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637934794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934794, "uuid": "5198e7f7-1607-40be-9805-4c0e5dcd7ef0", "comment": "Malware payload (RedLineStealer)", "value": "b0f2d081c387dbee10fac59ed07621d9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934794, "uuid": "adf82cbe-bf3e-4102-9aef-3e43994ed708", "comment": "Malware payload (RedLineStealer)", "value": "0894960790b1e711e04fc146680617f037138a78a6468f1bc262ebb368f4b9a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934794, "uuid": "0e0c3786-79ed-47b2-af5f-c4b47cc0efa5", "comment": "Malware payload (RedLineStealer)", "value": "1a86ba4d1e5ece23e93baec38af81b73babac66f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934794, "uuid": "e71d86ce-ea5d-439d-81f8-b3c8c316c6cb", "comment": "Malware payload (RedLineStealer)", "value": "0c36b6ae2e2015137bde0d0a4d9935bf11dffe7ca76a652e78a38b3712603007a83d2d0633c406bfaf460931ac125589", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934794, "uuid": "a2245f61-e066-466d-8565-aefc97bdc96f", "value": "T1515533FC8C418B47D24F143AF8AA0C7AC2D49562FBD09353872485D9DE76DB29CB849B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934794, "uuid": "2e8dd87b-da86-4fb6-9ca1-5802e3c5f678", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934794, "uuid": "d8d142e2-ee17-445b-9afb-8ea068887d83", "value": "24576:KznZzCTvyxR2J8ZkdEMDHC2doAZMSkIr4tMMvlkEaHNYK3o1ZOeQq:KDJkZNdEafdo242MtNakPQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637934794, "uuid": "f0066434-87af-48ec-aba2-f2d10bedb1bb", "value": 1374152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637934794, "uuid": "30d4414f-c0b3-46fd-a9c9-5497abed67ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934794, "uuid": "da1edf47-36e4-4778-8d84-79ac6a5db1d2", "value": "file3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2de04647-4e87-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1637910303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910303, "uuid": "26ad36a0-d9b1-4a37-8479-aeebb493e04d", "comment": "Malware payload (GuLoader)", "value": "185010cb404a452c081296f8c780c27c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910303, "uuid": "bf2ab607-fa2b-4672-9424-ec7db159fd86", "comment": "Malware payload (GuLoader)", "value": "08a61ab8af128b5db9cfbc4154a1d8183d34221ab0930e96dc4eb59c70bd9463", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910303, "uuid": "1eb72987-c083-447d-bf1b-33094154378f", "comment": "Malware payload (GuLoader)", "value": "8f2083d143e560b680cfb293d36c21d0a7fc96df", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910303, "uuid": "ba94afa2-7fc7-4faa-989c-13ff15cd02b5", "comment": "Malware payload (GuLoader)", "value": "a11bb591f53bbba1d366e28cfa78b805e779864355a266e0c5d53b1321292a2a2d886afc32f88f590cbf38a28d951f5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910303, "uuid": "b5efa58a-d206-436d-84d1-4fceb692c5f4", "value": "T1A0D338B3BA43FCADF0478EF4C16285E444A5793237584E0B4DC4162B293798EF94EA69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910303, "uuid": "55a4de91-b33d-4f6a-975a-e318f8d0a44e", "value": "d77040f4614bccfda7b8aa2e04863738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910303, "uuid": "da46c81c-2435-4d3e-80d6-da1f411771e8", "value": "1536:t5UD2FqnPrQFDeeF/zSkqkKpyGXdyLobHCWXfDQi2Te1D:t5UiCPEFqeF9NyXdy8xMiV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637910303, "uuid": "c6c0ffc6-0e14-4a43-932f-57d421c9cfbf", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637910303, "uuid": "1c466568-fa9c-45d5-8093-bf6fc07705b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910303, "uuid": "2abb5163-7c39-4a0f-b91a-11ea3b0585cc", "value": "184285013-044310-Factura pendiente (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81c4d105-4eb4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637929771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929771, "uuid": "e5a713f0-5242-44c6-9eea-fcd9e434cb25", "comment": "Malware payload (Formbook)", "value": "7877a7074c688baf439f7ec1ab150682", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929771, "uuid": "4dd69475-6d5c-4636-b54a-e3ed47acd7b6", "comment": "Malware payload (Formbook)", "value": "08ade6bd3efcd20c80defdde936ef1329713af42d28889ffb69ba26b321a297f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929771, "uuid": "632342c9-3abd-4a83-aff4-4e43553b4e98", "comment": "Malware payload (Formbook)", "value": "6c2539fb927b57388866f1c072cdf681b585fb2a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929771, "uuid": "8a981ad1-8138-41be-bc2a-5da01c0bc201", "comment": "Malware payload (Formbook)", "value": "edbee4b3a7f43597bb698b2479e5cbc3145be208e47285c5213c6748bd4916ce8dbaedca82f0f3e38f0b17b83d6a9123", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929771, "uuid": "71224abb-4c5d-4190-afb7-2663d598da05", "value": "T16D742369DC818EBBEC5641364FE52E6FF7BA42C41417453F0F942E743EB2A829E02674", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929771, "uuid": "ef876598-7cde-4a60-a265-f14eb3880c80", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929771, "uuid": "6427ddda-52b0-48e7-b08f-50dc22f7940c", "value": "6144:rGijPoPN5qX00RdQd7h0rTFRLFGQfhXStXjn+6FA1l9s4bJpIwW3zCjJbWp:YP+X00+2rhXJfhXSBD+6efe4bJpIwW3V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637929771, "uuid": "51a3c06d-2d5b-436e-82f1-dee46a7660d6", "value": 339374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637929771, "uuid": "80e1b6a8-7d9b-401a-b0ba-63f071a670e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929771, "uuid": "bce9b3c5-40e2-4788-b8a1-5866dac2c7a9", "value": "remittance advice_001001098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d2751e6-4e4d-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637885418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637885418, "uuid": "0d6ebfb7-51f5-4734-abee-0c30bc22e0d6", "comment": "Malware payload (RedLineStealer)", "value": "b323d0715f9172b707dd2bc941ca4cbd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637885418, "uuid": "f3adcc0d-790b-4f81-ba40-c0d2cceab585", "comment": "Malware payload (RedLineStealer)", "value": "0990a2572d8b275f4adb305f3673f72ba4baafa1f85c7132a2306531517ebca8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637885418, "uuid": "4742e10a-1527-4524-b907-4db6f354281f", "comment": "Malware payload (RedLineStealer)", "value": "6d6ea08d5d99f2d53f95b86ff3ac97cd67a128d2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637885418, "uuid": "2510bb0f-7e56-4dc9-8a5c-f6ea66dc3798", "comment": "Malware payload (RedLineStealer)", "value": "cfcfd53b92578bcc95ffb047101b0a6dc3680448b7c3906d498660603d7e63d67c3478b82bce16bbe0ad4721ebaf4aa1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637885418, "uuid": "4342807c-234e-42b4-84f9-bc7b2ab47508", "value": "T1F9B63301AAA66C31DE330934C431F9215FBDBD158BC9AD1B67A88769A570EC0F731DA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637885418, "uuid": "aac468f5-d852-4887-b6d2-62b0641990a2", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637885418, "uuid": "8236499f-11c3-45a3-92c5-7c8c0cb2f838", "value": "196608:PMhQAphSS5VmxECbzAZ4UCM6SuIkaXmeAurW/LU2YVldbvRoQobMXfubY:0OApQSjmxEny7aXzAuoULldbiQwMXfN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637885418, "uuid": "b43b6f26-d564-40cc-88ab-440941eda86c", "value": 10805898, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637885418, "uuid": "0e2bc1b5-d4fc-4bd6-b15c-bbab85f1f063", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637885418, "uuid": "f00b3824-cf75-4eb5-b205-d5135f329fd1", "value": "b323d0715f9172b707dd2bc941ca4cbd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5acccf27-4eea-11ec-843c-42010a9c0014", "comment": "Malware payload (AnchorDNS)", "timestamp": 1637952899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637952899, "uuid": "75b26d04-0f41-4f09-a9e4-9ca6ab1f80cb", "comment": "Malware payload (AnchorDNS)", "value": "a4289ae6b373bccf320ff67b25dd8ab0", "object_relation": "md5", "Tag": [ { "name": "AnchorDNS", "colour": "#AFABBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637952899, "uuid": "854007c1-8a4f-4a4a-879d-f47b0bad67ed", "comment": "Malware payload (AnchorDNS)", "value": "0a1361c3f9dbc71635ad46d04ee0ad66c78728294d9de113b9eaf13392201762", "object_relation": "sha256", "Tag": [ { "name": "AnchorDNS", "colour": "#AFABBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637952899, "uuid": "a7c0e716-a92a-4d35-bec2-77ac741e90f5", "comment": "Malware payload (AnchorDNS)", "value": "2610c8fecbfe3c1d3272dff007191dbdecec99b8", "object_relation": "sha1", "Tag": [ { "name": "AnchorDNS", "colour": "#AFABBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637952899, "uuid": "66825223-17ec-46b6-807b-a84c3cbaf33e", "comment": "Malware payload (AnchorDNS)", "value": "d5975000f8b129c315bda4f8da458962e51de0f9ac06badd71cd7bafeaa3da42fa1c7c42a09689084f6c8123aca2b007", "object_relation": "sha3-384", "Tag": [ { "name": "AnchorDNS", "colour": "#AFABBC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637952899, "uuid": "fc562442-a5ae-4394-bc86-7b98129b7471", "value": "T1D1748D25E254486CE41AC5798973D211EAF23C460F72B6EF23D507273E36BA47A7E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637952899, "uuid": "3542c7c9-8127-4eca-a948-742df035e8bc", "value": "485b95ed0c69eb8b816da620685cf220", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637952899, "uuid": "988559bc-075d-496b-adc0-02e92a86c951", "value": "6144:HbnezFzrzW3fGZfWr2EzJLTe6SoOxp/TusZ84:HL4xfWrZTBM6A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637952899, "uuid": "305c36b0-d934-4274-a2a3-3c382e39e455", "value": 352256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637952899, "uuid": "6ad0bbe5-f05b-4c51-9ec5-80566637575d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637952899, "uuid": "609a8115-2af9-4f6f-8f74-28ba391549cb", "value": "0a1361c3f9dbc71635ad46d04ee0ad66c78728294d9de113b9eaf13392201762", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea08f6b5-4e9c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637919638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919638, "uuid": "4043f244-8304-497d-90ee-b396aa115b9c", "comment": "Malware payload (RedLineStealer)", "value": "f4dcaaab18f0d6dbd7c7ee3387af6607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919638, "uuid": "f622fc1e-6ed4-484d-b3b6-6b1a96bad26a", "comment": "Malware payload (RedLineStealer)", "value": "0a2403cf21d0e2d4a119bf0bdaf7eb36eccc2497fb64bee6004711ca4aa3c472", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919638, "uuid": "e5bb1b8d-c117-4076-afff-124d752ca957", "comment": "Malware payload (RedLineStealer)", "value": "2be320eb05f04b14a33e668b6c12bf8a75b2f4e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919638, "uuid": "8b98ce28-5f61-48de-a757-21ae69ecb4d6", "comment": "Malware payload (RedLineStealer)", "value": "7debccfce9f263903b9db1544ff19ac83c66eb37b75431c2a791fb7a63ef433c6092bb2afeba6934efc5f4e67a27c588", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919638, "uuid": "86fb4a85-b738-4859-9e63-da5ebecf8f80", "value": "T134E3BEE03EE0C035D1A7173068B09AA51D3ABC736AF5824F3794263E1F706E05EA675B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919638, "uuid": "de5952e3-6372-433d-8a44-ac6ba7d9a0d6", "value": "a967f53cbb69a203dbf386eac93050cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919638, "uuid": "91adc96e-ee5e-4c86-8f8a-025883c17d97", "value": "3072:Za8eanZqCrEAYflJwPgd8q5qdgDmzU8pHhc2:2MTEAYfUP6sdHU2HhP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919638, "uuid": "a94bb556-133b-4401-b52f-7f298b684ed9", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919638, "uuid": "0cd4a4c2-36cc-43bb-8eee-fa7294820fbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919638, "uuid": "4574f8f7-5d96-4b3d-bbb2-1920eee3c598", "value": "f4dcaaab18f0d6dbd7c7ee3387af6607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51fdfceb-4ef4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637957179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957179, "uuid": "b63cbe39-14ad-4e40-aa09-6ef05e61f324", "comment": "Malware payload (RedLineStealer)", "value": "0ed55fa041adc2cb12006d044306633b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957179, "uuid": "98d80797-e465-4c6e-a9e5-ddae65ae6e18", "comment": "Malware payload (RedLineStealer)", "value": "0a7d966e66cbd260c909de1d79038c86a071f2f10a810f5890a150b67c4fd954", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957179, "uuid": "447641b9-9835-4bcb-8fb6-a19b8ab355ac", "comment": "Malware payload (RedLineStealer)", "value": "47859d9143e282508b5f58ff828809676fe63f7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957179, "uuid": "1f2ab3f0-c295-4007-b121-b6d704c0a30f", "comment": "Malware payload (RedLineStealer)", "value": "590c93c18ba8efa71f713a30f320b1ce8ccfa016b948fd61be4dca4d955f0cdc7f6370bd9d6af4266b09cec198fcf2a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957179, "uuid": "a9e5c10f-f309-4443-aad4-a80f96cd4f81", "value": "T1F23633883DE8E81CFBB147B2D8B1C12B9F91DD0E521812C72954D8E7B179AB34C4A67D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957179, "uuid": "1f14d45c-4468-4769-9e63-f763f8b4f6c4", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957179, "uuid": "3285cd29-0d0a-45ce-a2ef-b0358329fa10", "value": "98304:ysTGPf95Yjr6LnN9lOpcjqiRPr/5uCSqzA1Raz8yPXT:yqG8jgN9TjDRTB306r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637957179, "uuid": "46c2fe23-4f8c-4afc-ba46-d5db7d97150e", "value": 5004076, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637957179, "uuid": "78ef2497-acff-4f0b-b3cb-9c3274b30b1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957179, "uuid": "7899dd51-f968-475e-863a-82a9d7500308", "value": "0A7D966E66CBD260C909DE1D79038C86A071F2F10A810.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad584b33-4ec7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637938005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938005, "uuid": "1dc615ad-6283-4747-a539-439bb40b138a", "comment": "Malware payload", "value": "b50a331f4c58d258048c82d0e4ba1b36", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938005, "uuid": "6ca07467-390b-4a4b-b7dd-3da1d3529c1d", "comment": "Malware payload", "value": "0ab77f1c51c57aa5ad02555ba5e5af59b74339cd6152ff11f50f6d2654b4558d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938005, "uuid": "c31426e4-1c27-4264-bc32-3231d7bb7928", "comment": "Malware payload", "value": "2a40e730e72a002bb8dd2c08b941c024fdc27cbe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938005, "uuid": "a4e808a6-6ceb-4f13-b27e-72dae332ead3", "comment": "Malware payload", "value": "8c3cff04da493596ab4d0774a899349e101b935cff50abc0ea57552cd0c9a48beccf6ea4fc7098ca8acdf76760b34b30", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938005, "uuid": "1de97b9d-c50e-46ed-a302-b71e8b8ece52", "value": "T16492D132826E94228F20283FECB89593C7575E5DD0BA305513E409D4F7CBA81667739B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938005, "uuid": "6f777883-f390-48fd-93fc-152b224df233", "value": "384:GFfDS02JMTY49pWGxMNsZo7jULTdSx/zt22bBuyPWj4hymdGUop5hx:qmf6rZejITdSx/ZbBuyP1s3UozL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637938005, "uuid": "bed5d4d4-0602-41cb-8a56-1cfa91695a9a", "value": 20544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637938005, "uuid": "b8a41627-3971-41a8-b9bc-c6db5a0b97ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938005, "uuid": "133ac28e-c5b2-439f-9ef8-af0c98b2f132", "value": "b50a331f4c58d258048c82d0e4ba1b36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ce13e01-4ea6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637923804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637923804, "uuid": "dbfbe2af-560d-4bcb-b37a-76c2c5583105", "comment": "Malware payload", "value": "167ab19c328b8187029fda57cab0de83", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637923804, "uuid": "e28b5f5d-738b-46aa-9641-64a52fd7b36b", "comment": "Malware payload", "value": "0b781146f12866276433eaf9cb8a1b4578dd87177f2b8046bcf30cb95a4052b1", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637923804, "uuid": "a176f7fa-af7e-4265-8136-fe28e97faa6b", "comment": "Malware payload", "value": "a84283456b7ea1a5e5fbe12fa67fb16ed169f81f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637923804, "uuid": "75fcb69a-98cd-482f-aaf3-603624b51538", "comment": "Malware payload", "value": "c5113fa54568795fa1290fca57374b6ebad4be56d1b6a4477c292617b934910a8ec2de2aada4c0cad2ae9b697ab2605c", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637923804, "uuid": "cffc6260-f83e-48d6-bd8b-131cc3de2f69", "value": "T17E63E5796D258DBD972C3430B2DD1CD06FEC9727A98B82BA3BD06D79EE960C085CC152", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637923804, "uuid": "e7da8935-afea-4beb-939c-3343b19f0bb7", "value": "768:vlW/z6zST8e5Y88Omn2x0E3UBDNOWfLwvNnLuTW+Omy/Wy8Zjnc4ge:vGW+Ie5YI9j3UDzkvZCOmAFqnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637923804, "uuid": "a51b9aa4-e825-496f-85f4-12691ed350ac", "value": 70527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637923804, "uuid": "1c70ca4e-cd01-4332-82ad-4c96942d2123", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637923804, "uuid": "530ee68c-96fa-4611-bf60-81a3eb8f93ee", "value": "MSN UPDATE .HTM", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1628425-4edf-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637948427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637948427, "uuid": "359d5bb3-dd81-4ad5-ae8a-e8cf45d5f714", "comment": "Malware payload (Heodo)", "value": "a09a3c063501ab8fc13a2ed15ee1fb4e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637948427, "uuid": "6547665d-1195-44de-ac06-dfdb5b2e3da7", "comment": "Malware payload (Heodo)", "value": "0bff6dd8dd47fecffa1a7d39e24d0e20c8c5676f8a4498a4294756a2086f35a6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637948427, "uuid": "551c36bd-59f6-45bb-87ad-ee70aa783550", "comment": "Malware payload (Heodo)", "value": "d7170d7ec9ce6fc13213a127285dab4ed127467d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637948427, "uuid": "69a0abca-881d-4c69-a347-a1b1f287f0f6", "comment": "Malware payload (Heodo)", "value": "0954a110d07d9dc27010046d44cdb387bdcad11ded9d7baea4270c207173327319b4383ec74005b26be70c7fe0434ca8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637948427, "uuid": "3d28ef0d-78b7-42e1-9ed9-db7b90d7802f", "value": "T108E4AE1277C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637948427, "uuid": "2dacb72d-b2cc-4925-8b21-13ee906f804a", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637948427, "uuid": "8bb4e85d-6ddf-412e-a268-fffa29d8c3b7", "value": "12288:WKEUkuAOLka1miSmuYr1V72AobS3qTHPR101D:TEQLka1nBVCAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637948427, "uuid": "225a64b8-0c61-4a94-8f32-81615f8f10c2", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637948427, "uuid": "44db4c76-db8a-4c97-abe7-6799f0648dd7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637948427, "uuid": "2679170a-23ba-4936-9652-0ef16fc54a67", "value": "emotet_exe_e4_0bff6dd8dd47fecffa1a7d39e24d0e20c8c5676f8a4498a4294756a2086f35a6_2021-11-26__174022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1091af7d-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637954063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954063, "uuid": "79f5c04f-11a7-42db-b69f-1d0c616060ee", "comment": "Malware payload (ArkeiStealer)", "value": "f9c95c502f0975bd48be913f9fabbcff", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954063, "uuid": "cec2dce5-ef58-447e-b5d3-4555a5f17476", "comment": "Malware payload (ArkeiStealer)", "value": "0c6b62ee546449ef1cb2bb826ecfb03279f27946f7a516dca9fca8926c1105cf", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954063, "uuid": "5278acfc-734d-4537-8365-2ceb413e523e", "comment": "Malware payload (ArkeiStealer)", "value": "ce464d7af866b05c8f85997e2bb9c60b87f57268", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954063, "uuid": "56278635-db64-4a4e-a0f7-c17521abfd91", "comment": "Malware payload (ArkeiStealer)", "value": "01b75a666ea07ceafaf3daf27871c073a7ed7420d215bd7d7d17b2ead763c7429025c73eed22463c218ceb652f2486a1", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954063, "uuid": "d418ad42-6e83-4f2e-b65a-73b2266fecbe", "value": "T14114D0A076D0C037D0AB163364B0C6B5097A7F3F2776814F636636FE2E213D19AA1766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954063, "uuid": "aa8d4a12-d0aa-49be-87ce-e86184dc6091", "value": "b677a6ade7d6582bbda54d73cc7b1e72", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954063, "uuid": "1bdd4de5-e188-4283-8ec4-14f2bf7b0900", "value": "3072:dReUa0TnXT8TF2rtwbAeMeisbCa87hIem/vyRzTZgrn4zCX2:qUa0TnXT8TFctOArez87hIZ4zp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954063, "uuid": "751a4781-ff48-4800-b901-1c02de83a644", "value": 195584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954063, "uuid": "727e1273-634d-4fa7-94e9-7382a90998f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954063, "uuid": "4e9fa3e1-5ba2-4c9a-8a79-8a3f59ea570e", "value": "f9c95c502f0975bd48be913f9fabbcff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c14f844-4eff-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637961840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961840, "uuid": "b1b92b4e-0c82-44bd-abf1-f6e094c5d6ff", "comment": "Malware payload", "value": "2e9be45afb9288e4018eecaa2353c8cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961840, "uuid": "5c6b2c3d-6243-4970-8317-f99e67c683dc", "comment": "Malware payload", "value": "0cfdf6fae827b7e596abe461e7ccc24533cbfab8b80ad227e6518d71e5b231b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961840, "uuid": "737328c5-2723-4688-a90b-7b5b3de45013", "comment": "Malware payload", "value": "549fbb53dba248e549ebb69a95a0471c948566d0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961840, "uuid": "0a2da6c7-16a2-44d5-a943-17fb3a83b31a", "comment": "Malware payload", "value": "67ebb20dda4672acd22137e02f0744ef805e4abb8cd8ab61b8b085b3a95ae16f131dd28e017cd045ea28d0d1c2c37306", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961840, "uuid": "10b0da91-bfc7-4cbc-a3d7-9efca10c6943", "value": "T123C42F1C3B058E62ED0DC2F76D850B44AB560F1322487B86E78B36DAF76F89E5D47884", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961840, "uuid": "7a2837b4-16ef-411c-8056-682873423fe5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961840, "uuid": "e33aa0a4-11c7-4c34-a7eb-475d10772d0f", "value": "12288:BY93owsGkYsdIjoPWpl6iOi6Q8xzivrCIabjKoh9W:zdU0Wpl6O61xzsCIabjKoh9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637961840, "uuid": "4d384f8a-c478-4222-b583-2b7d37c5a85a", "value": 555008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637961840, "uuid": "d3049c4f-52b7-48f0-9765-f294c27a378b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961840, "uuid": "d47ab8f8-6a97-4970-a88c-52638ad35d15", "value": "Re-6526511222031.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3649b4e9-4ea0-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637921055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921055, "uuid": "7b141d55-77df-4de8-9ac8-75e143f7ce65", "comment": "Malware payload (ArkeiStealer)", "value": "71d5269a47e1b64574fa3ae7d4c7072b", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921055, "uuid": "c59db357-68d5-4fd9-bbae-f2fde79ebb94", "comment": "Malware payload (ArkeiStealer)", "value": "0d96be927d2a26e8375be0b8d5e2fa7665df54f6a7743b7800f1d332a834a92c", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921055, "uuid": "225be1d1-4330-49c0-a7d2-4272bca46b57", "comment": "Malware payload (ArkeiStealer)", "value": "56ba5fdb42f4bf9a2b756b3683e33cff94b793eb", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921055, "uuid": "75781a59-9dc9-4283-a563-915b3b1f30bf", "comment": "Malware payload (ArkeiStealer)", "value": "6218c22338f4c99f893c7eefc243e0331320c5c818b3c337dd6675c1796314e650e2d6333b491b66fe700bf2abb20368", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921055, "uuid": "3ea875a0-0331-455b-938d-85f5a3a18cb0", "value": "T1A6648D00ABE0C438F1B717F94DB9A3A9693F7DE16B6491CB628126EE56396D0DC30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921055, "uuid": "88348588-6e09-4b5b-b12d-4aab24098d5b", "value": "bce62dea7726f3b5e6dcf6bc8dffdad3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921055, "uuid": "4453a67b-24d0-42dd-8c19-bdf1973bdc04", "value": "6144:FvpS16x0DbKso1fiug9Ny8t94dgXmDas4:TRmKsoAug9Ny8t95mD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921055, "uuid": "ac8f018e-fd9a-4fd6-9f39-8f2efea46aad", "value": 315392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921055, "uuid": "817a8d31-9e32-4e1d-9137-2d159d62c5ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921055, "uuid": "af8ab843-ed1a-4ff6-921d-aceb7efe8094", "value": "71d5269a47e1b64574fa3ae7d4c7072b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9415e8f9-4ee2-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637949559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949559, "uuid": "58827c83-854d-4d69-bd3a-ed996d1f9899", "comment": "Malware payload (Smoke Loader)", "value": "603568da5b4d6d7e45e79b5d3677f472", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949559, "uuid": "9454b32a-de4f-478e-9c4f-dce7eee0b973", "comment": "Malware payload (Smoke Loader)", "value": "0d9cab003c5c67a5bfc0e5cc6823f32fcb175787e42d750f48dbe94ee9e9adb3", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949559, "uuid": "cc6b0517-c88f-44d9-bac3-86839a0a8eeb", "comment": "Malware payload (Smoke Loader)", "value": "0c94f054c63cea48bc80e3dec0941a0599e8664b", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949559, "uuid": "620b250b-3676-4e8d-8774-c28dfe2a5361", "comment": "Malware payload (Smoke Loader)", "value": "4352425c0eda8f653de724ebb16461bf360941fd981f894b4354d25aa077a4fc7447a0b1718541de6229d5b0e0937782", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949559, "uuid": "149e7df1-dfde-4b02-9d24-625580eae5e5", "value": "T121F3AF1137E2C472E2E7A630287ADBA02977BD731930958F2754363E5EB06D08EB9357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949559, "uuid": "75e31f2f-80e1-4393-afd7-d22098fad2b8", "value": "0870c1337a760ee1593b3bf581332ebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949559, "uuid": "91444f95-c1ad-4ea2-998a-db745f1b6fe6", "value": "3072:oNeuwwwF/zKXkLyOgA6XJzvY8AXmQmE6uBCCjkfHrWd2:7uwwwF/zlLyO4FvY98E6khjcHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637949559, "uuid": "7fcdbd74-34f8-4f2c-b715-f485604aa3c4", "value": 161792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637949559, "uuid": "f82d91b5-1435-468c-9c0b-bbff819f41c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949559, "uuid": "0d765263-9a44-4129-997d-41969e37b3bf", "value": "603568da5b4d6d7e45e79b5d3677f472.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b975b8b2-4e61-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637894217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894217, "uuid": "4f1cbb69-7345-48e4-bf78-06190429915a", "comment": "Malware payload", "value": "909f1104e3bc8c6a8d442414dc6ce7f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894217, "uuid": "0aaee6cf-fda0-4277-bdf4-bbb215090e4e", "comment": "Malware payload", "value": "0ee02c3ad61429cf31c3cc5b78eda968c08ea4941ebc7fc4f3361eea764ae462", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894217, "uuid": "6cc8db8e-da95-4ec1-b7f4-a805a4dc4521", "comment": "Malware payload", "value": "68cd10e8b140c71143474a86176731aa8e8258df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894217, "uuid": "349a1dff-4092-40b7-93b8-b5b2d12ae9dd", "comment": "Malware payload", "value": "089fede82838bc7d7a141a711ef241585f6632d90307e7e49accc77fdde78d4b748c4b84e0df8df9107214951675ba6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894217, "uuid": "6ae8c512-ccd4-4fda-91ee-99a2123b60ae", "value": "T14513F1809FE10883DB903C74ADBB9F4D54A79E73AA9025A82631057DB8F7081A6FD870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894217, "uuid": "559a87a6-b271-42ca-88e3-48d279bcb299", "value": "768:4k+ab+DaCk24e6AFoj7qS/OTnJnIC13UNPhncxOovUfo:N+JDaCk27WH3kJlmnSpvGo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637894217, "uuid": "ef0228e1-bf91-4552-905d-4fb32787daa2", "value": 44092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637894217, "uuid": "76789ec0-e6e4-490d-9c34-c03450d18995", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894217, "uuid": "9e5f5950-f5f9-44dd-bc5b-35a88862cc67", "value": "909f1104e3bc8c6a8d442414dc6ce7f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bcfb919-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1637921413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921413, "uuid": "77b9b80c-fb75-41fc-a694-1833dc49c776", "comment": "Malware payload (DCRat)", "value": "1ba74a157112020a863b20d3bb5adb77", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921413, "uuid": "c7857435-5cf6-4cc7-b0ba-3a77d81cded6", "comment": "Malware payload (DCRat)", "value": "104f03eca7632ceb0606d4e80068ea0718b4a7d5610bd7b99a40ad1b3c3935c1", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921413, "uuid": "54fecffb-29e8-4f8e-9855-7ee933af748d", "comment": "Malware payload (DCRat)", "value": "43a193073b7d96af0e55a8825d7db916d4bccc65", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921413, "uuid": "c1a00e26-f8b3-4501-a8bc-eb5204c57e88", "comment": "Malware payload (DCRat)", "value": "a4b2338d41fa2e7afd5de8bfeadadd839fbaa6d43531bfcccd5b2bfd2e51e1018b675aa4794cc12dc17ab3fec46e6d96", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921413, "uuid": "f5264fe4-74ae-47e2-936e-ef00a3bbde58", "value": "T120049F80B2F0C93DC12556F682D7BEB4D3F23C8AE8308356958CF1E62675D4A2793366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921413, "uuid": "af4eb690-cbfa-45cf-a151-0cc4e16ae065", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921413, "uuid": "cae6e59b-67c4-4535-9c1d-8565dafb1b7a", "value": "1536:V72oft8MK5u5gGz9bUvAAAAAAAAAAAAAAVm0AInFxRDahqca:R5ft8/5u6CAgIFxVB5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921413, "uuid": "c6514720-7d47-4b34-83d8-9649e479fd0c", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921413, "uuid": "49449dbf-ccea-4db2-b5d0-dbb05815f61f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921413, "uuid": "c338868d-cfe9-4b74-b069-6b120b4a9f0d", "value": "1ba74a157112020a863b20d3bb5adb77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70ff9b68-4ee3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637949930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949930, "uuid": "f75a73ca-4140-44ed-a95f-50f6a9bdc178", "comment": "Malware payload (Formbook)", "value": "0a17654221a708b5d5628752c92c853a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949930, "uuid": "c6e2c275-2faf-4c52-b86b-26bf34847862", "comment": "Malware payload (Formbook)", "value": "10699cf2b5fef42903e0cdc6fe0bec33613eb2782f043bd92bd4789a42356de4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949930, "uuid": "1ff96cfb-30d7-4e5d-b738-35ff44454ad9", "comment": "Malware payload (Formbook)", "value": "4765f197a6a75a8500fef40c77d332dadb055cc7", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949930, "uuid": "56cf86b0-8942-48be-88f5-989bfd0aa754", "comment": "Malware payload (Formbook)", "value": "0608d7ff25359419b3b498c694b68f03ab5b750be0cc9c6f64e4671fa1f3fb3bb2ac07789176eb58de9a11d2a05295eb", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949930, "uuid": "0c6d2c2b-88cb-4587-889f-ddef816cfdb1", "value": "T13F3412603BA78213D3A1C67D5A9C7DB90866FF6A7980DDC351A13147A3F88F210D1B6E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949930, "uuid": "35f94ac4-905d-4ef4-b98f-014f53fb1fa0", "value": "6144:eJ5Uhn8Lg42+pjsuLr7hzvvPRY5JDnHuGG6RIJiPLr+CafouC:eJ5UBP42+pjsuft5YzDnyBkDrYnC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637949930, "uuid": "c77b5ca0-cc8f-4052-9a15-656e3059d341", "value": 234200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637949930, "uuid": "622e6492-2b44-47df-96ed-1e9aafab836a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949930, "uuid": "21c809ee-c857-4b96-95db-772750c629d5", "value": "HKHSBC1K15551972-T01.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31fa12dc-4ec0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637934792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934792, "uuid": "a50e7758-e510-40c6-a025-f4fca3b554f5", "comment": "Malware payload (RedLineStealer)", "value": "ee11473d713c1600c9c65fd6ff4bad02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934792, "uuid": "6b9b2cdd-3e93-4956-855e-a11048a13e48", "comment": "Malware payload (RedLineStealer)", "value": "10c6ef8f363434324321d3e6ed08e0caef5ebb518cf8ed6acca126588c6680e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934792, "uuid": "e089aaa0-5ebf-43ec-8251-82aff3aff5b0", "comment": "Malware payload (RedLineStealer)", "value": "31affa52f305870099d434029bf2a75abe977f74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934792, "uuid": "f524b892-f83d-4f64-9738-743f05e5e3dd", "comment": "Malware payload (RedLineStealer)", "value": "73d667f6a4a88d8429e62b460c4eb06940fd3f8d60df81ddb5040fbd08cec0a2e50dbf245f272ea55f4b2b6c56651093", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934792, "uuid": "1042cab1-a621-4ac4-9164-e19f7d6d89b6", "value": "T1D7A421536DC8FB19A4911D3782CF3E291B922DD68B7255466B49FEF012A02016E3BF7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934792, "uuid": "ca3d7bb0-0d8b-4e7f-8d18-fa1d4211b989", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934792, "uuid": "3cc7ba87-6137-44de-a9ce-b2661f59257e", "value": "6144:kWuHzD2E1pqlIXgNLa+1VyzdYcDVj34JCHzghvhzBQBlKzeu3f:ezSE1p31pj3BTqhSKzey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637934792, "uuid": "5c05486e-49cf-442d-b164-62da3be5c0e1", "value": 449944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637934792, "uuid": "274cdfdb-ad5c-4b25-84b3-824a86935d56", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934792, "uuid": "9eba8ad8-090c-44a0-a53b-671f3390d005", "value": "file1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8113ad03-4e83-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637908725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908725, "uuid": "78515a79-d29a-4eda-8e53-c3f398e512a8", "comment": "Malware payload (Formbook)", "value": "c58d5e2b828ecaed0e6688d65e6961e9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908725, "uuid": "bd41dcb5-26fc-41d3-bc15-46573d650c31", "comment": "Malware payload (Formbook)", "value": "11128ecb20c21ca6dd1bc29409c2a33de2aa5f6db4483bd1062085821d3b4186", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908725, "uuid": "4a133615-e6bb-47d6-8000-a11debc8d9cb", "comment": "Malware payload (Formbook)", "value": "8018e506a3e3a7ca5dacbf8b70e2cf5d8b897013", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908725, "uuid": "fa48633d-0a5e-47d6-9dab-1ced426bb327", "comment": "Malware payload (Formbook)", "value": "5b7b1efd7e1032267a55fa4fcf3b92a51d8fa14b2f159fc28c319f7c6d1ad2883f9022a715f2ccfbc07c8e3d324a18ad", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "z", "colour": "#C882CD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908725, "uuid": "1659416c-ff4c-4c02-a9d3-15d3d908a04d", "value": "T164B42326F5BD2400FA89E46CA36529350678D4F8B7B0EC5CEF1C4393798C3B9AE4AD54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908725, "uuid": "8f722037-5603-47ad-b74f-cb824d4e9d75", "value": "12288:a8UcbKjinQCv7IfmuKTbH2IhqExOzhtPN2gaggmK3tM:a8bptv7SKTbWIhqEsboYREM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637908725, "uuid": "ecad898f-baf0-4e73-9a2a-c8572ae97aa0", "value": 497523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637908725, "uuid": "e030dd88-cd9d-40f3-989c-c6b490e40d00", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908725, "uuid": "02762f2d-7b67-4faf-973e-4f94a0929d98", "value": "TT_SWIFT_Export Order_noref S10SMG00318021.Z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0827ac61-4e5b-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637891342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891342, "uuid": "e77fa515-9e8b-425e-86d4-8a3ac80025e1", "comment": "Malware payload", "value": "567b80a21697c88b417a306036af95c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891342, "uuid": "17400ab7-e68d-4b5b-a241-00dc21f55eb6", "comment": "Malware payload", "value": "113f84cfae0a6240a4f5f41802283a17d976722319c4983a260215e05f8c6f67", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891342, "uuid": "38f98b72-23d7-474f-9559-bef614a98d88", "comment": "Malware payload", "value": "4131a48d08f23d2dd4bda1d6ef406ea948637a27", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891342, "uuid": "a948a708-e004-47eb-bb29-c37da869f0cb", "comment": "Malware payload", "value": "cd1eef232a8315a233698a80fd4e13a99130d7a6fb09c9a7f9b31d012b14586ad1f8c6b8dc6d7f36f60d1cdc29f068c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891342, "uuid": "b16443a3-a878-4e10-a3ae-d9d03203103f", "value": "T1C30623963BD171EEC5B7CC32C9121C749B21ACA9A38A8252951736ADCF3E4C2DF451B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891342, "uuid": "83ea7f7d-86d3-460b-a1e1-cbaa5c218f74", "value": "98304:D2G8U0RlychdyT9LFk/jVfxMOSvAfMt7Pm2wNC7K:R8UMUKdyTG7Mzv8GK2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637891342, "uuid": "8a0dc930-e791-40f0-9fd0-ff84504ef1b6", "value": 4009472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637891342, "uuid": "cf325a2e-20e6-49d3-87fb-26dca4d49088", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891342, "uuid": "0d0e100d-4efe-4cc3-957e-05188090cdbf", "value": "113f84cfae0a6240a4f5f41802283a17d976722319c4983a260215e05f8c6f67.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0345c522-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918822, "uuid": "a640723f-7782-499a-b6f7-135e08d58e7b", "comment": "Malware payload (Dridex)", "value": "4bcdeb39da135fecdcaad9f1a96c3186", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918822, "uuid": "4e733046-49da-433f-b646-e841cdd92694", "comment": "Malware payload (Dridex)", "value": "114957fd7fb9c6830b6da37b828ad27a8c8a61f01abb6f52424ca1c5da9f523f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918822, "uuid": "bc8aa99b-b39c-4f86-a8a5-1a5c1f445d38", "comment": "Malware payload (Dridex)", "value": "8432f49550f40d8da39ccbc9fdfaf6fc631def1f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918822, "uuid": "ca5f3f1f-1b51-4227-a86c-756aa68aedec", "comment": "Malware payload (Dridex)", "value": "3fd3410dd77cb03e7aaca305e4020aa1f2fb5e8cdd494661c79a9a28174f1e6b3f3e2b4402c79f17b94a6a086d9dc35e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918822, "uuid": "f119b21e-4f76-4505-a367-147a922fc869", "value": "T1AA65D162E36871E4C5739A31D03F551F0AB66D2268598205FB723A740D3FAC9FFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918822, "uuid": "abdf0a5a-8000-4192-8ca9-b3ef12d15554", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918822, "uuid": "9ba6a742-b716-40dc-aca7-2a2a4f91ec95", "value": "12288:XGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:W3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918822, "uuid": "1f2ca6eb-92d9-4071-ab15-5a4710f8dd1e", "value": 1409024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918822, "uuid": "8c21e6d2-ae13-4f5b-b43c-9b1cb25f9eba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918822, "uuid": "de1a1c8f-6c81-48ae-a742-4fc3bc3048c0", "value": "114957fd7fb9c6830b6da37b828ad27a8c8a61f01abb6f52424ca1c5da9f523f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d11a7336-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918738, "uuid": "cf2fa3c6-5d6b-4690-980c-2a55f340f9b5", "comment": "Malware payload (Dridex)", "value": "32f0105f83bb61e4fd688219dca080c0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918738, "uuid": "27cdefab-d378-443c-8226-faceb38534fd", "comment": "Malware payload (Dridex)", "value": "114c890f736efbfef6a5d5bfe69d10f3b98b5cf919b25536bff9dd7ba2738fc6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918738, "uuid": "104d9f6f-178e-4328-9cb4-5f208be723fe", "comment": "Malware payload (Dridex)", "value": "4de49a52dd511040dc5d36703966d6b0fe9075a7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918738, "uuid": "0d8e3a31-b245-4ef4-a072-169f5eed1ddf", "comment": "Malware payload (Dridex)", "value": "86246c2981d3a0ae9e8eaa4f6c7279efc500d15b2626ddaa830b40de49c21cef7e9706451a91120dab6d77814416bb82", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918738, "uuid": "7f81e23a-9b13-4904-b1a4-e22da7144eee", "value": "T19675E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918738, "uuid": "885bbd61-79e8-4184-984f-eb18a0ddebf0", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918738, "uuid": "3b617621-4bb4-43fa-8615-aa65bb29a8ac", "value": "12288:NZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:NZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918738, "uuid": "5c466f11-65b0-4efd-ac55-21f72d1ac02f", "value": 1609728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918738, "uuid": "44e1383d-a90c-430d-889d-35ce1f09625b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918738, "uuid": "31bbebe5-6674-4f8f-8945-69ab72b7b1b6", "value": "114c890f736efbfef6a5d5bfe69d10f3b98b5cf919b25536bff9dd7ba2738fc6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb8d4c18-4ef8-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637959182, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959182, "uuid": "faa155ff-0fa6-4c61-acad-b30d988bc633", "comment": "Malware payload (Heodo)", "value": "f0f62dd156a8acf3f7676e2d91fb262e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959182, "uuid": "11864e2b-7132-407a-b640-ae5e4f1f5a87", "comment": "Malware payload (Heodo)", "value": "11a8a1c5c794846248680f9f73497e7aa57d4be6ae3bc721b2b7fd8ea9eebb4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959182, "uuid": "25991172-0474-456b-bd68-1b53bfea2566", "comment": "Malware payload (Heodo)", "value": "29e9380ad51a6e385314384bc0e780f6d521eb07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959182, "uuid": "d0b9501b-8e8b-45ca-b927-b1e419e1ea1b", "comment": "Malware payload (Heodo)", "value": "acea8b3db9086ef10476a38bbe62d22d0886103750d241f8716a88690da4e605b69e166818ea8484fb7f47f558ac7c31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959182, "uuid": "719af062-6e92-4ff2-b458-cdae2f33d53b", "value": "T1B5E4AE1273D1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959182, "uuid": "c1f49932-5c30-40bc-a540-decd99025706", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959182, "uuid": "9febf0e6-e0e0-4283-9eb0-c2538bed1a40", "value": "12288:WKEUkuAOLka1miSmuYr1V7xAobS3qTHPR101D:TEQLka1nBV1AoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637959182, "uuid": "8c8039bd-6462-4580-9742-262de2097b63", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637959182, "uuid": "aa043f88-c3a5-487a-a8e9-d2acf8baab49", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959182, "uuid": "5c86c271-9321-4dad-8e6a-0cfd0ac532ce", "value": "f0f62dd156a8acf3f7676e2d91fb262e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dbe3e8c8-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918756, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918756, "uuid": "a5151abb-aaf7-47a1-bc48-5301816aeb33", "comment": "Malware payload (Dridex)", "value": "9e8c66aa2ddfcd976d5c60adbc55c0fd", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918756, "uuid": "b9909732-ebd9-44a2-b023-f16b1957da5d", "comment": "Malware payload (Dridex)", "value": "13c930925420bd6ba0a66a58839f6823407cc022539f2663cd749018c705bc60", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918756, "uuid": "80b3b328-3217-427f-b565-58893063e3e3", "comment": "Malware payload (Dridex)", "value": "35d4388d55b035c01e3060901647f4fef23b8347", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918756, "uuid": "dd94738e-6280-4b95-860c-e663b4637ac9", "comment": "Malware payload (Dridex)", "value": "070e6cde083b822afc0976f8c01b2eccae6ca6d7756415108266516cdd1e141d5d4950de4b9fa77851c090399e51a215", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918756, "uuid": "241ad64c-4edc-46c4-bba1-80a30c70a9ae", "value": "T10065D162E36871E8C5739631D07F551F0AB66C2268598205FB723A700D3FAC9FFE9129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918756, "uuid": "65a2f690-e26e-46cb-9f55-690730a4fa3c", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918756, "uuid": "e6a18317-2e49-4ac2-a3d8-b7e7fd8bc08f", "value": "12288:yGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7A1:H3JAvRl/fKQKCgFfx4P/vaA1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918756, "uuid": "0e1f5269-51c1-4879-93f9-9b9988c9b283", "value": 1466368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918756, "uuid": "ee23c06a-dcfc-4dbf-961c-acd7bee860b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918756, "uuid": "142b633e-39fc-47c4-8866-77010c103db1", "value": "13c930925420bd6ba0a66a58839f6823407cc022539f2663cd749018c705bc60", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8e99507-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918778, "uuid": "cc22758d-64e1-40d8-bb63-13b1195c575f", "comment": "Malware payload (Dridex)", "value": "68e9d541c4cd375f03051c96191ba135", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918778, "uuid": "92f0c733-e1eb-4fa9-a3bc-11b70ab3cc2d", "comment": "Malware payload (Dridex)", "value": "1424567126d25f416f5368a61891158af6cd71fcf72a337affedbaa0360db816", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918778, "uuid": "65786b18-88d0-4eea-bf1a-3a76ab77ff4d", "comment": "Malware payload (Dridex)", "value": "8174c682609623084c550515d95dc25aca40db33", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918778, "uuid": "dfa535f4-ff97-4bc5-be6b-968387406d2b", "comment": "Malware payload (Dridex)", "value": "3b791ebcdeb236b3c7f52310c3529f2c21e9ef9221e6f28f46bf34819be0708954f26b7dddf674378261ae4d855d20c5", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918778, "uuid": "b90afbc9-44be-4cfd-ba34-4297e65e673d", "value": "T1EA65D162E36471E4C5739A31D07F551F0AB66C22685A8205FB723A700D3FAC9FFE9129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918778, "uuid": "66ff20f1-dc3f-45c2-9089-9137ed1a64f4", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918778, "uuid": "e046f202-4e5c-4828-8fec-cb23bcf7a4db", "value": "12288:rGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:K3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918778, "uuid": "65e2984e-3f95-482a-a0e3-de34b4cbe63f", "value": 1445888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918778, "uuid": "bf270726-c429-4b3c-b004-7e86e5905088", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918778, "uuid": "b5c70dee-2a7d-4dda-8abd-67b1baae245d", "value": "1424567126d25f416f5368a61891158af6cd71fcf72a337affedbaa0360db816", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37f32755-4eec-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637953699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953699, "uuid": "98161797-2c8f-491a-8a48-61e38da95e1d", "comment": "Malware payload (NanoCore)", "value": "169791225662c87f38ec4a99e4630f9f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953699, "uuid": "09a2674b-36cf-447f-8a76-29354915a293", "comment": "Malware payload (NanoCore)", "value": "1462979d1afd4a1bf6a40905806a0b55f51d94c2f63bb23f33d3a4d7f871580e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953699, "uuid": "23366729-6a1c-4405-a38f-52ef944250f3", "comment": "Malware payload (NanoCore)", "value": "56c40ff04288458269897a116a454193354326a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953699, "uuid": "c02cf8bd-8796-43cd-8e50-efc1dc65a68b", "comment": "Malware payload (NanoCore)", "value": "405103599792b49f7427411ff4b16fab6ecaecd630497c2a18aff72ae136ba174c915ed962e569a11fdb11a4a7a3ba65", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953699, "uuid": "b146cdb6-c784-4d94-bbf8-48a74d69c36d", "value": "T1CEB4D00834CAF196FD3BDBB10C74B6954779F1F6EA01E6CDEC94248A96B2B804E10973", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953699, "uuid": "59fd83d4-f347-42cb-937f-edca89af693b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953699, "uuid": "90a43170-d318-4e0c-a410-9ef54a094a28", "value": "12288:JFnsiLTnqidCXOM6kljvkuGGIdHDtdQBlinSRodUtuWc3mRdoqyi:JFzLTnvSvkuGFHDEBgn+41W9Rdoqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637953699, "uuid": "781095a1-732e-411b-aa27-f55c8957ef86", "value": 518144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637953699, "uuid": "b355e0bc-a01a-4e63-bc59-09fbfa087ed0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953699, "uuid": "1863c26e-5d6d-4d69-87e3-8759f699ad84", "value": "HSBC\u00a0Payment\u00a0Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad569f3-4ebe-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637933894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933894, "uuid": "a8b005b3-53d1-4c97-86ca-1338283e80bb", "comment": "Malware payload (Dridex)", "value": "d9e0f058c1d5b98e1fc2b017a784dd63", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933894, "uuid": "490085c6-d39d-4bdf-8ae0-0acb4083f526", "comment": "Malware payload (Dridex)", "value": "1567c11f4c05218ec918a61fc442a2fa5a2b92dd95c368f16c31f18c89e4bb1b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933894, "uuid": "d8d4e831-126f-4694-b06e-48ee11df4a4b", "comment": "Malware payload (Dridex)", "value": "13699bde5309d3373287df27247b9a202f6709f6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933894, "uuid": "fdce9a5a-2329-4e11-8bd7-88f2ad6ffcc6", "comment": "Malware payload (Dridex)", "value": "488b0e54ba8efadc5c7742b6547df910f613a795a47192c34ff55ce83257f1b93c0d6674a468a042c039dc3a721a52d8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933894, "uuid": "fd5356b0-2f98-4e2b-abad-b867d6bccef3", "value": "T11F33E01B6326681BC4147E3E95085CF8882939FE9C4AE9073C566F5B01F91C39FAD35B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933894, "uuid": "820bbdce-3fb1-4d9f-9ff3-a57555f3115c", "value": "1536:UWbHPIbZ853SAJbpedIbivX9iJE9FyElH5gd8:VbQbC9eeqgEjbZgd8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637933894, "uuid": "950664af-eaa2-4525-bd18-1578182a6433", "value": 54790, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637933894, "uuid": "1ba0f74e-b6e3-4689-bd76-864b7d4e2ee2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933894, "uuid": "74016e1e-dded-4406-a9c0-63b6962bb216", "value": "hunt0343812.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e49fd20-4eff-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637961844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961844, "uuid": "494184d9-a898-4966-8234-c84b6ae58264", "comment": "Malware payload", "value": "601ab918654d00842dc817e7d2edbdd3", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961844, "uuid": "063815af-86ce-4254-9d83-d08726553480", "comment": "Malware payload", "value": "156918efc8e657852589588c4211c99320605a0a0ecbb0a8fc22b3554e048847", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961844, "uuid": "7bbccbf2-f1c5-48b8-bfa6-87a5b056fa79", "comment": "Malware payload", "value": "56ddf90c37cce375084242fcb5fc4f0eefe5741f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961844, "uuid": "2ab4ecab-69ae-4d12-8b62-f64056592f10", "comment": "Malware payload", "value": "57842015760e7456e4492b1997ca1f5230c884e3c33dae47a3f9880bc416d1a16b31781476d1195226fc69f93a18b3a1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961844, "uuid": "6fc1c183-2075-4614-9c69-4d3fec97465c", "value": "T15DE4AE21B2EAC537C47B42706E3A875A9639BC6407F2C5EB03D45A2E1E735D02736F92", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961844, "uuid": "b12a5c14-33b2-4885-b2d1-8838bb3a5c01", "value": "12288:e7afY8owv43bqKlRH1Vq9iyXfAoctdvZBUdE:e7yY8owvitjVqoAfAjRGE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637961844, "uuid": "91f663a4-067f-4f7a-be87-5d1ced1bb183", "value": 703832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637961844, "uuid": "e1b2267a-8760-4e9c-82cb-9b48c3809cd0", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961844, "uuid": "38af5c7f-c98e-44f1-940f-5a29ef4c5093", "value": "NOTA_FISCAL_2617879.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca175158-4ee2-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637949650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949650, "uuid": "5f9eba36-104c-40ca-bfcc-58534685c206", "comment": "Malware payload (ArkeiStealer)", "value": "73cb6739e2eeb1be8528ca90e815963a", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949650, "uuid": "13711555-c1c8-42b8-98cc-0de673805a47", "comment": "Malware payload (ArkeiStealer)", "value": "15faaeed646173dd72e040e10f873ee1a16217ce0f322abe8de7cc4a32324654", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949650, "uuid": "e0d13202-cb13-4cc1-9c8e-5a99182ed40a", "comment": "Malware payload (ArkeiStealer)", "value": "504958163fe9e4827313290f9e15e57e6f55c678", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949650, "uuid": "711950b6-d6e7-4461-a922-9c96a4c1b153", "comment": "Malware payload (ArkeiStealer)", "value": "e46165a13109c24be4d0a00eafcc3fdeb9e7d75b72d11be7eef38f487b9c08337b28de0d2403ab4a33b09668fd9d9703", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949650, "uuid": "0c267734-063a-4c23-ab09-1b8d57d0a05a", "value": "T13ED4122175A2C731F7A24A346CB4CF750B3B79726230168B2BB4162E5EF06F058F6766", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949650, "uuid": "38e39ef0-5535-4c67-bc25-fd5aa9606e41", "value": "18236996516f1699a9cb95ecb494d7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949650, "uuid": "ea0917a1-6248-4b37-91ca-a60168d0e0bb", "value": "12288:5sO8uTggVjUPyOX5tXn7NhyGn+xKMZVlM8+cc9r7CXvAlc:5yuTggVjUKo5hn7HyGaZUxt9cAl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637949650, "uuid": "47c1baeb-5dae-40c6-99bd-604413224ef8", "value": 632320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637949650, "uuid": "abb7f48b-7725-4af8-bcf4-a0f6ce5cf593", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949650, "uuid": "7f299683-be65-4202-9951-d209ba667a04", "value": "73cb6739e2eeb1be8528ca90e815963a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ebdfa7c-4ea3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637922384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922384, "uuid": "b8d6c286-fd9b-4432-94c7-85ac0c188fa5", "comment": "Malware payload (Formbook)", "value": "cb8bd5b9563bf3cfbafbbbbf99048266", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922384, "uuid": "2c785c31-2742-48d3-aaa5-43dfbe5482d7", "comment": "Malware payload (Formbook)", "value": "16afc1275bbb9dc325bcb03d7d0fb57b704adc0438c5c006070bdd07f2259230", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922384, "uuid": "2188b05c-9ac2-4656-90cc-23666b0b10fc", "comment": "Malware payload (Formbook)", "value": "9972dd790388aa860598448da56312571e4f4f5e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922384, "uuid": "e7bb3c4d-3ca5-4886-88c2-5043ac4121d3", "comment": "Malware payload (Formbook)", "value": "442e10db48b3daf07eaacad84c5df24fd135cc6dcb832ebb63aa25205b17e2e550df58ef3a68d513b50eeab008b9b57e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922384, "uuid": "abfe5e34-cef0-40dd-8541-0e4853c2e8ef", "value": "T1D2D4D035CB285AD1C57B4B756029111EAB3DBB6BF4AD96713DBCB0040DF36C24223E9A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922384, "uuid": "40013046-4e60-4411-98af-7910392e763a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922384, "uuid": "a1c18360-a020-42c7-8809-f9d6e8049c30", "value": "12288:INJIvDk0lixBFm+XZnc2oGNZfL3MFrbVwCea:INJIrk0li1XjfL8FrbVwCea", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637922384, "uuid": "0a254f26-04f1-42c6-a089-64fd755fc31a", "value": 598016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637922384, "uuid": "8abb8954-00df-4cde-8da8-4f883d1061b0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922384, "uuid": "800f88e2-c1da-4aff-b7e9-82b78e3e78f2", "value": "DO 2168569 2172145000025112021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ad47935-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918861, "uuid": "5d0da9c4-0be0-494e-9221-937b3df4acc9", "comment": "Malware payload (Dridex)", "value": "5f5c07488e5abf8dfc6e7fe4186c3560", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918861, "uuid": "20d0ff6d-b119-45e4-952c-8139e464e70d", "comment": "Malware payload (Dridex)", "value": "17f1c7f8add9b69cb52bee6eb8c572c2a482078a91f9cc52710e60c43efbb7d3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918861, "uuid": "b034b755-5fea-4e9c-b4cb-f49e4434c717", "comment": "Malware payload (Dridex)", "value": "736fbf758cc7b79f7c67fb6df47ed96fcd5a641d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918861, "uuid": "a2616cb4-d28e-45c3-8432-9876ef90ceda", "comment": "Malware payload (Dridex)", "value": "07a674d52dd8d2f88e40b156277694fa1a62d2c186197aaf2c785e4e036ce4e977d85954239cf0dac8d3c40e3da1085f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918861, "uuid": "6c556fbe-4626-4e45-870f-87b40ba30902", "value": "T14855E102FF9963E6D9502DF6D6F0F2A3CAB0F5854C680229DB61405F9CA0ACEBD154ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918861, "uuid": "8c34b6d6-fa67-40a2-9078-00e0cefb5791", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918861, "uuid": "10509ea5-adad-4326-9871-5cd2ae277226", "value": "12288:mZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:mZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918861, "uuid": "4b25c670-a3fa-4afc-a2f7-2639454052ae", "value": 1372160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918861, "uuid": "d0ca22be-413c-421c-9e24-1328c4437df6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918861, "uuid": "41901247-b35b-4921-b231-779bee7ff5d1", "value": "17f1c7f8add9b69cb52bee6eb8c572c2a482078a91f9cc52710e60c43efbb7d3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9bc9b9ca-4ea3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637922514, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922514, "uuid": "c30cf419-c8cc-4185-a87c-dddca3d21cb9", "comment": "Malware payload", "value": "c2b70563a3aba0bccb15ae4c561ee739", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922514, "uuid": "0296db48-cb8d-4a61-a5d4-bd23c7ed5de7", "comment": "Malware payload", "value": "187c0883641b7dc84f306186b0d40555ccd1129a81ab1c4d188e3e2ed695fd2d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922514, "uuid": "213da450-1a8a-4f8c-98b8-c2e7d758380b", "comment": "Malware payload", "value": "461c83bf6885c90ff91b1009921449c23d394257", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922514, "uuid": "a6be4406-d5c6-41ed-ac4b-3409622734b3", "comment": "Malware payload", "value": "65f668e713e2cd132b07e3b52336f520771507898812b5dbf178cfae7fb40b4b2052f524cbbbd64724c6a4bb37b2a4bc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922514, "uuid": "bd236d9e-d845-4779-accd-83e41762ce24", "value": "T14C04D0128ED0070B85FC490CDC94D898F670E85F90192391BB6FEE719A77E7484FA5EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922514, "uuid": "f8d7380b-adf4-4271-9eae-e0da89376dec", "value": "3072:JIceKrhvybhviTjj6X+Mcah/B7SbvXjMku5a528Jl20b:Oaty1viTe+McM/B+vXj1u5ac8C0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637922514, "uuid": "aa5d168b-0219-4b4b-8d18-f391fa7d13fc", "value": 189000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637922514, "uuid": "785f011e-594f-49fc-bf03-0bf6255461de", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922514, "uuid": "fdc2fcb4-05dd-45d7-b38e-19026c293f4d", "value": "Tax Returns of R73,765.50.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "595b2b87-4ebb-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637932710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932710, "uuid": "bd251bc1-533b-409d-983a-43fa64733d6c", "comment": "Malware payload (Heodo)", "value": "706b703865f4cfebbe895aabc0e174c6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932710, "uuid": "e55f14ed-748d-410c-871f-e1990f805fe2", "comment": "Malware payload (Heodo)", "value": "19b08163e2ecb9559eeefced25a9164b45e3718b1707d8a624533da66f1bff14", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932710, "uuid": "751c60f2-7a7f-4991-8187-e6ba2fda2cb5", "comment": "Malware payload (Heodo)", "value": "993933066d665f12e6067baf6dc785f97401e195", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932710, "uuid": "94ee9681-f37e-46cc-909a-00b0982a873b", "comment": "Malware payload (Heodo)", "value": "b46097dd46ae9058aca35f9403229fb86a7551dea9ac5ac10c93a8e590db5e3fa7773e48aff1e72dadeff8a7e72775b5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932710, "uuid": "20840d09-a9a9-48dd-ba13-7730c4124a6e", "value": "T14403BE1EC211F8ACD235D93A819945E5661D2E105082F54D24C0B58CEF7B2FFABEF3A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932710, "uuid": "77fb88d1-340d-474c-bd86-68a028850f4f", "value": "768:r/I83zw0pRrjevZCwVI9gBZVWpf/wak8y0VII6z:rnzzbII2kpw78XVIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637932710, "uuid": "8488e775-eb90-4ea1-b4b6-0a01d94f6fef", "value": 38073, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637932710, "uuid": "e636cd6d-4244-4ffa-a541-11d758958019", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932710, "uuid": "0dc35b42-698d-4931-880a-e49d75bf86a8", "value": "259145.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73cc1704-4ef3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637956806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956806, "uuid": "91854d09-7820-484a-9868-2e5ffcf0eca7", "comment": "Malware payload (Mirai)", "value": "56f6a43ea56b1b11f54ce4754d5c28f6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956806, "uuid": "7cd410d4-e3ab-4600-82c3-c31e650dcfe0", "comment": "Malware payload (Mirai)", "value": "1a0b33d19863cd654aebaae5a1ffea02efe52bb42843c50668124cad2f5de918", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956806, "uuid": "b8e624d8-816f-42ff-93db-0ff646176452", "comment": "Malware payload (Mirai)", "value": "d62af1f57ae42b8da060a3c39dd5aa86470a5be9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956806, "uuid": "0a355d94-8fa5-43f1-86fc-ae18b76c5bec", "comment": "Malware payload (Mirai)", "value": "4f82518a61df301aa584b531743d8c7dfcf8385d8d4696eae2305199574c08f64000649f94a47ab4cfa2690415d7e5f7", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956806, "uuid": "7090233f-5c6a-4ccb-95f5-e216c92544f3", "value": "T1C823F24320D3BA03E03458FA4562CC8DB64AABBDB1BF76A726440E154C75D93ECB58ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956806, "uuid": "ab48b290-60c5-4ae3-b530-dc2040cd8d84", "value": "768:aK7y1XGO1LCNgukEkvwtqPnH7u83nc0iF4oY9q3UELWt/iw+kvBGg6+fYtrBHx:E12O1LCNguovDPH7TcrnBLWhiw+kvBGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637956806, "uuid": "0ea465fd-0703-4a12-87f6-e21fc7dc0a02", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637956806, "uuid": "92bf8944-e0e6-4212-b87c-f80278e3d6b8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956806, "uuid": "ca976cf6-fad3-486f-9abb-5a4ef6d743b7", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89885736-4ead-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637926778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926778, "uuid": "8cec7d29-1ced-4e9c-9930-f051d65d2ee3", "comment": "Malware payload (Formbook)", "value": "facefe0735c730273913fa3ab9a2325f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926778, "uuid": "f49beeed-fc17-4173-8e92-ecf7b0958411", "comment": "Malware payload (Formbook)", "value": "1a92235ec84914d6b63d046bf213887d7c740026e8ed3e1ab3fb73cd061e5a34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926778, "uuid": "9172f2b9-2d93-4e21-bd9c-09603e6252b8", "comment": "Malware payload (Formbook)", "value": "868da4100783eed6d97eca2f96340c237464c7d5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926778, "uuid": "9b80a021-788a-48f3-9f51-1ea5e895c39f", "comment": "Malware payload (Formbook)", "value": "368e1d08d5f573238ad150db1c08f24b08da93522c769c409e76aed6c9d2c75964ff549e08d0ac9c852a6e3e70170f15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926778, "uuid": "1e2eab9d-2918-44eb-8696-f196929a7b30", "value": "T18ED48DB5E4AA45A0E51BCCB09A38FE231D32BCD3ADCA9136177931058F77A562F4490F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926778, "uuid": "2f88173f-ca7f-46b6-8191-a389900f699d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926778, "uuid": "da2cfd88-86b3-4e7b-a0af-20d772b1fae1", "value": "12288:XAWV9V9Ve0j/0cu2ekWA6j20TccrKstqtpOt:QWV9V9VxGksy+ccWw8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637926778, "uuid": "eefcdd01-b9db-4c37-b14b-862ee8135ac2", "value": 627712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637926778, "uuid": "39a3323f-723f-467a-8473-d44b1368b706", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926778, "uuid": "b1f4dc51-459e-4ca7-9f08-b98d6e69ea7f", "value": "facefe0735c730273913fa3ab9a2325f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82175972-4ed2-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637942657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942657, "uuid": "dd0f80d2-71d1-45da-8549-c15931759a6c", "comment": "Malware payload (Dridex)", "value": "e8169bbb6780b2930a0bb62d41c27ab5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942657, "uuid": "fdfd3ee9-75c7-4642-84b2-493df18e51e0", "comment": "Malware payload (Dridex)", "value": "1c5932f1fc2c9fa668dae97cb02a5c4301b088e9b3dfd02d00599014a589fc30", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942657, "uuid": "51114036-eca6-43b9-8261-a1f215ce921d", "comment": "Malware payload (Dridex)", "value": "1f95154da6d14de9428b69f5a98476849b5a6107", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942657, "uuid": "03c1f6d5-e1b0-4428-8422-8976381a09d4", "comment": "Malware payload (Dridex)", "value": "8f56063d5368bb09d01f21b663b47f74aa3f2911daf91159bdb67931fdbc213ea4723c541c3b3227a08a65f8a3fb7de3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942657, "uuid": "f88963e2-f561-48d0-810d-a0c8a60a0634", "value": "T1B883024E49A210B4DBA1DF3D4F0D18E3E5A9274A1D106D8B2059EFAC46322DB8FCF567", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942657, "uuid": "3ffa1d24-fb38-4861-b3aa-bd7a5d388ca8", "value": "1536:UWiPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5hRaO4eKXAic2qaKcQVDgdX95s:Vqqmc3/q0dfaguKyRa6KXAXdDgdzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637942657, "uuid": "b8ec3f2e-e9a4-4333-85cc-ff14fcf7ca72", "value": 88239, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637942657, "uuid": "3b3e8194-edb7-45c6-ad72-0d64ff0953bc", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942657, "uuid": "09351cbb-a2a1-4c86-8423-83e0a2bd3d27", "value": "subscription_080941.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3aaa155c-4e5c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637891856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891856, "uuid": "1cebdaff-e562-426a-82af-b8f0cfd596e8", "comment": "Malware payload (Heodo)", "value": "048aa4c19c859df0d59227721858a8db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891856, "uuid": "8a413646-ddc0-4df2-82f9-8ad8fef757eb", "comment": "Malware payload (Heodo)", "value": "1ce1a76dde0487b9991dca85f8cf3901628a52a9314f3d517edcccd2f6155d12", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891856, "uuid": "4822af8e-6f6c-4ea6-9421-b8c453aeedb3", "comment": "Malware payload (Heodo)", "value": "3b22ffe82a1ef5f7f0b20011b33536d32552c151", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891856, "uuid": "d0890d91-e7d9-43b1-853f-6574d0dc5903", "comment": "Malware payload (Heodo)", "value": "c8c67dd19596066a27a0aac968045afd0ec713d6cb441c33e7e90ec50ee0de7cc4f6b2b5b0eac5727995da5e32ce07ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891856, "uuid": "178be6b8-7b00-4ac4-854d-8a1ede769d88", "value": "T12BB4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891856, "uuid": "de84ccdc-58a2-4f95-b7cc-4c41faa05ed3", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891856, "uuid": "22e3b286-fac6-42d3-8de7-412db5a725b0", "value": "12288:smVdIG2GDNBtIlD987sn/rkZW+mw3ffEPy:sm4GDNBtIl6wgZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637891856, "uuid": "2b67e4af-7f2b-4e0e-a82b-5b9555699a57", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637891856, "uuid": "ddee4ff5-a788-4254-8b57-d11e7afd912c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891856, "uuid": "ebbc1f2c-ff87-4200-ace4-15c9e4e886e0", "value": "048aa4c19c859df0d59227721858a8db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e85f57e7-4f07-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637965592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965592, "uuid": "0030395a-648f-4bc1-a069-757a9355f146", "comment": "Malware payload", "value": "00c7a3480ed5afba125673cd593816d8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965592, "uuid": "83b0543d-3917-498c-b38c-70a41191aa6d", "comment": "Malware payload", "value": "1d056a5e06ded3303f148cf24719339c8474e9c185db4a121cc7ec74493355d0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965592, "uuid": "9fffe63b-407c-46f4-8221-655aaa094851", "comment": "Malware payload", "value": "1fc42b8c3f44dad2b771c778eafeb706df4c00eb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965592, "uuid": "fe9e4568-2960-4221-a55e-6cf64fc2f196", "comment": "Malware payload", "value": "f1a31253b11d51d04bf97ef363eb4fbd03d67f3651ed5f89e2d4471ca4714272576af941b035f285a4acde7e10114b63", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965592, "uuid": "df4a1524-6fbc-4851-bdf5-6620acb79d44", "value": "T14AA5AF23B6B24837C1332B789C6BA7545C3ABE002E78948A6FF51D4C5F3D6817B25297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965592, "uuid": "cd949c13-1af3-463d-82ec-29506cbc8f7d", "value": "db67c6e30bc923d9faf73b7915f9bc9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965592, "uuid": "46eff2bb-c8b5-4abe-a891-80a05a9d3abf", "value": "24576:qpWy9d5xDX9TB9qM5r1T+wpyfYjvvNsjzbdUiVKnvqSg0WfTdCCrOEgtYztsEeQM:M9PfHxr2INRSSWfaZazZ3qp0AA1WXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637965592, "uuid": "151c4028-e2da-49bb-b10d-530b9e1eb323", "value": 2100736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637965592, "uuid": "ecd42936-1fd8-4d85-bc73-6e75f33514d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965592, "uuid": "4ad91d74-41b2-46a0-a44d-87ee8bb16886", "value": "00c7a3480ed5afba125673cd593816d8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "404fbf45-4f07-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637965310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965310, "uuid": "8acf022e-9555-4f06-8336-8da1bd4b0728", "comment": "Malware payload (Mirai)", "value": "5d5b9e5478062d6509cf9665644318c8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965310, "uuid": "63329741-af18-427a-97b2-81166ef1cc55", "comment": "Malware payload (Mirai)", "value": "1dfa8dd35604ae5de82661dfc84ac53a16829a2167b442ede827a8f65c21ac8c", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965310, "uuid": "8d7dc269-aa56-4d42-a4d1-0f5e9c88ac21", "comment": "Malware payload (Mirai)", "value": "076332af6e2e6df1c57eb56c40dd706a8bbca7c1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965310, "uuid": "e953ef32-424e-4f3e-bc71-154b46604b63", "comment": "Malware payload (Mirai)", "value": "1e4438caf370c037da70a662e21aa1352e1f3f9113152272878e81213cc00de3de435c035bf279af6ad0ecb5fe9ac534", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965310, "uuid": "c111a3f2-8b13-4f8d-acf4-f2d960abdcbc", "value": "T150B3195AFC825B11D4C623BFFE0E0289335367A8E3EE7112DE215B2177CA91B0A77552", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965310, "uuid": "c972fc49-adf3-4fe2-90fd-0e1fcb07b6a4", "value": "3072:1bOfrDEPZUmlHrvldHwaGllZUdNZ/9nQA8rnwbZnn:hOTDEPZ1lbwaGllZUdj/96rwRn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637965310, "uuid": "7c94a5d9-7f79-4a69-9048-9877f56add59", "value": 109092, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637965310, "uuid": "4821dd43-f7a3-4a03-be7c-f27a59647400", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965310, "uuid": "d00feb50-3195-4eea-8b45-15e129adf639", "value": "arm6-20211126-2221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1848c5f2-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637918857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918857, "uuid": "f37265ef-7172-403b-ace5-781eeb0a465a", "comment": "Malware payload (AveMariaRAT)", "value": "d4a55bd0e6dbf6913d8681f1db25147c", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918857, "uuid": "f695e1fb-fc4b-4119-96f2-81939477a276", "comment": "Malware payload (AveMariaRAT)", "value": "1e291af24e96233dace8b196896a6b9c6dd185ab98f40d5869483b039586315a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918857, "uuid": "2d1464f6-7a58-4532-9447-66dbed339c8d", "comment": "Malware payload (AveMariaRAT)", "value": "7ae976ec741675019f177dd239309b820aadcf08", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918857, "uuid": "e6946055-6473-4fb1-899b-b62566ee9802", "comment": "Malware payload (AveMariaRAT)", "value": "2443bbcb29d8925bc4dceda4597b8b25b7db8c28105844a2031644cbb7b7ed5ea3e413132ad802bc9103b3700ac65163", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918857, "uuid": "3711dcfb-11e4-4183-9901-531903f4880e", "value": "T1B855BF52E39EC2F0DE165172BA7DF71A2F3F3C254530B956AFC52D3AAD21021112DAA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918857, "uuid": "977537d3-6d9f-4822-b808-fb60ca3c9491", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918857, "uuid": "37fa30b8-275c-4923-9fe6-9e06dcef062a", "value": "24576:Ku6J33O0c+JY5UZ+XC0kGso6Fa720W4njUprvVcC1f2o5RRfgUWY5:8u0c++OCvkGs9Fa+rd1f26RaY5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918857, "uuid": "8d6ffa70-0bd4-4c56-a8e5-5637465ed6a4", "value": 1388928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918857, "uuid": "24344fad-3e71-4499-a223-208b16d8c739", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918857, "uuid": "f0af8698-4710-4a4c-8afa-fee45405254a", "value": "1e291af24e96233dace8b196896a6b9c6dd185ab98f40d5869483b039586315a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4a27544-4e61-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637894235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894235, "uuid": "3e6b3248-2993-4985-bc35-2c0b290b6125", "comment": "Malware payload", "value": "4ffdd025ccaf2c14dd1a0925e9435dee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894235, "uuid": "738d54e5-f7d8-4064-92a0-bdb710cb06b6", "comment": "Malware payload", "value": "1edae2d54b1417c43c0d5aecb4a0a2c4d0d6e371bc5d817ee304fd2399f8406e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894235, "uuid": "9adba4c9-3465-4bb6-97d4-3ae747a623e8", "comment": "Malware payload", "value": "f2921fe367d91982e5140ca8771b5f6d735fac97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894235, "uuid": "af538679-3c0f-4f95-8c92-09dcd4781c5e", "comment": "Malware payload", "value": "bb3876fbff79f5cf70c6c601d6c5386e622583e12ec73c3a8255566f40bd0b0aebafc65dce794ab363247efc5cbf5bb1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894235, "uuid": "835fb987-b262-480a-8bdb-3ea0e2b8702c", "value": "T19633F1848146A9F5F1763D31A0F449A3636D0FF9C0CA266D62340B2CFF0718ACDDAE26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894235, "uuid": "97751010-a5a3-419d-b4b4-567c594da276", "value": "768:GSyWnk7O7WSjnmQJJX7ZhN9utsQLZJUE1hmqPFYV3d3OA7afdTq3U7gQvgleFr8T:Qsx7WS7mg1PXuW4ZmE1hmq9YldifJmXT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637894235, "uuid": "ed9e5a86-0c4d-4c36-84a3-df5777ca57fb", "value": 52188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637894235, "uuid": "9327c18a-f894-4941-bad0-0c23cad9c75d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894235, "uuid": "0c54babf-dd3b-44bd-a5c8-9a24b27b66ef", "value": "4ffdd025ccaf2c14dd1a0925e9435dee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "726b05a3-4e97-11ec-843c-42010a9c0014", "comment": "Malware payload (DCRat)", "timestamp": 1637917290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917290, "uuid": "4c984181-ffc2-4905-82f6-630ceca025e1", "comment": "Malware payload (DCRat)", "value": "36c2470621aaa492f3d4415b45c14c72", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917290, "uuid": "b42ffda1-77bb-4ffc-8730-89e0098c3a6d", "comment": "Malware payload (DCRat)", "value": "1f4cc05efadb87b86153abb1b850b7a78a7f7af14d09ff0cb5a91e2a90a00bdb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917290, "uuid": "fdb66d62-f0a3-4df4-9c27-44f263f4e796", "comment": "Malware payload (DCRat)", "value": "268716c566d8700c7e085abf1618c90c2226977b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917290, "uuid": "a2239a78-8562-437e-aab4-687979a4014e", "comment": "Malware payload (DCRat)", "value": "5476f8eafa32b823dfdf1a146cdc4c314d685e4337da145d2a000b7dd5dc6b791408d846f22f5e27c5f71056c5db6609", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917290, "uuid": "26ce5f06-42fa-4d99-88ed-96ed1ae25afb", "value": "T14D65DBDD726072DFC857D452DEA82CA8FA6174BB931F4213902715ADEA4D89BCF180F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917290, "uuid": "c971b242-5f34-4926-9aba-f747d5cef82a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917290, "uuid": "bb12a49e-a70f-4172-809a-68e1e9f2cb10", "value": "12288:k6cYwvZLz2H3u8ssX8FXnZRefZi2dl6IfEMXD+yb88SJYq/KWoUSwsnTN7mkulcv:kfPI+ZsX6njefg2SIfOyb88S3/B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637917290, "uuid": "ef8f6409-5a6e-4375-a19d-7fb31b04f13d", "value": 1439744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637917290, "uuid": "d7537849-f621-4b98-89a5-a59e98dcd261", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917290, "uuid": "c7b82a29-5341-4770-8412-76af268a56cd", "value": "36c2470621aaa492f3d4415b45c14c72", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67f65e28-4e87-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637910401, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910401, "uuid": "5d2daf72-f744-46d3-865c-2ca411ef0581", "comment": "Malware payload", "value": "fc12df534d811b1795367d0ae29f03ff", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910401, "uuid": "431bee73-8091-4ae8-a371-9d5a700606b4", "comment": "Malware payload", "value": "1f52d3796cf118e643b744438f397d3a4321e44f6bf90df2b69e6cee7fdd815b", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910401, "uuid": "8854904b-8a06-4bc1-b153-69cde390a991", "comment": "Malware payload", "value": "60379f5dc5147ffd14c0a3dc9288508bcf61aebb", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910401, "uuid": "83ce6909-a8d8-4d33-a6dd-216f3dda7def", "comment": "Malware payload", "value": "13c6d04f28ffcec92a23b90008f808e8cc4938c7f960ac165a2def907075f58ec97c1c23d2fc4275387c53068144aaab", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910401, "uuid": "0d4ac341-ca07-439f-a784-3e45e7a809f2", "value": "T1F184230C3E40DFC92B75E49F915C9AE19D478C81C1C826A9FF72686FEE11F42927AD20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910401, "uuid": "ba262660-a251-4624-8212-dffcd1af495f", "value": "6144:qJWYWxF7hqlVXh8OlyZzMH40qae5etp66UnF2eMW1JOk6mIOIrPiJQIWjjF2Oftm:qJneSBl2z3BeD66UnFhbfFIzfjFdftm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637910401, "uuid": "ba327767-0979-4769-9604-323af5d16cc1", "value": 401306, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637910401, "uuid": "a620798a-bc78-4969-917f-29a4619ebcd6", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910401, "uuid": "b4ad5f3e-87f7-467d-95e5-efd805a0e3bc", "value": "Reconfirm payment_details.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8de400a2-4ea3-11ec-843c-42010a9c0014", "comment": "Malware payload (Vjw0rm)", "timestamp": 1637922490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922490, "uuid": "29e9f32e-39a8-4062-8d2b-c1c3c5f72f80", "comment": "Malware payload (Vjw0rm)", "value": "4d998aff1fd51f84bdfc11c911923415", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922490, "uuid": "be1ab754-1e0b-4c35-8056-c3aede178555", "comment": "Malware payload (Vjw0rm)", "value": "1feac072e72912e9f2e549a07ee701881cfa290a59cbbad056987a55f059bf88", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922490, "uuid": "b40ef90a-a0ee-4d0a-8a74-2add3a9babd1", "comment": "Malware payload (Vjw0rm)", "value": "857f78e06d487b9dfdff53a9f8027641ebe38294", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922490, "uuid": "9f53269d-ca13-4330-bf10-599bfe9d8313", "comment": "Malware payload (Vjw0rm)", "value": "55ec6c55351749e9c4d213e0bf8a7dd9374bfc5def823b2fde6d469b84b185a838c8341c6a9b66b016b830f5b159a74a", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "vjw0rm", "colour": "#EEC0AE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922490, "uuid": "b1394210-f8ca-46c0-a510-494085282446", "value": "T1AAA27DCD2D00F6DAD564B61060ADADD89FF84227D401968D382EBA408F32B51EB5FF6D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922490, "uuid": "692a7313-4639-4602-bb4d-d89ec89c78dd", "value": "384:tm3uw3mx0WIX/19xIE2PdXPA6ZFbaO2QjihUXUV7ARFibSpC4VJt1qJEUzNlB2BJ:ol2xXIX9d2lfAMD2FKUVqFibSEwJQX2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637922490, "uuid": "cd7324ad-f608-4acc-8dab-efce6e22f2ab", "value": 22736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637922490, "uuid": "4d1efb85-79d5-4dde-80b6-2d0c1e95b8f0", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922490, "uuid": "43d2576c-d927-4c17-ba98-907b04bd32cf", "value": "receipt.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97b55275-4eb0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637928090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928090, "uuid": "d34ca070-c4db-46c2-8967-c3e4f15f58ad", "comment": "Malware payload (Mirai)", "value": "1bd8d1733e1315eb7f6fa966154b3e16", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928090, "uuid": "c4e847e7-26a8-4ec3-90d1-21213486bebb", "comment": "Malware payload (Mirai)", "value": "2009513b818f7867521072a694440b4d0b763e120e42c0a8f89ce368f209752a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928090, "uuid": "16ec5fb2-8bcd-4812-b4fc-4eda2571e777", "comment": "Malware payload (Mirai)", "value": "024def1e9c675e448dcb66a190231b546387b7b4", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928090, "uuid": "0aa93df9-4301-4504-a221-02fd27cfc35a", "comment": "Malware payload (Mirai)", "value": "7f876bf33dfe4e72a3bd188eb1300b1006b824585a478866395882af2b2f426b69c4a743dac59c10dd2488b971aa9473", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928090, "uuid": "e1c2e799-ccc3-4e80-8166-21c5f8814db5", "value": "T154B36C86BA8084FDC4C5F07C0AFFA036C565F0BC62B9769727C0BE1A2D4DD905B3965A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928090, "uuid": "33cb43e4-dc29-4824-a0db-f7cabe2bea9e", "value": "3072:Rp++42IUuCt24YlymuTOIQVgW/O3gB6oH7UxYmzB:v++42IdCtwlRuTOZgWG3XkBM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637928090, "uuid": "d224993a-9d74-4d79-9b01-aa2f7c5473c3", "value": 114072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637928090, "uuid": "051f17e2-a7a4-4b2b-87d3-17e4b3143809", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928090, "uuid": "b2cd66a4-27f3-4c15-acf6-4134f81da3da", "value": "1bd8d1733e1315eb7f6fa966154b3e16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "984884d4-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931098, "uuid": "e10fe988-6596-403e-87d7-1efef4a0aeaf", "comment": "Malware payload (Dridex)", "value": "c5cc2cac94471dbb62ec6d47677d76a5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931098, "uuid": "44c3b0da-d35e-47c6-a109-516d5326d58c", "comment": "Malware payload (Dridex)", "value": "206c71d0a05cb0c144643b86d0f431bbaa8dda3fedf5224e68fa6df43ead95a9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931098, "uuid": "bdc54241-0ef5-4e5c-b137-a6f440ee715f", "comment": "Malware payload (Dridex)", "value": "4576ce6ef69dfa9338e804944a27be81b2c79066", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931098, "uuid": "e03b0cb1-0882-40cb-bfe9-9038c1655097", "comment": "Malware payload (Dridex)", "value": "6320e5caf8ab7a83554a3a8b42edb12a3f7d95caba42d793d087c00cc7ec290171aa5c2334981f242b60c5f224e07224", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931098, "uuid": "fa57ca3f-97ad-4403-a3d9-e21721b8725b", "value": "T18963F20BCB55B8B1D6BB82FC81255EE4540F5B2C9D95DA1F39E47108EC2169B63CB32C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931098, "uuid": "b65bcc85-50b8-42d6-80f8-225f90eb2cf9", "value": "1536:UWkxPqrE3gpMokPF58Ik4kosQFVvSuMWcHlMNhqXpgdOO:VkYEwFkd58IXkOFVvMWG+NqgdL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931098, "uuid": "59c3bfea-4af3-46e4-8467-68727b0dab1d", "value": 68249, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931098, "uuid": "b97b4e06-cfff-4dfc-a556-05be64524106", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931098, "uuid": "be50e041-a0fe-47b7-bfbf-c739b636f59d", "value": "offer_363615090.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33cbb364-4ec0-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637934795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934795, "uuid": "35568a5a-4bbb-4cb8-af84-56e630379329", "comment": "Malware payload (RedLineStealer)", "value": "061bd3f10953e86da839c4bf47c1867d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934795, "uuid": "523f436e-ab54-4294-9660-7e6efa1f31ee", "comment": "Malware payload (RedLineStealer)", "value": "211f4f9df67b0227766e2f3928604a5d05558b68c5ce97776df5e2380ccda8a9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934795, "uuid": "a5051ff8-bd6f-47a1-9b75-20f8980d0e20", "comment": "Malware payload (RedLineStealer)", "value": "824a926474a880541b030be56f5309834c121283", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934795, "uuid": "e9dc223f-42b7-481f-b110-a353ac21c6ce", "comment": "Malware payload (RedLineStealer)", "value": "beb75f6259a6e56381e85e1709f220e89d14531f0be83a7bb5c418f38223b4b937d4acb5241a4cac6cb9652db1b9818b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934795, "uuid": "096a56dd-f7de-4e97-bf3d-de034bee6c76", "value": "T14834AE0463F84E13E1AADF7C18A202128B72FA73DA52D75F4DC8B0AD18567C85F5876B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934795, "uuid": "fd645e49-fac3-4368-a771-53f6e99b258c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934795, "uuid": "c2ab8650-5622-43ce-b05f-8371e2100154", "value": "3072:O2WT27p9oHctBLUHpR06i8hk5wrpdr91TDLS0RU+cZW/Wh2GjEOmDK:YEp2HABLUHT+ckyh1W0R4Zx2LI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637934795, "uuid": "21ea220a-d432-434b-a254-e8420360e8bd", "value": 245760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637934795, "uuid": "a4c4cec8-fc05-42f8-b3f9-ddfa18159b7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934795, "uuid": "d76f41c4-1407-450f-b13b-fdfbe886d217", "value": "file4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d2cd036-4e65-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637895672, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895672, "uuid": "63f5b915-5cb0-427b-bdc5-bafe4f4a41cb", "comment": "Malware payload (Heodo)", "value": "05a24efe138e35abd2da7d18800734b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895672, "uuid": "a1e9fdfa-f407-449a-840c-96347ae4cedb", "comment": "Malware payload (Heodo)", "value": "216d8b45ec0fb6cec51aa35bdf9c98fd4c508592b823aee1056a77445831e44c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895672, "uuid": "d700d531-9d64-4bde-97c4-99e015c451cd", "comment": "Malware payload (Heodo)", "value": "29d92270a3e9531ca13c99dd6a212687ec37f332", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895672, "uuid": "30505a54-041a-4308-98c9-229fdf4bc6bc", "comment": "Malware payload (Heodo)", "value": "5bafa42fe867ea41f383e76fb302327631fa08de0dbf386508feb94d92a744647d72e7833f7329abd96b0ea9e764ad66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895672, "uuid": "412eaced-d568-472f-aa61-fd331a967db5", "value": "T16FB4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895672, "uuid": "4578f176-86dc-43a7-ac9b-16ee87d0159a", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895672, "uuid": "41324f93-d934-4911-97a9-72f60c3af1dd", "value": "12288:smVdIG2GDNBtIlD987snMrkZW+mw3ffEPy:sm4GDNBtIl6wXZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637895672, "uuid": "71237ce0-5622-40bc-904c-218520c86d35", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637895672, "uuid": "4da8309c-7584-4266-9687-1144f24c3f94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895672, "uuid": "5224d33e-a0d1-4793-ab05-03fb05aab8b8", "value": "05a24efe138e35abd2da7d18800734b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ec6810-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931099, "uuid": "e059156a-f87d-4b9a-afac-0386e7cd6475", "comment": "Malware payload (Dridex)", "value": "5d31da137b685aa1cf447af57d855fe7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931099, "uuid": "7c0ae40f-90ec-41f9-b149-104982e4afc8", "comment": "Malware payload (Dridex)", "value": "22230976df2fc29a01ea47b0dcdee6221d53471c3b4bad8442f3a32cf3bf3b55", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931099, "uuid": "2cbf949a-ebca-47c2-ad98-d3999e52df1e", "comment": "Malware payload (Dridex)", "value": "e2734ba91c0d6f392417034e0c8cd01e24b4af6f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931099, "uuid": "6e7d87c8-5cc6-4202-9cd5-871c72032e6a", "comment": "Malware payload (Dridex)", "value": "9da3dfb4159ee45d84033a319af5b26a6013fe21b359be6b3034f38f2496f0d67103f6a8111cdaecd1964e6d1f00546a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931099, "uuid": "4bb96b76-7b0b-4af7-9a9b-36fc06eb238f", "value": "T1FE73F14E5A68A1E5C3B8BC3F430C19375D26E6E12A44876F6DA4B20D43F2387A38949D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931099, "uuid": "261a95c8-60dd-4fb5-bcad-8c3e06f30d52", "value": "1536:UWhPZZKz/1eCzbqzLkh/OPvTFVLQsleMCWey23EB6JNugdvh:VDEz/9qGWPvZVU3MDl23EqNugdvh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931099, "uuid": "c197ced7-7724-4899-a634-3ee0df23b8c8", "value": 75729, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931099, "uuid": "b4103957-c54a-4169-9645-09b695f64af2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931099, "uuid": "bccab434-12f8-41cc-acc2-67582e5bee8e", "value": "Offer848577.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41c2e0d-4e84-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637909213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909213, "uuid": "870f1c8e-e461-4e90-8f5f-0751976f7e30", "comment": "Malware payload", "value": "b2d2d9115bd393babe0f8b177b0d45fd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909213, "uuid": "cdc307e5-fc54-4b6c-9032-097d2888aaf5", "comment": "Malware payload", "value": "2244a4685966cfd237ab4abba59f80b8c2eabd52ccf3ea5ddc0ef431ef458991", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909213, "uuid": "193764c3-57c7-4ea2-8dda-e90cd5d232ae", "comment": "Malware payload", "value": "43e5066339c3bcc4bd9e353c116f7bc16ecdf7f6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909213, "uuid": "fa71310f-bd02-4bf7-8db3-26f56bc42aab", "comment": "Malware payload", "value": "411a098c82e722a836d5ebe9ca5211622d89d7a7f477f3865299ee671e95f0db288cf7c58910b461c5956e67ba98b53a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "docx", "colour": "#0DD1A9", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909213, "uuid": "f4246986-5273-4dae-9327-5f53cdf91274", "value": "T15C229D3CE601FC2FD12201BDE059C2F4E65910A7EB21792E219172AE47E12C35BDF679", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909213, "uuid": "378e79b5-d815-46ed-a0c7-f957111b9bc0", "value": "192:ScIMmtPvcv8EMG/bCcCZOfNl+CVWBXbG23wXJ:SPX88E7xAOfNHkqqs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637909213, "uuid": "b5b46d63-652c-4cca-a0f5-7cb1d1568ef0", "value": 10331, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637909213, "uuid": "d8c57a1b-3e90-4770-be51-2d1f8fb8aa00", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909213, "uuid": "9dc21e0e-c3a7-4151-a3d3-2ca65adb3d17", "value": "CDCB-PKG04-2573-2021 -TRANSGLOBAL.docx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "550d2fc3-4ef2-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637956325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956325, "uuid": "6928ea8e-a248-461a-9cc5-68a6eb8f0039", "comment": "Malware payload (RedLineStealer)", "value": "05dfb519ab631663350f03e21cdab66c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956325, "uuid": "a4c2ed18-22d9-4c47-83d9-fa7c483be0ad", "comment": "Malware payload (RedLineStealer)", "value": "22d52543ce6e00a2efb2dd2f5447f958f7907ba3c73915e141381bf04a69ff07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956325, "uuid": "4f320d35-f259-42af-83ac-e526fe466813", "comment": "Malware payload (RedLineStealer)", "value": "a918251ab537d3b11ab55b8cb8b8a9d75dbc1878", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956325, "uuid": "1f19fb0d-81c9-4a20-9a2f-c4a63be3fe05", "comment": "Malware payload (RedLineStealer)", "value": "bc7c663f48868d272082e31359c9d64f83418bd8ea607c0a7270a70d1b846eb00f33a9b031d5dabf940f3ee04471788a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956325, "uuid": "54db64cc-1ea4-4e4d-93d1-c709ce0b2ba2", "value": "T1B34454E82BE4F40FE3D587B45FDC88356AB6B80ED48AA62A1541BD9D59336C31B31133", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956325, "uuid": "e36886b7-cf03-4cde-ba06-161d16a7f91b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956325, "uuid": "754e46c8-d7d6-49aa-b2fa-7d27f05803f1", "value": "3072:xDXjD4wXQleP9LnuHWEsJ7R7XsBv3NhI9vrxFMU64:l40QleP97F9J8t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637956325, "uuid": "49959f9f-e27f-4bc5-a41f-460c8a94d11e", "value": 277504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637956325, "uuid": "2f7c0274-f594-4d2b-808d-2aee0088be19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956325, "uuid": "a8de22a4-4c61-46e7-8955-a4046cff98d6", "value": "05dfb519ab631663350f03e21cdab66c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "361e304f-4eff-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637961857, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961857, "uuid": "c6d0c4a8-b6cc-403c-976d-64515e4af95c", "comment": "Malware payload", "value": "58d595fc3b8236c9248bc7ffb47c087b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961857, "uuid": "abc25c63-847f-460d-b86f-85ada9b5bb23", "comment": "Malware payload", "value": "23f8b1d50ded4e893bf789f5e795aa889a6364f525927f49f607cac93ce3a683", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961857, "uuid": "78a098b4-cfa6-4f2d-a64d-85f05578dba9", "comment": "Malware payload", "value": "0c4712b2b3574b91206644ee789c634f21c2c1ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961857, "uuid": "23098fbe-34fd-487c-a446-793cdf820696", "comment": "Malware payload", "value": "098f08861cdc6d62ee5a7121558f5e133d9ccc4c9161e6934a49f16f2886b6a3f5ce65225fcb81f742351fc64b35f275", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961857, "uuid": "5d995884-31d2-403b-b2f2-eab840303099", "value": "T1F00523F69DE47719E0A812F7F64589A14DF05103BF29AC3DE6605443066F019CFA8EDA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961857, "uuid": "ed11d20b-6e5a-4a91-8815-5131db1c3e66", "value": "890e522b31701e079a367b89393329e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961857, "uuid": "e7e27095-55ef-48ce-b824-ba420dc9293e", "value": "24576:0thEVaPqL3L2DxJOANfq/PA2HqYzTHFyHZPIGQ:IEVUc3L2fOoG41YPYHZPw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637961857, "uuid": "bffdb985-4fd6-4eaf-9944-bdec9027d3e4", "value": 841595, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637961857, "uuid": "d6d8c774-876f-4771-8157-1685d3271ec7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961857, "uuid": "21b6d03a-3cf3-4578-9dab-debd4e23e42f", "value": "reserva.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9685a8a4-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637954288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954288, "uuid": "997a4381-e028-47bd-8ab8-b6033d980ca4", "comment": "Malware payload (RaccoonStealer)", "value": "da6d00abea40739b694d4691746e62c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954288, "uuid": "1006795f-0ba8-4c28-aaed-751dc5dc56d8", "comment": "Malware payload (RaccoonStealer)", "value": "248d5af4e028cadedef29b580ab3a28d5d5d45086fbb99f248f7856761d50454", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954288, "uuid": "6ca3648c-a5e1-4ad5-adc3-42e773f3b4a7", "comment": "Malware payload (RaccoonStealer)", "value": "4edffbf72bfcd3b2f61a4d6a15003db9f6c6dfb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954288, "uuid": "85c54305-cc28-4f2d-870d-caeb3a6759d0", "comment": "Malware payload (RaccoonStealer)", "value": "58ea0ffec5a71be0596d05c0fa7a8b78bdbaf27946a65eb41379b6dc25b9673db1b6a0faa78487796c29de7d8eaba966", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954288, "uuid": "bf553705-6c26-43c5-b540-70f2a08a664b", "value": "T1EDE43331AA60B129E48937B070A14CB33C64E3B53EFF7794FA98D64E871506E179EC94", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954288, "uuid": "85554820-36c5-4f5c-a0f3-a762071bd792", "value": "5a498eee87e4d89512a84502f500181f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954288, "uuid": "2ae9d983-321d-45a3-8929-393f2a98a0d2", "value": "12288:4ga/bpc9CMpK81wCGcvB2IX76J/iXZxy7QOciyCZxDlpkUjuRW:4//aCMpwCVQiE/EZxyR3rpJ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954288, "uuid": "982beeb5-384b-424c-9a83-86174af1054c", "value": 658071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954288, "uuid": "053dd7a4-21b7-4911-8e4c-e6d75dc1d23a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954288, "uuid": "ec9de949-3682-45c2-ac1e-66b1765d4adf", "value": "da6d00abea40739b694d4691746e62c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08c2297a-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918831, "uuid": "92f4a5bd-8c24-4b0e-a688-7d54e1da30ec", "comment": "Malware payload (Dridex)", "value": "a547e2f14c375de73aa013704367f35f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918831, "uuid": "ce7ba4d2-e6ab-47e8-8a79-5ce143695de0", "comment": "Malware payload (Dridex)", "value": "248f05930d4cf6075a5e309d4c20c5cf422a750d52a4f7afc31fd983b9cf897e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918831, "uuid": "1f7c1dbf-9a1f-4018-afeb-3f4f39f98c57", "comment": "Malware payload (Dridex)", "value": "c29eededd89c502cb410ecb45540f935aaa3dd5d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918831, "uuid": "a1de90ff-e88f-4edb-a4fe-260326bfeddd", "comment": "Malware payload (Dridex)", "value": "b3d019df567e0f1547b72ff3168c9e459cf25ecc0fd1734804ff8c9d4a2e35a7749421aecf7afa15d51e73d0bd821c6a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918831, "uuid": "d6c1b72e-6f98-4ecd-8f9b-b9d5bb3347e7", "value": "T1FB55D162E36871E4C5739A31D07F551F0AB66D2268598205FB723A700D3FAC9FFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918831, "uuid": "32b66559-f700-4f06-a2db-013fc5dc9c02", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918831, "uuid": "81f803de-ce5b-46d3-bdfc-58c739bff922", "value": "12288:/GVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:+3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918831, "uuid": "0601e6af-3dae-4b9b-a0fc-9fd19e3b596d", "value": 1400832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918831, "uuid": "61ea30e6-14cf-4700-aba6-38aa95053d0d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918831, "uuid": "3c19429e-5d91-4666-93fd-5b008df34e0c", "value": "248f05930d4cf6075a5e309d4c20c5cf422a750d52a4f7afc31fd983b9cf897e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "413c4dd6-4f07-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637965311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965311, "uuid": "793cfce3-c0a0-4ef1-83f6-614062b2437e", "comment": "Malware payload (Mirai)", "value": "e84a3ea815cc8c63fee163dac33e1d96", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965311, "uuid": "b01a839d-f447-4446-b7be-631349b03ed3", "comment": "Malware payload (Mirai)", "value": "25468abe3d79c434cc0dd9c0769406c8c3be88db2aaba7d557eaa2abd9886743", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965311, "uuid": "936e1367-d94f-47f0-ad1a-14d9f31483de", "comment": "Malware payload (Mirai)", "value": "9e24017b2fd2f42cba9f4c5f33c8769fc33a9855", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965311, "uuid": "8dc9f64b-d47f-4b68-a7af-41ad50c03302", "comment": "Malware payload (Mirai)", "value": "3c14400b7cec9ecedfed58e8cf91034a2b4f1d80cb6045741afceb545c0a4ec5b854282074e62c0b345d9187f333e636", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965311, "uuid": "1dcc176c-5c1e-46b0-bb68-45a21b47bcc3", "value": "T12B832985BD82AE16C6C5437BFB0E43CD37226398E3DD7213CD156F11B78A92B0A6B161", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965311, "uuid": "d7337c39-eb96-43d9-88ff-d2d116adc85a", "value": "1536:1mDc0gjKhei83YszBQlnEphy4vkzQfM1clFzdMx+Y6R3+J8DAL/0xwbZnD:1+gk/szOlEhuzQfMsJI+Y6UGDHwbZnD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637965311, "uuid": "5035778b-b856-4424-8bfb-163dcceb0616", "value": 81300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637965311, "uuid": "2f41886a-071a-466a-8eb1-4d19ed805003", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965311, "uuid": "31d19043-dc45-4ca8-946e-352009a55f89", "value": "arm5-20211126-2221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e8a48f7-4e9e-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637920317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920317, "uuid": "7c9feb36-46cb-4635-afed-edb514c8b4c0", "comment": "Malware payload (Dridex)", "value": "b35c99a8622cd401bdf10a11d5f4c76f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920317, "uuid": "f59f0eab-1afb-4d07-90ad-31efd031648d", "comment": "Malware payload (Dridex)", "value": "274be08984ed7ff6676180d2871208a4bf864899237aeb7958f10c40bbd9f8e8", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920317, "uuid": "a7926787-5891-42a0-bd8a-097977d58939", "comment": "Malware payload (Dridex)", "value": "e722b081eec3ee2a50bb36ebf7efa90d524496c9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920317, "uuid": "f95ea575-7284-4a5c-b0aa-20fac04a5cf9", "comment": "Malware payload (Dridex)", "value": "fc5d6cd06cf93be901a947b8fbd7522c6f061d38fbc8d531ca9719cea7f1ec16280c8bbe04e71ebf324d376b681f316d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920317, "uuid": "4556a5e8-9670-49d3-b0be-7b2dad62bd24", "value": "T13073025F952375D8C03A143E434508F139298227C457AD8E386752AC5DF93BB8FAFA6C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920317, "uuid": "649574e1-d420-4f5a-b449-da67e57df8ba", "value": "1536:UWpP2CET+S+agP7nA9u9DE2HPX5o9nzdyb9FFLgmFFTl7gdOt:VKT1k7TAGfW9nwb9FFLgmFFTl7gdOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637920317, "uuid": "0067975c-8490-48f6-8aac-887c55fdc279", "value": 76018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637920317, "uuid": "ed09bc42-7bb5-4f78-a193-75c978f6a37c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920317, "uuid": "1c16251d-b565-4394-a719-e9af186eb3ed", "value": "gift voucher 6617359 copy.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e64a2775-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918773, "uuid": "48b5de69-aa74-4c67-a3c5-031e11e852fc", "comment": "Malware payload (Dridex)", "value": "94ea5ec1d6e2773e4b1ac030ea8fb7f7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918773, "uuid": "4eebb092-9a22-47f0-8e8c-a19a193b89ae", "comment": "Malware payload (Dridex)", "value": "28cdb76bf1b90ef6b5e8ef101b419f5cb02b74bd3bfd2a4ca348b8402b0d2425", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918773, "uuid": "9bdb48eb-8d68-4f1a-98fa-69015183eb90", "comment": "Malware payload (Dridex)", "value": "e5b45a82aaba3716c3d62997052a874b586c0fe5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918773, "uuid": "595c6505-430c-4dc3-816c-358d153cd470", "comment": "Malware payload (Dridex)", "value": "42a0d55f5dcd9bc91dfc8fd169740a1bc72eab670d7af301b06034e6bc35ba2899b27a0b43f8083b26b2d97a94dd4c82", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918773, "uuid": "8b19743c-b002-4d54-bf46-015ca3d2d113", "value": "T1C065D162E36871E4C5739A31D03F551F0AB66D2268598205FB723A740D3FAC9FFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918773, "uuid": "9d76c843-b45b-4cac-8bd5-880995e2dd03", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918773, "uuid": "0d15705f-5353-4ad6-a727-e26ce3473ab4", "value": "12288:lGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:o3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918773, "uuid": "8a9a0850-62f8-47b5-bfb6-b8448ba45615", "value": 1445888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918773, "uuid": "4305914c-93e9-480c-8d5b-9a0ea51f6348", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918773, "uuid": "1e100c93-f8e5-438c-8a04-af2138167219", "value": "28cdb76bf1b90ef6b5e8ef101b419f5cb02b74bd3bfd2a4ca348b8402b0d2425", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1fcdb63-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931114, "uuid": "0170311e-b1da-4e0a-a16a-e9f90d946122", "comment": "Malware payload (Dridex)", "value": "94f762e9f5cf89bb61ce2958216f4017", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931114, "uuid": "c4e52e99-e626-489b-a1cf-64b7af233322", "comment": "Malware payload (Dridex)", "value": "2920bb77d97ba58ee96db57089f1977942295125f861eeb128c83775013c6d67", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931114, "uuid": "b6c82f44-b624-4b5a-bc27-ebfec2b661e0", "comment": "Malware payload (Dridex)", "value": "2de44f2dd8a45bdc6a6f0d77405f02853e6d9264", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931114, "uuid": "e3288c5a-bcda-47c1-a8f8-0664243b8898", "comment": "Malware payload (Dridex)", "value": "5e39c22983808e7696cfeef5ad052951b704d0243703a74797bec8fee8fd79010ac72fdcfa2249037e5f9771eda19760", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931114, "uuid": "ccad9b7f-fcda-42c5-a17c-472ad0e2aed7", "value": "T19C63E1ADC590F01DE352CEBDCB3688D583061D97B999964F28EAB60C2EE23474BFD054", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931114, "uuid": "b34e3c1c-be6f-43f6-9796-e70171e23dc2", "value": "1536:UWTPuALLImemeKHqeK7YncGrLUhSaGOZ7ROQbFrgdxh:VK80XKUYty/tngdxh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931114, "uuid": "429e93a4-b9c6-4c29-9b45-ed59bc01f997", "value": 69970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931114, "uuid": "803bad76-5119-4af9-b7fc-ffca421623ba", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931114, "uuid": "2e862eee-31ad-43b5-be6d-764d31560c37", "value": "request-09818285.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5ba28bc-4e83-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637908813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908813, "uuid": "7ef3e8d5-9726-4f82-af74-287ef3bf74da", "comment": "Malware payload", "value": "ae7e9f9f1c5bb6eb02a9d257ff99b90d", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908813, "uuid": "172a90d2-7ac6-4868-afcb-d26da95fd2f6", "comment": "Malware payload", "value": "29bf36c6b6fd6fdc200e39fb811768cd413ba4ae7dd85ca0479a17047ecfe49c", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908813, "uuid": "c1c643a0-99a3-499a-a483-70e50a41407e", "comment": "Malware payload", "value": "ea001a5fdd756370665ccf3295d2f13b65b0eb6e", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908813, "uuid": "406020c1-dfdb-46f0-951a-838063b8beac", "comment": "Malware payload", "value": "81a1e9c697fcb26ec443cd1112690db7c1e62a0bd7736372f39513d0b082795fc9c9874a55e1b457aace560ead154ff5", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908813, "uuid": "2faf473a-9969-4c75-a189-00075ccfdb19", "value": "T118A42390808581CD57BC3645B95CB15DCF53A2B3EBE398AB3E9ED5741728C02A4DB23E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908813, "uuid": "e0ad80a7-9ed7-43af-91e1-1e0098d9ac48", "value": "6144:F87/NIvECGM49g2O8OeF/gXhj7URyp+HYsqQliYqSc/Dk1frkFLhGWnKlCFTVlkR:GbNIv+r9g56w+Hhbi2c/DarCGmTin8jw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637908813, "uuid": "5fabd112-58d2-4f4a-8b64-cbe098f98cbd", "value": 454004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637908813, "uuid": "7bbfbe27-2f7a-44bf-9667-689bec8154d7", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908813, "uuid": "17befadd-2530-414f-95bd-20ecbf99f102", "value": "Factura.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89ba6320-4ef8-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637958991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958991, "uuid": "a4b1aca0-a966-439b-a205-b29e2b398f03", "comment": "Malware payload (RedLineStealer)", "value": "3036473dbbc33e438e536cf37197b837", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958991, "uuid": "d1f2c0da-f432-43b4-ad09-862493564ac2", "comment": "Malware payload (RedLineStealer)", "value": "2a9e7bc07bd4ec39c2beaa42ff35352bbe6400f899f70be8922688db70cc5357", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958991, "uuid": "a3c575f0-44d9-4635-b6bd-5850c4405d4b", "comment": "Malware payload (RedLineStealer)", "value": "5fc219353c90adb71cb2d71e5bc5aec0f7f93edd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958991, "uuid": "fb6931a7-2fca-4b12-93db-c2ecf3186a41", "comment": "Malware payload (RedLineStealer)", "value": "00c1ad53ffaf70cf4c1fd076add25c8f7d63ad5ac482f2fc9f6ca444f099e093527ef6762684b4351bb8bc7f22e191a6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958991, "uuid": "4a8e9c94-7396-4552-b5b5-a490e55c3d4f", "value": "T12F1633165D26DB5ED20741F58DDB6E42BC1D9023AF68F132663CEB00D8AFB496850ABC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958991, "uuid": "0b004c0c-6408-4fb9-94ec-450c43c8d57d", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958991, "uuid": "ab2fb761-2b6c-43b1-917d-2771ff78049e", "value": "98304:yL+w7w6JR5BxyUZ+SWCAv3k8kUFEh4ua8yZXbZo:yC/wHevUhu44RW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637958991, "uuid": "1a9721f6-b064-460e-b46b-7d31e75d02d4", "value": 4291192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637958991, "uuid": "fe7a0eb7-6542-4c50-9452-19c30fdbc9d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958991, "uuid": "164b6e97-c6eb-407a-84b2-b42655b93303", "value": "2A9E7BC07BD4EC39C2BEAA42FF35352BBE6400F899F70.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e127dc77-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918765, "uuid": "a99d1822-099f-481f-b68d-f147a80cc19c", "comment": "Malware payload (Dridex)", "value": "f883b0476e91d2e0cc04e0eb1da48ba1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918765, "uuid": "ef8c209d-ed83-46ec-9ed7-fd3b26ca3dda", "comment": "Malware payload (Dridex)", "value": "2a9eee2d4a689729f8aa6d173eb41948a79595c5b95b181908c38aba0271e7ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918765, "uuid": "a88aa654-4f9d-4cad-a3e4-9d9712950831", "comment": "Malware payload (Dridex)", "value": "ac735757c04e53ebc4116fead73b2f8f8db9c787", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918765, "uuid": "7e0bbd2b-df84-4673-8b4a-166f2a17ea9a", "comment": "Malware payload (Dridex)", "value": "76aefc5fc99cceb9a5ce913582627ba1c48350bc66b15a5d3825b95ec572da8024e83fc51088196b7b70673e3e39e23d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918765, "uuid": "eab15dbc-760c-48ea-ac5e-71120b853234", "value": "T123657C02FBF30783C48DF639B8AD1400E1B3E745C96F8B1D455F132AA892B963D5A59B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918765, "uuid": "a0cee824-a8a9-481d-89b4-ed1988d6c85e", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918765, "uuid": "ffc9dff3-b5a7-4549-87c5-263d54af13c9", "value": "12288:AZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuwqVtUH:AZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918765, "uuid": "95db621a-0efd-4276-8f95-5a84134285c9", "value": 1458176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918765, "uuid": "b26925cb-2d31-4761-a619-57dc393a172d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918765, "uuid": "d68ab49a-07c3-4112-b8f4-fccea94358a3", "value": "2a9eee2d4a689729f8aa6d173eb41948a79595c5b95b181908c38aba0271e7ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06dbe6ef-4e4c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637884898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884898, "uuid": "ce9ad730-c2f1-42e2-9453-3767b810f422", "comment": "Malware payload (Heodo)", "value": "2338385bb97da70b0488a3fda08ab99c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884898, "uuid": "56848e7a-32f1-4da6-94ad-8efd3185591d", "comment": "Malware payload (Heodo)", "value": "2aa0999c9e630094ea859c4e8b4013a71a9019ad8afa4146d0c3d49e1e4d1bb9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884898, "uuid": "a585cb96-f687-4f65-bbee-2bda7766fa89", "comment": "Malware payload (Heodo)", "value": "daf521bdd7299e4a1ec3b8fc2c2a578722b4f28b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884898, "uuid": "9a043660-6622-43da-9c4d-9ba41ba6ce66", "comment": "Malware payload (Heodo)", "value": "fd1087094ad429802b28073e7e332b9a9eec04fa827f6b8276626541b2651dbb35b9f1699ffb1cde266d6ad1fcbd93b7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884898, "uuid": "37f19188-02af-4db9-9c21-c8ab00cc9d17", "value": "T173C4BE11F3D2C436D0AF01357616DB9927B9BE61AE758293FBE47B4E1F314C28A38642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884898, "uuid": "e6256694-e7d5-4c97-8031-6f8f7b000c35", "value": "43031315f82b6fa0235c2c3dae2afd94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884898, "uuid": "9723a033-c007-4e47-86f3-629bbd488868", "value": "6144:fJ4kSRXCb0GNf0QNR+hbspY72fZ84iP/MaDO3H3XqD/hN4+XWrS4raGIKRCBKh:aC1R+6PfZ8l/Mz3HHvTO4p8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637884898, "uuid": "424d20e2-753e-4d5d-bac4-e85b1017c0db", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637884898, "uuid": "d18a8f65-040a-4d29-aada-0e4e8a0585aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884898, "uuid": "5210b96a-2617-4ead-a33f-7a554633dd48", "value": "emotet_exe_e4_2aa0999c9e630094ea859c4e8b4013a71a9019ad8afa4146d0c3d49e1e4d1bb9_2021-11-26__000133.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6a6539d-4ef9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637959495, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959495, "uuid": "4561895e-f05c-40b3-aec7-09df093b5f36", "comment": "Malware payload", "value": "335b8f5b2117d7d13b3f416d30f1cfa1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959495, "uuid": "296e322b-cf5e-4be2-b424-142ad185e929", "comment": "Malware payload", "value": "2acc05ac23f9a9464c3fcaca14fc0f9fa85a74bb3f726bfbec6bc5cb5147244a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959495, "uuid": "5bdc0f4b-1be6-48c7-9ff3-8b662fae2221", "comment": "Malware payload", "value": "6d51356b08904ce63c46d650a0e3ac7de10ad15a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959495, "uuid": "0c85f98e-477d-4a42-ac3f-6047c77f2e4a", "comment": "Malware payload", "value": "44311a4742b41e30d7aa5e584cdfccea2d011f5726c66abd06363b19c0b52d788dbe4fe60010d7791b8de7bf2d6eb9f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959495, "uuid": "b4659d37-f534-4d45-8cea-65740f7837af", "value": "T170A5BF33B6B28837C1332B789C6B97545C3ABE002A78948A6FF51D4C5F3D6817B25297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959495, "uuid": "bb135699-7240-4879-8b78-60c540750c08", "value": "db67c6e30bc923d9faf73b7915f9bc9c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959495, "uuid": "6f002e83-f166-427c-8dc2-07e857063dee", "value": "24576:qpWy9d5xDX9TB9qM5r1T+wpyfYjvvNsjzbdUiVKnvqSI0WfTdCCrOEgtYztsEeQM:M9PfHxr2INRSyWfaZazZ3qp0AA1WXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637959495, "uuid": "53a7db83-bacf-4ee4-ac5b-6bbdfdd3b765", "value": 2100736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637959495, "uuid": "ef8073c1-7a2d-43db-be13-6049b66c1e1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959495, "uuid": "fc0a9669-2679-42d7-a0bf-acd3ab917056", "value": "335b8f5b2117d7d13b3f416d30f1cfa1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c123bb-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931094, "uuid": "09ba2c2b-313d-4a1e-a4c6-0f472f6c133e", "comment": "Malware payload (Dridex)", "value": "192e08b4790ceb525ce53476103064e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931094, "uuid": "d19bc211-99f1-4141-a4d3-08c7a7988417", "comment": "Malware payload (Dridex)", "value": "2ae03b57777d7f42699e0d0912f19c4bf3c99f991d8f8b021427a2d284057b5b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931094, "uuid": "182c94eb-c7c3-4669-87dd-a1bd69df15b3", "comment": "Malware payload (Dridex)", "value": "c64857d4c958dd20be72479074d95465b9cd8b9c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931094, "uuid": "6bd20562-2707-402c-b17e-e41aaa2d6c59", "comment": "Malware payload (Dridex)", "value": "954f00388c0aec62c20503c8cc0254d73da5f899ff38a395991bbc6bc69bb02940cc62f1b0c62bad3cb4042c90213250", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931094, "uuid": "c0e76880-e8cb-4f97-ae7f-340b36bd8362", "value": "T14EA3129E85DA3C2CC5F648FFC38D09B5A9120A4E0642FE0F7C9953781B5618FA78D20E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931094, "uuid": "ee7edd3e-337a-4814-9265-f998ed1fe70f", "value": "3072:V3FzIsj8aipSW4vHREQ4iZKUbUs6FgaNRCbFgdZ0T:gOipmvxpZ9Kg6RsyduT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931094, "uuid": "1a6139e4-69fa-4be8-b6b6-7e8573bfc867", "value": 100095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931094, "uuid": "d4fd38a9-2682-4a14-9f99-a9353486c0cb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931094, "uuid": "4c59b676-955b-4804-bd06-8e7a1e2331bb", "value": "giftcoupon365810901.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b75e1294-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637954343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954343, "uuid": "c9db632b-94cb-4c2e-98d2-e77e97a66cb1", "comment": "Malware payload", "value": "337c80fb7e868ae7bd8451b2abf425f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954343, "uuid": "766f2506-7d64-4d11-9dc5-e97ff49e0b50", "comment": "Malware payload", "value": "2aed66a90e0179ee2d8db5a3d74ec6e4f7a46c81f4efa0c00218d46655db10b6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954343, "uuid": "65238dfb-beb5-4b0d-b45a-18a5f3c6aede", "comment": "Malware payload", "value": "9669541f8c8f1d2a07a6794de101ca7382273048", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954343, "uuid": "591f58ff-1f96-47ee-94eb-6cae6cbe14c8", "comment": "Malware payload", "value": "035e5b21834650fd7badb8cc483a8054d02a1b667fec2407cb9895ca8a2bf7e2a705eacacac98c41f4e1eed6575dc62e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954343, "uuid": "caf56321-27b4-49a8-bc43-e83601aba784", "value": "T1CF94026417BC1215CBBD8FB760B152019336A63AF60ECB2A73D530A829D7313DB1269F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954343, "uuid": "8cba6e13-7930-4260-a67e-818aa54852c1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954343, "uuid": "23de9df7-5fee-47e7-a3fe-b2c8f624aec8", "value": "12288:U0PixBFmiYR/nIHJqIzmuz7k+bE6scGt:U0Pi1k/I0mXFEncE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954343, "uuid": "0354c640-f6db-45f0-9b58-1d62f9bef560", "value": 447488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954343, "uuid": "535cdcac-bc76-4e86-a164-d7ee070784f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954343, "uuid": "c70da68d-56f2-4d23-baab-0c873bd6b7c5", "value": "337c80fb7e868ae7bd8451b2abf425f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "166c019d-4ee7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637951496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951496, "uuid": "a1c091d5-e30f-46f1-bf72-1dc85414ad8a", "comment": "Malware payload (RedLineStealer)", "value": "94c2c236ef4d030354e7c26b184d9c59", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951496, "uuid": "c45aaa69-8e28-4e62-bd42-d5274e9416f0", "comment": "Malware payload (RedLineStealer)", "value": "2b0519e3978cea744b220f109077b4b012dc4e9856be838588f0cad62cb8c31b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951496, "uuid": "abc2bf69-8960-4f9a-9cd1-428234e3f550", "comment": "Malware payload (RedLineStealer)", "value": "801778ba97a84a2a6d3835a6dfdc97bfcafecc4b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951496, "uuid": "bd91b642-3ae3-4c12-8e4c-d3d99bf8a41c", "comment": "Malware payload (RedLineStealer)", "value": "a6b22ded20611076f210a802b3d9ed1df643dfa524b91eb9ca3422ed50ed80f8c47ae77c3603a44f42f4d80dde632dd8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951496, "uuid": "cc4782a1-2ed5-4285-b1d9-7aac69280f05", "value": "T154C4AF1FA203C950F549BF74D6339F6523A0BDB39C68C24763987A7D942E7782E85382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951496, "uuid": "dbfe938a-947d-4890-829d-fb4e7fb3880b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951496, "uuid": "6c7c37c7-82c5-47ce-bf7a-ba494e8c439b", "value": "6144:VcgHBrnF5H0LsQ9mD+jr7WO/RxEl9NSFs0k7FbE5ksCxh5lPgPsa9KV9WUUlwRXu:VLhHJCj1/RMHZbEkN3WaRhm610ee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637951496, "uuid": "0bb31d0e-48a7-4edc-b3a0-f786bbdfaa9c", "value": 578560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637951496, "uuid": "109f1b8c-8599-4667-a14f-01cbb5a32c37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951496, "uuid": "12398857-25ea-42a5-ae20-7b4e3a3272a3", "value": "2b0519e3978cea744b220f109077b4b012dc4e9856be8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49358054-4ef7-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637958453, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958453, "uuid": "0411f8b7-b06e-4e90-9ec2-d6f588d709f4", "comment": "Malware payload (Heodo)", "value": "3b317de79aced583edc44ed2259ee9f0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958453, "uuid": "eec98990-5788-47cb-ae00-30ff6e678d83", "comment": "Malware payload (Heodo)", "value": "2b2296ab51296ea92fc3387f0bd4db9a44588198caee0dc88353e5ff2fa65b57", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958453, "uuid": "79a897fc-5230-429a-aae3-f21c6c98549c", "comment": "Malware payload (Heodo)", "value": "5a4682253218300b871435a4ea6a69425be5d933", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958453, "uuid": "77a50d1b-1a52-477a-a112-a27b1b260407", "comment": "Malware payload (Heodo)", "value": "c9ff1acf66a53da36babbe421364d4f3e0d59796d780d470c46b57c3afbafe615babbf7183bab43639104dda61ef6091", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958453, "uuid": "84a7a37a-419b-481b-94b7-4cda6dc6b66f", "value": "T198E4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958453, "uuid": "47779271-4296-4618-a717-4a3de72bb41d", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958453, "uuid": "20ececa9-1f7f-4604-8511-b4494ed3d013", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhyico09cDlB4Vx/ID:0uH0GCNeQIi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637958453, "uuid": "facf88a6-880e-4aa3-bd7a-55b44684c418", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637958453, "uuid": "5657a894-5926-4b07-a478-6fdce835e607", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958453, "uuid": "00559fac-5dc1-4832-ad0f-14f48281f43c", "value": "3b317de79aced583edc44ed2259ee9f0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f03a0bb-4eee-11ec-843c-42010a9c0014", "comment": "Malware payload (WSHRAT)", "timestamp": 1637954517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954517, "uuid": "cba3b053-b251-4289-ac33-3109bd98b8af", "comment": "Malware payload (WSHRAT)", "value": "d7635680fdef884b00183d6e6279c816", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954517, "uuid": "b60ddfa2-8670-4c15-b1d7-e4c34bc2c863", "comment": "Malware payload (WSHRAT)", "value": "2bad00a5d95151f8a72c537e066bb1d2f1f7c73dfadca31f0ec21da7935df1df", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954517, "uuid": "646e16a4-6323-47f9-b04b-4eba6ed989ba", "comment": "Malware payload (WSHRAT)", "value": "1b6632f660b8b68d62d7d7dc2437fc43d37d161d", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954517, "uuid": "e7bc5d68-3939-4b3e-8fe6-0d9346c5e6e5", "comment": "Malware payload (WSHRAT)", "value": "c274677c12637c7145dc7cf7a80e7b6870d910947515bea79f0472983182e7cb7083accf6b50eaf2aaad15fe6682a1db", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "wshrat", "colour": "#3E84A4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954517, "uuid": "4e1e5300-ed8a-40b7-97c7-6119e422f33f", "value": "T1C53512870E260B81B76AF025022C73039DB8DE6B1EB711DBE9517D4EAB72C144D7DBA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954517, "uuid": "69d6904b-d5c2-4b93-984e-14be5df956ad", "value": "6144:5S10afpsmpz7yJBKZFMTY8glmhyeV5HPWYgPyhhW/Ym/a+tpafgQnRPsbQBzoqHh:WM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954517, "uuid": "e1861eed-4675-4f25-9264-bb21b919be8f", "value": 1072214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954517, "uuid": "11911ca4-9857-4876-a298-540d93a9e715", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954517, "uuid": "05ffb800-6384-46fe-a4ec-f54128409a6a", "value": "Customer alerts.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b524b9e-4ed8-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637945276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945276, "uuid": "a609c257-2c16-4d45-8297-612a75d6993e", "comment": "Malware payload (RedLineStealer)", "value": "45c7d66ca1987d417e1858b7b353b758", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945276, "uuid": "caf38284-b938-4fe0-8218-f89f0a315aa2", "comment": "Malware payload (RedLineStealer)", "value": "2bd4ae02afd897b27640f8b3286928043845cefad1ca97ca7ed2b859b0e4b984", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945276, "uuid": "7f5b01d8-9ed5-4acf-b711-711ad0264ec3", "comment": "Malware payload (RedLineStealer)", "value": "ed09b156cfd87ec42f620721a35bf27392bb8c1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945276, "uuid": "81cce197-d29f-44b6-95ef-7f7dbfa5f2f8", "comment": "Malware payload (RedLineStealer)", "value": "a310f6e7cd0eaa14b19684edc64aaa387c11ee1d3210a5bb41c8c3c0e11ccb8635eb67f5fa4aa37cda4a99fc1949a24a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945276, "uuid": "4786f3d5-1acb-42b7-903a-a209b338bc25", "value": "T149750100A7A0C036F5B71AF8897993B9693F7DB26B2495CF12F526EA86356D0DD30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945276, "uuid": "f8d3d7e0-d5dc-413e-8843-e8dd5ca480f9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945276, "uuid": "edbb7c84-10e4-415b-a7e6-b3c87992c145", "value": "24576:3AxGKJBPIuIGzKEtZd+pIQqNV5FTD9cxPutdIp5ybLD930+xUu8NIeCRRa8:wxGkt6iQqb5uu3I7qk+xUstRU8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637945276, "uuid": "e9e9e28f-94df-4e26-b370-d373dd33a208", "value": 1652736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637945276, "uuid": "de5b6e56-d3ee-429c-8742-ddf27ecbe605", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945276, "uuid": "6589355c-8b2e-4fe7-b0f8-6f4db2232a53", "value": "45c7d66ca1987d417e1858b7b353b758.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d919b0e5-4e84-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637909302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909302, "uuid": "a95d9074-64c3-464a-8d03-2998318f3731", "comment": "Malware payload", "value": "dc3c58a43f34d362a30dedd67fa46b20", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909302, "uuid": "eed47adb-f402-411a-9bb9-67b99c339421", "comment": "Malware payload", "value": "2bdc327b1a15adab54bb1e22dc1fe0b01e89423b4828215d2534955c8ed12090", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909302, "uuid": "97091d14-b9c1-40b0-a99b-8d7b1a45d39a", "comment": "Malware payload", "value": "0b8fdf2870f42bf3ecca239d832d8b4cfc4b772a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909302, "uuid": "57501201-ee7b-4f44-9351-0386fdde74ba", "comment": "Malware payload", "value": "078d35e8b1dc06e1e91625eca490a4e74f7d62527793d022fcde2c1f93a4ee160bcd544f2edbefcec889fe71ea0265ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909302, "uuid": "d6f32b1d-1715-48e7-b24f-ca68533ee616", "value": "T1E2B4022467BC1630CADD4B72A0B49201633BA56AF50EDB6936D374AD18D7313CB12ADF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909302, "uuid": "83b3d6d2-9946-4f28-86a1-0f5edc1963eb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909302, "uuid": "93279ae3-dc34-4e0d-8b10-9d7cfb4ca24b", "value": "12288:e0UixBFmuU/52kTnT3Oc22PVcM2Mof+lm8vLH:e0Ui1bUMcnT52vM27zs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637909302, "uuid": "2fc11bdd-6b22-4f8d-9a93-2f44ac787b7a", "value": 517632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637909302, "uuid": "646b16e1-a7ca-4532-ab9a-c3bb547b74df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909302, "uuid": "dc971388-6b07-4839-9260-040fa7d2945b", "value": "Cotizaci\u00f3n RFQ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4942defd-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918939, "uuid": "8c80cb61-39da-4748-b98f-04983266e921", "comment": "Malware payload (Dridex)", "value": "b6b41e427a208e21b75fdff54a69e35c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918939, "uuid": "f7439e09-616a-47ae-956f-0513182e8855", "comment": "Malware payload (Dridex)", "value": "2c32f681c7821bdbcb2038414964456759d7fb48d656ceb200f0eff871e1eae1", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918939, "uuid": "721fbf48-107b-4f55-8b82-761ed941a65a", "comment": "Malware payload (Dridex)", "value": "ee4fbf79a3ed6ed84741800f3dc401f4ae844c8d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918939, "uuid": "e10b56d9-1ba5-43ef-abd5-17695633dd33", "comment": "Malware payload (Dridex)", "value": "731e31034cf638ff7abbd98fc0eb0dabd2fbfe894c64a171c298fbb4ba5f2db33f78c003e851079fabba6f5a242b40c8", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918939, "uuid": "e6e7b7a3-2cec-4945-9f71-6cda1fa84d02", "value": "T15C55D162D36871E8C5739A31D03F551F0AB66D2268598205FB723A740D3FAC9FFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918939, "uuid": "d72b7d43-b8bf-49d7-b01f-1b7414ec5b65", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918939, "uuid": "05ba2a1b-cb88-4003-8f0b-e59aef84bd14", "value": "12288:jGVNJAvuPFUl/faxuVlBLXKCgFfEK7JRLeHlX//ve7:C3JAvRl/fKIKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918939, "uuid": "3195e238-df3c-4dd2-a209-a78713960659", "value": 1331200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918939, "uuid": "d4b67d49-b960-42dd-bdd6-3a02a7cb14ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918939, "uuid": "2d291e13-f112-47bf-84a7-c94098c96a2a", "value": "2c32f681c7821bdbcb2038414964456759d7fb48d656ceb200f0eff871e1eae1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bc88b58-4ec4-11ec-843c-42010a9c0014", "comment": "Malware payload (FluBot)", "timestamp": 1637936607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936607, "uuid": "5770a9ed-bd5e-41b7-a57f-5347aca0b93f", "comment": "Malware payload (FluBot)", "value": "729160d423c809ec7d4802fef9010076", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936607, "uuid": "455646a2-27a5-4f74-b4bd-d14533285f20", "comment": "Malware payload (FluBot)", "value": "2c74efb0e8304948e56f4ccb1ced6c05734842ecdc95628decacfa74d06baf6c", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936607, "uuid": "3efe58f9-0ce5-4a3c-9b36-91057d389bd6", "comment": "Malware payload (FluBot)", "value": "05e887acc64b92764a7ce9156745e59b42f1144a", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936607, "uuid": "1a1d3868-6049-4549-a92c-fb3c1e477b24", "comment": "Malware payload (FluBot)", "value": "4f2b0a5288698363650f404bd22d519cf9d058e27a249c73ca4ca55a0dfd09b4a8ef5769261bed05b84b02463fa1b39a", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936607, "uuid": "de00a2c3-276c-4127-a961-5a55217719fb", "value": "T1A736232DFEEEE1DEE203E135D195D5870608041E4A00F91B6BB6978D4EFAC505B06FAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936607, "uuid": "be86205b-ba96-419d-bbae-03260f1547bc", "value": "98304:p6nnEiSsLombCuNZGFOxXknnhoZI9wHRp73rXTdgksiIAiLFY0YsET8LA3W3gr:pCtoeGFOx0nnhp9wXC2I/7YsS803V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637936607, "uuid": "c0356e06-b025-473b-b60f-738362db3a15", "value": 5259300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637936607, "uuid": "0a047d2f-bc72-496f-972b-4de5dbe7d548", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936607, "uuid": "791992ab-4ad6-4fe0-abd2-c1669afc702c", "value": "Voicemail12.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a998fc3b-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637954320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954320, "uuid": "cccdeba6-d5d4-41e9-ac34-a3b212305fca", "comment": "Malware payload", "value": "4feb9c7b704b1ef4906fdb574be550a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954320, "uuid": "bc6d22ab-5eee-47f7-b382-376943b4ccb3", "comment": "Malware payload", "value": "2ca7acbcb6a1aa56f962cba84250d97d3f01cd598c92c2e4acd072c95a5f8530", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954320, "uuid": "79793b93-1b0a-4d9d-9b5d-6f6ebf7853eb", "comment": "Malware payload", "value": "86bf8f7f6a66307b4ce69efd7f34f16d6c57fb30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954320, "uuid": "5e0cae67-123c-4ad9-bb81-e8ba6cb07329", "comment": "Malware payload", "value": "6496ded9e48773c21b2e0f9ff630a8aa01788dc16d4e76d75049f1dd8e8f7893d606430fead9c1662ff64f075fab4be6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954320, "uuid": "189874ba-a2bc-4649-b6ee-0e15be58468f", "value": "T1DD05B2D023AB4231E2AAD231AF7CC53703F9B8115279D7D9186074AD2D92F83791DB6E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954320, "uuid": "378e0ae0-d573-44e8-9f06-d3a65b4a44b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954320, "uuid": "866979f6-7871-4d0b-a0b1-a2c7e0ac8a39", "value": "6144:MXu/7+QxDiM5snMvB0EmKLZPDvOBpqgOMTSa9n2HmTgVBk:57hf3bvOBpXTSJXq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954320, "uuid": "e47b0dfe-b872-4fa0-a2b1-284d31b253b2", "value": 802816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954320, "uuid": "9ccb567b-33a6-4183-9707-e2142e3589af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954320, "uuid": "607298cf-b90c-4e30-afb0-eeb1a316e51f", "value": "4feb9c7b704b1ef4906fdb574be550a5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c448dc0-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637931078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931078, "uuid": "acbb66ab-1b6c-4630-aa6e-aa345939de61", "comment": "Malware payload (Heodo)", "value": "ca084599e3beca284859fd1c78e07dbe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931078, "uuid": "a93d7788-ba32-40fc-8d85-701c0599bf89", "comment": "Malware payload (Heodo)", "value": "2cf2a0ef629ae579abff192ce879ecc5bb9dbe4b6ae67477effa0deeef879480", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931078, "uuid": "ef230c1e-4a2a-4ed9-8594-c3ba38c0790c", "comment": "Malware payload (Heodo)", "value": "0794e78dc515a4b222ec8bf4a2b11c181f1f1750", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931078, "uuid": "94f975e1-c844-4c85-bc7d-66205d7433bb", "comment": "Malware payload (Heodo)", "value": "e29e825160a7347f9b289e3aaa482795f7582fe9906479d78697042f6314e62cc7f367a20cb995e84f3ac7c6df0ac147", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931078, "uuid": "7dce3a1c-a7f5-49bf-9783-c2a09d2320b5", "value": "T17B03BE1EC251F9ECD23AD93A81D849A5521E2E105042B94D2580B58CEF7B2FF6BDF358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931078, "uuid": "0602a3a8-b0de-4ecb-ba24-a5511c5e4f13", "value": "768:u/I83GhApRrjevZCwVIYgBZVWpf/wak8y0VItKF:unKAbIIjkpw78XVIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931078, "uuid": "47573098-5ecd-46d4-895b-07ac050d9e59", "value": 37994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931078, "uuid": "8a5a85ff-3f93-449f-a497-76e311e5131a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931078, "uuid": "21fe097c-f691-44fd-b40a-3324f195c947", "value": "SCAN_10002754485673546214742.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fc5205-4e83-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637908899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908899, "uuid": "4cf53316-b8e1-4193-9ebc-12720abf6ff2", "comment": "Malware payload (Formbook)", "value": "c9c4a75a99c0f4ded22cc0b96e5ec23d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908899, "uuid": "01b349af-e8e7-4f65-822b-2ac8316f99f5", "comment": "Malware payload (Formbook)", "value": "2d9cb324f1b2bd1917884e36d5b13b9e949807ae5caba015bff60e8ec7d483d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908899, "uuid": "f3826196-1eef-4e9e-a234-2d60fc8e2fe6", "comment": "Malware payload (Formbook)", "value": "63c7999513a3bd0387e4721a09b57a3a42cf36fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908899, "uuid": "ba087e25-ed28-441e-9c0d-879ae5b70e94", "comment": "Malware payload (Formbook)", "value": "35ba4533bd79672e30d4bbbe1f28ee0c32b8d6f5eac090d0c4f83fdadc145a02e8a9740992c60503813c863252ffa5f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908899, "uuid": "11f73883-f783-4957-9597-3423f3752400", "value": "T149A4F1A43394F38ADC2A4BB54C2090D92331B1563D05DA6DACC8B7CF1921B566B27BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908899, "uuid": "cf99e9c6-48cb-4f32-aff4-7247b72053b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908899, "uuid": "c887a568-ca74-4c75-b0ff-78702bb84d8f", "value": "12288:w3PYk/HXvXksjvV6efW/oJIymu/u+IaIT0tD00:0PYsHv/vV3fVIyd/u+Ia60C0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637908899, "uuid": "bcce74fe-f37c-48ef-816e-7abcd09227ae", "value": 457728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637908899, "uuid": "fb4db04b-42f7-430f-96a6-483d803046d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908899, "uuid": "fb00f052-bbac-4eab-8399-1547381d466a", "value": "PO_467889999087746346.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cb820e1-4e5b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637891404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891404, "uuid": "62ae34ef-d28a-4f81-801a-3247a17645d5", "comment": "Malware payload (Mirai)", "value": "cb467fb9d518dcfe4ae28060ba49c9a2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891404, "uuid": "90adcde5-59f9-40bf-8d42-6b1d4a35620c", "comment": "Malware payload (Mirai)", "value": "2db6d71ad549bb585d788adf8305ff089ce812a65f6b63b303c417cf488fd088", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891404, "uuid": "8ddc99a5-1641-4a2b-a6a6-ba3c007c1262", "comment": "Malware payload (Mirai)", "value": "70152fec2f325cf406dcbc178a918f8f98b6da97", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891404, "uuid": "524bdcc1-1a23-4169-99b0-42c51df7a358", "comment": "Malware payload (Mirai)", "value": "fe7b997f6714dae5186c4429cca07dd0585274dbbb636955d1962ca449d4c454fdd374e886b505c3bcc46c34f54d009a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891404, "uuid": "bdc54ca1-2923-4dd7-b339-62066115e738", "value": "T1C763127698063EC1C9347C798949DD88378DA5BDC5BF4C2FB671EA8422C09C8B2B44C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891404, "uuid": "884b129a-d059-44bb-871a-306d8894f15e", "value": "1536:4ysA2EEE8pHGFrdhydICV+BlzLbGDZNOlVf4xHJTm:47A23EuiydI6ylzLCDZNOv4Bxm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637891404, "uuid": "1dc6c687-7c61-4ae4-9b13-33df2c47f938", "value": 70876, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637891404, "uuid": "5473c438-ff24-4560-9bc5-69882712c1e0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891404, "uuid": "07c6db8e-879e-4e9e-a97e-19e18c60a7d8", "value": "arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97be685a-4e85-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637909622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909622, "uuid": "4b2ae600-248d-4e11-80d5-1bfdc4924abc", "comment": "Malware payload", "value": "a91c3e4ec7bdf0756383800d2d66b79b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909622, "uuid": "e664952a-0094-47dd-af73-3e9ab0f38489", "comment": "Malware payload", "value": "2e260ee3942d4a1c52476e05b71daf254617f261db6ce4aa5145a108f747fda3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909622, "uuid": "8fe2a739-ecff-4af5-b185-12dc8fbebe66", "comment": "Malware payload", "value": "23b61b7ed8117bad7cd986f4a7eedd915c7eaa22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909622, "uuid": "352c0076-3450-479b-9d8b-0588532ce0b8", "comment": "Malware payload", "value": "08411b7feb8c3879f6a42d93abef18909e41bd468312f685c0a333a004a8d79f71af465ab497898b0cc4eef8b7373741", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909622, "uuid": "8f00d88a-805e-44b3-8728-aa9f9172a170", "value": "T1201318273EEE2107EB1A97B3AB53E41096339E427DC1EE9D2CC751D81925B472E8064F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909622, "uuid": "351a4e2b-9482-4566-821c-aff11a89e501", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909622, "uuid": "3ccbde09-3093-46a5-8467-599c9a4bbd32", "value": "768:9CYEhMSBr3ekkGUFCE5tz34kkcz7jrKGNOqxQdhHg:oYIXBr3ekkGUFCE5tzIvc/jrKIOSQ/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637909622, "uuid": "4e5d6ceb-bbe1-41d5-8469-b57d1e5c7220", "value": 41912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637909622, "uuid": "c555ad6b-fd2c-423b-afe1-4326a6106b6d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909622, "uuid": "9a941c6f-946c-4829-8422-9b5e6bf1d5e2", "value": "INQUIRY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ab313c2-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918969, "uuid": "302e78c1-bcb4-45f2-85db-9487522791ea", "comment": "Malware payload (Dridex)", "value": "8bdd5a9dbe6ed7f370621c995b365166", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918969, "uuid": "8493ad16-9a45-4deb-b1ed-422c4e6ba7a4", "comment": "Malware payload (Dridex)", "value": "2e3345d45293cd602f027f8a9c0ffbe4435aca82efff9d09318e38af7b4aff0f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918969, "uuid": "d0b5650d-c2ec-49be-8934-11c393900b00", "comment": "Malware payload (Dridex)", "value": "54b3c311855e88b1051a44d1ea7cc2560361f4fb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918969, "uuid": "9513935c-64d1-45f2-a63f-69756a08e1c2", "comment": "Malware payload (Dridex)", "value": "cdb41c1def230dc66788491baf1c1a6dab0b75ca4abae44ab258f7c1cf3be6c1800869c3e8454dfc8ac11f94655481a7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918969, "uuid": "4cbe5a49-2f64-4dbe-954b-127e617b8546", "value": "T14155E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918969, "uuid": "87a0f64a-08b3-439b-8bb8-3c1167633749", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918969, "uuid": "648b903d-e0a3-4d71-b924-45974a7c53ae", "value": "12288:4ZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:4ZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918969, "uuid": "b1be5dbd-07b5-4405-b126-d9eaed4bd92f", "value": 1306624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918969, "uuid": "14a45cbe-1c0b-4c3b-aff0-1525d6718831", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918969, "uuid": "df1cd67f-8421-416e-8e2a-3052379ee7dc", "value": "2e3345d45293cd602f027f8a9c0ffbe4435aca82efff9d09318e38af7b4aff0f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b06339b-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637921653, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921653, "uuid": "ec0a9b86-0345-4d63-a392-c7b43a352a01", "comment": "Malware payload (Loki)", "value": "514c70bcb82b8fdf11aa57a8a1ae91da", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921653, "uuid": "cff7e473-26cf-4ddd-9bc8-10994e585cb4", "comment": "Malware payload (Loki)", "value": "2e6c76111ee95201e9b70048205602530b88f321ec0a1e45861a906b4eed3f68", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921653, "uuid": "8bf33c97-5f4d-44a3-98d1-ae1447cd430d", "comment": "Malware payload (Loki)", "value": "72e848f4b66dd1bd89a207f6c0f6502421316656", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921653, "uuid": "41f12747-4cbe-459f-8e83-7f817bb83ee3", "comment": "Malware payload (Loki)", "value": "1eb3b914914c6e8022c4f723125bdc5fdca4b2b65be2241328f3ff38aab5a836c9f1afdad0d7bdbb252f0ccd752f3131", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921653, "uuid": "51f67232-06e0-4d8b-91df-aa9e480b9b65", "value": "T12E341206F14AB574F3229ABE49B8DD863314CC7F4687302B7511B40FE9FA4A48592F9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921653, "uuid": "f1322091-121d-4623-b8e9-23e337f004cc", "value": "6144:cMYoWslxtK92ha46oe/1vSGmgElaTjV/bMpyYMc6NHekBBzgK:cMYoDlnKya46dVSGmcTjNbnYMc6ek5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921653, "uuid": "e5136d46-b1fe-4e4b-9af7-59c118b0dddd", "value": 234376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921653, "uuid": "886324d8-e293-4a21-b9e5-698a6a7a8b86", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921653, "uuid": "2173e275-45ce-4ae2-bdfd-3ccf7a98cdfc", "value": "PROFORMA INVOICE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "775aad7a-4e87-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637910427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910427, "uuid": "6ac29d97-f0e9-44d0-aa69-901f9115d7a5", "comment": "Malware payload (AgentTesla)", "value": "4f4f779139b34d29b831687014a8c3d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910427, "uuid": "acca52d4-6d75-4298-be22-65446c16d5a2", "comment": "Malware payload (AgentTesla)", "value": "305d5d000b62973f16324d78f8ae38a81f1e358d599bbc26bc4745123f78f45f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910427, "uuid": "11400dee-ee49-4c81-b7b9-5fde1b544bb7", "comment": "Malware payload (AgentTesla)", "value": "b18835e383b9ce5cefda2b80e62ab893b448f00e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910427, "uuid": "924090b3-0100-4455-8e77-1927b67ffbc9", "comment": "Malware payload (AgentTesla)", "value": "913e5cf915ac4359521af335c8d3a3a7905e63488da5530cc1ac4a6416f9296fbd812d7a85718c6c920cbfa231bf3854", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910427, "uuid": "2464c4b8-20fd-4618-8b36-a1e821d0066a", "value": "T13F84238F6114D3C92979BE3831ED8BF23449F2CB234CDC66975AE6301A990AC7419B1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910427, "uuid": "75d0544f-2239-49fd-afa5-51bde949f01c", "value": "12288:wfvRcgKQqeo78mSrPLYtEmoNdx9cZxOpy:wfvQNd74fYtElb9cZxOc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637910427, "uuid": "c433d39e-0f31-4f73-97eb-ddb17a11b3fb", "value": 404397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637910427, "uuid": "a15693b6-6b41-4e1c-889e-fe569c669f83", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910427, "uuid": "749ba168-0d35-4034-9d4b-3c867f5083fd", "value": "TRANSFER SLIP (3).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc981812-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1637918703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918703, "uuid": "129f3912-abcd-4eda-812a-c494d4ad206f", "comment": "Malware payload (QuasarRAT)", "value": "6f3432b6c27af39ee853a544b671cb15", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918703, "uuid": "f3103ac7-c5c2-4ba7-9b16-508239e81feb", "comment": "Malware payload (QuasarRAT)", "value": "30bc6d1024943ded3b3b666c9bebaea8059b6cd06d9af6ec346e113407f439db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918703, "uuid": "0995906b-f4b1-4799-9ac0-066941c5a953", "comment": "Malware payload (QuasarRAT)", "value": "959ff9f6b5e0a403264ca505e86e1be5ab627551", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918703, "uuid": "333aae42-d97a-462b-b0d2-c6cc38efe86b", "comment": "Malware payload (QuasarRAT)", "value": "7842f521da237dbabe40989d6decdc73da56fbc5ead2053bf7db5f6e9bd28fe368e604634917a3803b27901e0f08274d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918703, "uuid": "196855ba-8ab9-4f0e-9a07-42b86688bb95", "value": "T1ACA5BE41A3DC82A1CE6A4372BA36DB219B777C692634F70E1ED83D7A3E723521518353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918703, "uuid": "a082f49e-9f19-4982-807c-17a43c71872f", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918703, "uuid": "ef7c4851-b011-4e3a-85dc-043971f58b57", "value": "24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYi:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918703, "uuid": "3d3b6853-764d-4c60-bb4f-274108464728", "value": 2111608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918703, "uuid": "b61d669a-0356-43ff-89d6-63fbbd4bcba5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918703, "uuid": "c1f21bde-5be4-4906-ae40-05bb86bf5880", "value": "30bc6d1024943ded3b3b666c9bebaea8059b6cd06d9af6ec346e113407f439db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "becae031-4e87-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637910547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910547, "uuid": "3eca273f-a8bc-4580-83ac-9b9a81ab0be9", "comment": "Malware payload (Heodo)", "value": "46fea91e093a2c96867bd0588c24328c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910547, "uuid": "f188740d-8f96-4de9-b788-4a3284eb9ed1", "comment": "Malware payload (Heodo)", "value": "312ccd569b0633433ca3f9f17752d73ba9852fb707c00d1897ece7d467af9897", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910547, "uuid": "e5326000-5878-4a44-8b7f-99666dd4541b", "comment": "Malware payload (Heodo)", "value": "98a69738e4c3bd6bbec6b414fc6d017b4533a48e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910547, "uuid": "44985c88-041e-42c9-859a-62b0d17706a7", "comment": "Malware payload (Heodo)", "value": "afc730d7c1825d03ce2fa9bdba82640fa7bd0cfc7436a196a5aa17e55aaa2f3ec628f3c007b03f545ddfa3ad01d92963", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910547, "uuid": "b44774cf-e89f-48fc-af67-9d3db6cb7315", "value": "T1B9B4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910547, "uuid": "072860dd-cc5f-4249-be0b-6e0be09e0c4e", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910547, "uuid": "c1c8961e-590f-4d51-b3b7-fa1e75d9b2ef", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDaz3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjmXC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637910547, "uuid": "9e5c1e1f-1b61-427c-a908-6a0ac1c0c70c", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637910547, "uuid": "4f4e8330-3fcb-4d53-8f35-9777d783b315", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910547, "uuid": "1c0dc21c-de36-4e73-b98a-59c78107196b", "value": "emotet_exe_e5_312ccd569b0633433ca3f9f17752d73ba9852fb707c00d1897ece7d467af9897_2021-11-26__070902.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c39bbbcf-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1637918715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918715, "uuid": "ba0439c1-281b-4dc1-a1d7-5c3d9d481640", "comment": "Malware payload (BitRAT)", "value": "93aeb333457ed131ec655d10cb7cd59a", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918715, "uuid": "a13834b6-153e-497d-b470-1887b04e0163", "comment": "Malware payload (BitRAT)", "value": "3134cd218f6b26c50cff3e6276831cf8fd26e7ae8dc75cce0030896f4e7ee428", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918715, "uuid": "a075b681-cd86-4882-9ef2-573ff67449bc", "comment": "Malware payload (BitRAT)", "value": "7547078d7525ac4e2fb5abe648d7c52f9edd1442", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918715, "uuid": "1e55742b-eb51-463a-abcd-e840c831ae51", "comment": "Malware payload (BitRAT)", "value": "102cb84868bdccb4f14ada0dfe7b386f9b033c3aa714746670f224d614e613e03cfe8bdb101e1ceda1c0b3691145410c", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918715, "uuid": "eedebc65-a255-4ffe-8d24-0a6c94aada28", "value": "T1A195129C8320E7BFE54401B0BD99BBB78428EE9266DCB6D0D09C7D1D54B3EB112E7246", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918715, "uuid": "e158eec5-4f57-493a-aeef-44ca20f3e918", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918715, "uuid": "53ec7f3e-6c3f-4940-a4e4-b813c0ffd934", "value": "49152:2rcOXyUGORNNUwkJoX9iR6WGMQhz4zgdqAoHFL:zOXyUVR1kei18EzIYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918715, "uuid": "f8d557e1-f194-47c7-a68c-130dc93e929a", "value": 2052608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918715, "uuid": "976111bb-89c9-4ab5-9626-a18cb0ee5cee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918715, "uuid": "38468724-5d4a-445a-aa43-c68e7920668f", "value": "3134cd218f6b26c50cff3e6276831cf8fd26e7ae8dc75cce0030896f4e7ee428", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a85990c0-4eaf-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637927689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927689, "uuid": "fa4e0b85-7503-467a-a165-d422541528ad", "comment": "Malware payload (Mirai)", "value": "b46ec9169d7d72ee50f7f206c60aff2b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927689, "uuid": "c49f4b31-b095-489b-a73a-4dc6ec46b37f", "comment": "Malware payload (Mirai)", "value": "315e45ef9b5297786201869876f2751b1da09cbc224861d043a7063f4ffbf2cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927689, "uuid": "493ebd3a-4e2b-4eff-ba23-d3fec87dfc5f", "comment": "Malware payload (Mirai)", "value": "150a7e3fc2f889ea7a77da7e89347caba4e0a0cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927689, "uuid": "a775736c-f493-4496-9698-c31d7af0a013", "comment": "Malware payload (Mirai)", "value": "922f83301ac35d8ceb5488e3531bfd35046b2ab2bb05fe37a114f0ea9d53a326c4cc095c3e91e2b57f007e5167bb3dcd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927689, "uuid": "51847cdb-e839-43b5-9b69-84ab6fd72800", "value": "T12FC38D46E283F8F0CD4509B0149BF736C97968312168DEE6FBD8FD8AA866703D02635D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927689, "uuid": "3690d0a2-3a28-44a2-b817-eac6f9d4e64f", "value": "1536:zsoMfwISuYQUNoFY8t5mHHIZpRr1CVMTdIfKdvTYESxUC6U8O4EAoNVe3U331gLO:onVJoovf001Fi/xR6Up/33Gwz5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637927689, "uuid": "8316b338-a4c3-4313-8f78-83a41caeac79", "value": 119576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637927689, "uuid": "cf00537c-07f1-4779-8f31-9ffda419c007", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927689, "uuid": "18e582ed-9d43-4e8f-8424-00a0d3c3a597", "value": "b46ec9169d7d72ee50f7f206c60aff2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2c36b380-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918891, "uuid": "b4595c1b-8007-4842-9989-512bdc394241", "comment": "Malware payload (Dridex)", "value": "d6d2b7aa9232eeda14644138ddbc6569", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918891, "uuid": "69f18274-6629-4315-8ac2-b59be96844e5", "comment": "Malware payload (Dridex)", "value": "31a694cd04044831b2125f6cf16bc9dd342aee9ea89181e1aa302c82951cd956", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918891, "uuid": "fb611424-1511-4054-a0e6-022cfc1cf4e2", "comment": "Malware payload (Dridex)", "value": "6b419ed314f2bc61d236344b4cf302f0e9f2c237", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918891, "uuid": "7ff50910-4ba3-41e9-b7d7-17b85d541be5", "comment": "Malware payload (Dridex)", "value": "38323fa9229789973bf871262007bc3c382bd40298d14789ea500725d45e75c7f6b96f5ed80a8cc51d1a727c95f91bea", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918891, "uuid": "753b8820-5a6d-4017-88c8-11141a1f0d3c", "value": "T1FA55E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918891, "uuid": "6175bd71-a001-4117-bf5d-448527a7954a", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918891, "uuid": "c53e5cbf-531f-44a2-832e-7f0f9478305a", "value": "12288:nZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:nZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918891, "uuid": "cf895eb7-6a0b-44c8-a7ff-edb0e1a10b76", "value": 1363968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918891, "uuid": "48e54c0b-91b2-4453-86e8-284cfd97e53f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918891, "uuid": "0c08a19f-da4e-454e-94f5-ac5675fe59de", "value": "31a694cd04044831b2125f6cf16bc9dd342aee9ea89181e1aa302c82951cd956", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62f4fffe-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637918982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918982, "uuid": "9e0673e9-d865-4ff8-ad78-c0affaae88aa", "comment": "Malware payload (NanoCore)", "value": "cd2c69c919c9db4018d4d6078a595275", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918982, "uuid": "1bbf08ec-1704-48ed-a4a7-1e18ad39abfa", "comment": "Malware payload (NanoCore)", "value": "31c032e022f812b60c6d2f12597186d72d7f34abc2c6da2a8d6528ac9dbf9805", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918982, "uuid": "bb03cdd1-d0e5-4669-b64d-735c3f71f910", "comment": "Malware payload (NanoCore)", "value": "409fa40c476724cb47532d53b844d084a78dd12e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918982, "uuid": "062a1014-ebde-4c51-937f-29d3b109cca2", "comment": "Malware payload (NanoCore)", "value": "25b7a16f82e08fb93f9dcbfb1221a3a62f0fdc3e6119391e407c64a972a6d57d72539c4edc3415accdd4f0f373058320", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918982, "uuid": "9b785851-1b81-466a-9c39-9b54ff4c90c4", "value": "T11945BE02B3D5D036FFAB92739B6AF22256BC7D250123852F13982D79BD701B1227D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918982, "uuid": "c6e82a4b-3929-4b9a-9052-c987ae170b59", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918982, "uuid": "627535cb-736c-4acf-ab56-41ff7d3a68a2", "value": "24576:9AHnh+eWsN3skA4RV1Hom2KXMmHaFZyrh9QI/C+EZCBqUIYXmf8MuvWzx:ch+ZkldoPK8YaFZyri7QPIYXLMZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918982, "uuid": "971ce27d-6b7f-4633-99ad-07d88ec1ad9d", "value": 1254376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918982, "uuid": "ece22ed8-52e3-45f3-abac-167c3c250069", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918982, "uuid": "d4c1e2b2-9893-4cfd-96a2-462f7d9706b5", "value": "31c032e022f812b60c6d2f12597186d72d7f34abc2c6da2a8d6528ac9dbf9805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72647af5-4ef3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637956804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956804, "uuid": "00186fdf-f03a-484f-9c03-d1ff84b72f90", "comment": "Malware payload (Mirai)", "value": "ed0196d613046e6523d935128f8b73d4", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956804, "uuid": "d4139653-b47f-48fe-ba8d-03f5f7a12717", "comment": "Malware payload (Mirai)", "value": "32b42e8f80fffe76d0068c8a645696d3619d7fe3acd5f9cf3b5e9213e4b141a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956804, "uuid": "16e920f4-d27a-4c82-b47e-2541b8d86e4d", "comment": "Malware payload (Mirai)", "value": "529da8b58e67adce063d1e19c4e8ef1e7879f2b7", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956804, "uuid": "7842f872-3ba9-44a8-8e29-b4f6d73f2ffa", "comment": "Malware payload (Mirai)", "value": "5cd24068431c18fd0b2e01fba28e465c3cccf08c858256898caa5c8741cc3aea9681b0670a60e6b7915910be2b3423b0", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956804, "uuid": "867e10ef-d75c-4444-8183-e94e5b177b92", "value": "T1A2B2E189D6FA1BC3C2A19336D0BC8A4DE1B61AC10342450A610DB24EA3D764E97FB3E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956804, "uuid": "392d7c8a-f4a1-4676-a279-f6a82eb0e477", "value": "768:R/QOC0Yhn6ROHWFlAcwNEFCnNBxcUddcE:R/nihneFnwTNBaLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637956804, "uuid": "475b2fd8-b029-481d-818d-dee685a86711", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637956804, "uuid": "9e16c01f-1126-4796-b094-a14d12c249ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956804, "uuid": "a7d192be-7211-47c8-b99a-b4e0b8781685", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "396a1f30-4eff-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637961862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961862, "uuid": "f80b1235-95d7-4a92-a18b-7517fc1fbb2c", "comment": "Malware payload", "value": "c378fa05724cb8425ab7b09544832d3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961862, "uuid": "bc459fde-90bd-4e2c-8679-0f4f6cf99bc5", "comment": "Malware payload", "value": "32e136bfb026a9deee569cdc3566782083b4da190da9c66dd42bd93cda3ba9c5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961862, "uuid": "664db27a-ef40-42b0-bc62-5deb62b1c125", "comment": "Malware payload", "value": "ba8106222ace49ce9649643c0c5fdb225924cb46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961862, "uuid": "c67d88b5-41a3-4d99-b0d9-f250bba51e2b", "comment": "Malware payload", "value": "c00417f293cc653f6fe73e0996a522e2c9e2b4bb3cd1b97ca3f6f5e6fe34a7c2c49050b45352253a3e994201cc3c3e01", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961862, "uuid": "82838278-d204-46a5-99de-d68460adff5a", "value": "T1B4B38F23F654CE51D1858AB284B70BE9080ABC6047918F9B13CD7D6F7DB69C2D82369F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961862, "uuid": "770b0d34-21c2-40ca-b940-28c22ab9de3b", "value": "0f4982a9a9c5930fccd78070d4b8a22c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961862, "uuid": "63d51ce5-5478-4f8a-a71c-491319fcc96d", "value": "1536:FTqlDUWNxwYyqIKjtY0jBlmiEyyX4K3egLsmZDcNOoddipqx:xqVUzY5Ys9EltvsmZDAzuox", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637961862, "uuid": "ad603d01-f697-40fc-b9ed-d940b8c0d3d9", "value": 110592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637961862, "uuid": "1133355b-ca78-41d4-9ea6-4263b4aec093", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961862, "uuid": "38aa3e67-f4dc-4da4-a66c-52752134d367", "value": "MV-SOOJUNG V.SJ-40326_YATSUSHIRO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8635b1e-4ef8-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637959176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959176, "uuid": "716ff69a-eef3-4588-8b67-56a2eea66eb0", "comment": "Malware payload (Heodo)", "value": "819700456f46a39770262bb94bae0cc4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959176, "uuid": "cbb70af3-9f61-44d0-b6ff-1efc937f8ab8", "comment": "Malware payload (Heodo)", "value": "3387eaf58a2b4f46a293949c50bb9d367feac546d13c31b489ab50cc904ee417", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959176, "uuid": "73255f2f-e02a-4011-8160-ababe1481e59", "comment": "Malware payload (Heodo)", "value": "59a80f27d2d4c4da9b15f5e786e7d12eb9f23d8d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959176, "uuid": "60be56d4-ec86-4514-b2e3-db48d6544af1", "comment": "Malware payload (Heodo)", "value": "95f739612b30197c2ea1aaffc2bc44d9de6f8690a980c5f2580b77bac8c583570aea0fc62d23f141f0fd7a35aac60f8e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959176, "uuid": "ca64375c-c927-442b-b661-f38a830decf5", "value": "T1F3E4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959176, "uuid": "f5630676-9f33-47ee-9c90-1147a983cb1c", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959176, "uuid": "6de06318-2624-4840-baed-4ad9763c591b", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhxico09cDlB4Vx/ID:0uH0GCNeQfi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637959176, "uuid": "932ca5e8-3d51-4fd7-9e47-c23f14732549", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637959176, "uuid": "3bde1d7f-933b-41c2-9e53-d7de82b9b3bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959176, "uuid": "42c9178a-18bc-454e-a878-593629836ce5", "value": "819700456f46a39770262bb94bae0cc4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "406232b2-4e97-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637917206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917206, "uuid": "a6e280cd-4fe3-4bf4-9550-0c562cbc7df0", "comment": "Malware payload (Heodo)", "value": "358676b3cb1c8c3050238684232d0be4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917206, "uuid": "4542dffc-89ac-439b-b2da-83e0eaa1524c", "comment": "Malware payload (Heodo)", "value": "33b765655f21583750a5b1bb6800e72b4999245b83720e314ff59150a1fe5d48", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917206, "uuid": "a27628cc-eab4-4223-bae6-ba79e46af54f", "comment": "Malware payload (Heodo)", "value": "52c0ad849328fa5fef1c43abb04c28eac6fbf482", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917206, "uuid": "baadc8cc-1bc2-427d-8c70-13f2dd925e45", "comment": "Malware payload (Heodo)", "value": "ab2ae2d525ffaf67b2a463514ccd42a17b13797991e05d95d9da58f29b8aab251cd41e21a6465888cda9bb5043f094f5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917206, "uuid": "7a431ef4-e9c4-4f02-bc78-f6d77826457e", "value": "T1B3A4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917206, "uuid": "e41aa904-c961-4c28-8fb8-2cc5d0363ed3", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917206, "uuid": "960205cd-551b-4ce8-afd6-461ca78ad16a", "value": "12288:o4xZ0/tI1BD2LETv0FhjO9U6W8XUDaBN7a1vt:oED2LETvMxb6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637917206, "uuid": "da874aaf-778b-46b9-a0cb-0481f662ab26", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637917206, "uuid": "1a56f057-e072-4d5f-a5ba-14e53e82961c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917206, "uuid": "d08f0692-29b1-47c0-81d8-109e54bbb30f", "value": "Emotet_n1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aed4efc7-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (DarkComet)", "timestamp": 1637918680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918680, "uuid": "ea323ffe-e640-4f3c-b2cf-1e376195d4aa", "comment": "Malware payload (DarkComet)", "value": "96869d0910a187a01b92d17d14de1b40", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918680, "uuid": "c6cb538d-ed39-40c4-b51d-786232a71798", "comment": "Malware payload (DarkComet)", "value": "34198a7c08e6044408a178520c73a34a9d696a46ed36db793ec681b5ecb3b86b", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918680, "uuid": "65be84db-478b-4c5a-a4be-5443cb7bfd6d", "comment": "Malware payload (DarkComet)", "value": "f0170466220a460fdd5c4b77c956c672e38f7bb0", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918680, "uuid": "7f1486b3-056f-416b-8f67-f27afe33040a", "comment": "Malware payload (DarkComet)", "value": "468aa75c6cbf1a68ca21e2874b53763e8b31e2a5dd59a6af1e159dfb7ef281b76e725d24a6ceca7284ca15b9e209353b", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918680, "uuid": "ae9ffdac-4ee6-47b6-b550-7cda96badc03", "value": "T162063343368C413AD47033F065BDA2831B68BCB34675974970B4724A49B7463DEBBBAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918680, "uuid": "c7fd045f-f0f2-402a-a8d7-5b891fb517d5", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918680, "uuid": "883e7511-2c93-47d7-a507-c343b92d985a", "value": "98304:Gviz/27qWGq/TzuqCDl2Ptao7jYGaCldR57UNa:Gviq75/TzufTmRGNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918680, "uuid": "519a145f-d4fb-48f2-9234-a752d069cbdc", "value": 4011008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918680, "uuid": "bc5824f1-56ec-48b5-be39-061c33f2de51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918680, "uuid": "06fb9a60-0406-4fa1-a6eb-0a70ba8659df", "value": "34198a7c08e6044408a178520c73a34a9d696a46ed36db793ec681b5ecb3b86b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92f52d01-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637931089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931089, "uuid": "99e2f4fd-2502-4940-98c5-871cd30bf8ff", "comment": "Malware payload (Formbook)", "value": "ccd3033369c99ff56f71d9d8e3aa80e6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931089, "uuid": "6bcde0cb-73e6-4c41-ae8c-2f9534d8dadd", "comment": "Malware payload (Formbook)", "value": "34443c2f4cf165f96c3eaffb93f2a7b3628ebed8ed119b3ef2ad3e5dc450e0a0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931089, "uuid": "2ac8e974-03fd-42bd-a141-e2447a5e39cc", "comment": "Malware payload (Formbook)", "value": "bc325d0a1cfdfccb5816b8fb9f77fef0b9493da4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931089, "uuid": "c521051f-8f88-4faa-810d-15ad5bf8b94d", "comment": "Malware payload (Formbook)", "value": "d293697493b4a81d032c121f62da665515d5469bdeca25fee680652fcc22e392ac7c5d8a7363624aca35348fa4b7197c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931089, "uuid": "bd01d680-9915-4f32-a4c2-eaf4fc740237", "value": "T1A8F48DD5A7604637D876A1FEFC1A0278493A3D113D3094893FD85E0C0F3D992EB5AA6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931089, "uuid": "7f43179b-380b-4b64-9fb8-f1c23c25c46a", "value": "d5a5a85102968ed0997ce91809ca5aad", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931089, "uuid": "c5290963-4e87-4515-9590-b21ce50ee7c3", "value": "12288:wTDxfHlE1XHBC/qo3R7HaZRZEBTV3bXyRfwUCm0gRS+:w3RFIHBCN3hHWeBTcFcH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931089, "uuid": "96322836-0868-495b-93dc-0d33f1084e9e", "value": 731136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931089, "uuid": "9954f225-74b9-46f9-97e3-bb90baa27373", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931089, "uuid": "b2642817-e80e-4c82-9631-12f976ffbe9d", "value": "Confirmacion del pedido.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1dec3cf-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637919115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919115, "uuid": "a543f721-d5a0-44b7-a7dc-6e066c75ffac", "comment": "Malware payload (Dridex)", "value": "4a053f11069bec3a06df7a99d9869728", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919115, "uuid": "8d6bbc78-10db-4d47-9f3a-edef8cdeef53", "comment": "Malware payload (Dridex)", "value": "34b87ca49b68d8e9f165cba7fbdd47c091619ea7f81eef67464419367a63e7a6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919115, "uuid": "48d9d700-2733-4eba-8b26-13018018cfc7", "comment": "Malware payload (Dridex)", "value": "57eae9d729bd6b6d1f838a3cbbcbd89e8d1bc325", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919115, "uuid": "1e687004-ddd0-4f81-9419-6d5ea5dd200e", "comment": "Malware payload (Dridex)", "value": "9bc4a6f81f48bcedc275722df6853619aaf21681b78dc2e2f2617cb465c5a04b211f57e1dbe7057ecf3941c6bbbf8cb1", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919115, "uuid": "a2c88ec6-69e8-4a87-87b1-f711a0dc3bd2", "value": "T13E45E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919115, "uuid": "82230e50-fea4-4809-908f-1e3489f95825", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919115, "uuid": "9a9bd3e6-1ad6-41bc-b8fe-bc4f43803eaf", "value": "12288:ZZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:ZZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919115, "uuid": "24a92b46-2c6e-439a-bcaa-c1a2016e72c4", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919115, "uuid": "6b526d43-203e-4051-b17f-f6030a48db9a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919115, "uuid": "5479034c-ead7-4865-92db-5608ee1c48b3", "value": "34b87ca49b68d8e9f165cba7fbdd47c091619ea7f81eef67464419367a63e7a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce5fb0d7-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918733, "uuid": "029f13cb-6f65-40e1-bb09-534e69542bf1", "comment": "Malware payload (Dridex)", "value": "f17489e5825eb3807e527ec6186380a9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918733, "uuid": "361f3847-5665-43b2-a014-68d56163e4f1", "comment": "Malware payload (Dridex)", "value": "34e4dd4f79639ebda6d63dd10e01d559439611fcc4c79151f947bff810dfd722", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918733, "uuid": "6725e0f6-b453-45d8-85ec-47256b43bfa7", "comment": "Malware payload (Dridex)", "value": "ae23c9f0a5685c28a0d7169d9ef037b42c6f04c4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918733, "uuid": "51ed7c07-58b7-46f4-b52b-a41dfe952ac8", "comment": "Malware payload (Dridex)", "value": "7aaa7cf0a00545b0cf46f096f002fe95989b2b0c4672bc9ef70cf50f06a8b55f95f01fb64eeabcfd4524e8a54e8649c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918733, "uuid": "1bd42c74-bd8a-4f39-bc38-ead26b959869", "value": "T1AA75E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918733, "uuid": "6c470a95-1387-48e2-8a67-57a05bc4db39", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918733, "uuid": "9f36f5cd-c40f-4221-a3bb-fc176ec746c0", "value": "12288:eZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:eZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918733, "uuid": "ddd80139-688b-43e3-9406-4b7f099defa6", "value": 1609728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918733, "uuid": "53253d7f-e718-4773-a9f7-73c1dd0c8f3a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918733, "uuid": "463daef1-b68a-4fa4-b141-ee0cf78ac1ab", "value": "34e4dd4f79639ebda6d63dd10e01d559439611fcc4c79151f947bff810dfd722", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "daae21dc-4ed0-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637941947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941947, "uuid": "46c416f1-7425-4323-accb-9eed82ec62b1", "comment": "Malware payload (Heodo)", "value": "2bc9f8fe65659f0959a902a378d9759a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941947, "uuid": "c7216830-7f0e-4448-a00e-c6ee7953a727", "comment": "Malware payload (Heodo)", "value": "351b0ac748540ae1e3c1325737e46f860ce97f96aa7b73e261d26a3e64fe2d8a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941947, "uuid": "7f584bfd-fd50-447f-a72c-0e83660a5423", "comment": "Malware payload (Heodo)", "value": "8453256e201d2041ad9404723ea65fe2a3268681", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941947, "uuid": "3fac09a4-90f9-4bb5-93c5-af23d90f2b90", "comment": "Malware payload (Heodo)", "value": "b678f26415b3de6586be93aa5e2a1b2a390eb475276e2069d67174938fa273f5e3cb56408d5ba2aa9d67035c4da543c4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941947, "uuid": "f36c80c6-b0a3-4468-a9ac-c0e5a8ac90e0", "value": "T1DA92B0BAD14EA5F6E33F87BB04D6D3EAA707101011024BD839D222FFEDCB58B6061665", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941947, "uuid": "84c61b26-5eb7-4769-9c06-5c7006201d68", "value": "384:4Y7An3iXC6B/MFQQweXtfDCwGZ+UeFYu4bnGHexRh4ZU8xbc:hA38B/JQdXtfXUealnYG+y8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637941947, "uuid": "78592f20-6c30-4aef-a330-b67e614f68cc", "value": 19858, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637941947, "uuid": "58db2d7c-666e-47de-86b1-515f82b79cb7", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941947, "uuid": "21a78dc9-69c3-4bc8-8ba3-30d5cb23267b", "value": "emotet_e4_351b0ac748540ae1e3c1325737e46f860ce97f96aa7b73e261d26a3e64fe2d8a.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cad4d7eb-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637954375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954375, "uuid": "b34914f8-c368-47ab-b333-7397c794b7ab", "comment": "Malware payload", "value": "ee576c31b907cb964a5659590a0a7626", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954375, "uuid": "cb4561dc-53a3-41cb-9504-293a4e74ad96", "comment": "Malware payload", "value": "353f48b8aa95565135382bc598d07d779b449831cbb6df47476735d0586e68cf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954375, "uuid": "176ef1a6-15c6-458e-b001-198fd5c4dd05", "comment": "Malware payload", "value": "955bb6bb362fbf0ef168432bcec733cdcd5eec91", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954375, "uuid": "3ff0351f-be2c-4ffe-8261-55248bc31a8e", "comment": "Malware payload", "value": "994127fbbfb131d26736b01162981129d4516d69172a33099e0fa83f355dfaa4be5820f097e3581aa7b58d5718ac1944", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954375, "uuid": "58ca7191-ec29-455c-b7b6-90d509f8cb91", "value": "T182E53383AB07B3D4D5103EB4BDE04D77752BFAEE03C2BB56A435895E841D78A1684E23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954375, "uuid": "0b0fdd0a-78f0-460c-8b8d-a5c826a1f3b9", "value": "14f114a2dc25b2164d3e700770328075", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954375, "uuid": "ed51537c-4b3e-4cca-ac54-c84a9e2c00ed", "value": "98304:4hjELhIhuNcqDwJWx9n5jbLju8at9jN1sntu2n:4BELhlhwJW3n5vLj2t9jN1zu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954375, "uuid": "c40e5945-d228-4fc1-8d5a-d4203745f3e9", "value": 3170351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954375, "uuid": "44d1a913-8be6-47cb-94ef-290a3c8686af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954375, "uuid": "690bfff4-7cd6-4799-aebe-9f6d5e4df303", "value": "ee576c31b907cb964a5659590a0a7626.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dad524f-4e9c-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1637919403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919403, "uuid": "5d4e57bd-e155-4413-a4d6-36e3b71c7d0a", "comment": "Malware payload (STRRAT)", "value": "77db2f319d04e818ea3cec372de8e657", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919403, "uuid": "e4077422-7c3f-46bf-8b98-6e29db105dea", "comment": "Malware payload (STRRAT)", "value": "355a0daf44a77b2bf4d53b37f56509e95727ee32df5a438e65dd9b9f36528595", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919403, "uuid": "d439fbce-d8cc-449b-a350-fe1a3960798b", "comment": "Malware payload (STRRAT)", "value": "bc23003e35aecb56a80db15c152d864eeb8de678", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919403, "uuid": "d4cd7f02-3a4c-4115-9486-dcdde6028a4c", "comment": "Malware payload (STRRAT)", "value": "6d85d6edb2a07b5fce8e43bb5899e9be01b102b9d64991af1b3ebf59ac23faf37fce15b426fd37f42a0d04f131340e0e", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919403, "uuid": "63a1136c-f5c0-4ba3-87aa-7ff6f70ab89e", "value": "T1A304CFE17A844A66BC1C670480B6D59B82B0343E987C119D7D3DFE5ADBA33C27431B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919403, "uuid": "86838b35-1dcd-4938-9862-b3c3e40775f4", "value": "3072:cOOfkGXrByMDPEKfnc9hgBvXbff7dD53EIAhuTipBz:UzEMD8KAhgB/bN53JAwTYz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919403, "uuid": "22ad5e23-5b86-44a9-8823-42ed073dc971", "value": 187035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919403, "uuid": "1e810fa7-2eb8-4e56-ac90-fdc37c42c509", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919403, "uuid": "16939e52-e1b4-4048-803c-63c9a861cb1e", "value": "Purchase Order.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f906493-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931110, "uuid": "ec2eab61-d7d5-419a-80d2-45b9c188f9a7", "comment": "Malware payload (Dridex)", "value": "045ebed775a6dad54d48bfdde47b812b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931110, "uuid": "aa02a325-f9c3-47c6-8fe7-f9d884287021", "comment": "Malware payload (Dridex)", "value": "357c76fad5daf79e95a844b192314705de52d00dbe96457ca7bbe1fba62c0f77", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931110, "uuid": "6cd39df3-e6d1-470b-a7cf-944c8bc7a510", "comment": "Malware payload (Dridex)", "value": "e43cb73a1730ac45bdff6c42047fe8be40ec8eb8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931110, "uuid": "6dc32638-5a30-4894-8ba1-d2e2746b0868", "comment": "Malware payload (Dridex)", "value": "a45dc560264782dde5a3cee81bc97868feafe1c36f0afa4ca8928f06298e2838f3c797c485a5f7ed5b2825685bb4b60b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931110, "uuid": "9c02937a-dd1c-4668-be26-f018e5b70cea", "value": "T18963F1AEC2C0F42BC312DE7EDB269CE2920A196375858A5B14DEB71C3FE73474B99014", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931110, "uuid": "f2a6a0bf-1e72-424c-9e73-b59ececa4c6b", "value": "1536:UWdPuALLImemeKHqeK7YncwIFu7Mw0622AxJa8uwgdDjW:VU80XKUYUu7M2YxICgd/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931110, "uuid": "f0b8d93a-c771-4ee5-be0f-b6b590817c7e", "value": 68625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931110, "uuid": "0a1eb0c4-23f3-4514-bd96-8716aedebaaf", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931110, "uuid": "3858aa0e-a33e-45cf-b07d-4ba8d03c5c98", "value": "promo code 63589.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9d950bb-4ec3-11ec-843c-42010a9c0014", "comment": "Malware payload (FluBot)", "timestamp": 1637936389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936389, "uuid": "52feacbd-e19e-49e9-a01e-33105752a251", "comment": "Malware payload (FluBot)", "value": "5e3fb4a6f144335016f5d0773b0113fd", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936389, "uuid": "f4f5215e-6414-42f5-b8d4-55b18fc48659", "comment": "Malware payload (FluBot)", "value": "36158735c5442bb6a2f5432226403905551f360d7ce99fa51e9d2b54b7cd02e7", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936389, "uuid": "d5a5b392-9290-44f7-82da-75f08d1b414f", "comment": "Malware payload (FluBot)", "value": "1a555e9e7f65ebe7ab2c6a48e126c63bb38e7612", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936389, "uuid": "882f7927-0bd2-42eb-910e-c337459c24cd", "comment": "Malware payload (FluBot)", "value": "09ae8d1445e9b77a103ce1aaaef968c08fd072348d64d79662300afb10674de67e662c2c70de5138d2e0ba5c9df94418", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936389, "uuid": "cefa9de7-1e8d-4375-825f-ee838ec89e22", "value": "T1C8362329BDAED156D003E435C171E98B8908609C2D64F51F2636BC4DCEBAC839B56FCE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936389, "uuid": "ff16f963-5ff3-42bf-bdb4-310f38a0f525", "value": "98304:jBtJvromXxeDvU83t4q7fE7NhOa071d2mXD3rXKZsVWR3W3PXclK2NJ3w:jpromX4QCt48sObdi+V63YsU2Ntw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637936389, "uuid": "17286209-6a6d-48fe-a822-7dee9d9a547c", "value": 5259300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637936389, "uuid": "783d6a8a-e529-412d-a923-7e38fcdbea1a", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936389, "uuid": "bef091ae-b21b-4055-b56e-661abcd36137", "value": "Voicemail52.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17afe8ac-4ed6-11ec-843c-42010a9c0014", "comment": "Malware payload (GuLoader)", "timestamp": 1637944196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944196, "uuid": "29519652-e9bb-43b7-b98d-7f01a9f24a8a", "comment": "Malware payload (GuLoader)", "value": "06adc33905e8fa1cb75048a05121e850", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944196, "uuid": "a0808c3e-f93b-4b39-a20b-352329a13e66", "comment": "Malware payload (GuLoader)", "value": "3969849500b4456d9b648eeaf3f471fcbfeea14e323d3db643fc628b9ee2a586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944196, "uuid": "438de89a-37db-4b4d-adf9-e3d3a18a3bd0", "comment": "Malware payload (GuLoader)", "value": "586c543e7d41322f4cc17d15b9970444bd736b80", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944196, "uuid": "d145e9ff-cb76-49e5-82a6-f1b81f6e67fa", "comment": "Malware payload (GuLoader)", "value": "5ad49ab2ef90c183d83ddd8f7751dd65b414203ba399c555a0683ac0f7ebbb3014b725b9ac2f4b2720ba2f56c8c94301", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944196, "uuid": "360c4eb2-2406-49d6-8238-e87ccd02d02e", "value": "T128D35A377A53B8ADF1278DF2C27859E400517D313389E54BAEC0369B2A779CE925D382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944196, "uuid": "24154f37-d037-4ec6-bd56-5fa1134c46ba", "value": "d77040f4614bccfda7b8aa2e04863738", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944196, "uuid": "a4edf5f9-486b-47be-8bbc-cab33b105aa5", "value": "1536:t1DsyiTOKIPdprbrHGqw/v4EBc9wNSTFnoFAD:t1ETOVVprE/v4kyooiA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637944196, "uuid": "ce764296-ab67-4abd-9413-981469c9cd0e", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637944196, "uuid": "568e27a1-ef79-4e01-9d17-b85bfa9b9f63", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944196, "uuid": "bfbd0723-4040-4ff9-acf1-1195799e6b69", "value": "SPREADBOARD.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "637f80d8-4ee6-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1637951196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951196, "uuid": "0cab255b-38d4-408b-a455-60229b56f98b", "comment": "Malware payload (GCleaner)", "value": "590f1f37bd82f3e99c0fbd0667b07dc6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951196, "uuid": "d2f9374c-7599-44ae-b507-b4706f80a12a", "comment": "Malware payload (GCleaner)", "value": "3a227b8e84722b577247b94618314f2ff02a48a2f984c32391717a68df894586", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951196, "uuid": "6d495077-f3b3-4bd0-b6cc-dd52b6895d06", "comment": "Malware payload (GCleaner)", "value": "89a1629bfdc1cbbc52432c463aa9b6a1bbb443cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951196, "uuid": "c586d5ad-a560-4f48-b908-c68b7194277d", "comment": "Malware payload (GCleaner)", "value": "78468d54638c46de79b84daa153aeea601272d20316c216ffad392115348dd3a11591da01de7d9aa90ec425f8243e117", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951196, "uuid": "f28a3bae-d145-4f1b-a1e9-1bc999c264c2", "value": "T1855633007D906679D803A376876CFFB6A2BE53B6063149971790DF8FC730A16922D29F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951196, "uuid": "3e8f6500-d596-494c-8319-82f32736e951", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951196, "uuid": "4d74e753-ef87-44bb-9f4d-dfb9debc3464", "value": "98304:xHCvLUBsgkc+5i51ilISSHHEunrhkhc1f0CnzcM8sOsTwvwZZXfVCbNwsc0nSW:xkLUCgBjW3KEimhm5nwMZOsTWwcnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637951196, "uuid": "4b903cfe-0f93-4884-af7a-717faaf2e674", "value": 5890059, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637951196, "uuid": "c59d7e0a-4f04-4e2f-802d-7579af9232f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951196, "uuid": "16c8b181-3487-43af-a09b-f2d165e54473", "value": "3A227B8E84722B577247B94618314F2FF02A48A2F984C.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c483dfe-4f13-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637970403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637970403, "uuid": "1b285162-5062-42b3-894a-1cf055925c16", "comment": "Malware payload (RaccoonStealer)", "value": "7ffdebad8136a386aa586f7d3e97e935", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637970403, "uuid": "14a87692-51c5-4725-a7d4-2fe22d65c26d", "comment": "Malware payload (RaccoonStealer)", "value": "3a3032f28b080be56626c4ff6c345fe83457e4148644026b4899e6aead5bd570", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637970403, "uuid": "a0c8b0e8-68fb-4ba9-a727-258972880eac", "comment": "Malware payload (RaccoonStealer)", "value": "acf27bafcf55b0bcc9eb2299234aff9a64f41570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637970403, "uuid": "9a33864a-a3ab-4722-a857-a62062e89eae", "comment": "Malware payload (RaccoonStealer)", "value": "fb9d7ab58d0a51fee4f6df39dcda54d5345149bbdf7fec9ac3cc80d87814b3d27f3959b2f926c4fe915e2fd2cafe696d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637970403, "uuid": "56ecb9bd-c6a9-46ea-94ac-502202d1834b", "value": "T1A6B3F9C5FA246B91EC3993F10432D93157A27C3EA570E64C2DCA3EEB3ABBB515811943", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637970403, "uuid": "c1a6b8c4-7bde-4b20-8996-f6093836773d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637970403, "uuid": "46be0450-e867-46bd-8baa-edd8733ae817", "value": "768:D394Umm/LcbEx5zq5xGfb/T9Mynk70FqY5lnmknjDzbj8rckuRU82rXyFrZ4CYjg:VjK82r6cCCzECtOkWMi4O+0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637970403, "uuid": "e59ec184-bd1a-4f63-a4af-c33bb2a2c944", "value": 116224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637970403, "uuid": "73278008-bc6a-4e83-9d36-372d55b4365e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637970403, "uuid": "ad2e90db-35cd-4a01-bf9d-8974840d20ab", "value": "7ffdebad8136a386aa586f7d3e97e935.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ea357c4-4ebb-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637932826, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932826, "uuid": "4a790528-1656-4f90-9096-e08346a441f0", "comment": "Malware payload (Heodo)", "value": "a5a4760871dc315a6ca232182bfe18f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932826, "uuid": "addb1d2f-2a5e-43bb-92b0-2e15c9ad7b60", "comment": "Malware payload (Heodo)", "value": "3ac4707434bf8a0d54c1daa7a034b4eea681c268b4e86a0866915a17db878f72", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932826, "uuid": "b8740888-508f-4ea0-9be4-4d337e2e0b6c", "comment": "Malware payload (Heodo)", "value": "b12a7b4f3b1f13c9d28b46ac4117caeba22da458", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932826, "uuid": "554c054e-aaab-434b-8a01-d7f5b5432d2e", "comment": "Malware payload (Heodo)", "value": "d47fbd44de51081ce80ba129cbcb31198404c5e11b39f0c8715beb571274ab958cb9bb1229a5d709205021c4acfad241", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932826, "uuid": "9376c280-c2f7-493e-8536-f8ea11d9a19f", "value": "T1FEA4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932826, "uuid": "73132d7c-c092-4256-8ee1-0f46ceacf77f", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932826, "uuid": "9dd405e4-fd32-4b44-a1d2-388531108409", "value": "12288:o4xZ0/tI1BD2LETv0FhCO9U6W8XUDaBN7a1vt:oED2LETvMob6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637932826, "uuid": "658ce415-0734-477c-abf7-36e6a975cad8", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637932826, "uuid": "8533453d-f8d3-49b1-8546-f2c74a4547c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932826, "uuid": "aa1ee6db-954a-472f-965e-97987b400e41", "value": "a5a4760871dc315a6ca232182bfe18f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97350b2f-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931096, "uuid": "7d91f5a2-cb3b-45ad-adb4-90148b64b7fa", "comment": "Malware payload (Dridex)", "value": "82ad03df6915fba52fe788dbc0d26eaf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931096, "uuid": "294432c8-9047-4988-97fc-63ec7cd0bd27", "comment": "Malware payload (Dridex)", "value": "3ada0070c21d2b1cca9a6d2facd947f358fcaada940a1b2ae7fac03a783d52d6", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931096, "uuid": "f7dbdbf6-6833-47f2-8d3d-5412d39a5b8e", "comment": "Malware payload (Dridex)", "value": "0a5b2842b311cde7d912c616181c54a249424588", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931096, "uuid": "e3938a6b-cf06-4551-8184-3d306a09edca", "comment": "Malware payload (Dridex)", "value": "a4c224e98dd3cc8b05fcc1de9d7bff1d7f22d3affe8f494b98740b7df5eba03a8f9374bac26f248389071ecac4d3a0c2", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931096, "uuid": "b381b225-a234-4f54-b5df-0a6908c86ea6", "value": "T10493022ED4DA7819C1E280BFCA8934F64932050E5447FE3F69BD5278076608FAB9D26D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931096, "uuid": "40415456-8f32-4a46-806d-5c6170177050", "value": "1536:UWcPFFxgFzx5YVqHS2YzayhpSW4vHR05Q4r5UZKUbjitdLhiEUegdoL:VfFzIsj8aipSW4vHREQ4iZKUbjivLIeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931096, "uuid": "02cea419-1a17-4ccb-881b-89c3716ab0f4", "value": 91210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931096, "uuid": "4c08d07f-fca6-4fe1-9f55-08c737d973c7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931096, "uuid": "0b9d2edb-697f-4f90-9c3d-2e205d78bfc5", "value": "Netflix coupon_871552.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d39e128c-4ea8-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637924755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637924755, "uuid": "aad847e4-6708-46b9-b2ba-592e8750e734", "comment": "Malware payload (Heodo)", "value": "0113ca70335f7ca2c44f603414c608d1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637924755, "uuid": "30dd67a8-b542-49fb-80fa-4af98ab01584", "comment": "Malware payload (Heodo)", "value": "3b64870f16c8f509088810bd1879ce87b94f16d7a3aeea0034f6a348632de1a3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637924755, "uuid": "44f345be-7655-434c-82f7-d53a5fa207e3", "comment": "Malware payload (Heodo)", "value": "62b14d39f986efecc5bd5bc18f796206394caadb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637924755, "uuid": "40dd5177-8aab-4bd9-907c-794b35195ad0", "comment": "Malware payload (Heodo)", "value": "7446ced05a6c524f717d3004033b0ddc78bddf2ef13091c4ba26e9638af599fa07b31669e9b1a883b82eebc293790499", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637924755, "uuid": "cf7854bf-d718-44c8-8677-455817759abe", "value": "T11003BE1EC251F9ECD23AD93A81D849A5521E2E105042B94D2580B58CEF7B2FF6BDF358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637924755, "uuid": "2c070b52-23b3-4150-b53b-5c99ee4eff02", "value": "768:+/I83GhApRrjevZCwVIYgBZVWpf/wak8y0VItKF:+nKAbIIjkpw78XVIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637924755, "uuid": "b698a076-f331-4750-b67c-7b34b743a518", "value": 37994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637924755, "uuid": "722392a5-d5a3-4df9-9f97-827c8f146604", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637924755, "uuid": "adf88238-2f5d-4a62-99c7-038dbb15a864", "value": "check copy.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5eb87d53-4ec5-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637937014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637937014, "uuid": "93a804d9-c1ec-4624-84db-9c4f5abb38fc", "comment": "Malware payload", "value": "6731a64261321a8bb487ca75300f8f52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637937014, "uuid": "453077cd-c986-483c-bffb-2dd3c90ed0d6", "comment": "Malware payload", "value": "3b791d58083b7a958b8497c956803b0c1504d0f8ca974f124f45ae8976b16a40", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637937014, "uuid": "7dba385c-645c-4243-987a-d49bc3ba3319", "comment": "Malware payload", "value": "2dd973be0f0176558012e5aa4495ac3946735e9e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637937014, "uuid": "9e9aa814-5f7c-446b-bcdd-21bf665758aa", "comment": "Malware payload", "value": "65753c75385db4ed24f2aa5e63e520f4a4823ea5538fb4e336b2e8abb3af04c6505d49ffcd549b92ecb727162f2ae5c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637937014, "uuid": "e13c1b18-03ea-4e17-b767-3fd63bc40729", "value": "T16EA4DF97356893F2D53C4BB3BE03A41E17B22DB49921D2486ED3F2C72471B214E61AB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637937014, "uuid": "5d8b8b54-9023-4eb8-b220-044fe102ed4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637937014, "uuid": "01b916f5-a0be-4f35-84a4-191170a34eb7", "value": "12288:toL77JkjfAcGRaYGObzfJufRUoG5ReyixBFm:KHaLSkYGWzfYe1Reyi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637937014, "uuid": "86916863-a61f-4226-a75c-df15b8e2ca2c", "value": 483840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637937014, "uuid": "d78696fd-f18b-4f18-8f0b-a7d5d1bc41c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637937014, "uuid": "ec81dbb3-fd69-4458-9c4e-1a96473f4f84", "value": "PO-ZC927X1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a144cb7a-4ee3-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637950011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950011, "uuid": "838c9efb-89f0-4f80-9e9e-73eb7d9b1119", "comment": "Malware payload (NanoCore)", "value": "8bb29e0e7904fc78b3af0378c1d8d7c3", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950011, "uuid": "73bb764e-2b4a-4da4-bf01-bcfec9607872", "comment": "Malware payload (NanoCore)", "value": "3b82f48feede3ee5878f03d3ec21a4e5e4f7b81ff84b0d9ed98510a9c7a0359f", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950011, "uuid": "dcc9b9a9-616d-44f4-85e6-b62415f827a4", "comment": "Malware payload (NanoCore)", "value": "2af4be08a7f28fd7a7e98672c3256ded38706750", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950011, "uuid": "0e3575c0-41c0-4d62-a7fb-09a9843309ce", "comment": "Malware payload (NanoCore)", "value": "9a68b149cf43bbf7e5c178e46101587006b60235615bbe2a8654758fcac81dd3ec550b942758ab7cdc2b6651bd57984c", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950011, "uuid": "09019a5c-be74-4a44-a396-9c89850bcf5b", "value": "T18E31CC3DFE2765960D31E92D93AE1EE3CCAC4407CFB0E531619943898A72876299C07F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950011, "uuid": "129c7855-a65a-48d6-a33c-a435ff86033e", "value": "24:p4OtGAKvzjepfMWPnENxASMVQ6xV3cJeWB23LV7ANAtGApaAdZJA4yoQNAx4hfLt:egG/vWpMXnALxsJDIZ48Gdq9ce4hfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637950011, "uuid": "2ccbc6b4-683d-4447-a1e9-47a32eb74dfc", "value": 1510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637950011, "uuid": "2ff01519-ce9a-47f7-80a0-f8735278e7d9", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950011, "uuid": "d801451e-8602-408e-9cfd-d7b0c387d29c", "value": "719282_Payment_Receipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be6278d2-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637921713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921713, "uuid": "0a5296ce-e964-4945-872e-27aca4412763", "comment": "Malware payload", "value": "2e2570bcaaab11eda2ae6e239af96e22", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921713, "uuid": "0ec88304-a610-43cc-8524-aee0e6c9ab1b", "comment": "Malware payload", "value": "3b8329b3a23aff1e80f43ba79b8f1f8724180659e60f960340b7b37cd7a65d76", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921713, "uuid": "21982b79-5fc1-4cd5-82c3-b6a1aa063565", "comment": "Malware payload", "value": "dba38e016700624371e24316bc9b32e4d7fb76b5", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921713, "uuid": "a3a3d9b0-5068-4c82-8780-c79445ebe544", "comment": "Malware payload", "value": "3d827a0451bbce715cf47369db7588874faa1a88c4f6f59b01c2a1394cf300fe4ce09397afd15c2c14c67dc46338adc3", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921713, "uuid": "b228156b-04b4-4598-99fd-a845de059d42", "value": "T103341229FBE291F3C9D097B1EE1E72DD9354FE195664CE4320A1F5E93733980013AA1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921713, "uuid": "611239be-79ba-48bc-bc44-69da88c8883f", "value": "6144:pEUyGlnTKOVSbMbatur46MFsqpL5cyXhrydTV2s9e3B2sk:WUyWVNOG46SLZRmdo/3B2sk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921713, "uuid": "03e7d53d-8b09-470f-a8a6-e30a4611c7da", "value": 234616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921713, "uuid": "1d373d45-2bb7-4d5f-94e7-ce1e46aa0284", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921713, "uuid": "7520bef6-1a95-44ae-a490-1d2791632c63", "value": "Draft shipping docs 08798.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee140efa-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918786, "uuid": "fcd811e5-eb73-43d2-b09d-fc310b419874", "comment": "Malware payload (Dridex)", "value": "d69796752faea68d9010a9671045e0b9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918786, "uuid": "8cadfd2d-1603-4cb6-b2e5-7d9e03cd1198", "comment": "Malware payload (Dridex)", "value": "3b855a23e994dea8c214afcbb01123d1317ec701166de6b77d8b3f0c1125698e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918786, "uuid": "eda741c9-8c80-48e2-ac55-7115b5db8654", "comment": "Malware payload (Dridex)", "value": "1e24007994f3d530bbf2fb05ecd42e9c4b40a63e", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918786, "uuid": "80dc89f0-0d88-427d-a137-7993f769c3a0", "comment": "Malware payload (Dridex)", "value": "6f9474d60559ceb5e35afb864fdf2c798c99b683e3991c0a729d2beebc14f73ede253211d23fae0a86cf52afaf892c85", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918786, "uuid": "8138e2ab-68b3-4399-9551-b3ed95b16118", "value": "T197657C02FBF30783C48DF639B8AD1400E1B3E745C96F8B1D455F132AA892B963D5A59B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918786, "uuid": "3b41bc5f-18f5-48bc-9b23-2fc4e5fb2235", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918786, "uuid": "bceac329-8898-47ad-ab8a-d31d226e0baa", "value": "12288:NZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuwYZZ:NZK6F7nVeRmDFJivohZFV+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918786, "uuid": "93e55a3d-4eb5-48df-b38e-a04848f80ea5", "value": 1433600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918786, "uuid": "27d83857-87da-4ad3-96ab-eb3418928bef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918786, "uuid": "328368e4-34ec-4c54-88cf-9226147f9d5f", "value": "3b855a23e994dea8c214afcbb01123d1317ec701166de6b77d8b3f0c1125698e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65971230-4ed7-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637944757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944757, "uuid": "50f0957d-4163-4f8d-8eaf-7f16b4cbb61d", "comment": "Malware payload (RedLineStealer)", "value": "21cf69e39bd3a43d3301d019e9e1680f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944757, "uuid": "eb7055b7-1679-4687-bd4b-f559346bad5a", "comment": "Malware payload (RedLineStealer)", "value": "3b92d404ba9919276d5b8c1c70dbf1f791013d200c54055bad241816bd29307b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944757, "uuid": "3ce6cd89-c568-40bf-91a9-ed7959182733", "comment": "Malware payload (RedLineStealer)", "value": "85717132522d72c0c80c537e1daf63f0f6f76547", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944757, "uuid": "08dbad70-4d3f-41b4-a1b2-292b332e841a", "comment": "Malware payload (RedLineStealer)", "value": "4b645522e7bb20a543a9c50c1e370a1505b60c74a66eded2042526f9d374bf1a9c9c2e06ad656b151bbb19dbb479b314", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944757, "uuid": "8a7db6dc-9e51-4b98-b07b-cf52774780a6", "value": "T1775533FFD2C0D9C5CAC2D9F5682CCE99B7E60AE9ED080553F324E0EB89A0449D64716D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944757, "uuid": "74c2bf34-ea23-4f47-bae2-e8a321bc3074", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944757, "uuid": "dfc65178-2f13-41f6-a655-920d8bd504d4", "value": "24576:dymyQgsMkzrxh2lNH66wjTUkhJgmz38YkEaHNYK3fca+38:HbLPzuz664hJbzMYNaNo3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637944757, "uuid": "80875005-a682-4684-9673-a135eabeb759", "value": 1362800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637944757, "uuid": "222f62d4-24d9-4623-9ecc-6a30665a5c4c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944757, "uuid": "eb498de0-de80-4fa3-954f-9072f06622b8", "value": "Nexus Hack v0.2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20e89681-4ef8-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637958815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958815, "uuid": "62b0b421-ba39-4a7e-8b21-2e28312fce5a", "comment": "Malware payload (Heodo)", "value": "f440642e632d4ae9a9feca7a659ed204", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958815, "uuid": "3aaa9cd5-a538-46f4-8ef5-8b67b00c6008", "comment": "Malware payload (Heodo)", "value": "3c61f2e9b4fe1dee88fb0fa496f5d44f6f08e2efa1e84825eae016521902959a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958815, "uuid": "8eec7333-80f4-4bb0-8a47-027cc72c987d", "comment": "Malware payload (Heodo)", "value": "406c6c401dd6183dc1c22388b9a983565d865ae1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958815, "uuid": "2322e4ff-2777-448b-bd61-fc73b49c8f33", "comment": "Malware payload (Heodo)", "value": "88c9eab46e254bf46fc6c00acadec0a929fe8ac8d8f61df26be54b3439ee8f132adddaef8ada6123a06b760071ffac16", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958815, "uuid": "491eebbf-049f-44a7-8a3e-82db71fa61ea", "value": "T1DFE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958815, "uuid": "d354b3ee-43da-4136-a857-be8e3fa438a4", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958815, "uuid": "12a2772e-1d26-4b14-ab14-43eba688eb13", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhFico09cDlB4Vx/ID:0uH0GCNeQXi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637958815, "uuid": "510bd05d-606c-4876-bee2-d8fc61059bb4", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637958815, "uuid": "6bd7b0e6-6a10-45dc-8f86-015192bdbc86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958815, "uuid": "53a281a7-4e17-45f0-b4c1-8d84e4a554aa", "value": "f440642e632d4ae9a9feca7a659ed204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d23db308-4efc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637960830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960830, "uuid": "bf2e3072-6c7e-4a9d-a1f0-96b6bb34d95b", "comment": "Malware payload", "value": "1036ed7a9ab87062b22b3d47fa686e6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960830, "uuid": "05120b39-715d-405f-a930-b5bdfff46ea0", "comment": "Malware payload", "value": "3ccb921993ccaf52af063cfaae2e31df9101befd6553a5a4631367416116c412", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960830, "uuid": "a8ddce81-d5cf-4e27-b5ac-6c142744fe9d", "comment": "Malware payload", "value": "00ceb2cf8753bb0637db427622bd18359947284f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960830, "uuid": "cd529948-4094-4efb-8c09-dbbe5610b9fc", "comment": "Malware payload", "value": "d7456aadb7e15bb524dff31bf7cba2873101b7fe0758d1fd22ddbe47750e7b1ff1099b7d6fc71e4d0acb566bc10de512", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960830, "uuid": "b4b01b6f-5fc2-4b29-968b-05ba5baef30e", "value": "T1F74512022F98C446E4B13F70D82A4AF64B27FD60EDF4F58B2E427E0E3A315D16968756", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960830, "uuid": "2407e42d-d51e-41ab-b11a-795947cccc0d", "value": "0c76fb2e0afbbfa0f738c7edfe787366", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960830, "uuid": "ac69f582-7e85-48f6-a7a1-e0e7b7e30faa", "value": "24576:ok4sMizQfNz/L5vwEck5D3XETaqfgeKb8/09+Eb:okJMhROEtHETub1f", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637960830, "uuid": "7bd24db0-557c-4da7-81ef-d10397ae477d", "value": 1227424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637960830, "uuid": "56b72723-e37b-4e11-a44d-1734f8dc42d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960830, "uuid": "12edd77e-a980-4546-9e84-ccf6fa2c7fdb", "value": "1036ed7a9ab87062b22b3d47fa686e6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbb9331b-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637919131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919131, "uuid": "15a91c36-1493-4695-96e2-aea42a68d677", "comment": "Malware payload (Dridex)", "value": "93c7117d555fe4e4790b02958ddcee41", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919131, "uuid": "b65b31c8-834a-4ece-ac7e-a3f58761af3c", "comment": "Malware payload (Dridex)", "value": "3e01cc84e691f32494b07ecb3468cbb5d9c085488fe0a5b8110f80071fcaf180", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919131, "uuid": "f674ebc1-d6ef-4fdc-9337-3e2900a781e2", "comment": "Malware payload (Dridex)", "value": "d7eaacfdc572f9bcdb295eae11881fffe72b0a43", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919131, "uuid": "b6cb2774-4e94-435f-aa23-d70b010e2be2", "comment": "Malware payload (Dridex)", "value": "474fe2b5b87730b2213c774b81e239f9bee6335a88c0e27fa9a02b40f3c0437d2a720e182862b0e701017ef3dc50f183", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919131, "uuid": "4862a187-820c-4e7e-90f9-335028fd5450", "value": "T1AC45E002FF896FE6D9512DF695F0F2A3C5B4F9854F680329DA61441F9CA0ACEAC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919131, "uuid": "52df8821-272f-42ff-850e-456ce211ee26", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919131, "uuid": "8ef5cd50-0437-4256-aefe-4a3d352e11ae", "value": "12288:fZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuwhMh:fZK6F7nVeRmDFJivohZFVe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919131, "uuid": "fac6e5ee-0a72-4222-b42d-3c70e4991dea", "value": 1220608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919131, "uuid": "34cbbd07-74cf-44ab-9410-9892578e0340", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919131, "uuid": "7b644a40-670a-4fd4-9613-99eed4ebce14", "value": "3e01cc84e691f32494b07ecb3468cbb5d9c085488fe0a5b8110f80071fcaf180", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6705247-4e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637913190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637913190, "uuid": "9de14c90-7cf0-4a35-963d-8d7ebc367789", "comment": "Malware payload (Heodo)", "value": "57b12dd3229ea2d085cf08c16ee2c788", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637913190, "uuid": "1f3e19c5-ebc0-4b83-8bbf-f6d0a895f0cf", "comment": "Malware payload (Heodo)", "value": "3eb2c1cf65629fbeb92dde4d53c6d95b98086a4a7ef6168ecb5d81434317a10e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637913190, "uuid": "7df8c6c2-f9dd-4e25-947c-da2c77b01fb5", "comment": "Malware payload (Heodo)", "value": "cec26dd20f44a8d4518d8b0a0ca5ef4c742e41f0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637913190, "uuid": "ec796022-d3e9-4637-b47c-098720064c86", "comment": "Malware payload (Heodo)", "value": "b617305732f8e45d04a39d6d14ca11a32d745418f452f59c512de9d1aa572a4017773c78d31e72ab7a033a3e3640e6da", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637913190, "uuid": "bc3be04f-4c0e-430d-af21-82966aaccc31", "value": "T13F03AE1EC251B9A8D235D93A819845E9611D2E016082FA4D24C0B58CEF7B2FF9BDF35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637913190, "uuid": "d286c710-0af3-4e2b-b41b-65e24f802641", "value": "768:dbII+/I83pLGrpRrjevZCwVI+6gBZVWpf/wak8y0VIyR:dMnpLSbII+Bkpw78XVIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637913190, "uuid": "0a638320-b1ba-479b-9152-5a2a73ee4cc9", "value": 38032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637913190, "uuid": "7cdc9b36-571d-4ddc-a01a-8a0727fc2069", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637913190, "uuid": "99289c24-3eb7-4bf3-ba11-b02fcb1e6227", "value": "57b12dd3229ea2d085cf08c16ee2c788.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b6fb8ec-4e7a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637904662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904662, "uuid": "d98525f4-87db-479d-a0a4-ecb905fb31a3", "comment": "Malware payload (Mirai)", "value": "928466fb63fca731aed4cf626d69a4cc", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904662, "uuid": "d32b5e0a-78df-4071-b741-8a318f3861a0", "comment": "Malware payload (Mirai)", "value": "3ee9fbb0589958ad5ee818b63ffee896a3a85f2fa67e2812ffab6b0e8c1371de", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904662, "uuid": "b6ba5894-8ae9-4e98-95f0-2d8599dfea0c", "comment": "Malware payload (Mirai)", "value": "2f03a97948e3de79c6bd87874d6e42c9b6f2b0c8", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904662, "uuid": "c0064078-810a-46de-96c3-ef19b0de5925", "comment": "Malware payload (Mirai)", "value": "703a877021c7b2308ca088c6ff812b32482d24b2612a811dbb6da49553f3090801dc6f316b71e57f1ca120dc5c9010c3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637904662, "uuid": "61e8d159-a653-4014-b966-d34c68de26fd", "value": "T12943F80AFD816F01D4D922BAFE0E114933936B9CE3FEB1129D116F15A7CA91B0F6B452", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637904662, "uuid": "d033593a-7815-42b9-826a-d8d5ae09198d", "value": "1536:AKnGoTN+vQc20896RaDUWUrH/dD5EemhdlSIihdS04gzLwbZn1E:QMN+vp/aDerH/dD5EYLdS05PwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637904662, "uuid": "83eb8c4a-e667-47a4-a472-6dfaad703140", "value": 57652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637904662, "uuid": "48058aa2-cf3a-4020-9dc2-3a715750ac2a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637904662, "uuid": "bf23953f-d343-4fba-ae37-36c8269f7fd7", "value": "la.bot.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e430cef8-4ebc-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637933373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933373, "uuid": "d66e67e8-a57e-4f15-82ee-cfb2a2259707", "comment": "Malware payload (Formbook)", "value": "25348a9ed8b5714857ca9d90b6346c06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933373, "uuid": "94853b67-f93d-4809-bd8b-8a81802f1068", "comment": "Malware payload (Formbook)", "value": "3f329c3c43a80af4145116889d380b5022d7509b18a36143d3adf455d71ad02f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933373, "uuid": "fc15ed02-7d13-418a-8c62-a14ca0896e51", "comment": "Malware payload (Formbook)", "value": "2409b3aa6d381cf4f2e638e133344d5a29b4a65b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933373, "uuid": "85edb10c-5269-45d7-aaf2-a2dfbe0ce5be", "comment": "Malware payload (Formbook)", "value": "e2ccab59fb8b14bd5e8084d4b58ae6bcf0a62ed82a9188247ee011561b7fd94cdf14f44deb4026c9929e4942154322f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933373, "uuid": "f3e6c9ea-0345-42bd-8f02-b8f7c7e8efbb", "value": "T160B40119766EBF12D9BC8BF784836140C3F698636365E31B9CC671EA3A15FF44106A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933373, "uuid": "d35cce31-7248-4607-8cb2-07a1322c419a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933373, "uuid": "3e3f4b70-9ab1-46b6-95f3-f01ab68813a2", "value": "12288:HMcioLwixBFmPshh73a+37V2VMj0iUlljLCw/N3hPmednq:scn0i1Rh73aLVoFwV3hPm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637933373, "uuid": "b9d4ff71-513d-49e0-abb3-5a8e20f5444b", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637933373, "uuid": "5ee77b30-271c-4d1d-86dc-24438cda3e4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933373, "uuid": "59c83bcf-5b34-4dd8-835c-343cf516de15", "value": "0026011021.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5075cdd-4ee4-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637950554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950554, "uuid": "cb4a085e-120a-4ef0-9cf9-326f93949c93", "comment": "Malware payload (Heodo)", "value": "e7ff5523b290629fee5592a26841fd2e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950554, "uuid": "d42ae95b-8b04-4e6a-8fa9-48ceeb5112c8", "comment": "Malware payload (Heodo)", "value": "3fda4623fcca94ac7820539ca4fb58c68548a642eb434e4728393c8bb2149291", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950554, "uuid": "b246dbe2-87d4-474a-942d-bfa19404b23c", "comment": "Malware payload (Heodo)", "value": "ea04726e543c8b62184df480dcffbb7fbd4a3fc8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950554, "uuid": "212f9bfc-bd04-46b6-a1b2-846b01fa5a92", "comment": "Malware payload (Heodo)", "value": "b66f76de0a0254fafaf604878d890085f4f4fac399c301943ec17a4ceace8f2a46e906898a7f01c1e1ea94fbcd2af21a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950554, "uuid": "cb8e5840-a053-4c70-8b91-9294fad74a88", "value": "T15003BE1EC651F9A8C235D93A85D806E5621D2E119086E6493080B48CDF7B2FFABDF35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950554, "uuid": "09a03201-714d-45c9-9e3f-0bdd8cf63dcd", "value": "768:f/I83slqpRrjevZCwVIXzgBZVWpf/wak8y0VIp7:fnaqbIIXQkpw78XVId", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637950554, "uuid": "52b4cba0-6aea-4f64-9cff-df961d654aa3", "value": 38040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637950554, "uuid": "7e738cb5-ca76-42d8-a52b-65180e648106", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950554, "uuid": "ddd42b5f-71a4-4707-a164-2a2f3c0c2cf7", "value": "26112021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbffcd69-4e61-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637894221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894221, "uuid": "8811476d-f43d-46ad-9ea7-5ce2d32b7ae8", "comment": "Malware payload (Gafgyt)", "value": "9bec9947627bc20092926101dad3b989", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894221, "uuid": "a7e348ae-56d8-4b8a-bf67-95f34521f379", "comment": "Malware payload (Gafgyt)", "value": "3fee5b54579f719945daa607e66bbce0d93108267f5574dfb4be92a8385b2bdf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894221, "uuid": "66872943-ce6d-4d9f-b550-7861fa094da0", "comment": "Malware payload (Gafgyt)", "value": "00bccfb55f5c9dcd37a2e696633970ce3b688d91", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894221, "uuid": "e3e527d7-6b36-4bd3-a70e-9cc19351f4f1", "comment": "Malware payload (Gafgyt)", "value": "be6335adabe9aeaba7c3436ea9a3679a9263a6ff603caa66436a5427e0ca1862bbc23920fcf023818100b2ad231cadfc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894221, "uuid": "12bafc60-f370-4684-a62e-c5b2e4c38386", "value": "T119D3083F7B270E33C0CA107102E71332AAB5D79934F957D7A9D06DA86F16A843426BD9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894221, "uuid": "e4e190fd-c6d4-403a-bd3f-f5d523ab8914", "value": "3072:0Z3wuqMjUzANPkkw9phaEROLNsYH4H7ued3aBeTj7NV:0Z3tqv0lyphaERWKb7ued3aBeTj7NV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637894221, "uuid": "e3692d66-6b09-47c6-842d-f4bb3a90aa7f", "value": 136269, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637894221, "uuid": "03ffa5e3-686c-49be-af6b-769e446964f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894221, "uuid": "86d22561-4565-4505-b9ce-f1f7af220713", "value": "9bec9947627bc20092926101dad3b989", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0ef36a-4e6b-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637898330, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637898330, "uuid": "9c3c5083-aac5-46cb-a7ad-ef6d7e16af43", "comment": "Malware payload (AgentTesla)", "value": "f7285a29c0bdc35b44576664ee56ec2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637898330, "uuid": "23091425-5bb5-4b08-b8b6-c3aec29b3ba4", "comment": "Malware payload (AgentTesla)", "value": "4003951d161ede913e512bd1129b81a2b23ba348dc1424742535c07351f29cce", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637898330, "uuid": "b074822c-55c3-48b0-96ad-607ed1645592", "comment": "Malware payload (AgentTesla)", "value": "2d6a3ce7b4305206d7570533bb9a78e652ea1e82", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637898330, "uuid": "9a08dc3b-9785-448f-8343-7b6d933eae37", "comment": "Malware payload (AgentTesla)", "value": "f1cfe8a3a04014f0ec85d26973916bd5e96d1e67884cff237a79eeea93f80cb903dc00b6ff7217c5d0624890a06099cf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637898330, "uuid": "fc3494df-10a0-47ba-b9b8-29e9279a8603", "value": "T1A1B4D0A715C5D2DEC04CA076CA2AE6F9B1E48F91E508895333E4BF7638B11CC457E62B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637898330, "uuid": "e15a209b-f5d4-4e38-b158-cd371fda2b6e", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637898330, "uuid": "2ffa38dd-2ba5-4804-b26b-ddd5a600474f", "value": "6144:9GiMoi++jrC0QPWQ9Wsrkp9Vv4vOaO28wOEIqa2rpMK5R5HAGlcsQVQRJKzc:rk/Wysrc9VvzYnO65EGyzQRJKzc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637898330, "uuid": "d633dd07-3875-412e-a523-4e7e0e203c76", "value": 534060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637898330, "uuid": "d13d2fdb-57c4-425d-845a-86c59b73122e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637898330, "uuid": "bedea878-5c55-4d6c-8647-92e85d5b8f62", "value": "Payment Notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d548246-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918973, "uuid": "f6394605-9dd4-4644-b9d1-ba28899e3d07", "comment": "Malware payload (Dridex)", "value": "156ccf8324c479a229603a59485b1b68", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918973, "uuid": "3f8ce404-c076-4608-8312-f3eaff94371d", "comment": "Malware payload (Dridex)", "value": "402d6617014b320ae65709f7029fd2cf3661f5d69932abfa2e2e770236718d65", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918973, "uuid": "b31164bb-3c1b-4649-8f70-4392b9ceb751", "comment": "Malware payload (Dridex)", "value": "bd071acdbd27c66fa091ab07c1a079c57475f9a7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918973, "uuid": "db4a17fc-7fb4-4f00-ab3a-4bec3f8bc7e6", "comment": "Malware payload (Dridex)", "value": "e40f275290f601196d4152ec418f3be8f7a13b0af41dd41dc9cff6de1fe9f0bedda1d8fc00c5c91b736b93e698797771", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918973, "uuid": "9203ccc7-86f8-4097-af44-9d519b30de14", "value": "T11545E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918973, "uuid": "67ddb362-48d5-41a2-9044-72aa070470e8", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918973, "uuid": "54120191-d0e1-4709-b60a-2770421f9dc1", "value": "12288:mZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:mZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918973, "uuid": "20625bb7-42ca-4183-b219-568a4b61c0ed", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918973, "uuid": "b8560807-bd7d-4337-9920-3730d30f4ee6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918973, "uuid": "4bf81b2f-fc22-4137-b2d4-94e864ecc7ac", "value": "402d6617014b320ae65709f7029fd2cf3661f5d69932abfa2e2e770236718d65", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e100dd4-4e9e-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637920263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920263, "uuid": "c917e912-1603-4349-b501-0917a951a369", "comment": "Malware payload (Heodo)", "value": "b02c06ddbe97b42f4750da37e34f36cd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920263, "uuid": "c9eeb910-6285-4a84-9983-77f17d1bfe95", "comment": "Malware payload (Heodo)", "value": "40c646a7cb90a24a3f3e45ee83e0268df79bc496b964cee3f56a5d709bd26bbd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920263, "uuid": "5f5ace05-5c69-4f39-8444-f39cfa69184b", "comment": "Malware payload (Heodo)", "value": "318957745bb8b8c923c5ac65a8910b1b368e0e99", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920263, "uuid": "9d410229-84b4-47c0-ad3e-a76b17ce942a", "comment": "Malware payload (Heodo)", "value": "79d93500fb943e4c840237f3ffe21c948865ae2f38f4610b4e23c987482f29da44a02ea7d63e078c34c33166c706592e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920263, "uuid": "e1e68f84-4e39-4fbe-9d1e-a1551008aac0", "value": "T1A603AE1EC251B9A8D235D93A819845E9611D2E016082FA4D24C0B58CEF7B2FF9BDF35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920263, "uuid": "f9ad44f9-04a4-45ff-b51e-579a7afe72d0", "value": "768:tbII+/I83pLGrpRrjevZCwVI+6gBZVWpf/wak8y0VIyR:tMnpLSbII+Bkpw78XVIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637920263, "uuid": "a6760f31-058f-4a78-9c98-5bb16f28411e", "value": 38032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637920263, "uuid": "7a0d3a73-fbd9-473d-9e50-2eb231f3547d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920263, "uuid": "1b7c808a-f8a0-4744-b43a-d26347f53008", "value": "EZ-6976 report.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b151a2-4f05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637964676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637964676, "uuid": "8b966161-762e-4761-9dc4-2b47170ddba2", "comment": "Malware payload", "value": "e8163df7b49d99f4fed28b1ec55a2a2c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637964676, "uuid": "027ef0f5-96c8-4413-9124-c4baf73666d0", "comment": "Malware payload", "value": "40fa33cf581a043dfdcb9b7267af42020fe8072cb8a22c251c244822bb2aaf41", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637964676, "uuid": "ed1d4160-7a7c-42a8-888d-1d175b23bb85", "comment": "Malware payload", "value": "b65ee1d5366697a05d241c8ac33c0a1eb5ccb723", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637964676, "uuid": "a14fc752-9bfe-4db2-abde-77a0f5220443", "comment": "Malware payload", "value": "adde07cfa8c930c6b459a3e2200252a6cb66706e8f7c8db42ee2b9d8082e65257fa4bdcc5790b5cac38d0d404ab26a99", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637964676, "uuid": "b742db66-80b6-4f08-9191-3254853c5285", "value": "T14C149D427BD680B7DAB722718B46A72EB3E5C700473B69CB57D51C242B354C3A33DA1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637964676, "uuid": "9d15f517-0442-4a8c-b81d-0203396e214c", "value": "6144:WKEUPDI8HTI4IPualOM8Vka11WqQtXwpf:WKEUkuAOLka1miR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637964676, "uuid": "c505a638-cb4d-4880-85e4-c2fa8fdc64b8", "value": 205064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637964676, "uuid": "5c0fb779-d577-4acc-ab77-47688d6e7a4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637964676, "uuid": "511faabe-0005-478e-8043-28b0d7561d55", "value": "emotet_exe_e4_40fa33cf581a043dfdcb9b7267af42020fe8072cb8a22c251c244822bb2aaf41_2021-11-26__221112.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bb27a5a-4e59-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637890650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890650, "uuid": "fd2f94b8-8285-4a46-864d-3406b13fd14f", "comment": "Malware payload (Heodo)", "value": "a54e7480e38aa5a65ec86b930430d165", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890650, "uuid": "eb275aad-2987-4dcd-b82c-c6d88d0eee42", "comment": "Malware payload (Heodo)", "value": "412a6678b51f57b292f35d982203fd3e53cfa8316ecd40f95c6bba69b7329f21", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890650, "uuid": "64154ca7-51ff-424a-b324-83bee530f8de", "comment": "Malware payload (Heodo)", "value": "521a636fd70f10b8a6b4ab6ad0d1da11d118e5de", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890650, "uuid": "435b5aa6-9830-4386-bb29-4ae5d0829e3b", "comment": "Malware payload (Heodo)", "value": "b0f0920273d6b767faca77d0d0c65994d826bbb53f1c673861a7a5bf80b695cebcb1bf9553043874944d5da30742508c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890650, "uuid": "ea1f59b5-983c-4274-8ad6-4f803879d84d", "value": "T1F8B4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890650, "uuid": "d8709f83-7ce5-4cfc-8ec9-6c3e32fa9d35", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890650, "uuid": "90bcbc6e-dee4-4348-a64e-0591c46d2b7b", "value": "12288:smVdIG2GDNBtIlD987snrrkZW+mw3ffEPy:sm4GDNBtIl6w8ZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637890650, "uuid": "2e2c60d7-d2be-4a3d-947a-dc2b04339bdf", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637890650, "uuid": "de189aa9-1dfa-4eeb-bbea-d849391560a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890650, "uuid": "65059d7d-7213-471d-b9d6-245d85235c6b", "value": "a54e7480e38aa5a65ec86b930430d165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f67aa035-4ed6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637944570, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944570, "uuid": "2992c2c5-75aa-4df8-84f1-2c9f344c0cfc", "comment": "Malware payload (Dridex)", "value": "22ed6da91b890549598b6d29abfdb404", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944570, "uuid": "b76861d1-195a-4273-9628-233f6b63b445", "comment": "Malware payload (Dridex)", "value": "41cae704ec5ddb77d1ed6cb2e3f8f70cf775f5a303fa156c92489e38848d1051", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944570, "uuid": "0446494a-b6c0-40e9-950a-68dd7ca3ea94", "comment": "Malware payload (Dridex)", "value": "5b37493467cfbf7839cd8bfc3703ab8eb72deefa", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944570, "uuid": "903745c5-18ab-4e41-91b5-bc9a8ad6c3a3", "comment": "Malware payload (Dridex)", "value": "803b35016d602b87688c5c737d17ab103c30d52659c7dac25f1d233876a2f59d48da52f794e937d701f073aa7c46cbdd", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944570, "uuid": "81892d84-d9fb-4572-9b68-aa8b0e79f821", "value": "T1AAA3029DD59E681DC0F298FEC5C928F214760E5D4842BA4F2CED6074273614FEB8F16A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944570, "uuid": "de65da60-1638-4ac7-9954-30c60bd0a980", "value": "3072:VoFzIsj8aipSW4vHREQ4iZKUbiFftri7Ngdoh:DOipmvxpZqrimdm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637944570, "uuid": "ac29fac3-114e-4f52-ae64-1a11aa5f7c77", "value": 101638, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637944570, "uuid": "6d79c5c2-fcb5-4cd0-b5e4-e566a5a10ab1", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944570, "uuid": "036698fc-770a-4e02-b296-2f11692d50dd", "value": "offer73931308.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a50d372-4e51-11ec-843c-42010a9c0014", "comment": "Malware payload (AsyncRAT)", "timestamp": 1637887185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887185, "uuid": "3cdd7803-6248-4eaf-87ce-9a18eca4281c", "comment": "Malware payload (AsyncRAT)", "value": "f80cf6cad38b9bb0e964ca485c4f52d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887185, "uuid": "64d764b0-8976-4597-aad0-0c419bb9a7a2", "comment": "Malware payload (AsyncRAT)", "value": "42b8be731007bfe95a319be6726441e9da0504048f8402beabaabf712db3f3ef", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887185, "uuid": "000cad78-988c-4cf9-a54c-7efdabf7c852", "comment": "Malware payload (AsyncRAT)", "value": "07474ada9bce1cfea2a87111ba027e418eb8d55f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887185, "uuid": "973d685f-1bfd-446a-9afd-f08336399c26", "comment": "Malware payload (AsyncRAT)", "value": "1f51f7447195b09e47795002fb30574a3cec658e278471ad3c97cac327f14fcb834ae0a4f2723e7268f74927c498c55d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887185, "uuid": "0912c9b0-2d5c-4aab-9a66-370cec173235", "value": "T157C4632C7E058972EE1ED070886A86E47F120E5F6741696A13EB3EC7F76F2591CC9C84", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887185, "uuid": "03c03743-5d48-43dc-a181-06436000c306", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887185, "uuid": "b47cb7e3-7b7a-42a4-8669-c52ee29f11f7", "value": "6144:4M4CHVlM3lDmoabUlBzGWRT4pewNaScBF5HjQ8GYrWj:4O1lM3UoabUnXRNwNaSctMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637887185, "uuid": "34ffa16b-9b79-4000-902f-0c13e4dcdc7f", "value": 570880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637887185, "uuid": "9e61d93b-243d-472b-b9de-b17b05224beb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887185, "uuid": "32e2baaf-a547-4516-b6d4-fd74de5dd798", "value": "f80cf6cad38b9bb0e964ca485c4f52d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f47e353-4e9e-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637920345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920345, "uuid": "05477ac8-7d1d-4c36-85ca-eab1ea82da7e", "comment": "Malware payload (Loki)", "value": "4064aded78b88aae27ec09bc6bcd13ca", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920345, "uuid": "08a729bd-b879-4589-8d47-c616412950d0", "comment": "Malware payload (Loki)", "value": "43012ba86b9132d85fe5c8726b05ddd2c629bea383b5cac2ab2f4b5d6f7350cc", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920345, "uuid": "a85ae435-2fad-465a-8224-44ab604df211", "comment": "Malware payload (Loki)", "value": "8b265f90eafad055de9b3f7678d659bed078f12e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920345, "uuid": "9cc42e39-f29e-4db1-9795-5c6d75313714", "comment": "Malware payload (Loki)", "value": "b21b6c7a95f50c18dc4c1cc96a324d9e84e658ef894663c85eb531e2877f94420961d143fd3921033e45f09533bf8bc2", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920345, "uuid": "224c8c21-7e0e-4f89-ade6-023411c013f4", "value": "T16D34124833F46D18DA8761F17E2B11709AA3EE27B48AF608D55A758F0333335027E6B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920345, "uuid": "19140eea-a6e0-4376-b1d0-1b7f1b86577c", "value": "3072:SJ9cwNU2IQnt8CVfmoS4qu6dlhuAh18/EQ2UVOqcrsqoV3ij9EbrfPgGZ1ihCQ8b:kcwbt8CV/S26dlhRQ31Orkiajz+hCZF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637920345, "uuid": "2f13a297-dcfa-478d-acb0-641cc410a237", "value": 234776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637920345, "uuid": "dad51a2c-ca85-49d4-9cf3-c2fc398f5159", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920345, "uuid": "5914652e-ccda-40af-97ab-36eaded3b1ec", "value": "PO-0010A-HSG-210120.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "584dc47d-4ef6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637958049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958049, "uuid": "00f4a2a7-819b-4c4b-a187-fa05157f815a", "comment": "Malware payload", "value": "388cc2e6148905b7ea90c445522420a7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958049, "uuid": "d281ccd2-64c7-42c0-a70f-cac434293254", "comment": "Malware payload", "value": "4309153c57cebc3458e40b2e4e9887daf265718612228db44366bc06e2219585", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958049, "uuid": "25cdb9e2-e641-4d0d-8701-294b351f3150", "comment": "Malware payload", "value": "bf3c487928f2d904d274005d3d9e8ff568d7ecd5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958049, "uuid": "ecb97a68-32a7-4176-b62f-24f1126b9ddb", "comment": "Malware payload", "value": "bfda930118c675a07329145035da9935b70c94414ed4b0ce89e5b114e45312ea427ee820532bd7952f33f417cd96b053", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958049, "uuid": "cb3da8b0-b973-4074-8dfe-3f45e126fd1e", "value": "T15136237393651085D4E2CC36953BFEF172F22FAE8F81E87566A6BDC520315E0E216983", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958049, "uuid": "1a835afb-529a-44aa-a26d-e4b4055f3991", "value": "9ebcd018a747182c37aabf2ab1139666", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958049, "uuid": "c45c5b75-36d9-46a4-9419-2ba9cbd70358", "value": "98304:/EQoCJ9KODbCat6Vu/9vcnYpJU82tnhuF08RMLyNBfe3CRjp:/EQohOavVu/ZcO+8cZ8aLlCf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637958049, "uuid": "9efe1ad5-6888-43b4-8a7e-9e895d9121a8", "value": 5082928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637958049, "uuid": "6c55d209-1cee-4166-bc84-f68fe9df582a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958049, "uuid": "fb1b9eec-eba2-44ef-9d63-26355fb4dd05", "value": "Utility.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b06c821c-4e84-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637909234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909234, "uuid": "164d654e-335c-4c96-9b07-169f0f8e39a3", "comment": "Malware payload (AgentTesla)", "value": "1140fe7e4671de14bc4e93b7833388d2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909234, "uuid": "8d085079-3fa1-4366-a46a-dd5e14c5df6b", "comment": "Malware payload (AgentTesla)", "value": "439c1ca11be7919835e6a3524baa7f86355d493963aadba4fe661c3ac878553e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909234, "uuid": "c5ff9de8-0fd6-4b27-a3dd-18751a5dde98", "comment": "Malware payload (AgentTesla)", "value": "7aff92890d3517bd89896d523c6ff500ccf3a1b4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909234, "uuid": "dc664c0d-ea34-4f5e-92c7-6f08d0bdcdbe", "comment": "Malware payload (AgentTesla)", "value": "ab9d4bb998f3754bdd1b59ac9136dc4f280ff9f12c8679994a3340ebd8ede55dde00560af5b09ab42d586a20260c05b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909234, "uuid": "d703976c-16de-4732-8f30-b88a2cb4dff7", "value": "T10284231C9D0AEDD47AE710FA498954F937D19288CC8396663E32843A35160F1BF76E3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909234, "uuid": "55d1dd2f-f09e-48b6-9261-795f8b3e6322", "value": "12288:YomWCaUjLD/rNJIsziDltZHuTx8QMkPqwA:VmWCaUbTNmse227gJA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637909234, "uuid": "a4bca5b5-83b0-4b64-a116-d5cfb02305f4", "value": 406496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637909234, "uuid": "93106aca-6be0-4c67-89b0-e1a5874fc3e4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909234, "uuid": "9bf5a6e0-231c-4ed8-9aaa-3fc85e83b456", "value": "TRANSFER SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd54b73f-4ed3-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637943213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637943213, "uuid": "e1fcba41-ee64-41cb-b83a-0bfe14a0dc0e", "comment": "Malware payload (Heodo)", "value": "2a2f6cc34c9de360a7f4b077f8580bcb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637943213, "uuid": "294d7784-13ed-40b1-8a64-ff54b61c2afc", "comment": "Malware payload (Heodo)", "value": "43cd19dd2f1523fe229b626f418bb72738d7252918bd9faec4848117d54c8b34", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637943213, "uuid": "71431fbf-621d-4f58-abbd-5d263610dafc", "comment": "Malware payload (Heodo)", "value": "f2542f11192333453f4fb5e40a0fb5218f526135", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637943213, "uuid": "a47a8471-b54f-4867-a6f6-cff081875b6d", "comment": "Malware payload (Heodo)", "value": "56b3151f38e3d41160c7273cf5dd579c7aaa7130ec75ceb279405e799997d92562eb94a80965c15d4c88337fb02c27f0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637943213, "uuid": "21ac3267-4ccd-4612-ae10-6160ea1de0d8", "value": "T1A9E4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637943213, "uuid": "a7ff674e-c088-4715-8c2d-f8eef18b3dea", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637943213, "uuid": "d2448a33-4a53-4d4c-8447-3150163474a7", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhIico09cDlB4Vx/ID:0uH0GCNeQui7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637943213, "uuid": "e00a4875-edac-4983-a189-f5bb4ce5c73e", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637943213, "uuid": "69503068-78c1-4b84-9c58-0d1880bf6d95", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637943213, "uuid": "d6e5c575-98bd-4ed3-84ab-05b95ab2f4e1", "value": "besta.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9496dcf8-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931092, "uuid": "59ad9681-71f0-45fb-a48f-67f393c7a74e", "comment": "Malware payload (Dridex)", "value": "91cd0de7d5078dd3645828e7159b0e11", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931092, "uuid": "2c8d8e41-6c0d-40ed-9d8a-a1ffc52f3636", "comment": "Malware payload (Dridex)", "value": "43d08e34fdcb226a6d4b63cb0774718f933a522964791753db4336edd1d099ff", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931092, "uuid": "820c3f4e-0a4d-4537-8a37-852619662f3f", "comment": "Malware payload (Dridex)", "value": "da8c0fdeab056fabffb0756d9c9c7328d0d82dfc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931092, "uuid": "25ff2242-cee8-4b88-b1ff-58e638a68f53", "comment": "Malware payload (Dridex)", "value": "2817176d83e3f9da83e97e07ee53820676f49f10daa492734c1db1f66aa09232df419012f9019cc2251e247889d1a25b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931092, "uuid": "f7f2bf27-afde-445b-b09f-37736df3f839", "value": "T1C98302ED8644A4B6D2B4F83B030D1176FD28A6A674C1D7DE097CB65817F3387A78902D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931092, "uuid": "7cb0c94d-6694-42f4-b246-cbb15717675c", "value": "1536:UWPPZZKz/1eCzbqzLkh/OPvTFVNulPqmi+7mvYXl0gd3d:VpEz/9qGWPvZVNuJN0gd3d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931092, "uuid": "ad179f59-262b-4c31-943a-daf87f494f3f", "value": 82276, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931092, "uuid": "354524c2-6ea6-4810-9476-2a3459ac6be0", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931092, "uuid": "11060003-6ff8-4a31-aae8-1331b0bb0637", "value": "freedom vote1810229.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9972674f-4ee2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637949568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949568, "uuid": "59c976ca-24c5-4b2d-a1f6-24bca13951fb", "comment": "Malware payload", "value": "59760d62ade74653e1e064dc713856c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949568, "uuid": "8a346b89-4648-4e4e-84d7-e2036208d547", "comment": "Malware payload", "value": "4629d8e12d84524be33bf7e00c64decb815816db85237088b3fa3a65870f4c3d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949568, "uuid": "e7bd9473-79fd-4527-9fe1-a6f2bc86176f", "comment": "Malware payload", "value": "7ddf26d24192befdd384f055283764ad699f8d8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949568, "uuid": "d5e06182-22bc-44aa-9176-c44192fd2b97", "comment": "Malware payload", "value": "c7cc7b8ce980c8043c574606049beca4315842bad68c5d6063b287cbca94575ac988175710e08361b5e9dccda6f0ffb3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949568, "uuid": "c37800ba-0378-4d42-8da0-1c92c3528c6a", "value": "T105D41200B6D2E474C2F355B854B0C9B549BF7CB2D231C15B37A8221EBE741D1AF2A76A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949568, "uuid": "6b918cb6-8daa-4412-89b3-3f6e637b9531", "value": "0870c1337a760ee1593b3bf581332ebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949568, "uuid": "0a660662-b681-471c-892d-a14cab07241c", "value": "12288:tlbwYnf0jrZMIUD7LDo2bTZpXEBY8+ayD/YpfThn2kYXD/IIQK:tXf0j6jD7AmtpUMrDApfTh2kCDIPK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637949568, "uuid": "55dc01cd-530b-4cde-a6eb-b3e038081c48", "value": 631952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637949568, "uuid": "63453e7d-a768-4f4c-aabc-6d65478dcf0a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949568, "uuid": "d51e9fba-4bcc-4897-966f-a548d9e64a34", "value": "59760d62ade74653e1e064dc713856c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fa9981f-4f07-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637965309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965309, "uuid": "e38f5328-6fa7-4827-a064-2a1050508b09", "comment": "Malware payload (Mirai)", "value": "7e85a74560e21480c7ab2fdf6af13192", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965309, "uuid": "9ac18249-a14d-4ecc-8204-79e439b7da2a", "comment": "Malware payload (Mirai)", "value": "464045882486a407242945a5d2a64efd4d32131981ec14860939d0cef679f84f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965309, "uuid": "b701015c-2fd4-4ddf-8e0b-8caf641f2eaa", "comment": "Malware payload (Mirai)", "value": "3d2d1da1cd9d767232af0fb53119aace010f2175", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965309, "uuid": "57c955cd-119b-4c36-bf8b-5dcd5d5fceff", "comment": "Malware payload (Mirai)", "value": "a494305f3b914210ef1a4876b3fd8ff9ec44af443d487f18eb704fa125d27d7936bcc7c5a5db9e06c7f2c0fc6b49cddf", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965309, "uuid": "ea6bc07b-2364-4123-bbea-57b8d246191f", "value": "T14A831886BE82AA16C6C4477BFB0E43CD37226398E3ED7213CD156F11778B96B096B051", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965309, "uuid": "91b9ac5d-2d7c-4d77-8aa9-029357cd6489", "value": "1536:Zq3D7gjKnKK43YspBQlnEuhyMzzzQzA+AJFzd2xKr+MzWv8r5vC0xwbZn7:Zmge/spOljhJzQzA3JmKr+vKlwbZn7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637965309, "uuid": "ececb646-8f3a-4be0-8db1-7b10d8c607f8", "value": 84428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637965309, "uuid": "08a82403-dd11-49f8-9e50-a245265f2ed5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965309, "uuid": "42d089f1-30fd-4342-abd9-01fcd18aeaf5", "value": "arm-20211126-2221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c942807-4e91-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637914542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914542, "uuid": "9efb1e16-fa50-40f5-9d6a-1c5fbc52c872", "comment": "Malware payload (RaccoonStealer)", "value": "01dc9c854ece0ad3a1ab51ef5ffab87d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914542, "uuid": "9ef6c879-7b55-4672-89c2-fec23f2c2e07", "comment": "Malware payload (RaccoonStealer)", "value": "4656bcf6d5fd3e2cd7be25e2c0088b1622d09cbf43f87791b569589636e20e71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914542, "uuid": "c8cbf5b0-67c2-4101-b5d6-65a8e2ac9b68", "comment": "Malware payload (RaccoonStealer)", "value": "d03ab4f7a59a8c298d98cab7f6d0c93b54f0390b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914542, "uuid": "ab16fc1b-1540-4bcf-a66a-af3af68691c5", "comment": "Malware payload (RaccoonStealer)", "value": "196eb3c86a4178e0d29ce818bdbcdc86bd258052cd785fbd9f1e5c3ebff739b65daa9891ae31ef96099b213112d8c21b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914542, "uuid": "6c5326be-e266-4cde-aa75-660657539d31", "value": "T1E1E3BE2071D08035E5BB153328F49AA2DE7AB832FA75414B37A8322F1FB07D1596D76B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914542, "uuid": "b35704f3-fdc5-4892-84f9-fc08b67bf6a9", "value": "36446b075514827fc9326b30f24cdebd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914542, "uuid": "f84f794a-fcae-48fd-9eb7-625e8e372e9a", "value": "3072:WXGe/n/3KWWhovhhM/wzy2eTWgGINm2H3RuU2:KH3ihovhK/wzy2eT9GOw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637914542, "uuid": "e651882a-a761-4863-bf89-e2e116f6b5a6", "value": 149504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637914542, "uuid": "19459810-d79b-41e6-bc5f-8767e60b97ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914542, "uuid": "0e4d3f5e-58f4-4059-b620-fa79a4431897", "value": "01dc9c854ece0ad3a1ab51ef5ffab87d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87923d08-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637919044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919044, "uuid": "ab62d182-4757-4a4b-b20f-ffe775d87335", "comment": "Malware payload (RedLineStealer)", "value": "eb42b6d2fa11feb8ed6c0203dc4bb433", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919044, "uuid": "b4c8b7ea-b879-4e46-b82b-c17f7d38ff6e", "comment": "Malware payload (RedLineStealer)", "value": "46ca8b1bd07ee2eab1f87f8f90089b78416a0ea244673af38a5ae4ef126b2ba5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919044, "uuid": "294cafb2-4fec-410a-9498-e729d99fe71f", "comment": "Malware payload (RedLineStealer)", "value": "7f46d5440383f1f35ebf23d05ef25f1f3451a569", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919044, "uuid": "d2568a83-8f1e-4746-9cc1-5f160d608ed1", "comment": "Malware payload (RedLineStealer)", "value": "beea5b2650b1449c060eb88d6926631929b49c1ff1e55a13a7424d671182a4565018c56f0e7068cf483e5f31c03da7bc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919044, "uuid": "335c8e99-1e88-4175-8332-ee0b5e2c6fc9", "value": "T10E548E147BA0C439F1B75AB888B593A86A3FBEE16B3490CB62D527DE46356D0DD30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919044, "uuid": "b77eae28-74ab-4c8b-872c-35ba3bc7d368", "value": "ef656273bfb85d28a2059cd3657b6b5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919044, "uuid": "ce5be55a-3860-40d4-9323-86870f8bca0a", "value": "6144:Hv5QfR2uvEJQ2ww4SXuZet0yy8uo7sBJSFid:P5TQ254SXuZet0yy8uvSF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919044, "uuid": "1be40870-a0c1-42d2-bfe8-af02b7a9e6bd", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919044, "uuid": "33e9bf8b-9f90-4f84-a1bb-01321a36759d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919044, "uuid": "d2a415ca-6829-4796-8ec0-dffebab63671", "value": "eb42b6d2fa11feb8ed6c0203dc4bb433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "417f3df5-4eb3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637929234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929234, "uuid": "725bc266-59c2-4910-a393-289b2cc5c5d0", "comment": "Malware payload (Formbook)", "value": "da4e703a7ba3b91389253c94430182c9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929234, "uuid": "736b5b53-fce3-4839-a5d1-9fb7aff07d25", "comment": "Malware payload (Formbook)", "value": "46e51f41840a1a08e695f8b5dbd03efd3b3f7071edc00d9e916a73a02d8176a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929234, "uuid": "70999be5-737d-4b8c-9cdb-fe9a73d3cf4e", "comment": "Malware payload (Formbook)", "value": "4f832fa9e5856ed0e9c1fae8ee2d95c3f3f302e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929234, "uuid": "b7c8c8e7-64a6-46f7-afda-309475139d08", "comment": "Malware payload (Formbook)", "value": "72ea7c1d12abe4e2a6f21b58fb61b5830bcf7be47d8e12297fd536c7320941f351c85044bfa7707c63eaae80694c6af6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929234, "uuid": "4781ac3b-0167-4e76-928f-915388a1ef6a", "value": "T11CF45B5AE7C36038D5671CBEB91E1A509C543E222BCE7C6E1DE57C484F72B927832236", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929234, "uuid": "72fe8c43-9301-421a-80e4-44f284d5f18a", "value": "01f42bb56bd8196b0da3b3826e73efd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929234, "uuid": "a1c9fc4b-6b20-4323-b34f-bd0722aa07f4", "value": "12288:HOYMYlxIimj6qr9wMiE+wGFYjA2KY59roDBM6nGplGJY:HOJYMimv+9wGqfKY59cM6GplGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637929234, "uuid": "60ac36d9-1e82-4507-8117-547710e79454", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637929234, "uuid": "ca59da45-b3c7-4618-a578-927378b16c3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929234, "uuid": "7f11eec1-e223-4625-9088-635824cecba4", "value": "PO201808143_330542IMG_20200710_0008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e6ab6cb-4f07-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637965307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965307, "uuid": "611a6218-ceec-4073-9b02-3e5f9f90b114", "comment": "Malware payload (Mirai)", "value": "592564e8b1e105df584fbbfbc3b2f069", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965307, "uuid": "e0b2cb9a-36aa-4af1-9b69-60f7b4b9b3f4", "comment": "Malware payload (Mirai)", "value": "483e905f11f9b98b89507977f598221f1122bc35650035119cd7471b6746ecf2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965307, "uuid": "33fc4e52-885f-43e0-bf61-2660b3454964", "comment": "Malware payload (Mirai)", "value": "bb2f602c9349a31783ce81d766f092126a602a01", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965307, "uuid": "6ee9539a-c4a0-42ff-a5c2-d0a581bbe036", "comment": "Malware payload (Mirai)", "value": "ba8fdae8e0086b9075bff11908b335be45924f9d49ee0f23ad06e023c20ac64548cd748f8a2a4d9911fe38b4a6c2ed33", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965307, "uuid": "0dc6eaa3-778f-4c28-b090-06a4d9086635", "value": "T17AB3941E2E618F7EF76C833547B74E21F24863D626E1C644D19CE6015E6438EB81FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965307, "uuid": "b6efdb59-8adb-4e52-94b4-c1dd4f2edbc7", "value": "3072:p76c0SmZ3GeuWNYoMfD7aIQMH6E7siwbZnv/:p76c0Sm3G2YosaERwRv/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637965307, "uuid": "fc23fb9d-62db-4272-b41b-9f0f2c7eadf5", "value": 109392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637965307, "uuid": "b232051e-973c-400b-9173-673a6010ee1c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965307, "uuid": "d85cd75f-9231-4ae1-9389-a9943bba2a7c", "value": "mips-20211126-2221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a45f9c-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918791, "uuid": "80e52eb0-1e38-4c7e-8d90-e972e3e01bb5", "comment": "Malware payload (Dridex)", "value": "aec8754bce47765e6d1ff6641449f71b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918791, "uuid": "ae07ab86-df7e-4b17-9975-8fb028b321b4", "comment": "Malware payload (Dridex)", "value": "494d90eeeb3acbdcf85d81839a17e2cf4843713b12fa03fe3ebaaff3711807b3", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918791, "uuid": "d475cc30-994f-480f-96e5-991b119e9d2e", "comment": "Malware payload (Dridex)", "value": "00de05368600c975e06c625974489e683177e331", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918791, "uuid": "336dfae7-16cc-4f71-83df-a012ed8f0282", "comment": "Malware payload (Dridex)", "value": "dae500baaa5a3efd172d9351db007f9b4f29fc51fd7e39855aadef8ae1e6799e89ec76e9f5ffa91e3e94972c48db9385", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918791, "uuid": "cd9de90b-9af5-4eee-b327-ec9531fb11e9", "value": "T1F765D162E36871E4C5739A31D07F551F0AB66D2268598205FB723A700D3FBC9BFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918791, "uuid": "8325e692-c471-4e53-9fbc-61aecb72c7a7", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918791, "uuid": "b58509a6-6348-47cb-a282-ea8c370aa405", "value": "12288:iGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:X3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918791, "uuid": "d1398cce-6c56-4b6f-ac07-bc8547cfa7e7", "value": 1425408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918791, "uuid": "3df2f8eb-15dc-431a-8de6-47ecdc5ba641", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918791, "uuid": "539505a0-8db7-445e-a90b-0c3cc13a9854", "value": "494d90eeeb3acbdcf85d81839a17e2cf4843713b12fa03fe3ebaaff3711807b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c0820da-4ef9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637959209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959209, "uuid": "ab374a51-c05e-4567-8549-4e06ee1dd37d", "comment": "Malware payload", "value": "54703a1521ec4d0d257fd72bcb318971", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959209, "uuid": "0a8d5870-ffd3-4f1d-b855-baa20009203d", "comment": "Malware payload", "value": "49bc7d63d4e82e6d645b37f79c7e689fbe0f8313152376b14e68d570c99afb82", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959209, "uuid": "20c25567-f2a8-4456-b8cc-141574a6a85d", "comment": "Malware payload", "value": "40e376a63ff6866eadf5423b5b318fcc25758ffd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959209, "uuid": "f395fd5f-4616-45ac-9637-5c962e216501", "comment": "Malware payload", "value": "aedfd6fe7e7106e0f331f4f066806ee4007b19e5c7ab73263078998feab279183eca833bd2497a9415b78e0e4fd1ebee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959209, "uuid": "4ab0a309-815f-46b4-965e-d87a94ce0d87", "value": "T109C63362EAEE7627D6D70C34244A27A3CF3F7E62850193330E76769139A1E1475EC9B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959209, "uuid": "bd2f7f42-d4a0-4153-899e-25684edd3d7e", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959209, "uuid": "3d053336-c158-4d5c-8949-6cf077e8f727", "value": "196608:JY+VXBp3W7jPP73yMItJQFW4f8a15r3LUdg6XQo0HMYfdcWM/7MnkYtpNYMbz5q9:JY+V7sjPDCxJQFkaDr3LcxQo0qjDMntq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637959209, "uuid": "b26cc499-6e93-4058-90b0-74f87d243156", "value": 12143659, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637959209, "uuid": "9f22f7e5-ce0c-4071-aba5-9bcd77003de2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959209, "uuid": "87132247-e83e-4d81-b930-c1c3d48d28ef", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e6e2aef-4eb4-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637929766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929766, "uuid": "5f83bb42-2a8f-4d20-8a34-9b8ca3ee4362", "comment": "Malware payload (AgentTesla)", "value": "c2e5e9f346425d5edd7ba6218135f017", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929766, "uuid": "47973b96-c188-4369-a922-a1fc4120ba1a", "comment": "Malware payload (AgentTesla)", "value": "49c2ce5a720050cbb7266b11ac666179e7dd045f60b343819b22af82a469743b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929766, "uuid": "eed16432-7807-4a43-be61-e247292a2c47", "comment": "Malware payload (AgentTesla)", "value": "6285100468c71dae58b9e6233475249fa53734eb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929766, "uuid": "06fbea5f-76b5-4953-ab99-cf9fb3404286", "comment": "Malware payload (AgentTesla)", "value": "c7f6a0ba64bf447a0aa23fce8eac9bb45bb2eecc0e478e94b4ea547d3a7b754a265aea7fd7a74f98ccf40f02890968ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929766, "uuid": "25f15c46-8369-49b0-b9fd-452e76754e3b", "value": "T1A7A4F15EB2B051AFE80886B608B9D57D9F31ADB6DC98121633A17F860FF31150D11AFB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929766, "uuid": "29d36ba2-17e0-48cd-afa0-7a2f23758b90", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929766, "uuid": "eb9b8115-341b-49aa-b3ac-ec18c2f7b20b", "value": "12288:ZNPoJlXBDWWxaHnRX7z2P1h/SvDOJx5UWRj0Lq:ZhoJlRSWxaHnRLz2NovDOftv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637929766, "uuid": "6646a271-a60e-440c-9fae-74fdb18cabef", "value": 458839, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637929766, "uuid": "4bf46ec2-11f9-4076-803f-9b7af8b9d327", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929766, "uuid": "2ffc81dd-ba85-476b-996b-877c0a7f0d7b", "value": "Urgent Quote.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063ff032-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918827, "uuid": "5521efe1-6ffd-4214-8d6b-35c740f85d16", "comment": "Malware payload (Dridex)", "value": "6d6d268e7bafbede834d84141ade7ae5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918827, "uuid": "cb5866b3-61fe-4c65-a39b-b6689833b8b1", "comment": "Malware payload (Dridex)", "value": "4b165651a1740bfbac89a2a15423f935cf2058ce9fa79903889e04016be8344b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918827, "uuid": "3d8e817c-9712-466f-8df2-d2ee10ac7077", "comment": "Malware payload (Dridex)", "value": "43f460cb03c89dbf77545944c913c7fb6f0fbca6", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918827, "uuid": "f0834ae5-9c3e-42ef-88e6-b242d43777d8", "comment": "Malware payload (Dridex)", "value": "0ac032acb160c82043a35569bb77f15322cd9eeb27f19c29c4734e95bec1e8c8bb7c7256325cb5674247d060b774a39a", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918827, "uuid": "d317ce20-1576-4178-a372-b56bc35a432f", "value": "T17C55D162E36875E4C1639532D03F151F0AB66C226769C205FB723A740D3FB89BFE9129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918827, "uuid": "21833488-9a6a-4f4e-8e83-a1ba5c9f016c", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918827, "uuid": "37ca46a9-19c3-48b5-908a-4736676792a9", "value": "12288:RGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7u:03JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918827, "uuid": "7cb3ebe9-29f8-46ed-b6be-6be4e1b88310", "value": 1404928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918827, "uuid": "0f072c45-1d93-4378-9f95-b23cd2c83c27", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918827, "uuid": "28eb8e8d-ed68-40f4-84bf-6aae22d97693", "value": "4b165651a1740bfbac89a2a15423f935cf2058ce9fa79903889e04016be8344b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d6949e2-4e90-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637914329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914329, "uuid": "aad53611-0394-49e0-ace5-c0e01c0abc16", "comment": "Malware payload (Formbook)", "value": "607bac1d2dfb0d8a6859d5a67b812b5c", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914329, "uuid": "bae65e7f-73d5-4615-be17-a6f1c89d0b8f", "comment": "Malware payload (Formbook)", "value": "4b19a3abba880de5f9fbb4dd9331add29b5ab61a5cdd7bff3c6c1933fa86146a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914329, "uuid": "590b09e5-297e-4c8e-9c0b-a04072314bbb", "comment": "Malware payload (Formbook)", "value": "8f899e254d2178854e1f77a10372b7baf0aabc7a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914329, "uuid": "1c216208-bb47-4a4a-ab8f-251ccbc0ed3b", "comment": "Malware payload (Formbook)", "value": "71269e7566e10de384f5671336608fb35c8725ebd580b41f60b5679c45d2e2679630afd01259e1c9b2986c4cf4fc1246", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "HSBC", "colour": "#21B471", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914329, "uuid": "2bfb276d-515d-4d23-bad7-22e9da01a2e0", "value": "T12E34134BFF44EAB3EEF521397164E0093628FD16AC0C1A4E19433DE95AB9DD4794B28C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914329, "uuid": "89bf26c4-be20-472b-9079-5a25d7a7c1f9", "value": "6144:7bW8Q1EDuBxA73eGwJU/xu81waGM80N7QAxt89Vk:7bWZ1ECYeVO51waIkNr89Vk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637914329, "uuid": "f769dd3e-c3b1-416c-8e42-c5a637a6b16b", "value": 234760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637914329, "uuid": "5e0cc6ab-8438-4266-9069-0c96bef8ce7c", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914329, "uuid": "fc4a2f25-9f53-4925-8875-7b60a07d47c8", "value": "Document7000.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd20262a-4eaf-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637927724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927724, "uuid": "1abd05b0-470d-4be1-9797-857e611f501f", "comment": "Malware payload (Mirai)", "value": "a39a7bc5a6446a59f90ab30b6dd8dd01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927724, "uuid": "1593678d-0acf-420c-87de-2f82c006c1c8", "comment": "Malware payload (Mirai)", "value": "4b5d36a046abb7f4e706ac43c8d8c65cbfff9af8339031dae0f1fc1b467c8d76", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927724, "uuid": "3781ffe5-4618-42df-8aa9-4e779b91bff2", "comment": "Malware payload (Mirai)", "value": "201f4635d9f40336c3694b38582742b33d506d8f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927724, "uuid": "61238602-e9a5-4be3-8aa8-ab6295a81398", "comment": "Malware payload (Mirai)", "value": "3fed86c565f697ac5498ee769cddcb9a17185851cf786d6152c12895106cc1a445abf0c68885598a5150686843ea8026", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927724, "uuid": "5d9fed84-278f-453a-85ab-8bb8df49fd2d", "value": "T125E3C60E6E215F7EFBAD823547B34F20A35933DA22D1D5C4E1ACED052E60389642FB65", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927724, "uuid": "a267d013-5d18-4951-bb43-1c5dbb91a217", "value": "3072:D93QGJu4yqzFc+7Nb/mpTymx4fWHVt60x5uO3TzXu1:lQGJu4yqzFc+7Nb/mpTTHD5Lnu1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637927724, "uuid": "61883878-c002-4633-bc4c-5c16ece51ce3", "value": 152440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637927724, "uuid": "381362ff-1b11-4638-9f1f-dbf0008a79ca", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927724, "uuid": "149f6ccf-64f2-4d3e-920e-7a74940558fe", "value": "a39a7bc5a6446a59f90ab30b6dd8dd01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1aa317bc-4ec3-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637936041, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936041, "uuid": "a379bc73-bc9c-4e8f-a3fb-c2c26a5b5fe4", "comment": "Malware payload (Heodo)", "value": "046aa4ef43d3ae5161a89d4c41db8515", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936041, "uuid": "d4a1d379-6a8b-4ac4-a269-36bf56ea372d", "comment": "Malware payload (Heodo)", "value": "4b9b680fc8806494d6771ea181298b0a8d8749a2e005a2bf17200e304851083e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936041, "uuid": "fa586f25-a31b-4255-8f7b-8a3764c694c5", "comment": "Malware payload (Heodo)", "value": "9a24e374e40c878f81be6b265e4fede2e82c7753", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936041, "uuid": "4cd71c05-3976-416c-9b30-541b44e6ca81", "comment": "Malware payload (Heodo)", "value": "fddfe4731f7d0998bba2737b03e5593798ec2a96f811eef6353aee4695172e1575ad6f79db946480bc16d48d8a45058b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936041, "uuid": "3e44e7e3-0278-4f67-8d80-fc5cddc1ada4", "value": "T19793495B67E500BBE4368638C8630E1AD776F81616619F6F0364066E1F273C29E3AF71", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936041, "uuid": "0962cfd9-15f9-418f-821f-f42773ee9612", "value": "09da5c9e7ddc162a45279f14ce37b03b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936041, "uuid": "7536cad9-04d0-4000-be3d-3caaf0ff5c70", "value": "1536:by+d07dEGIWhBMnSyKBAKeqKZ6p2KJ92zsWOrId09dlUiGPz:++d0REnzKBPRK6p7L202MOiyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637936041, "uuid": "570fad28-0f17-4ba5-81f5-97d4e8053d0f", "value": 92672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637936041, "uuid": "9e1ba21d-a545-4364-b179-b55fcf2de534", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936041, "uuid": "3522dfb1-b101-472d-9b03-bd2946919ea0", "value": "046aa4ef43d3ae5161a89d4c41db8515.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cb417e-4e52-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637887875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887875, "uuid": "c8e9eee6-bfe1-4a84-8bde-5c3afc233374", "comment": "Malware payload", "value": "fba4f54cfdca650a57c66f83ec1b084e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887875, "uuid": "a0d2f4ae-be1c-4578-b202-b3eb559861a3", "comment": "Malware payload", "value": "4b9c4a311f2b3fa9f2c954a70bfa8bd4c89e87899f6d35d54c46edf9d6c3e859", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887875, "uuid": "26360799-ed01-4484-a7de-a6c949896a5b", "comment": "Malware payload", "value": "a949c3711cb57564916a7732f1274c7d5d7dd733", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887875, "uuid": "9a0ea0ab-f13e-4dd6-b073-3c46060fba54", "comment": "Malware payload", "value": "2cced5d08b610f7acebe875c55720a8e423c0ecbb14e319f341970ebc6c5e490db20b130a906ef206c528893686bc00c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887875, "uuid": "fda62c6e-43e4-491c-9ea5-0ee694133807", "value": "T1DA7623AA62A8331CC01BC9B5D537BD07F272521F59E485B972CEBAC03FDB014DA46B46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887875, "uuid": "84744a1c-31d6-49e4-a85e-a53133cb3c91", "value": "8e88eb7cc5742529ccc6b16edd9f9c23", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887875, "uuid": "ce413029-ffb2-4c6c-9e52-1c3bb5a13628", "value": "196608:8OUZuR6VUYceLcNt2iCxTyXUg1TJDt0vURmS:8NZ66VUYce4n2t2Ug1VDo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637887875, "uuid": "8264abef-f4f5-432d-91be-859e8edaf4a2", "value": 7172608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637887875, "uuid": "974b0a0d-d94b-42e5-8582-372c7eae7047", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887875, "uuid": "82e6b5e3-6a7d-4e03-9091-64077fe53876", "value": "fba4f54cfdca650a57c66f83ec1b084e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffa1cb9d-4eec-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1637954034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954034, "uuid": "2b763073-200f-49e7-905d-798580526a1e", "comment": "Malware payload (DanaBot)", "value": "ab3e3b3acfe93b280dc2ebfecdb0e4da", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954034, "uuid": "3657ffbb-5012-45b9-ad08-ed7903f8b002", "comment": "Malware payload (DanaBot)", "value": "4c1195c5e8de2cc8d71038a024b0e40ed342df5d15ab82a3e2c72c19e723f4de", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954034, "uuid": "6b1557a0-7cd2-4635-aced-7539818d5fab", "comment": "Malware payload (DanaBot)", "value": "cf101cc6cea588ab80ae094aa0fcd4ff068fddd2", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954034, "uuid": "40752324-c681-414c-b0c5-2c6455e04ffa", "comment": "Malware payload (DanaBot)", "value": "abc94a85b56a9a02bb6cceeb2e50d1e687906504485c219954f7e2c5221c33428957c01b04202568a0d421ae145e84a2", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954034, "uuid": "1928c191-42fe-409a-9474-43ec4c6dce83", "value": "T13585333173D3E034D5C92635273A4D54DEA2BF6275E346BA1F5C260B2EA6BF140A1B0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954034, "uuid": "5bc7622a-b9a1-4704-bdaf-df847f370c7e", "value": "30633f34504d0e28d8bd0b63cbcfe112", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954034, "uuid": "c84e0780-b522-47db-9c16-b5e96d1258f4", "value": "49152:Rf1dhj35W1E+Z6NHKt6CvyerZj6See0OmE4R/eAQ:5hjJW1EM6hKt6YjWnE4Rn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954034, "uuid": "d5f4570f-0eae-41a8-8b40-15e2410bc955", "value": 1745920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954034, "uuid": "2bf7091a-2774-4cc5-ae18-4bbd311009fc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954034, "uuid": "ef976e57-38fd-4298-9329-0a3744f2c2c4", "value": "ab3e3b3acfe93b280dc2ebfecdb0e4da.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94f5bf0c-4ef1-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637956003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956003, "uuid": "a60e380e-79c8-4a69-ba2f-7ab33aa9441f", "comment": "Malware payload (RaccoonStealer)", "value": "4a2612bcf01429cdcfeb9f3bcaf4e5e1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956003, "uuid": "57871135-d82c-4ec6-8846-d461d7d99a12", "comment": "Malware payload (RaccoonStealer)", "value": "4c55c1751729ce6ceea3e07ec703d9086228e27a7a9ae3934267b4ec1adbb1af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956003, "uuid": "f4a8f388-9edb-4d80-98d2-5f8db073da76", "comment": "Malware payload (RaccoonStealer)", "value": "efe08160305dc305e543b9d454ddf53090d37bbb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956003, "uuid": "67eca6d7-7da6-4660-9a6a-a00fbc30ec26", "comment": "Malware payload (RaccoonStealer)", "value": "6e4a6ecd1d5888a5e101e951d9170f08f99bf038ab1284e41f43010cf549e4124308e2401761b4c67f123b8585b87dca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956003, "uuid": "35fab7e9-e6d8-47b3-a2d6-b37e0d1181d3", "value": "T17B44CA036E58FB18C0957D3782CF1A2917E31CDA8A329DD66F8DAE5126106063E3777E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956003, "uuid": "0fd18ad6-8d99-4788-a05a-13f8ea314912", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956003, "uuid": "b0802c4b-d7ef-4450-ba41-e8c7f2f0e0d1", "value": "3072:V/JqFUMdjVjPUnfu+rcJmBsqeRcS3zddWhyXwNaPLANPq++OKHhnNAUTX+1X2+/W:V/JKjBsu+r0JzpdWhIwoPLF++jhnl7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637956003, "uuid": "dba61a22-eb10-4e4e-8f14-581796881af9", "value": 269208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637956003, "uuid": "9c41c1ef-76da-492b-b639-81dc4e22a203", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956003, "uuid": "00d586ac-89a8-405d-ac7d-b5c3fff04f10", "value": "4a2612bcf01429cdcfeb9f3bcaf4e5e1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3648f98e-4e8e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637913324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637913324, "uuid": "7eacc320-725a-48f0-90b3-21131ae007f2", "comment": "Malware payload", "value": "1bbf6d86296b0cd91ae44f537435c8b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637913324, "uuid": "96ef6b6f-27a4-4b9a-b503-abab92c40f0a", "comment": "Malware payload", "value": "4c73f30ed6c6a944261aa3b5157ed6b696fd6d963691bd5a899aa3d493abd6b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637913324, "uuid": "e66ed7bc-7e64-4d1b-95d0-d2d694669446", "comment": "Malware payload", "value": "accf9ae21a742770e9663f392abab1f6619215ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637913324, "uuid": "66a74e4d-04a4-4e2e-a3a1-b2850129dc85", "comment": "Malware payload", "value": "5fb9bb3142489bfc831ad0b842692313f5cda1b8331a9a377a4b12bc65ac1af385946905ef3db4de930e8a79816dc560", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637913324, "uuid": "1f0b95be-ed55-4c04-8f7f-e8bab1cd43e4", "value": "T1F2A4026017BA6524DADC4BB7E0915360A33AD236F44ECB5D37C6A1AA05D3312D702BDF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637913324, "uuid": "0ce184fa-6c90-483f-b5ed-e6f514262953", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637913324, "uuid": "9d4c0d77-e9b5-4266-828e-a6c6a1f71a35", "value": "12288:e0tixBFmiHQ2bdUsQSEbR3A5coA11J0qZTXrAwLfwSswHWwNrASted:e0ti1JHFbdmSEbRwaoE5DxTRBlta", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637913324, "uuid": "1499e77b-4b5d-4b78-a27d-a5edfacfef53", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637913324, "uuid": "5a13424c-0ac6-445e-91fa-ad9079faeb12", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637913324, "uuid": "f2a19260-d3c1-4ccc-9fda-e0462aea1d97", "value": "QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90d990c4-4e9f-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637920777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920777, "uuid": "9ca7c1e5-4655-4089-b1ef-28b27bdff245", "comment": "Malware payload (Heodo)", "value": "c9cfc1b306336741f0dca81a2095d811", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920777, "uuid": "891953ee-57c3-4747-b82c-44a1ad35883c", "comment": "Malware payload (Heodo)", "value": "4c984c0e85f665af3d63990e73dbf6e0874820e7278db2b04c90e90b1a9ec5f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920777, "uuid": "7f89e970-f91e-4619-8555-967355fc1ee3", "comment": "Malware payload (Heodo)", "value": "34667e4265043d83e0edd28609c0f2074b07b275", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920777, "uuid": "f7ff7fce-e1a4-454f-bc3b-e24935dbeb06", "comment": "Malware payload (Heodo)", "value": "4cab312f7873ffffa2d8d84b80c5862dc04ee7a0a9cd36a5341116b6882d495c8a30d23f6a57376af36a79687c836547", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920777, "uuid": "6c8d3332-ccdc-4f66-98e5-7b3fb9262e3f", "value": "T19E44BF10F180E072E5FF143A49FA85695A6D7A600B80E9DFA3AC0C7E8F675D1B63059F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920777, "uuid": "11c523a9-f4a1-4520-a784-a1874849e8a1", "value": "d79502333a75fa1e04705c457de6707b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920777, "uuid": "daa76d1e-94a8-49c2-b355-1e11001a8cc1", "value": "6144:y6EJEO2pMMNdpbpXoUMAWpWEP57WaWTBsb38U:y6EpI9IUMAWpWEP5WTel", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637920777, "uuid": "53d013a3-6eb8-43d9-8eea-22f3f6428f86", "value": 271360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637920777, "uuid": "5064c64d-2c70-4284-976b-3eec3e670133", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920777, "uuid": "68061b13-1457-4c80-9496-ca95d307784d", "value": "emotet_exe_e4_4c984c0e85f665af3d63990e73dbf6e0874820e7278db2b04c90e90b1a9ec5f7_2021-11-26__095931.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39903eb8-4ef3-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637956709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956709, "uuid": "28c487e6-d230-4ad9-adac-18181b01997b", "comment": "Malware payload (Heodo)", "value": "b40373c4bc2e47c187eb8cc4b0d57dd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956709, "uuid": "d3c0513b-4bd1-4edb-98ee-641a0856489c", "comment": "Malware payload (Heodo)", "value": "4caaf443a709fa4a33f048d2d646ae38581b726509963fa247a083ef99a1879f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956709, "uuid": "40b42a8a-87a5-4423-855b-c96cf6d4c681", "comment": "Malware payload (Heodo)", "value": "7fb84ea127c543d72ae815d7ccd17cb94852fc29", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956709, "uuid": "a35bf5d6-e92e-44af-be5e-8b68bc4d1e07", "comment": "Malware payload (Heodo)", "value": "e56a248f5686149b29591288f5aa5ce96947b086150c1b9a660ce3b982c7334520e0d81c4a9bb97f57abe8d1d6e750ac", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956709, "uuid": "a2a3091d-1d5c-4961-aeea-329bc511c944", "value": "T10BE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956709, "uuid": "3f80cdf0-01a0-4a41-aac4-ddcc804e9fdb", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956709, "uuid": "63709578-c60f-4024-b21e-2b5aa6a1178d", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhWico09cDlB4Vx/ID:0uH0GCNeQci7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637956709, "uuid": "d0464e16-f46a-4797-9102-fb6d97cb8cd2", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637956709, "uuid": "d8c52d59-b7b5-43ea-bf1f-df47eab4fbf1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956709, "uuid": "36237759-aa60-4c4e-af04-7a7757815629", "value": "b40373c4bc2e47c187eb8cc4b0d57dd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fab6f5d1-4e84-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637909359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909359, "uuid": "859ddc59-2473-402e-bdff-e967636e0a6e", "comment": "Malware payload (AgentTesla)", "value": "e014629e969675f6e0857d9829bb6956", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909359, "uuid": "f106303e-4c1f-48dd-aa29-3034795b80b7", "comment": "Malware payload (AgentTesla)", "value": "4cbe599837c07784cfe7dc3223f54e5a46f4f0262c7a8efa19ecf2c7de0ad1f3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909359, "uuid": "96496483-823a-4524-bbed-30c9c8fd17d5", "comment": "Malware payload (AgentTesla)", "value": "626785ed67d5982f8a933cd54dfcd7aa70f8549d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909359, "uuid": "dd58478a-aa2a-43ae-9477-9205d2805bf7", "comment": "Malware payload (AgentTesla)", "value": "885ca3147749bfb5012988ac94ee04f1aa6c40856c854686d60e886b0327129b2337b5d1f8ca216f2c8e20a3dd894690", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909359, "uuid": "a8b33d67-a5d5-49a7-8b98-aecae51cdd22", "value": "T16694016D73443F23C96E6A7D0499478152F4C2977611EB499EA278F21BAB3F04701F8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909359, "uuid": "09104bce-830f-447c-b473-e1ae3918cf4f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909359, "uuid": "1e520f37-1350-471d-9a45-4785fa6e75ef", "value": "6144:0MwrUSXIlEa5YngKsRwG1mwMMa78KpVJyiu1Pjyq1Q8Ct1p6c1tgmox59sQR0pfn:0DrUSFgKwQea78c4vP5YtgmoxPXeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637909359, "uuid": "b1d087ac-0e59-4d95-a05b-184e89ec3f9c", "value": 447488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637909359, "uuid": "325b77f4-96af-4413-8ae7-07d47d908451", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909359, "uuid": "245e61de-3640-4f48-82cc-9983e248b92b", "value": "TRANSFER SLIP (3).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22849171-4ec2-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637935625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935625, "uuid": "233ea33a-41ec-4a38-b12b-61089ffc928c", "comment": "Malware payload (Heodo)", "value": "be6cc11a00747b0b97647e99129b61fb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935625, "uuid": "75c9863a-9e89-4e12-83a8-8ebda064822c", "comment": "Malware payload (Heodo)", "value": "4de8e43690af465650b44c651907533b89ab5c93da4c199a2e0770c128c8cd59", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935625, "uuid": "b639404f-4f99-4690-8408-4f86209f8cb2", "comment": "Malware payload (Heodo)", "value": "d39226dd320fb389766c3c7d821433d11c15115e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935625, "uuid": "93adc0fa-613a-4ae4-bb82-4bd190ee6588", "comment": "Malware payload (Heodo)", "value": "cce33dcc8ea34a8532240aa33230f2de7f5c4924ec9f76a3f3ec979923c4164d2ea7f45acddb18f01c02ec3b8c5bf914", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935625, "uuid": "9318a358-5520-43f7-8b21-4052ab703e95", "value": "T13EA4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935625, "uuid": "bbf2e17f-879f-4524-a3f0-323e1ebc04d8", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935625, "uuid": "ef7a0257-a706-4faf-8a5c-330332bfc5d7", "value": "12288:o4xZ0/tI1BD2LETv0FhRO9U6W8XUDaBN7a1vt:oED2LETvMPb6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637935625, "uuid": "4ea2a580-315e-4d68-8f9f-1d5f7444acc6", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637935625, "uuid": "d726fc7c-88b2-4cce-b515-2e95e209ed4d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935625, "uuid": "ec9496b5-f0f6-4926-9c5a-125048288a0f", "value": "besta.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d93c2159-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918751, "uuid": "c31b263f-07d6-4f5b-b92a-af24b0c98187", "comment": "Malware payload (Dridex)", "value": "ec7196719cd7072437a15963ec474858", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918751, "uuid": "d7cb47d6-fbc3-42b0-bcf4-8c66f1f8ae58", "comment": "Malware payload (Dridex)", "value": "4e16c7179564c280431462f14d51eb4da50bbc1524b4961b289a0ad0fb96ed35", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918751, "uuid": "9ed630ce-2493-418e-a7a2-7354ecc0409d", "comment": "Malware payload (Dridex)", "value": "371c3f1ace0a466b1da2ea4773966c3762602c72", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918751, "uuid": "38709757-c0a7-414f-b205-1dd603e68e84", "comment": "Malware payload (Dridex)", "value": "55681e13f0c779b11ac4e8fa11003b5f59a8ac24e6e5ef772b22a8fb0c02bb32c9d10e8624a53a6eb93211cdfa96ff12", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918751, "uuid": "290cab32-188a-4823-bcb1-6268e4f0f6ca", "value": "T1FA658E12F3F311C2C09EF239B8AE0405A1A39E11C96F871DA65F13355C5BB923EAE55B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918751, "uuid": "66c5e940-f2c9-4c49-bb95-419274205e65", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918751, "uuid": "1a839b72-2c9f-4865-adf9-d4179de44722", "value": "12288:CGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7erYb:33JAvRl/fKQKCgFfx4P/vaerY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918751, "uuid": "e9c806bf-c166-46d1-863b-62ef76589902", "value": 1499136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918751, "uuid": "3718c14d-9d24-4d47-aee3-94d87b6f0196", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918751, "uuid": "7b3fdfa0-95d0-4717-8957-c95e233943b7", "value": "4e16c7179564c280431462f14d51eb4da50bbc1524b4961b289a0ad0fb96ed35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4fed4da-4eb1-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637928676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928676, "uuid": "aa60b44e-5a38-4000-9646-e156d058922f", "comment": "Malware payload (Dridex)", "value": "e6a5ad688b55b50758e1c0610ecf5487", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928676, "uuid": "38d812e4-7403-4112-9769-0d9b485ef9a5", "comment": "Malware payload (Dridex)", "value": "4f974e08c9c8eb7ff04d8aa4aecf7e9d60595a8c1cbdfac6a68eaf1283ec7a9b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928676, "uuid": "e3004300-6647-4769-859e-07f6a51a8f3f", "comment": "Malware payload (Dridex)", "value": "abf6078a9f4295e3ba15f66e9a8dc561b39c9fcb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928676, "uuid": "2ed1fbcd-9e87-4f6d-a3b2-0e102f2effe5", "comment": "Malware payload (Dridex)", "value": "1452be6d1121fec1d3fb57d6782e67d079a7fb7a0f091402ad98ad0606245c1afaa62b4f128aa5e4875e0dc9e379ed2f", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928676, "uuid": "4d420dc2-0d2b-4bc1-87af-6b3fb65a1b22", "value": "T199A30298A45AF04CC0E598BD418D1CE7653C0715588BBD1F38B9A2B91B760CFABCF439", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928676, "uuid": "b6a3a340-8056-4850-890f-08caaa466a1a", "value": "3072:V/FzIsj8aipSW4vHREQ4iZKUbKimuuJPwHq16gdfH:EOipmvxpZw0oV13df", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637928676, "uuid": "4ee5af40-9f89-4a81-8fc3-f6deac9c9227", "value": 100793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637928676, "uuid": "f1847ab6-5cb4-4c95-905b-6b279d93d6e9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928676, "uuid": "a40526c5-4ba1-4fe9-94d5-f93f9f322fd1", "value": "hunting license 13373596.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c42e381d-4edf-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637948351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637948351, "uuid": "52ac5fa7-bbcf-4409-a3b2-15e9871eaf0a", "comment": "Malware payload (Heodo)", "value": "7862c030805a664e1ab87b4797145ddb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637948351, "uuid": "7e2115af-c5e3-4c8c-89c9-3e11983ea515", "comment": "Malware payload (Heodo)", "value": "4fd070e2fc3944e1a5b6ff8b75fb16ed6e21c36a279a2913621c2711d16087ab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637948351, "uuid": "7033c147-a7ed-40f8-9477-8c22be69c339", "comment": "Malware payload (Heodo)", "value": "548caf7c2370a143706bd038e27b1d83961637a0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637948351, "uuid": "aadf086d-48f5-4b48-a22e-f5968b7f3349", "comment": "Malware payload (Heodo)", "value": "27ee9d1f04ee6f34c2ecb1f8973a21780f019c0471b7100ef450915e14595cafb2266f8f7e724f9f3ba3695398370a1b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637948351, "uuid": "8d9c1a86-7810-44c5-8b76-63a61f00f70d", "value": "T15BE4AE1273C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637948351, "uuid": "c19b2de9-cf94-439d-a967-0b8391ea04c9", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637948351, "uuid": "e72da5ab-c949-4345-a10e-45af64befc59", "value": "12288:WKEUkuAOLka1miSmuYr1V7HAobS3qTHPR101D:TEQLka1nBVTAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637948351, "uuid": "a6acaa2c-05c3-4c31-adb1-f97940c3be30", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637948351, "uuid": "a87b71f1-665e-4705-b0e5-dbe877a2e623", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637948351, "uuid": "45bc4493-505c-4787-a77e-250c11d3eee4", "value": "emotet_exe_e5_4fd070e2fc3944e1a5b6ff8b75fb16ed6e21c36a279a2913621c2711d16087ab_2021-11-26__173906.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a312a9d-4e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637912901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637912901, "uuid": "ce2d7bf2-f748-40c8-b85d-9652634538ed", "comment": "Malware payload (AgentTesla)", "value": "ed7632b77847e9e12369e7f0c57d09b0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637912901, "uuid": "8bdb8b46-7358-4eab-81e5-eb41717b34b0", "comment": "Malware payload (AgentTesla)", "value": "5180e81e4b5a4ceea365a30b7668306d8c9f750c2c9a638de692e9673fac0691", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637912901, "uuid": "0181c8d3-eacb-4e65-8c2a-967797fe88a7", "comment": "Malware payload (AgentTesla)", "value": "2f0a6d91f26bc491d0029b017d27026df9bbb0bf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637912901, "uuid": "da451f17-d7d0-4e69-b750-2d351121f3c4", "comment": "Malware payload (AgentTesla)", "value": "e0e510269361549e187cc93285c318cf3b7d942e24dcb3cdbe4a96b61e5d49fdaa10a7f3e64a1b42fa327960ef88130e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637912901, "uuid": "bab3a889-e102-40f2-9e45-3692fe0f243f", "value": "T1F3A4017DB2843F23C98E657A489A920052B0C72BA631F745AD917CEB573B7740B01FA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637912901, "uuid": "2099d29b-8655-43aa-a190-2508c1b453de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637912901, "uuid": "92d2e829-e933-409a-a998-5d4061225042", "value": "12288:CSR5DMXVAmZPnmtrBnXfaAAMZpIbwVoy4Fr:CrX6mZf4va4Zp1yb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637912901, "uuid": "9722c8a9-565a-4cce-90ef-d488c222d741", "value": 456704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637912901, "uuid": "9b2f518f-4b17-43bb-965e-2b78a116da71", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637912901, "uuid": "15784d7e-a134-492c-a8d8-5f567d9420e8", "value": "Payment transfer.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ee8d96e-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931109, "uuid": "dc2ac389-8a01-4389-b19e-c7227fdfcd50", "comment": "Malware payload (Dridex)", "value": "0c7961c9fdc17ba6a0028c93f8eeaaaf", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931109, "uuid": "040f885a-d66d-4d16-a4fb-453e7e74efa3", "comment": "Malware payload (Dridex)", "value": "52b61c02a74823e7c4796603c37506cc1fa258be5d6a54902c262f598b07472f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931109, "uuid": "96df534f-4de3-4372-b553-2d40cdd04196", "comment": "Malware payload (Dridex)", "value": "435744589706428d8114d9a77c8ff42dba435db8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931109, "uuid": "41fd1c52-46a5-47f8-a4e9-f498af175eba", "comment": "Malware payload (Dridex)", "value": "302c84f2af820d7a997088f963a3a29a3804936a7cb070bd9ab554fcc76bd10adeb9fa60a04b6731722412df2e06f900", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931109, "uuid": "e4c931d3-1658-43b7-a66b-d67e6d8d8574", "value": "T1E473F2268E02A868D9F300BC40FC66F1720957BCBC95E45F38F49518AEA07D7DB9D22D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931109, "uuid": "9a5f0b50-cdd9-48f7-b2ac-b6c004eaa1ce", "value": "1536:UWjPqrE3gpMokPF58Ik4kosQFVvSuM8Pw1BKdyyGmRiPxWgdy:V+EwFkd58IXkOFVvMf1AamYWgdy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931109, "uuid": "37ae34f6-5f01-4e98-8647-7d1f91c2187a", "value": 76668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931109, "uuid": "cfee0a43-fdbf-414a-a616-ab64e1a92471", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931109, "uuid": "b18403e0-ae7a-462a-a8a0-99abd39eb49c", "value": "promo code40392.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2af4916-4ef6-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637958173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958173, "uuid": "d4757891-a79b-49a3-9558-257ed66aed23", "comment": "Malware payload (Heodo)", "value": "fb2b087ef9bdab718f828b2551bd3cc9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958173, "uuid": "2c4f239e-dcc3-48f9-a2f2-9b802e5eab79", "comment": "Malware payload (Heodo)", "value": "5349862ea741d27dc1b812ae2f16e828e4456145a51ca0a17678306fd5abdac2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958173, "uuid": "f914b8ed-13f5-4935-8809-34be4ecb5792", "comment": "Malware payload (Heodo)", "value": "97c2c38fc35582e03a53a060b0554e2853d5d511", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958173, "uuid": "45c870e5-fbc1-4787-be5a-f1bb82585646", "comment": "Malware payload (Heodo)", "value": "634895e7d0478fe6778f32063941d4753eb2622ac19ac352007561aeaeefbc010ac6e8fcc082e1ecf8d2ece7719e6f84", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958173, "uuid": "88f85c26-522b-4dcd-b9c4-09af808dd048", "value": "T130E4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958173, "uuid": "30ce8e44-8b79-4f5c-bd70-e2c860be8d0c", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958173, "uuid": "a3dc3f65-21bf-4b09-9cd6-c361aae4e0ac", "value": "12288:FqQlvIOH0GCTBHmPt4eBQh3ico09cDlB4Vx/ID:0uH0GCNeQxi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637958173, "uuid": "a500baac-1cf1-47a4-b541-6ecb615f30b2", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637958173, "uuid": "fdaaa00d-10a0-40c3-b5dd-f9b45db875e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958173, "uuid": "0c3c9350-c3a6-452e-b262-93a15918bd35", "value": "fb2b087ef9bdab718f828b2551bd3cc9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b12cf3-4eca-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637939192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637939192, "uuid": "8c2e5f46-f2a8-477c-b42d-2a862328df30", "comment": "Malware payload", "value": "f40db283c4ac790b963ee6fff60777e2", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637939192, "uuid": "cd985e0d-0a8b-4960-aca5-b4e237d1d3fe", "comment": "Malware payload", "value": "5428dbedf8e4476b2ba746ddbcde0b1104da52a4be9f64e4be0e95102fcc7f12", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637939192, "uuid": "664f5ba1-5ff5-44c7-acf4-6fb080e34189", "comment": "Malware payload", "value": "e8dbec7dac0dabc537a6018d4a5f33577e22c179", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637939192, "uuid": "134791a4-c817-4aa4-8cc1-e72cbf9d7159", "comment": "Malware payload", "value": "2d2abac787a0e9d2fa3269e15292ba1cb198079ae12ddddf3e4a3383dc70452440aea3cf68ebd538574c6c212f8f89a1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637939192, "uuid": "3cfa0cb6-3fbc-4569-bf37-1498181cb1df", "value": "T1F2C5AE2239C6C532E97E41306969EB7A56FD7EB00B7284DB63D85A2E1E705C14332F63", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637939192, "uuid": "f2459ff8-5139-4516-828b-4fa754e9744a", "value": "49152:IR9YBoTjQgDA4NL1kYBqZVhQAeQliQggstwBjKBR1lZZz9xnvjkLYtRNgiDYFGJS:QYn4NLeYcSAprBjKjvXDQi7rGHaZ2G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637939192, "uuid": "de72b5af-2850-4d85-b066-b9940eefbd03", "value": 2655232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637939192, "uuid": "a4278b43-7d6a-4d01-b80f-a42bdc5c8ea0", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637939192, "uuid": "0a4e8012-5044-4aac-a7cc-955ee23ba4f3", "value": "andreblau.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a931f31b-4e98-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637917812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917812, "uuid": "89c70275-aee5-4290-9cdb-b3d2db24fd90", "comment": "Malware payload (RaccoonStealer)", "value": "bad4f83598b9c18722f2cca6bf0410cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917812, "uuid": "fd168d3a-d5d7-403e-98c4-7698cc70ea94", "comment": "Malware payload (RaccoonStealer)", "value": "54a9562e6c77a8e835e44f99ded308a6ce806d0ca09efb7efb6cef376532b278", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917812, "uuid": "5750a4c7-aa0a-40a1-b260-908bddda7b37", "comment": "Malware payload (RaccoonStealer)", "value": "6e10dfdbf25b7990ae45373dca85d54088216621", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917812, "uuid": "8706813c-ca34-4b9a-ac9d-4984f62c5d2e", "comment": "Malware payload (RaccoonStealer)", "value": "1adcfd205a90eb9f8b926c86b10cba9294baad9326782b37104b744e8cfb73b6bf19cf550a8353700170fa3d037766ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917812, "uuid": "9856f4da-74a3-4f6c-8400-e45dc7462d2e", "value": "T1FA548E10BBA0C435F1B75AF488B593A9793FBEA16B3490CF62C526EA46396D0DD30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917812, "uuid": "9ccf9662-4099-4dd7-8fbe-97fc5bf119b6", "value": "ef656273bfb85d28a2059cd3657b6b5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917812, "uuid": "82fd4709-e17c-4051-93f7-b29ba3df9264", "value": "6144:sc/v75fvwN5ch028QOokSXuZet0yy8soe25/Vu0Z:scX9Aj0L87okSXuZet0yy8sm/VV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637917812, "uuid": "ab34f792-32a9-4f2d-9f66-99cc27df4f2b", "value": 301056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637917812, "uuid": "301fefb9-8b40-4cab-abfa-a1ca283b0b42", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917812, "uuid": "7203b1c9-7fd8-42c6-afda-5e8242a196bd", "value": "bad4f83598b9c18722f2cca6bf0410cc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b68055b-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637919050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919050, "uuid": "b8bacb56-d861-4fe2-bcc6-546159684382", "comment": "Malware payload (Dridex)", "value": "0cea842b15be5b2e537ddfed28706abe", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919050, "uuid": "1400d24d-dab2-439c-bade-78da62f8f0d2", "comment": "Malware payload (Dridex)", "value": "551ffee108503aaa811686e21a22388d509a652f7f4876a12de86092e19c596c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919050, "uuid": "95a8727b-ad98-46e2-86b1-2ef7006a4958", "comment": "Malware payload (Dridex)", "value": "510fd4fba4122a2d5cea810cb8d90493ef9570e4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919050, "uuid": "f2dc0c53-b667-4bea-8ca5-fc0b98845b5d", "comment": "Malware payload (Dridex)", "value": "c37e5a27ca488ec7bf050b391b40cb4deb584f0de60cd833e67d430e10221a9d3969d1cae83ba6408adcd5f991a21a52", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919050, "uuid": "7febd98a-c434-4cc9-9421-045f55088468", "value": "T18545D162E36871E4C5739631D03F551F0AB66D2268598205FB723A740D3FBC9BFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919050, "uuid": "551f73b0-1eef-4ae8-b33e-4bc60b894193", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919050, "uuid": "c5fd188d-16fa-4bf9-8602-f52f4f2fa73a", "value": "12288:wGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:h3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919050, "uuid": "c58c5ac2-aa33-45c3-9d1d-750aa3e57b6a", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919050, "uuid": "469e4cb0-c204-4c92-8704-4ccfdd57eb45", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919050, "uuid": "738f9ab9-f69f-4019-9045-d96ad615917c", "value": "551ffee108503aaa811686e21a22388d509a652f7f4876a12de86092e19c596c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fdb4115-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918977, "uuid": "feff0444-9198-41d5-aa6a-047b55c628f3", "comment": "Malware payload (Dridex)", "value": "366013530a4b95379a78c2fdb73c57bc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918977, "uuid": "e8768485-c760-4433-98f3-fc0dc1e5f5bc", "comment": "Malware payload (Dridex)", "value": "559ea4cd5ccedae2401361426823b4c92046f9f997e78b9cf9a1c1e31f9b79c9", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918977, "uuid": "bc9c4afe-0808-4ea4-9716-2daff2ca8565", "comment": "Malware payload (Dridex)", "value": "ef3d3ab238a9c130efde5d42a25d6da283fb32b4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918977, "uuid": "164313d9-2b8f-46f9-9800-491e891eee1b", "comment": "Malware payload (Dridex)", "value": "5864257e00cdb1a1b4b19b8d052eeaf387ac1dc30f2231f07ecc400e3a7179236973561994540b762a2df34512a4d7e0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918977, "uuid": "05319ea1-8869-4e97-af21-1f557504a5c0", "value": "T18245D162E36871E4C5739A31D07F551F0AB66D2268598205FB723A700D3FBC9BFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918977, "uuid": "702ba745-bd2e-4bce-9982-50ff46891179", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918977, "uuid": "1ef77be3-3cee-48e6-8a01-becddd445fa9", "value": "12288:/GVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:+3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918977, "uuid": "d1f00104-721b-4ad7-8b21-0be85c7dbf1b", "value": 1257472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918977, "uuid": "9d92f465-ddd6-4e24-b302-adf8b83ca3e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918977, "uuid": "145560e9-1b3c-445c-a783-ebbf4c7cff90", "value": "559ea4cd5ccedae2401361426823b4c92046f9f997e78b9cf9a1c1e31f9b79c9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83a3758f-4ead-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637926768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926768, "uuid": "5a6f824b-e9d0-4773-985b-c657b1737949", "comment": "Malware payload (Formbook)", "value": "a99234dba0754aed2ad19b49a1bbd20e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926768, "uuid": "a6c15d61-009b-4b2d-b8d0-880f7c110ceb", "comment": "Malware payload (Formbook)", "value": "55b588d9d763bee7e3a03b6bb027af6ccd779fadd9022696d31e102a97f1b18b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926768, "uuid": "35c1d43e-f5df-4245-9657-bfc8919e0d7b", "comment": "Malware payload (Formbook)", "value": "e8112668a5d0fb5fc2305161d68615dcee74db0a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926768, "uuid": "1007de52-7af9-45f5-951c-092a66c66fa2", "comment": "Malware payload (Formbook)", "value": "90d96d0d5861b649fb18c6ac8d753e2d984a17f683b8b5ee72cc17db582cebbe0030400e6a68bfd04259dc72748680d3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926768, "uuid": "ae0811df-f5f5-42e9-9f21-8c16cb613fdd", "value": "T12615290025E93129F1BE07BDD1B715249BED786A540AE7CE5F9530E6ADB33E0890CB93", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926768, "uuid": "aa828c8b-95c0-4844-bfb6-f27580de5676", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926768, "uuid": "6824693b-2a7d-4bc7-9530-6cd866b58321", "value": "12288:qLVaRGVHWBwQGw/ISNIg+yXtX5nRkkQtgpPU8QOgWKRZ0nAHV1FdRKP:yVHugNqIPmOtgpwRZ0AHjRa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637926768, "uuid": "37274735-21a6-4196-bff2-587da984694a", "value": 934400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637926768, "uuid": "4e9ff257-375e-4299-86b8-ccb333d39751", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926768, "uuid": "0416fd38-41e7-450e-83f3-fd9376f951c1", "value": "a99234dba0754aed2ad19b49a1bbd20e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e230041-4ead-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637926759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926759, "uuid": "554c45e5-9d81-40a2-a1db-7960bcbdb49d", "comment": "Malware payload (Formbook)", "value": "463112a0111bd29c88fc7f47d5747cde", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926759, "uuid": "ae7ba1e5-384d-41cc-b3ed-f1f0dba2278a", "comment": "Malware payload (Formbook)", "value": "55cb62507ca0a059b4ccd73090352bc2ca8aef120a329787a3b635a679b6dff8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926759, "uuid": "8426c0b6-3309-4c57-9a5b-0e2b7613e11c", "comment": "Malware payload (Formbook)", "value": "4eb7d7737cecaee414d9c815b0cb75ccdbbb2ee3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926759, "uuid": "2110dc8a-aa88-4d5b-830d-81035cba7922", "comment": "Malware payload (Formbook)", "value": "83c433e2795312beb44ca8545a90cc2359b59e4a1bde10d65061d22f9c9b18a1601d94c33fadc221c40e60e5ff40c68e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926759, "uuid": "f77cbe84-530a-4013-b15a-4917a5b2cc51", "value": "T15FA436AF6940DCEDF355F878C9E490A455A4DCB998BC85A3F2DD3B0E1FAE0258042D36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926759, "uuid": "55d3c0a0-161c-4c5a-a2c2-01b521eed674", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926759, "uuid": "459374d9-17af-4a8f-b1d6-7ef15e9ff584", "value": "6144:MGi5rXajDMDJaRmThzb/Xf/4A7wy+Q1Re0pi2XgXugPidOERs5V+jY:GXoADsO1n/Sy+Q1Re4izDPOsL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637926759, "uuid": "cd6294c1-d68e-44d2-87ff-6fd4a4e4a594", "value": 477783, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637926759, "uuid": "7555086b-5e49-4fd0-860c-83229d8a8699", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926759, "uuid": "f6688d41-fa78-40a4-a3cc-878dba5c21d7", "value": "463112a0111bd29c88fc7f47d5747cde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4033d1-4e83-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637908821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908821, "uuid": "bb364f90-a645-4c09-b0ca-1726b3ac7c19", "comment": "Malware payload", "value": "a3eebb62e809fb584b2257bfa507f27d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908821, "uuid": "6e9abd35-f74e-44a6-8b79-ca0723490701", "comment": "Malware payload", "value": "55d1ddbb4ca69d94b7e9a544027617c280242853cbf319ddba52889a82d57237", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908821, "uuid": "194c7d91-bfd0-42ac-849c-b1717beaf033", "comment": "Malware payload", "value": "726b913533b0e2b58d3bac07fbe6ac6b60a2117b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908821, "uuid": "fb77fd3f-23e0-4d20-843b-67f3f7c35b15", "comment": "Malware payload", "value": "76b0677b49102258196709e6a5532e9c1c2ab5c786852e51fe161c6c42bfa087d353357a1edeb787093c4d4a3dcb3d92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908821, "uuid": "7d400f6d-e4d2-4f38-9401-42c8088fea99", "value": "T1BDB4026417BD6324C6FD4FB7A0B64252733A8222E64FCB7537C2A1A819E3312D7116DE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908821, "uuid": "66433ff0-257a-4cf6-8b57-450778ffd25f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908821, "uuid": "45074116-694e-426f-aebf-b9c1ea16c3f7", "value": "12288:M0DQ9S9kTJmA3dECFn5rvReDO2VNTxgHixBFmduV:M0DQ9XTr3iCFnB5eDtN1si1+uV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637908821, "uuid": "f5763ff6-db57-4a8c-91db-b36acd56181e", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637908821, "uuid": "f8e91b33-3d9d-48c9-b93f-84ce89b04d40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908821, "uuid": "503dd362-123f-4cd7-8001-b1fb04d84ec4", "value": "Factura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac0d027e-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637919105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919105, "uuid": "ec3277d8-36e7-483a-a0b5-1897db6fe050", "comment": "Malware payload (Dridex)", "value": "41ed518bacab22ba8da8b7c5f15ba859", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919105, "uuid": "b7fcf7e0-ac42-4e38-ac5b-728f19028e20", "comment": "Malware payload (Dridex)", "value": "55eddcd9ad0a30bea19917fb692268f64d0368b82bdd21f978f1ce2232091087", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919105, "uuid": "7cdd8fad-7f33-4a4f-a527-e82ce0718bf2", "comment": "Malware payload (Dridex)", "value": "1b2212ed3d9261d2517f1239bf1ef19c71e1430f", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919105, "uuid": "a2c6b7f6-931e-4186-9139-1a0c2b5473e9", "comment": "Malware payload (Dridex)", "value": "b1f1903953c8584b52979dda437178a6118cb9abaa01d131f808d632c5506a77d1d0dec2abdc32839ec742f546a56b33", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919105, "uuid": "2e8a31cc-f12f-4943-b42d-838e57df8b8c", "value": "T13545E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919105, "uuid": "c32389f4-627e-4660-a317-706f3a47e659", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919105, "uuid": "927abea6-a245-48d1-8f22-070691a545ef", "value": "12288:nZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:nZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919105, "uuid": "7a7fc025-8aa2-4946-9204-00bf7fc27fc2", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919105, "uuid": "211e2c16-273b-468a-b555-89c47bae5076", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919105, "uuid": "56fc2ba5-7fa7-4e8b-9969-3246847c6df1", "value": "55eddcd9ad0a30bea19917fb692268f64d0368b82bdd21f978f1ce2232091087", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "130f10e0-4ea5-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637923143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637923143, "uuid": "5e4310ce-e931-41d7-8b93-4eb74b88ceb9", "comment": "Malware payload (Formbook)", "value": "2ac8d894e24bcd30aca57b0fd640250c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637923143, "uuid": "184d3074-77d9-47be-934f-3a8e454e9dd8", "comment": "Malware payload (Formbook)", "value": "5627d54b0f87a8fa0e9a33d2cbce145140eb0e88e77f1076e7658310b742aa83", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637923143, "uuid": "22dc5f35-4537-4a1c-8660-91f273642fe0", "comment": "Malware payload (Formbook)", "value": "734a49e6546fa2e8109bb49819ba8732fedf2806", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637923143, "uuid": "4ef5f9e1-9050-4417-8dbc-0e839f37b377", "comment": "Malware payload (Formbook)", "value": "54f1394d7cf83c1f5e53c4ca84fb05f3c103c0e1c715290bd440c634fa19cb53882bc0a8e7c9ba158d8be730a4adeefc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637923143, "uuid": "bceacf82-c3c1-4767-840f-9bb5a5fceafa", "value": "T163F49E17E9A7D136C5F30E3DB94E1A2864972ED09F63686E58E8FC444B7E384343A172", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637923143, "uuid": "097d0be8-d652-42a9-b1a7-2cac54a9d7bf", "value": "01f42bb56bd8196b0da3b3826e73efd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637923143, "uuid": "08063a32-8e46-451f-a35d-552da5602a67", "value": "12288:HOYMYlxIimj6qr9wMiE+wGFYjA2KY59roDBM6nGplGJY:HOJYMimv+9wGqfKY59cM6GplGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637923143, "uuid": "d2c348ce-cd22-468f-bf9b-d748264de477", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637923143, "uuid": "3c79cfed-2d30-4aee-a4c2-8dc346158f9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637923143, "uuid": "2aa84ae4-548a-4363-9ebd-41ad670ac619", "value": "2ac8d894e24bcd30aca57b0fd640250c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38b94e08-4ef4-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637957137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957137, "uuid": "fb6f9249-f702-4216-9496-d67b5afa8329", "comment": "Malware payload", "value": "e395a1a4c3cc17ea11400d1376864976", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957137, "uuid": "ec14ac89-436c-410d-a258-caa83f5e1bc2", "comment": "Malware payload", "value": "5659ddeba227aad3f57f9c39d3e1236b586360e42bb8705fbabd1ba4eaaa36f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957137, "uuid": "8e80f85c-0673-4305-b19d-60c5c69ee67c", "comment": "Malware payload", "value": "427b6431ea94bbb54b98f5defb4d3b3029382a2a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957137, "uuid": "3811fc7e-51ad-4319-8c94-46e8c48a7196", "comment": "Malware payload", "value": "30debf66f1365424241bb3641920ba57f9bb5f389e97b3987d99ef5aaabe95ba77b4d9d0b1462cd922f5e6cff0b7a9a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957137, "uuid": "d31ab3fc-c319-4a08-ad43-b861f6e177d3", "value": "T10CE4AE1273D1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957137, "uuid": "645beb78-c361-4ebd-9854-3d1c3e1d383e", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957137, "uuid": "d9c191b2-87c5-430f-9c5c-fd01d81dac76", "value": "12288:WKEUkuAOLka1miSmuYr1V7oAobS3qTHPR101D:TEQLka1nBV8AoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637957137, "uuid": "f8dd06c6-8fb0-473b-9ea4-5a020f742861", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637957137, "uuid": "4fa04370-9991-4d98-9209-67a2bc8b97aa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957137, "uuid": "1e8dc0a0-5511-4770-904f-ba1dd9f93897", "value": "e395a1a4c3cc17ea11400d1376864976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d130ad86-4e62-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637894686, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894686, "uuid": "dae0574a-d2b9-448b-b331-271746b6da39", "comment": "Malware payload (Gafgyt)", "value": "2fa3b81fbc020c8e9c3ce28675139cc5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894686, "uuid": "bd267bd6-3c02-41d7-9c93-1d8ed7d1c916", "comment": "Malware payload (Gafgyt)", "value": "57369f6e0838018d863e57d3518a354e540abb869e7eeaff405f6eac1c5935b1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894686, "uuid": "c9e446ba-a61b-4751-912c-a3feb3b6d6b1", "comment": "Malware payload (Gafgyt)", "value": "79049ae36f18961f9d35acc2d6060357370a6036", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894686, "uuid": "86eb0f7f-e465-4013-9be4-50cce1668447", "comment": "Malware payload (Gafgyt)", "value": "275624362f451e1e0411fd225231c4514a313e0f13b6c4cea425355b64955b2d1a8cc65584092b6dae8763e68754017d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894686, "uuid": "1f915c32-1613-4fb4-b558-4339724d291b", "value": "T18BC319A7F800DFA6F40BD67604D74B257630BBE60E931622721739A7AE722D43827F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894686, "uuid": "b577bc51-082f-4339-b3a5-e50b9b9f33fc", "value": "3072:T/tN11wE3EVXY5ayuMbJ3idQlimMet3QBeT9ENV:T3vwE3EVXryu+J3MrmMet3QBeT9ENV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637894686, "uuid": "75bf3532-7885-48d2-98d8-18a819a79a1d", "value": 122135, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637894686, "uuid": "8c1261ae-1069-416f-af41-f2c61e43d06f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894686, "uuid": "2e38a6b3-8d9a-4cdb-9fb3-23e28bc9e032", "value": "2fa3b81fbc020c8e9c3ce28675139cc5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25d21b23-4ed1-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637942073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942073, "uuid": "a2f3eb9e-24fb-4f1a-a46c-92d277e96a8c", "comment": "Malware payload (Heodo)", "value": "662dc4d91a5ef132e2d1189b3a4e02b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942073, "uuid": "7d9b3171-9de1-41a3-850f-7ce71b36890b", "comment": "Malware payload (Heodo)", "value": "57ee582dd61758cc5fd69d467bb4bb3d62c32d566e9f0ea6b61354c45e751399", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942073, "uuid": "26e13abc-1bf1-49f5-b348-4b6f3966688f", "comment": "Malware payload (Heodo)", "value": "bd780d4283f9a83b2892f483501d051680ebff92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942073, "uuid": "6f7ee55e-276f-4924-86cd-4759452a5a80", "comment": "Malware payload (Heodo)", "value": "5d571f5c947f1cb24478cc4134bdbfcf3fd8b3082e694fa1c66db00bc1efb60752a792cc92140352fdd6a31e9b72b253", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942073, "uuid": "1bb58357-ad06-40d0-bc43-5d71aec44c26", "value": "T1BAB4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942073, "uuid": "280cd9d5-8c89-41b5-8250-eb852bc34407", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942073, "uuid": "36c5add9-7eb4-4e06-b9b7-c84e046eaa4b", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDam3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjdXC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637942073, "uuid": "f75a8f45-8cf7-4a3d-b4c6-34ed8425c15b", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637942073, "uuid": "13b3215e-1105-4cd8-bfc0-d9a63c3a1b9c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942073, "uuid": "ba897432-a7f8-4645-8676-81795d909d15", "value": "662dc4d91a5ef132e2d1189b3a4e02b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb5c5b9f-4efb-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637960389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960389, "uuid": "173bc49e-8d4c-473a-99ed-0294f18941f7", "comment": "Malware payload (Mirai)", "value": "1c238b8328b22fea7c18cc2c44db1359", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960389, "uuid": "bbe98ba5-6398-462f-baec-e65e336be2eb", "comment": "Malware payload (Mirai)", "value": "5878f4c9b82024aed62a01be73a2cdf709c085aa445be095bede9983c7bd6459", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960389, "uuid": "d2ab4a9e-2561-4986-928b-6facc2d9dfcb", "comment": "Malware payload (Mirai)", "value": "86193047fbef97094c0d9cae7c218a54c462e85a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960389, "uuid": "7e77fc56-8c1b-4a62-9c67-26a7e2ee9722", "comment": "Malware payload (Mirai)", "value": "e32e51416a84b70ea033f14838bb416b2c353be8c52456eec369b611a0181463f8d052a29b3aed1eebdfedb135e04fb0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960389, "uuid": "3641f448-d60e-4b52-9ab3-5be5321fdc6c", "value": "T1D2337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960389, "uuid": "9a9a4030-83f7-47e8-a882-40787c9653f9", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvGI:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637960389, "uuid": "83501db1-bb2a-4908-9bb7-8489b81c20a2", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637960389, "uuid": "60ae31e0-3226-42d6-a1ca-8ed1c5e4cf71", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960389, "uuid": "8c26c4e2-4b8b-4f7a-921b-383cd7a4c390", "value": "1c238b8328b22fea7c18cc2c44db1359", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dd30c45-4e91-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637914598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914598, "uuid": "3389ae96-0447-43aa-a435-9a8baac100f8", "comment": "Malware payload (Loki)", "value": "5253056e4aa7b17478a877a4e1a95655", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914598, "uuid": "d7be770b-467d-4f7a-96fd-12cbbc51c1df", "comment": "Malware payload (Loki)", "value": "5945c9bd751714e6f7d29ee2fce81522ebfa0d9dfc6b04c7eaaeaab0a2162a1a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914598, "uuid": "1d515720-1b04-4cc4-99a2-e39f7c686aac", "comment": "Malware payload (Loki)", "value": "b93d9ea824b1b4091cc33f5f075067fdf0486267", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914598, "uuid": "80c05b22-79ea-475d-9cf4-33518b4b5345", "comment": "Malware payload (Loki)", "value": "2297e3ced70ffdfaa826bac683720cec1257d1c2dccd28b05994a428c5a19aee7da001004a801ef1df206cb9693e2458", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914598, "uuid": "d22ffb1f-3223-452a-bcb1-3d9f6a56b909", "value": "T1156423928FCE0DD7E346863722BA7D78F37EA5A514A14A1763D02F4D1D6201FD248627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914598, "uuid": "a8ce9a49-e623-40b9-8d02-17d5dc4abf43", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914598, "uuid": "7467a772-b4d8-43bb-b33b-dca438729e95", "value": "6144:rGiffwUD/hhRC+psVN0nTvLoVZU4CnI1/Un4cp0CjxCIg9QhGc9HsED6Dnmk:DfzbhhGTADLqZDyI1/5cp0losED6rmk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637914598, "uuid": "c9d79f01-30e9-4bdd-a4e0-f5f2b971ef66", "value": 333385, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637914598, "uuid": "a3af4b6a-ca73-49d6-bf91-da47f21a8ba7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914598, "uuid": "3afe122a-ab6f-4c3b-af96-e1aa197570f8", "value": "loader2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8d6db4c-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918804, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918804, "uuid": "ef63251d-9e50-4b0c-9fe6-52006e9e6dc6", "comment": "Malware payload (Dridex)", "value": "da2840fc190af8a35f974ccabd4d3b5b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918804, "uuid": "e22d4583-2fd6-4770-936d-a01f3feb7506", "comment": "Malware payload (Dridex)", "value": "5ab7f5960a2652821f3477d035336e8af6c7e2b667e57149b4be94a6fac10e19", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918804, "uuid": "1430ea8c-fd8f-4808-900a-a3e335daa061", "comment": "Malware payload (Dridex)", "value": "8a6dd71bd4586434e68fe7e2f408d2927f3ab17b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918804, "uuid": "6a3a874b-91b3-406f-888d-d933ce273dc7", "comment": "Malware payload (Dridex)", "value": "42096d056437fc7cc5ca60440a29a1ed480e7c763274f2440b4c38a33a7633b5d9c0ec30cd9f17af20d85eb15b82035e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918804, "uuid": "a888f721-2204-4265-bc37-57c2a0712033", "value": "T16965E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918804, "uuid": "08c6a133-2377-421d-b199-97c92f6f5e31", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918804, "uuid": "dddd7454-2383-4d9e-b930-81feca9b39fc", "value": "12288:oZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:oZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918804, "uuid": "e8774486-98ea-49b0-b326-83e45c36847c", "value": 1417216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918804, "uuid": "aebf77b0-dedc-481b-9ee6-1a575aa76c82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918804, "uuid": "ed53de49-c089-4194-a9e1-a595da44078b", "value": "5ab7f5960a2652821f3477d035336e8af6c7e2b667e57149b4be94a6fac10e19", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c8b46d1-4eaf-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637927454, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927454, "uuid": "d9a34268-9e3e-4ad8-aa71-814c30590530", "comment": "Malware payload (AgentTesla)", "value": "e60db5a330e16328772bdba842f29950", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927454, "uuid": "44089f07-f423-4bc5-9a8c-73163268c0f8", "comment": "Malware payload (AgentTesla)", "value": "5b48236bf45c079459c7fb3ba0941ce8de16a248f955615d30da973098595040", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927454, "uuid": "cb3fb3a8-2a16-402d-8922-9fcbed04dd3d", "comment": "Malware payload (AgentTesla)", "value": "7d60f1902b50e4bcde2d5b924616c006263d1025", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927454, "uuid": "9f78e1ef-375b-4186-810f-56046c82dcef", "comment": "Malware payload (AgentTesla)", "value": "2199f07afc9c9e92e3ea0d7e1a749c11454e515ee7847707903d8c91b1f7594490574468c2a7b46ba8fb3299f8995672", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927454, "uuid": "e3f87664-5086-4545-a5a1-dc31a3f84f7a", "value": "T1A4B4122553B84221CBCC8B3670A48255573FA226FA0FDB5837E5B1A91AD631317327EF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927454, "uuid": "6985a43d-9684-4a55-9516-e62311c55bdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927454, "uuid": "88f93deb-5791-4bbe-9872-ba31a5336308", "value": "12288:+lMs0LixBFm0H+Sq/qitHiqFrvX58V54DHptsgTsrq:+Ws0Li1PH+Sq/3tjvX5q54QgTp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637927454, "uuid": "d9a8dff0-3dda-4004-890f-380c42296f91", "value": 508928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637927454, "uuid": "7201d566-f2eb-4a86-8908-2881ee5fa4b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927454, "uuid": "de95a16f-8d4e-440d-9b7d-a48e195b9d23", "value": "Payment slip URhcolexFq2SKzCxls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d35db987-4efb-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637960403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960403, "uuid": "51e667f6-c349-401c-8ac4-107b88e378ac", "comment": "Malware payload (Mirai)", "value": "769cd4f88ddd53060656e1f3b08e3ac5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960403, "uuid": "85f49933-dcbc-4f03-b5e1-60a159e8d822", "comment": "Malware payload (Mirai)", "value": "5b6b5f74abea595e65d5bdd2465164c4dc357b611a2054939edfcfaa5097d7bb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960403, "uuid": "a660cfec-dd63-474a-a019-e0b9152ff89d", "comment": "Malware payload (Mirai)", "value": "d6197c6741369a4ce0797ea3405b0c5ca0ee4a83", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960403, "uuid": "7960d762-54ef-4dad-80fe-1eb0118abe22", "comment": "Malware payload (Mirai)", "value": "c39fe476450de8164263854d8e0a71b7cf2847e7158af53ee2b7ca0c9a4ed2e8737a0458538059d1caca75d8f3250cc3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960403, "uuid": "a97c794d-3eef-49e2-8ca7-a8a3f64031b0", "value": "T104A2D01825CCEE72D170803AD23CC31BEFDB47B652FE713A1E18479DA49440AE3B9945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960403, "uuid": "7f618755-5cee-4423-9345-fc6c5c36e860", "value": "384:YD5mog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSb+4ohymdGUop5hX0:YDgoh/DxCvhdR4IjWVFbS0s3UozJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637960403, "uuid": "ca121ec1-c587-43c1-a73b-91a70e7268e7", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637960403, "uuid": "1aeb749f-f378-4b02-81d9-9debafbf509f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960403, "uuid": "e177fb70-4b2e-4c30-a057-7173b406115f", "value": "769cd4f88ddd53060656e1f3b08e3ac5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0ce6af0-4e4b-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637884861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884861, "uuid": "5b19e534-ab53-453e-b5b6-21ce0c2b0bc1", "comment": "Malware payload (Heodo)", "value": "8023093d8cbb2e6a88d86d7ccd156003", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884861, "uuid": "8b43b5b3-1935-43eb-b977-726870966735", "comment": "Malware payload (Heodo)", "value": "5b83f3026e7bffc6b7890704547052d4a5c6ee67f44c487ff99b6198341188a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884861, "uuid": "8a8d7c48-461f-4aaa-84d2-ba1b5a1cb7a3", "comment": "Malware payload (Heodo)", "value": "e88275c44bb1ef86ea4fb33efd7b9f96a2a8d6a1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884861, "uuid": "18517135-57bd-4880-996f-fcb515eada2a", "comment": "Malware payload (Heodo)", "value": "e2dc403f23507ff5b727c93a5b3bb0b2e70857024f73b6d576886cde53cf187957954f14f9a69588cae20bc214ddb703", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884861, "uuid": "6e21d21f-d655-4cff-8700-cd7e84b1da0e", "value": "T196B4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884861, "uuid": "0dfb5d0e-b776-4b75-837d-fa2047031106", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884861, "uuid": "b56c09c5-8e51-4623-93a9-9232e16d561e", "value": "12288:smVdIG2GDNBtIlD987snRrkZW+mw3ffEPy:sm4GDNBtIl6wSZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637884861, "uuid": "73f3d7e6-a4e1-47cb-aa9a-80a5820d8ba0", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637884861, "uuid": "7b4abcc2-429b-46d5-beed-5226714739c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884861, "uuid": "5309eac6-b062-4cfb-b4ae-c145ef5128ef", "value": "emotet_exe_e5_5b83f3026e7bffc6b7890704547052d4a5c6ee67f44c487ff99b6198341188a0_2021-11-26__000055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f2ff79-4efb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637960118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960118, "uuid": "436e5833-edc1-41b2-8ba3-3b35a9b0a953", "comment": "Malware payload", "value": "eab390679a48f1966fa0dc5411052877", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960118, "uuid": "8eb58efc-a6c1-42bc-a38a-006bce641bb9", "comment": "Malware payload", "value": "5c44c2591657a89363a0ac2643c60a2eaf35e51ffb4b9f817f744726f5f748e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960118, "uuid": "3f95138c-f3dc-4901-9026-d36f7756a845", "comment": "Malware payload", "value": "f1f570547e8866dd223456f5301f189c0df379ce", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960118, "uuid": "ebcba438-5014-4c88-8359-1f2ad6d487a1", "comment": "Malware payload", "value": "5ff6ae4753db3988d44bb36b71e13598960e78b7135bf8474658f2632ae82ecacb4283dd5ca3e3d4e6ab112c2fd9f5ad", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960118, "uuid": "f16d4102-88ce-4d84-94fe-d220ad560ba2", "value": "T1D2F309B0B6FD6C04F0666E323AB743E0959478034EDB865A2C35AB7C1479F81B9B1E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960118, "uuid": "a18f2487-755f-45c6-8df0-ee20a12523eb", "value": "0f8863a869a5fefd6740fa6e44c50562", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960118, "uuid": "3d551c8a-6af8-4a4b-8424-e8ea959cf8e2", "value": "1536:u4C7aLcmyzh6mbEqU/n6NCoPQC/1apMXKk9G3m0eAXYgV1P/JuxMSMOROr6:u4CWYmyzh6mb/U/nY5IcQRIqx/M4z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637960118, "uuid": "c4e5cd6f-8b47-4f66-8cd3-b36c3e415d31", "value": 172032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637960118, "uuid": "b1742f87-6203-4f72-9126-37132240a61c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960118, "uuid": "5c66715c-b2af-454d-a29d-9b7ccb7a2bd0", "value": "Dokumentsides.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33209d82-4e58-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637890126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890126, "uuid": "6b805d29-25a9-45ee-8fa4-f9a327bf12a5", "comment": "Malware payload (Heodo)", "value": "99b11f7138719abf7e58a0253f9c3319", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890126, "uuid": "e477b2d6-3ba1-4434-b161-c8e4449a8cd4", "comment": "Malware payload (Heodo)", "value": "5c8d96612375f49dda8818008280246ec50e2fcb6b25a74254bae23568a7b993", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890126, "uuid": "b69f476e-3fb1-44ce-90fd-6c8d22bf904e", "comment": "Malware payload (Heodo)", "value": "0d211e2f59e83bfe9dfb1428b3d6a9f258d6ecc8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890126, "uuid": "885673f2-ca91-436d-b9d9-90bbebb1518c", "comment": "Malware payload (Heodo)", "value": "86a588e99ef49ba914c85f0f2d5be1f91cccb785ff6066986bab30223ef58bfc4ff92643e65ea6cb42c3c3d9cb3eac9a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890126, "uuid": "7b626ff0-0de1-4c5c-9440-a9f1ba1a648d", "value": "T19CC4BE11F3D2C436D0AF01357616DB9927B9BE61AE758293FBE47B4E1F314C28A38642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890126, "uuid": "4f2e7d55-0ea5-4b92-a2c3-22bc9142fef0", "value": "43031315f82b6fa0235c2c3dae2afd94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890126, "uuid": "59e58919-62c5-4a02-9c4e-a31e992af8da", "value": "6144:fJ4kSRXCb0GNf0QNR+hbspY72fZ84iP/MaDO3HXXqD/hN4+XWrS4raGIKRCBKh:aC1R+6PfZ8l/Mz3HnvTO4p8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637890126, "uuid": "c725f2ff-7e9d-4df1-a601-b21a6bbc67f9", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637890126, "uuid": "df8a6a44-b072-4131-8093-8782a6171294", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890126, "uuid": "1e274268-1a45-4b9d-9500-0efc3966106a", "value": "99b11f7138719abf7e58a0253f9c3319", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75199976-4ef3-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637956809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956809, "uuid": "09c5fb76-1d9b-4d2c-a22d-da2948a507f7", "comment": "Malware payload (Mirai)", "value": "8f2923e8165e7edf20d1e71775a2cd28", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956809, "uuid": "33c9c31f-d21c-430f-8942-7c7a8df84280", "comment": "Malware payload (Mirai)", "value": "5cff909550e6d078fde667c5f21dfc10a676df203f2c0196ee5a49c130202196", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956809, "uuid": "04737617-12c4-4cb8-a261-5504e4cfc5b4", "comment": "Malware payload (Mirai)", "value": "e85d95e72849a5f4b31902f00cfc960ba0bd2b8e", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956809, "uuid": "4723a049-0d16-4a58-bbc1-c6a9e0e3f8a9", "comment": "Malware payload (Mirai)", "value": "f6b3e454a3683c2ac8ca69e4c30556136755bbae7450733a117a186eeaeb9cbdaca200c8330bd722e9e848d4fbd472ae", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956809, "uuid": "5a38cb1b-cac5-476e-8a69-e10bef9a86a7", "value": "T1FFB2CF727015B8B2C7E200B7ADEDDB43FB801AF8D0E873291465099DEAD5C42ABF1647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956809, "uuid": "185606af-deee-4917-bd25-01f471ae744a", "value": "768:5X9nxn8o9wnBoWzEQf2EjKb3p8ms3UozH:5tn+o9wjfBAZ8LzH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637956809, "uuid": "f159ace6-85cb-44bd-b8f2-25bc1da0d9ce", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637956809, "uuid": "a73ab4d0-04ff-49a9-99cd-b290621c4139", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956809, "uuid": "22ba3e0e-1505-4b77-9f8d-0dd6bae13dc2", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00511e3-4ecf-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637941472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941472, "uuid": "96d3b799-d46a-4d6e-acaa-2f9fc13eb0a5", "comment": "Malware payload (Heodo)", "value": "2eebd46ffc2d21fa0dfb499be4b4f3e0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941472, "uuid": "97ad7bdc-cc78-4d75-ad74-46750a6b67b5", "comment": "Malware payload (Heodo)", "value": "5d12c6347154e495560b5dc23892bb8bf82a9a3def35b297c81fd71aae25a884", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941472, "uuid": "1d719350-4dc9-4531-85e4-82da42730cc7", "comment": "Malware payload (Heodo)", "value": "cd1b088d13d7507b256b668f05d64fe1401d0806", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941472, "uuid": "9f007e2a-856b-43b0-9461-49083df2bb12", "comment": "Malware payload (Heodo)", "value": "8223c283ac0a883432785e609c5acc8f3bff29402c2ac2e107be616838b213c865e9388fd0747a0590fdb14fa34d9e95", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941472, "uuid": "aeba9656-6e97-4574-b66f-4ecd24c4e63d", "value": "T12BE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941472, "uuid": "0193f5ae-feab-4c3e-8f8e-6388d4396b79", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941472, "uuid": "1da01914-f497-4eaf-88f4-c4dc0609607c", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhyico09cDlB4Vx/ID:0uH0GCNeQEi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637941472, "uuid": "bfde2e4f-b9f5-4819-9716-75b4da0172b9", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637941472, "uuid": "7d88a39a-a4de-4dff-84b5-0294a7863aa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941472, "uuid": "6fb9daa5-000b-483f-bab0-3ab89a752c12", "value": "emotet_exe_e4_5d12c6347154e495560b5dc23892bb8bf82a9a3def35b297c81fd71aae25a884_2021-11-26__154425.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44450586-4ec2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637935681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935681, "uuid": "9487a5f8-9a0a-451f-85ec-fcfe458abea7", "comment": "Malware payload (Formbook)", "value": "ff0e7f5aa6fab2c63d0285dfd87d2493", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935681, "uuid": "f11d0d98-d24d-405c-b1f9-37be4a519611", "comment": "Malware payload (Formbook)", "value": "5d34c22ad79b26915cf70f298b1a7d93fd2a30bdafe2926fe0a430692e2fbb80", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935681, "uuid": "28ce8705-7391-45d0-ba00-935a28731495", "comment": "Malware payload (Formbook)", "value": "711c860a556f54603b771d11683e5c27ea66d9d9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935681, "uuid": "c6b2f847-7d38-440e-9c9e-a9839c50d4fc", "comment": "Malware payload (Formbook)", "value": "eb376508b33dbd7551390d5bf8c890daf22c3cc878d6560251167dbdb3e3fddc72803f46b98041c6d00b7a276d73eb62", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935681, "uuid": "b625fb4d-030b-4848-8ca4-d6119a2bfd8e", "value": "T1F064231B5BD399BBEBC5107819A397EEF73BC0680005A577AB780E0E32545AF6C4CB85", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935681, "uuid": "b503f1b0-c053-493c-a46d-e7f83e0872c2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935681, "uuid": "4c9d5b6d-1776-4ada-8419-0640c98419ca", "value": "6144:rGiIsu+isEVBiCzXJD4rKI52LdgvLVVg/7FxeIa8MqATiOb6+cE:Bu+i3Bii5srKI5OdgjOPxIqATslE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637935681, "uuid": "560271ab-2c69-4d48-8550-3dd477809f21", "value": 317283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637935681, "uuid": "fbf473a6-23d7-4e09-9e0f-16984b6bdbcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935681, "uuid": "2a8a8e9e-8da2-495e-8117-a27a40525988", "value": "chizzy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "836c579e-4ebe-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637934069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934069, "uuid": "a3e799bb-8e52-4dc7-a098-68837c85be7f", "comment": "Malware payload (Heodo)", "value": "f5df845e932031a758e4ef59be274f02", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934069, "uuid": "3cefcd18-b2bf-4b76-bf9d-bc9868dea512", "comment": "Malware payload (Heodo)", "value": "5e0d39e37b98f8baea7481112b7eeec926bd1f8622d64e429ad964d7bafc3659", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934069, "uuid": "6a75dbb8-14df-4749-a1d9-5be02be122f7", "comment": "Malware payload (Heodo)", "value": "b638fcb4aa6800e0dfcdef5acc4fd2c944c5a362", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934069, "uuid": "95dfae88-cf68-4771-90d2-e3258428504f", "comment": "Malware payload (Heodo)", "value": "f66dea287ed8de64e241e2050957aadcd6aa7fa05e22373e313ccffbec619f55cefcb91d4a4a19e59516d58164fae0b3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934069, "uuid": "422c1503-0c81-42e8-90be-96b307626344", "value": "T1F203BE1EC251F9ACD236D93A81D845A5651D2E11A082BA4930C0B58CEF772FF6BDF35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934069, "uuid": "a4101589-df6c-459d-bc1f-f197f2261c96", "value": "768:1L/I83RvxEpRrjevZCwVI8gBZVWpf/wak8y0VIedb:NnRvKbII/kpw78XVIIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637934069, "uuid": "b435fc4c-83b9-4155-b0d5-ceb34d5b9324", "value": 38049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637934069, "uuid": "e33cdcd7-0716-46be-85b5-cf7d79c3c25b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934069, "uuid": "c00df478-9a13-410d-a190-f678b0561d27", "value": "copyXpayment.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "855bf1ce-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637919040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919040, "uuid": "5929f976-b6cf-4a34-8deb-19d57d1552c5", "comment": "Malware payload (NanoCore)", "value": "ee3398bbda5f43930d7e93c8803ec75d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919040, "uuid": "bf033377-d724-4aea-84c6-7794e3aaa304", "comment": "Malware payload (NanoCore)", "value": "5e4a24907a01aae40c2a0d8e0f194e053f94368f9799cf737fa4f77082ca72e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919040, "uuid": "fadb00b4-6dac-4f56-9b0c-cef5a856e9e2", "comment": "Malware payload (NanoCore)", "value": "eb688c1e5cf6757e73788eadf24a9b0678eb4c32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919040, "uuid": "0658d758-f1bc-4b51-9649-c2c7936bce53", "comment": "Malware payload (NanoCore)", "value": "e92cddf651eb8bed2b562a81987e6d333c1888b4f4c844b3f433df0a908225229dad8ed18a0d8185227c158b568ac692", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919040, "uuid": "face55b2-f38b-4ecd-8263-e0cd171f8151", "value": "T1BF45BE02B3D5C036FFAB92739B6AF26256BC7D250123852F13982D79BD701B1227D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919040, "uuid": "33b18021-873f-4fea-aa99-241c591cf891", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919040, "uuid": "3fdf0ecb-edbd-4aac-b97b-1d40a744451d", "value": "24576:9AHnh+eWsN3skA4RV1Hom2KXMmHaFZyrh9QI/C+EZCBqUIYXmf8MuvWzP:ch+ZkldoPK8YaFZyri7QPIYXLMn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919040, "uuid": "085eef4f-f217-4f51-a345-d27a6b40ee34", "value": 1254328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919040, "uuid": "1c77296b-6442-4a11-a068-7e2721b6796d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919040, "uuid": "21cb4930-47c5-4ced-a03f-bd408757dec5", "value": "5e4a24907a01aae40c2a0d8e0f194e053f94368f9799cf737fa4f77082ca72e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac7971ca-4ee2-11ec-843c-42010a9c0014", "comment": "Malware payload (Redosdru)", "timestamp": 1637949600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949600, "uuid": "e0bca645-7382-4f06-bfb9-ab3140e251bd", "comment": "Malware payload (Redosdru)", "value": "d988a09423318ab1dadafff1b4f27f1e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949600, "uuid": "8923f8a3-2fbf-47d1-8c53-48fb28437d29", "comment": "Malware payload (Redosdru)", "value": "5eb5ed756b14dd3e6898821753d02f24f8bd0595d911f61f772d7d2652d8ff97", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949600, "uuid": "51babdf6-606c-4ef5-b6b4-e23ef3f9dbee", "comment": "Malware payload (Redosdru)", "value": "e2cfe3bbce2e0ff768f10086d8956969d71a06cb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949600, "uuid": "21e31aea-87f6-448a-9e30-a752fc8a0a63", "comment": "Malware payload (Redosdru)", "value": "4a9f57ebc62902f971e497089daebc9eeefaba3e75ef0e89fb4b5f6d37f3df8fe540a6b3afc31f7edebc0b5aa1588a88", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Redosdru", "colour": "#9040F0", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949600, "uuid": "8ff330b6-82d3-4bbf-8f2a-4584306ea261", "value": "T13C12394A6A5290B3F781EA7A417EA7BFC92623531757EB22DB94EC500C12104F12E39F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949600, "uuid": "6a67e2a6-c332-4939-b950-04f2bafb29fc", "value": "e78eab4985965e46cae096eee6530936", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949600, "uuid": "ef8554cf-d3d6-44a6-8195-3e13278511e2", "value": "192:ih1u/Os1q4gZe0KxfSEn+S5cPj4wMuP1oynX:L0KZSy+1swMY1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637949600, "uuid": "4f24f758-ab6f-4644-ba57-b6d486205326", "value": 9216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637949600, "uuid": "4be43f76-b535-4cf5-adcc-035ad71c543b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949600, "uuid": "ded27e16-9b23-4533-a075-6ab0b4d83d7f", "value": "d988a09423318ab1dadafff1b4f27f1e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf5d165f-4ecf-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637941471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "46f5f987-f73f-4472-b0fb-acba72b3dc4b", "comment": "Malware payload (Heodo)", "value": "06e1977e365fdb85122a26efc75f524d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "169556db-bc49-4ad5-93b5-0bbaa2014f80", "comment": "Malware payload (Heodo)", "value": "61bd3e5e4ecac1c0d778c3b2763bfdc3667cbe4a2159a59b6028b00384fd33f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "ab35bfd7-2698-4220-bbc2-697611e1b045", "comment": "Malware payload (Heodo)", "value": "6f2b7b61d9ad7e1d4d56997f65cd520b266a3201", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "b91d57ea-c1ff-4090-a74b-a5dc89cab646", "comment": "Malware payload (Heodo)", "value": "eb96673c1d58c43f56ebac2bdec2e074225f4b81727cc8872882e40c28823e2875400433776ef23d3d5151d215193d98", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "5d811626-08c4-4d93-b1cc-eca90b5083a5", "value": "T138E4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "602c0234-1ce9-42f3-b58e-c6c848716596", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "22ee712c-9a8d-4708-84b5-cde23e410b55", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhGico09cDlB4Vx/ID:0uH0GCNeQci7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637941471, "uuid": "a5baf889-cb34-4d0e-8f52-8601af527af0", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637941471, "uuid": "19bc0952-054b-4e15-9f94-79f21be7913b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "032b12a7-d03c-4cfb-964c-c08f37fbcb48", "value": "emotet_exe_e4_61bd3e5e4ecac1c0d778c3b2763bfdc3667cbe4a2159a59b6028b00384fd33f7_2021-11-26__154426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c9c95ee-4e7a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637904664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904664, "uuid": "655771ed-5817-47d0-8bd6-c45f286a9fb6", "comment": "Malware payload (Mirai)", "value": "7aaceda7e33a5687ce97919d025af655", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904664, "uuid": "a62506d2-9ce4-4c6b-8d90-e913c13924b7", "comment": "Malware payload (Mirai)", "value": "61d130c1b0eeb306c8e3abf85c84499e025ff8216efce26785ba4c239dda2bcd", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904664, "uuid": "2e3d3152-910f-44e2-91df-79d689b379c3", "comment": "Malware payload (Mirai)", "value": "7d782667c57d4ef6e2f1f287be47ed56bf1aa723", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904664, "uuid": "cdff044b-fd7e-47d1-ac16-7ff64428b5d1", "comment": "Malware payload (Mirai)", "value": "38070148faebcba979199432d621b6bbe8ce05b5e8a0ed6ccf669dc0ee66e7a6104834315ed9da7656fe4fba677701fc", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637904664, "uuid": "fda35778-58cf-4d89-a8d6-33f2c301f2a6", "value": "T16CE2F845BE829E07C5C94377FB0E028C376523C8F2EE7213EE153F56E68A917099B4A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637904664, "uuid": "0e3af751-52ab-44a2-83b0-041cf655e96f", "value": "768:IN543de47z/sMT02DYTmnFiwoq4mGw3uLTwTHwbZn:y63YszvDzngbFmi4LwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637904664, "uuid": "d1b814b4-dd7a-483f-9b74-24a6d6e3a251", "value": 33768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637904664, "uuid": "78bfbea1-325a-4773-9c48-d851f8c3d42a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637904664, "uuid": "fcf94049-6264-43fa-9d69-9e7036b4b83e", "value": "la.bot.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed6727cb-4e52-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637887861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887861, "uuid": "a2b82212-dc13-4523-ae38-f89820f9eb66", "comment": "Malware payload (Heodo)", "value": "5527bc68395f999a0be21309d0a6794d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887861, "uuid": "a840148c-790f-42b0-9d57-122fc15758e4", "comment": "Malware payload (Heodo)", "value": "61ff78444b2342a020294b7eae44afa5589327981a4803c44086be14658fff43", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887861, "uuid": "bdc39d32-160b-4635-9b02-8670d02901bb", "comment": "Malware payload (Heodo)", "value": "05abf463a4e865dd6b63ec6ac3a0e47ef0b7ae9c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887861, "uuid": "97886986-d0dc-4e2e-b79b-ca23a3ae9858", "comment": "Malware payload (Heodo)", "value": "d43da0c32be2ba458d0578e1fbced2caa67fadfba4a136d9fd55cfd99d41c34b8c8170c5bc5e69b8fb6af48bc02d653d", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887861, "uuid": "3804edb3-35f9-4c10-98e8-4d39711772a5", "value": "T11AB4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887861, "uuid": "a7a20c19-37eb-44e6-8332-dc2f2e068a0d", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887861, "uuid": "ceabc1ce-8072-4d9e-b9a2-ba1d4e02384c", "value": "12288:smVdIG2GDNBtIlD987snyrkZW+mw3ffEPy:sm4GDNBtIl6wFZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637887861, "uuid": "8a92b090-c879-4f4a-94f9-092faa521968", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637887861, "uuid": "957d56da-2096-4d54-aafd-7f84f7c242bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887861, "uuid": "91c48b22-b5a8-4912-a459-a3ee7b010335", "value": "emotet_exe_e4_61ff78444b2342a020294b7eae44afa5589327981a4803c44086be14658fff43_2021-11-26__005057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1436fc1-4e4b-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637884861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884861, "uuid": "90f5546a-b8ad-48e4-8867-e3571b645220", "comment": "Malware payload (Heodo)", "value": "725cbd047471d29a339f7f199029aa2d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884861, "uuid": "94d7d466-0b18-48b5-ba29-9d6ff8a10328", "comment": "Malware payload (Heodo)", "value": "6249bca4c6f2bb4506de16fb9e071ed55493642042ad6c4ce50bc2e6d2eca546", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884861, "uuid": "c0c2385c-876c-41c4-b3bc-d066e797b1f2", "comment": "Malware payload (Heodo)", "value": "cc14ed95c9c8a86d246183a98e2aae9c20f4c067", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884861, "uuid": "541dd744-6fca-4770-9f84-6569a12f6b57", "comment": "Malware payload (Heodo)", "value": "307ec0ecc555909eaac4a70b634e19597dc4ce023243dd5ce46831e4163ad29b76c6f53fb6ece62b5811028c76749b11", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884861, "uuid": "fb7619ed-0ddc-4f80-b3aa-7ecf3f8df003", "value": "T1DBB4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884861, "uuid": "cfd19e06-08ee-4532-baa0-a10e1a613aad", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884861, "uuid": "b3f58b2e-97f1-445b-8fbd-c2a9c7659cc9", "value": "12288:smVdIG2GDNBtIlD987snNrkZW+mw3ffEPy:sm4GDNBtIl6wOZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637884861, "uuid": "fc5b1525-cebc-4e5c-99f9-ebc3760186db", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637884861, "uuid": "42b21461-a65a-418a-85e2-4c0804928d2e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884861, "uuid": "540be02a-63ee-4dec-8016-0eb0a69fd5be", "value": "emotet_exe_e5_6249bca4c6f2bb4506de16fb9e071ed55493642042ad6c4ce50bc2e6d2eca546_2021-11-26__000057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f8c233c-4eb5-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637930170, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930170, "uuid": "5b0c2099-80c9-414f-8724-eb57577e8408", "comment": "Malware payload (Heodo)", "value": "c3b2ecad5f62624faca59a95842e361a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930170, "uuid": "40ddf596-344d-4177-b514-396aa23d48e8", "comment": "Malware payload (Heodo)", "value": "62b5a497290e98a371eab5800d35490f8ab9f89e981f4ae483bb7c183a9fdd4e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930170, "uuid": "734740fb-7c60-4e8a-9cb9-ed1e117490aa", "comment": "Malware payload (Heodo)", "value": "644f883388cd338b4d7adc13d10ff9e6f981da61", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930170, "uuid": "53ebf031-af55-4587-8126-532eff8d7304", "comment": "Malware payload (Heodo)", "value": "a3addd677bff244ead023e123642488eb3bd46722469d2d6645fcc1dc531d95110922252a561a0fee47f97926d622757", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930170, "uuid": "ad20935a-0958-45b2-b29c-df613b4aba78", "value": "T1F203BE1EC251F9ECD23AD93A81D849A5521E2E105042B94D2580B58CEF7B2FF6BDF358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930170, "uuid": "57a5d306-3d60-437c-93f1-3d1eaf5e40bd", "value": "768:u/I83GhApRrjevZCwVIYgBZVWpf/wak8y0VItKF:unKAbIIjkpw78XVIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637930170, "uuid": "c529ef19-f5ed-42fb-9b91-462c61815935", "value": 37994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637930170, "uuid": "490dedb4-022e-4c16-969c-add47c05658c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930170, "uuid": "cc21df32-8fb6-4df0-ba29-a6b7fbf278db", "value": "REP_462937164623563.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbadace2-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637954350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954350, "uuid": "7b7b8780-3a62-4d13-a33c-b2dbf4dffa7e", "comment": "Malware payload", "value": "a0c4268b5be499e817f45f5dfb049010", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954350, "uuid": "05c7760b-f5df-4f58-a4d4-271a0543aba2", "comment": "Malware payload", "value": "62d54d23908b06fb851da8829798a3d82110e0c189a8794f9d7deb9642f1542d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954350, "uuid": "9c96419a-ca7d-40b1-9887-c3ba3305c05b", "comment": "Malware payload", "value": "3c6cfef86a0e1a2ac7ea7224a15f2b12f22f1829", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954350, "uuid": "93630e6d-a2da-4f54-a881-38dc8bbaeb5a", "comment": "Malware payload", "value": "23e9b2712bdb9c5714d2212c9d9831bdaf4cbdd049cd70af118c3c333e3e5bc4b154d1ead474ff802a7d71cfc954e9dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954350, "uuid": "fb04001b-6ed6-4640-9994-215ed4d6a6f7", "value": "T1D6F43B81A3E099B6C636527A8CBF92985F767F440DF4B9D27ED03A480BB5B40742D273", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954350, "uuid": "755a5d4d-3e22-4c98-a230-f39cce7dbeab", "value": "fa05048bfda17ad908358f66259767df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954350, "uuid": "5eb3659f-e6ca-4164-b0d0-8cf71a53476a", "value": "12288:a+3V1iARDZ1Wv7GFdc6v8cnr3pB7PeDhxYjAyJtWcpEL36U:a+FrZ1Wv74d9lTrbeDhmlJtWf36U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954350, "uuid": "7574b64d-0eb1-4a4e-9e59-ff4846019f65", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954350, "uuid": "7706b4c0-f8d3-4d8d-8e2a-ea21fd4da0fd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954350, "uuid": "2a79a529-558c-4e68-a4b2-c7868368b3ac", "value": "a0c4268b5be499e817f45f5dfb049010", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "354d6170-4e85-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637909457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909457, "uuid": "4bd4c13c-60fc-444a-b41d-83060f8f8bb4", "comment": "Malware payload", "value": "269bbc849d309e1efcca760e801aea50", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909457, "uuid": "ebeaad2f-b693-4a9c-b655-0b178a54601a", "comment": "Malware payload", "value": "6319c7eb7248f45c351456b175b3cc82ccdf5e85d8058d317bca1a1536bfed9c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909457, "uuid": "90fc6acd-4578-4301-aa1a-9033403a91c4", "comment": "Malware payload", "value": "da1d223370a04891153a5ff3e64cdc8837e8ada0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909457, "uuid": "5493bf0c-a340-4c7b-8e24-2ef8ec3780b0", "comment": "Malware payload", "value": "2d91589b356525cd21c16115462ec2ec433edb4448cf0821b04a3911a1ec27663c59d2807068b4749f37a00a6dc28825", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909457, "uuid": "1cfae400-994e-4fd2-b975-69987e315b78", "value": "T1AFB4DF573228A7F2D53C47B7BE53A01D57A22EF59921C2086ED3F1DB28B1B104E60A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909457, "uuid": "99acea79-20b1-456c-8f7b-f3c5ceb8d026", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909457, "uuid": "2d6b40fe-54c3-4fb8-b825-1919a2e551f5", "value": "12288:soLgixBFm7onLuzWkesyr+mguBxpxEwyQeDvzWz:F8i1+onKzW1sQ+mggpe5Qe7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637909457, "uuid": "7ac3c7b4-f1da-4995-9de6-12714f6c4c6e", "value": 515584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637909457, "uuid": "386163fc-2662-492e-bbaf-d5efc4e91d7b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909457, "uuid": "717ba6ce-6072-4247-8768-01defef04c83", "value": "company profile catalogue and trail order.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74fa97d-4eda-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1637946155, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946155, "uuid": "4c17168f-16c4-4382-bb5e-3fa8fdcfaa6f", "comment": "Malware payload (STRRAT)", "value": "139a802a41a3cf3b519da12477dda186", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946155, "uuid": "7e4cfad3-cc34-4c74-a087-770be2f9533f", "comment": "Malware payload (STRRAT)", "value": "636cb98f6293e4bebf2cc5ec0bef87f081dd9002ebbc26f0f0253ac7cfb0cee2", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946155, "uuid": "752f285d-5c86-48e5-b27d-a465961b8a0f", "comment": "Malware payload (STRRAT)", "value": "8ad3d729e90795304bd7920e17d3ea8f54f2baf2", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946155, "uuid": "480a6eec-6853-4ed9-accc-131fc03d774b", "comment": "Malware payload (STRRAT)", "value": "6c08aafdb181761e2f46e68faf90be612ef95df783f10616d4a4781b6431389cb4abc3ac34a8ee886fb5f0b20959e763", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946155, "uuid": "6bfbb40a-b94f-47c4-b0c2-3f6fafb52757", "value": "T1BF04AE106B472BAEC6DACA00E136CD18DFAFE5CDA1D99441F22E384F5BD293402DE759", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946155, "uuid": "3ac049ee-0278-4d41-ad64-a86b594e7216", "value": "3072:lAAAbAAAYAAA8+PAAAAfAAAAAAA1DAAAbAAAXHNAAAAJL7AAAATOAAAjAAANkAAi:lAAAbAAAYAAA8+PAAAAfAAAAAAA9AAAn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637946155, "uuid": "38fb1262-1468-4b70-8bad-0ff2c14ea96c", "value": 186658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637946155, "uuid": "225c06c5-08f7-4306-bf70-d0dc82961662", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946155, "uuid": "78c5249f-d299-4f77-b696-9bd41f9ed559", "value": "Quotation Request.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc84dd5-4e52-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637887892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887892, "uuid": "60f4bff6-69fb-43d2-bd98-2284fd9d849f", "comment": "Malware payload (Loki)", "value": "639143addd8ecd7eba8d22b658d756bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887892, "uuid": "684f3bec-bc29-40e4-bbe9-15ae76efc0fe", "comment": "Malware payload (Loki)", "value": "637e9fc04b3d81b993f12af193cf91bcd701f73b8963a4f14bf110859163e01e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887892, "uuid": "a13d6f1a-761f-40e6-9701-971aa450bea9", "comment": "Malware payload (Loki)", "value": "59385c67a12104bc41fb4c925f5e4749f7a4a33f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887892, "uuid": "9f232e79-63b4-4ebc-bdf1-0a1898b36525", "comment": "Malware payload (Loki)", "value": "296f3c81b792cb89aa0eac394cde3b27be6aa301ad97be12cddcc240b25c8b84015374b97c6cf4de1cf90599cdd3c544", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887892, "uuid": "6b2f078e-a580-4573-8fe5-daec7bb32035", "value": "T10D64236A68C05D33DED20A7719F29B68F3F793C96355366A1BA00E3B2E524C3C49B341", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887892, "uuid": "6bb63233-8538-4133-b7bf-340bf73b15dc", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887892, "uuid": "1e0ef1cb-0f99-4cac-972b-12da3f5e21e7", "value": "6144:rGiCCCdy3K/6W/HRRT5pOn+Ts1A0kzt22d6YAHhqzE5aHQf:xyyYLT5pOn+Ts1VMfehUqaHQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637887892, "uuid": "28d84b34-6872-47ad-9230-22a720f42048", "value": 311865, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637887892, "uuid": "3c2d5820-73b0-4fb4-a118-2a762ac6c7c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887892, "uuid": "3f7d4c69-dfcf-4074-bf74-97d482695095", "value": "639143addd8ecd7eba8d22b658d756bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8845bf9c-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637919045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919045, "uuid": "2e8283b0-e449-4090-9581-17f3ea08f322", "comment": "Malware payload (NanoCore)", "value": "bf906f942d13d30c680057e96ad38074", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919045, "uuid": "ed7a7564-5c71-4b33-8c2b-9ef57957f3a9", "comment": "Malware payload (NanoCore)", "value": "63aad73063b5ee7273f4d031dc62a8467cff8231bc533a9665971f3631978a47", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919045, "uuid": "a65ecdd2-e6a5-4a07-8250-1b6677ae878f", "comment": "Malware payload (NanoCore)", "value": "1e21450aa867be118d3623952ed08bdf82472454", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919045, "uuid": "72e1b437-0fd1-4ec7-8758-f90f15bd6391", "comment": "Malware payload (NanoCore)", "value": "39fd6f43339e476dcac4d7cd473e92b5020e1b71d78dfc0d7f8c3cca53589ecacab0a98187754289bfd64971aca0ef70", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919045, "uuid": "94ba252c-b7b1-4dd7-b5d6-d25713fbb96a", "value": "T1CD45BE02B3D5D036FFAB92739B6AF22256BC7D250123852F13982D79BD701B1227D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919045, "uuid": "c15f2c6a-7fa2-4e92-b9bf-38d6760576bf", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919045, "uuid": "6a23e0a8-b46d-4a43-a618-1141795b5ede", "value": "24576:9AHnh+eWsN3skA4RV1Hom2KXMmHaFZyrh9QI/C+EZCBqUIYXmf8MuvWzW:ch+ZkldoPK8YaFZyri7QPIYXLM+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919045, "uuid": "fed493b9-db04-4094-b0c1-16de0de59340", "value": 1254296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919045, "uuid": "5a643211-1d80-44b5-80a2-68f04063afc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919045, "uuid": "20088d8b-c2ef-4774-b9fc-69f7d991200f", "value": "63aad73063b5ee7273f4d031dc62a8467cff8231bc533a9665971f3631978a47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6a1ad0f-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931122, "uuid": "8cefce38-4995-47a2-a838-a0558f67856a", "comment": "Malware payload (Dridex)", "value": "c2c827e43ca3d3452180dd36bc52b582", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931122, "uuid": "c121aa42-9cb0-49af-baf3-770287efbd2e", "comment": "Malware payload (Dridex)", "value": "63ce1d00cc40a7870cff0f8256f54b786255f9928e6c9747d4fb7c3fb83ba278", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931122, "uuid": "1a20e85c-e4e5-4c6e-8a56-26758790031d", "comment": "Malware payload (Dridex)", "value": "a922d550d0d0af0434d71fe2066417d1ff82f2c3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931122, "uuid": "d3633b0e-83c0-4758-a21d-08e8a9045b82", "comment": "Malware payload (Dridex)", "value": "e2b7f7a5550c8d8638ad28a74a76409bb5e2c7c500eb1105ae5fd8bf097b5ffede11491d58abd2a85a7d9233bd476db0", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931122, "uuid": "3bc9feb0-db68-4259-a783-06ecba2a22cc", "value": "T1E663F19E8994F509E722DDBDCF2A5CE8E3060A533919D56F24E9B30C2E663470FDC069", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931122, "uuid": "261d65fb-d84b-4060-b13b-7a0e7611dcc2", "value": "1536:UWbPuALLImemeKHqeK7Yncl60eEbRn+mvgdaO:Vy80XKUYSrR+mvgdaO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931122, "uuid": "dd68a10e-9890-4265-9aff-aa9fadd5e12b", "value": 70697, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931122, "uuid": "9b84a0ea-d798-400b-90cf-554377fb7bf5", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931122, "uuid": "c19fcb64-ba55-4398-a2b1-6fe0de063b61", "value": "subscription-068379.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31e5e2f5-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918900, "uuid": "5af74a05-8788-4a3e-9a57-806b3d3aca08", "comment": "Malware payload (Dridex)", "value": "e57e81a28fe78e44bb3ff92b0aa211b0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918900, "uuid": "18b92e49-f387-4323-acfa-359eecff7b1b", "comment": "Malware payload (Dridex)", "value": "64eadd3a1fe874e2299e3f3321a478a3bc1c2e530ae28fefc4927d1c7771bb92", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918900, "uuid": "466db7b2-1c2b-4b90-afaf-6e66d5b2c53f", "comment": "Malware payload (Dridex)", "value": "087ff74a9232abeabe0bdfd835690820fa990718", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918900, "uuid": "7b5c6282-df1b-470c-a94a-72bd031a7028", "comment": "Malware payload (Dridex)", "value": "3fa2a01236bdd9fa54b3bac1ead02268d6085ef3a8e37d65440c1731377fc560122a7631618ed8ebe0af652f9b1d034b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918900, "uuid": "42eb622e-9b46-4e45-a04b-485cd369601d", "value": "T1D455D162E36875E4C1639532D03F151F0AB66C226769C205FB723A740D3FB89BFE9129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918900, "uuid": "35ece3c8-5cf2-4545-9199-1d8fe132541a", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918900, "uuid": "dc4e34a5-f86a-40f1-bd7f-7a97ae048e3a", "value": "12288:eGVNJAvuPFUl/faxuVlBLXKCgFfEK7JRLeHlX//ve7TY:z3JAvRl/fKIKCgFfx4P/va8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918900, "uuid": "b0363f6b-8256-4268-9394-3db1f00c6eb0", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918900, "uuid": "c87862b3-15a7-4120-9ec0-2075c1095e37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918900, "uuid": "9f56a607-81f7-4555-8b12-5bc8553d2607", "value": "64eadd3a1fe874e2299e3f3321a478a3bc1c2e530ae28fefc4927d1c7771bb92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed56285f-4e52-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637887861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887861, "uuid": "4563793d-1362-45bc-a20b-5c7b0eb0bc03", "comment": "Malware payload (Heodo)", "value": "8aea5545a3ee9cd0e19ebee9f8c41e22", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887861, "uuid": "693537ee-2d00-4667-95b6-d546dbdeaa6c", "comment": "Malware payload (Heodo)", "value": "657981385cba9e34cf109f034367628d584b62455a2e03aff8c200c79988b4cc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887861, "uuid": "6ba94df8-ad95-4f93-a273-5fc73e77891e", "comment": "Malware payload (Heodo)", "value": "f87cf71d8cb149ee4cf331ca208dc6b813049a10", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887861, "uuid": "c5a6bb3b-a3bc-44e4-86f3-4219251673d7", "comment": "Malware payload (Heodo)", "value": "b4a144498acfeb27cfac0a5e8cc485f049e2107aa79835d150ebd755af0e59fa646968799c204383086e3f92ac499b4e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887861, "uuid": "279f7fa0-0b85-4929-bc97-e7fd30ea54b4", "value": "T1FFB4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887861, "uuid": "5179023d-996c-43c8-ad92-b9f8d1fb3b08", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887861, "uuid": "65e223b6-61c9-4a06-97f8-6fb09d63ef01", "value": "12288:smVdIG2GDNBtIlD987snErkZW+mw3ffEPy:sm4GDNBtIl6wfZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637887861, "uuid": "511eef23-2c93-4d34-bafd-5f7e5c37103a", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637887861, "uuid": "fba7e9fe-b7a8-4c45-b765-1e9c1835bf1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887861, "uuid": "73f8fc4f-6f1a-4500-b0cb-8b9d42462682", "value": "emotet_exe_e4_657981385cba9e34cf109f034367628d584b62455a2e03aff8c200c79988b4cc_2021-11-26__005057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9d2155b-4e96-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner)", "timestamp": 1637916954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916954, "uuid": "7a604a0f-43eb-4221-92dc-c7fac2debcba", "comment": "Malware payload (CoinMiner)", "value": "0767fb874bf23423f828694e1845dd52", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916954, "uuid": "9f8c91ad-5855-48d4-8dcf-682ec5159ebe", "comment": "Malware payload (CoinMiner)", "value": "65a90f7ce88c21097bde9575109000efa1832a51d0cbd9c47ef701838884ca4f", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916954, "uuid": "e9a4e31b-e1fb-49af-a3ce-3b8ef9723483", "comment": "Malware payload (CoinMiner)", "value": "dc320d23d3e672bfe7368f36435c346165dbfc7c", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916954, "uuid": "f10977b8-8f22-4586-927c-d92721307471", "comment": "Malware payload (CoinMiner)", "value": "86296558ed38838ad36203cf5eab091692832f806bdef8ebd17380708b8b5d830d043e634bb4d3bc1fe86b0d221a72bc", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916954, "uuid": "deb2818d-d9ff-416c-9aef-6fddf9b64085", "value": "T12B9623AD6298335CC41EC4B4D427FC49F1F6531E19F58ABA70DBBAC07BDA824D502B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916954, "uuid": "bd55d1e9-9790-4e3c-915b-514b2462d0c4", "value": "ca1bc56825379f5b034a1b6092fa2cee", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916954, "uuid": "cfdcb31d-5b29-475b-9dac-32e827642ba8", "value": "196608:iuLar9NWDfqx9PSJe+SLUBvGIZWl5kDG8jvpwLM7QN/LyC:rmnWD2hccLsG+WAp2M7g/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637916954, "uuid": "969b4d4a-9ad5-4386-ab26-1eb0a980ba67", "value": 9290240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637916954, "uuid": "75145d80-9c7c-4e56-a2ff-ba98ab1519d2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916954, "uuid": "a708a23b-3482-4636-bc71-50f4b832a6f3", "value": "0767fb874bf23423f828694e1845dd52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "53b8c868-4ec2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637935707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935707, "uuid": "923ae9b4-ae4c-4caf-8fb6-2721ef4c2ab0", "comment": "Malware payload (Formbook)", "value": "6d41337fd9b4fd0a9c5fdad674e3b456", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935707, "uuid": "bf762d71-c889-42d7-8fd1-f28bdb3c6bd2", "comment": "Malware payload (Formbook)", "value": "66240d21d38ad719384b072b30d2c5a9cf4b4c978869b2e6e5e1e31a41a192e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935707, "uuid": "5636e05c-ce77-4442-9410-7b81911aec5f", "comment": "Malware payload (Formbook)", "value": "c3da466318c1ba0a1d637aac1deb4e81f90f93f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935707, "uuid": "1ca0c4eb-fbf9-454c-b588-4874a008183d", "comment": "Malware payload (Formbook)", "value": "5b67ca22a9bbe4a5ded863a00c7416a90a0ef3f927ed772d2e1d9144e2d2dc04641cc880d4a80ab2254cc40689ee6364", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935707, "uuid": "5f6c2455-7bfa-485e-b9f2-604d6f64f27f", "value": "T19E64121963D1AA6ED3EA02315EF29F31C6BB9C6094F5F7D78B884EC9791CB51200606F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935707, "uuid": "e354b23c-2f57-4d50-9b8b-fea5afe2e00b", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935707, "uuid": "29e7171b-745f-4374-a4de-d832d3a37205", "value": "6144:jGi/pUyOGWsBvL9V6pIzpgOXMskaXUy+eViezYsDKJGSRZp1:tsG7Bv5V4IzSyeL/eViHsHS3L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637935707, "uuid": "b7cf690c-2523-4b94-98f3-13cf156d4daa", "value": 324562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637935707, "uuid": "d07b2744-be5f-4028-acce-bbb372f857b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935707, "uuid": "4c5b5356-e428-47e0-9384-0bbd523d0c62", "value": "RO20-1902.scr.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0cdf677-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637921717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921717, "uuid": "d8a1fe53-123e-434d-aac3-87ade8c7b09b", "comment": "Malware payload (Loki)", "value": "26b192bfb398076a4c905bd0e54e7338", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921717, "uuid": "13888d81-7ceb-49f6-8428-a7aa78328531", "comment": "Malware payload (Loki)", "value": "6698474885c2803fef2fbeedea7630259f94524cc9847c497d16bd6f33dd50b5", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921717, "uuid": "c4fa0ca7-b387-4666-b846-53f5ee72e88a", "comment": "Malware payload (Loki)", "value": "6c119c93fc05433fb58088411735b71bcdc5c87e", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921717, "uuid": "be2e4de9-610b-4963-9acf-7c148afb175c", "comment": "Malware payload (Loki)", "value": "40d8e892fb610e6b84a6289fee0214738008b81c5d99d14e9c944ca92c5a77cb772bb9157c18ff7597862eed1dc8491b", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921717, "uuid": "f50ab2e6-f28d-443c-98aa-54bebfec4eae", "value": "T1733412103D9CA3E8F8B1473F9A146B38BE30CF20570F91C697AE796CC2B984567A4197", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921717, "uuid": "4f212a71-dca1-46a4-bbc4-bd4266375f02", "value": "6144:lwzoKFhHL9RT82nQXMobKoit/LbOerSxDNNN0zJxdb8dfPc5:lqoK7T8vMoeLLxMvNCxdIS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921717, "uuid": "7ac38b80-3478-423e-9d0c-172c46996db3", "value": 234264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921717, "uuid": "307871e4-8ddc-4ca7-83c4-03e6e30f43cd", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921717, "uuid": "d22a775b-8f79-4f84-baa5-0e6623fbd1e0", "value": "Product_Specification_Sheet.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f96ea62-4ea3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637922493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922493, "uuid": "4d1383ab-554f-45e2-8b21-9ab8a11393e0", "comment": "Malware payload (AgentTesla)", "value": "90b9a35b051f3f6e72e04bb5d84aa767", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922493, "uuid": "9dda0082-d8fa-4ad5-8f90-988eb6f7604f", "comment": "Malware payload (AgentTesla)", "value": "66f9f0931d20f98e044684eb871a348227a8cc3979c80d5f961d9211e7bb5ace", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922493, "uuid": "7c58ec62-c13d-49f2-975e-548f7b4241a0", "comment": "Malware payload (AgentTesla)", "value": "a9a6c5724376d6e16bcf17c27be8e191755ae760", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922493, "uuid": "a71e0864-b607-498a-84fe-c623d729ee1c", "comment": "Malware payload (AgentTesla)", "value": "9cf769dc1989af316cb7d5df887e6ea2ab8196885590282a4235fabbcb48ab9f2637f4878a36ee3fd17d076a3b9b25d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922493, "uuid": "6b75c5ec-4522-44b6-8442-82379985cc78", "value": "T184A4BF332645FCD96FBE1E80AD1429950C647D77AB6C82ADFEC101D274EA108EF1B9B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922493, "uuid": "3b793080-c8a6-4aee-b800-573625f89275", "value": "6144:WsERLnRO1YGSjdoq15ZpbKZkgBane7s9xaomeSKaVthG+ZqL/D2t8Rc+/0vI:j4S4dFJp2zm7YZSvp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637922493, "uuid": "dd006418-427b-4b27-b25e-bdcd11885764", "value": 469268, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637922493, "uuid": "00c3a8eb-1033-4fe4-a645-d5173afcb683", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922493, "uuid": "1ed51dad-3ca2-40ce-8d2b-9a39fb2918b4", "value": "Details for your information.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7046069-4ed6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637944544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944544, "uuid": "46d01259-ad24-4ce0-adc4-5f3afd9a65e9", "comment": "Malware payload (RedLineStealer)", "value": "df5e6fcc14b6fe0b408ad9f58f990d8e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944544, "uuid": "5868bcb4-15cf-4c3f-851e-baf9dc33e355", "comment": "Malware payload (RedLineStealer)", "value": "66ff0927c5240a491e4ae01c5ed98fc31fe365bc300aafff76ee29872ef1ede5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944544, "uuid": "491148fe-a5b1-4cea-82f8-6b0b6f4a90ed", "comment": "Malware payload (RedLineStealer)", "value": "8c3ed6290e0100236a023568fc2a89bb9ae59d1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944544, "uuid": "d68654f3-c245-41a8-bc2a-8f0f51e3173e", "comment": "Malware payload (RedLineStealer)", "value": "9055280ffc60be57e70da260885c0bbb9a2ec22637811d2673d1bd446cd155f1444c4572dc6758fad7764744f54b8f4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944544, "uuid": "92fdee00-7344-46b6-88eb-e6e6a611a91e", "value": "T1669401036DD8FB18A4915C3381CF6E291BD22DD28B7255462B59FEF412A42062E3BF7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944544, "uuid": "a4aea736-5002-43c1-aca4-86efc882f849", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944544, "uuid": "96d7f1c6-63fd-4e94-bece-aa8f49db6cde", "value": "6144:ncHCnpr/5teA2FtglbDvbHdRmX7wrYNc8eR3iXc6v1ue:ncuH4WLbH+rwr9i9ue", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637944544, "uuid": "962d51fd-c6ee-4d0c-b596-b24686e0aded", "value": 431512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637944544, "uuid": "cae8de62-422b-4331-9a4a-ee4df441c784", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944544, "uuid": "08987eaa-d6dd-4252-83fe-fffeaa794fae", "value": "Auto_Install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7e0b0f9-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637918749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918749, "uuid": "11178cff-eb0c-4a31-88cd-a045e4770a55", "comment": "Malware payload (RaccoonStealer)", "value": "bfe257194270a5d311e7de87a84c146a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918749, "uuid": "6be50126-6384-4455-958f-062071b31ae2", "comment": "Malware payload (RaccoonStealer)", "value": "6702aa89016e59e96f54642193ffcd79cf2327299aa4c3714114bc877ad9a589", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918749, "uuid": "3d93da91-72b0-4c68-b22c-d788538d2ce8", "comment": "Malware payload (RaccoonStealer)", "value": "5889114337290c18cd15bfd99b8466f7d2e0693d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918749, "uuid": "3ad165fe-a91a-48b6-8316-1e8f8027604d", "comment": "Malware payload (RaccoonStealer)", "value": "4b55a78a9c43b9cfede0465d9a5389fc3bf934d05431040b943897169263da1a0c00264ff97c059a1f1977c5652a53bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918749, "uuid": "d4f75be2-32e7-46a1-8b4c-1bac8b3f5d8a", "value": "T1F1E3CFE036D0C035D3A7693178B49BA11E7ABC731A75828F37A8162FDF312D04AA575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918749, "uuid": "29eac6a6-0163-44e0-86bc-0abcf4f81bfa", "value": "a967f53cbb69a203dbf386eac93050cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918749, "uuid": "2ab881cb-6a38-4480-b63b-7f9b13956a88", "value": "1536:T/y8eanRHPSXubr1md2cG4WnCZevUqLHtqcRmBySTsPRlIQa/+tUjlg/2:Ta8eanZqCrEAYOUqZ4ByKsYt+tr/2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918749, "uuid": "353ba408-7be8-45e0-85f2-eeb9692c669d", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918749, "uuid": "f1c249f0-aee8-4b31-a969-2256a8019cf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918749, "uuid": "0708974d-05b0-4dd8-a795-859ff6869c65", "value": "bfe257194270a5d311e7de87a84c146a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905296e7-4e90-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637914334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914334, "uuid": "83fe163a-372f-4c87-9bef-c6512b5c0e06", "comment": "Malware payload (Heodo)", "value": "64f67a94fa3648839edc2b714d86dd7b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914334, "uuid": "4d5c7af3-9c46-4a1a-90b7-c340c59e5e19", "comment": "Malware payload (Heodo)", "value": "685ca45b9a2d9acd96e32ba3055b4a9e7e57964e644f403ac62ada0a45685eeb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914334, "uuid": "7bcdf721-b2ac-41fd-b4a5-111222672917", "comment": "Malware payload (Heodo)", "value": "6ee3018eff52dfdbddd20b3c5300acee9d9d9842", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914334, "uuid": "c48aac79-5dd9-4899-adb6-60bd543c330e", "comment": "Malware payload (Heodo)", "value": "1c0a53903e5659224a4a193891f4810a455e0cc6421baa3deb2af77f2d39a931fade55878f593ecbc6e6551e4f42ab2a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914334, "uuid": "f9970fdc-6734-45a5-89a3-a4c9425b9279", "value": "T17FA4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914334, "uuid": "2ef22a69-bfc9-4df6-9607-7148cc9e8650", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914334, "uuid": "bc66a8c9-9618-43ca-9341-bf97ea7469cc", "value": "12288:o4xZ0/tI1BD2LETv0FhjO9U6W8XUDaBN7a1vt:oED2LETvMBb6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637914334, "uuid": "55e6b4f6-2210-4b7f-98f0-1d38f55f6a2f", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637914334, "uuid": "fd35ee13-40af-4a52-a8eb-3ec7664d804d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914334, "uuid": "d94616b9-12cd-492d-bb20-c773e1e6a756", "value": "emotet_exe_e4_685ca45b9a2d9acd96e32ba3055b4a9e7e57964e644f403ac62ada0a45685eeb_2021-11-26__081209.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "119c2851-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637954065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954065, "uuid": "90a0de77-3e57-4aa9-af95-7c23f038fd5b", "comment": "Malware payload (Formbook)", "value": "4451e203f7492210b9cedf00680b2883", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954065, "uuid": "5ab77ada-4891-4fda-bc76-f1c0ee153139", "comment": "Malware payload (Formbook)", "value": "6876e8698f67c2b477c89b891199d3485051a14f52284f39e35a8e8057f53fae", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954065, "uuid": "6128eeee-75a5-4f3d-9f4b-9623369b8ff1", "comment": "Malware payload (Formbook)", "value": "fb5dec7439c4250b9d425163fc87d20e99238611", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954065, "uuid": "949d0285-fbd5-41cd-a7fd-16db3246a064", "comment": "Malware payload (Formbook)", "value": "5520ff3bb590ce9059f35a7e7df64b528e63dfca762c67bfd1d432d4fe2eae169fd32a81acc15fd890f7bbaeef60f429", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954065, "uuid": "fb70222d-7f8b-4cf6-9144-d2feb074643e", "value": "T149B40105B96E6F14C57C07F38482A1C283FF99DB9690E39E8CC630DE1A92FD64557A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954065, "uuid": "e2960052-46f8-41a5-ad6b-c420803ff656", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954065, "uuid": "99cacfde-b2cc-46a6-8666-3a85a758a57c", "value": "12288:Eq53APLkoL/ixBFmNuvVQBmAUKY3VwCG0W4iwengeyHJw6D:Z5yhri17vVamD7G0tzr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954065, "uuid": "7a86c029-ac42-490b-b9e4-32a9b0277657", "value": 516096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954065, "uuid": "e777ada1-df61-478c-baf2-c267bbff647b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954065, "uuid": "d378479f-b8c0-48b1-8865-92fc620a9364", "value": "4451e203f7492210b9cedf00680b2883", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4bfd45-4ef4-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637957144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957144, "uuid": "d57b1952-78cd-4c9f-8205-3e1ff9fbe20f", "comment": "Malware payload (Heodo)", "value": "786b2fb6958f107ef0aaaee43affd574", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957144, "uuid": "e0b0bff3-e5bc-4047-9e7d-effbc97557ce", "comment": "Malware payload (Heodo)", "value": "6880d7e5d3ae924810521df084c7d5d6843bce1b33552c67382e4e32d04852ad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957144, "uuid": "83814f57-1d36-46f0-b09e-af57ee31567f", "comment": "Malware payload (Heodo)", "value": "088cd783fc41fd7d76b17adb68125f8ce9fa8ee8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957144, "uuid": "aa50f8bb-ba37-4a07-8663-3902765b1b05", "comment": "Malware payload (Heodo)", "value": "37540a6ed01d72ae007bba12ffb23a9085ff1bfd63110e6b6d4ab96915c7c63ab51544de21aad2ee941540c362892d28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957144, "uuid": "0bc5f7d3-9091-4a93-9093-1d29c69ea7cd", "value": "T1DEE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957144, "uuid": "50650d72-2ccc-4bf7-af3a-6134882b661b", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957144, "uuid": "dcec0196-aeaa-494a-abf5-2ebae3c85fb1", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhsico09cDlB4Vx/ID:0uH0GCNeQqi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637957144, "uuid": "ca4d79f6-38c2-4191-9a88-1e79b439e681", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637957144, "uuid": "bbba2352-290f-4132-8756-e37ea608df4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957144, "uuid": "6660e944-be74-4aff-9e96-1f4c82af1f64", "value": "786b2fb6958f107ef0aaaee43affd574", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b71718e-4e9f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637920554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920554, "uuid": "c0c7ae0e-dc57-4e27-ac66-519923b9fbb9", "comment": "Malware payload (RedLineStealer)", "value": "9cef7fd60a2c86dfad46948b68a3e607", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920554, "uuid": "c54e32c9-b34b-4c2d-beee-e71dd6ff081f", "comment": "Malware payload (RedLineStealer)", "value": "68e08a18772a04308624bd35c23aa98050e4baa1bc6e4d95c281571db747c5ab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920554, "uuid": "3810c6cd-c0cc-424a-b34b-c59b6e799e5f", "comment": "Malware payload (RedLineStealer)", "value": "0020e4adce038822d9e2dc3ef1ce943ee827811e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920554, "uuid": "4cf2c75e-08ef-44b7-af75-6a55ee49211c", "comment": "Malware payload (RedLineStealer)", "value": "a2f886139fa5c904735fc725443be4ebd1080dd5569acd28c1f674d0e755c5d7255f99c70c170b77279db5f56f6050c1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920554, "uuid": "d28eed0d-10c2-4fb0-bf24-182a7e09448e", "value": "T1B2E3AD21F6E1C075E5A3263D68F49AA01E7EB83255B4C14B7758123F1FF02D08AA676F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920554, "uuid": "559e954a-ab9c-4332-9ee5-30968a19275e", "value": "30633f34504d0e28d8bd0b63cbcfe112", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920554, "uuid": "70d4d341-2dcb-4992-91da-d7c1ecd6d92b", "value": "3072:EbKefv7G6+Lhn8sB39MCtXH6FwfGdaqmvdLn6Q2:YrG/hn8sBNMOHi6pVuL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637920554, "uuid": "a0db9311-1aea-4353-a4e5-f01ed5ee5e7f", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637920554, "uuid": "e23836ac-7ebc-456e-ae73-aa91b08e8db4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920554, "uuid": "a94dca43-8383-4894-a17d-478f91b886a1", "value": "9cef7fd60a2c86dfad46948b68a3e607.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11bbaa4b-4ebb-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637932590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932590, "uuid": "ab34ad59-3888-48f7-9204-7e4d06b65145", "comment": "Malware payload (Loki)", "value": "6580579446983db99ba7f0870582a13a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932590, "uuid": "0f73f79d-82ea-4ccf-8d64-138e1d990b40", "comment": "Malware payload (Loki)", "value": "69610eb2689986f31a48f809678ffbb9e1d902aaf32a7987584b79e04d9d815f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932590, "uuid": "048eda62-266a-4a26-aef5-e897935c6823", "comment": "Malware payload (Loki)", "value": "948c5b9973e1395d28da68c564044b4e2bd50b5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932590, "uuid": "3b9229db-9747-45f6-b92b-5ea3e90c6508", "comment": "Malware payload (Loki)", "value": "ef6f0c2a8b9472064653df47a715a2c41ba5d83fbdeaae69ee8a6d535f86ee105b8d3c5f7a3aa4660f5eca56a5e0750d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932590, "uuid": "f0c35e0e-c82d-4749-af30-b3f9e9af6dd5", "value": "T16084F119B77DAF12C93C07F7989A910053F599A723E1EB9E5CC3B0EB1915FD9000AA4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932590, "uuid": "6a1b5452-0ad3-4dc5-8173-3fd0a6dfa98d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932590, "uuid": "55d9e8cd-48d1-4def-8961-be0624dd10b7", "value": "12288:HCEIkpj9u8oLMZeMrQVQojp70jT0mD0z7uBixBFm:iE1pjwVIcxpgI0i1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637932590, "uuid": "bb07bac9-15b4-4b6f-823c-cf9fc0669b18", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637932590, "uuid": "15e7b27b-83d0-4829-87d8-7b1ca0ab983c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932590, "uuid": "c621253a-3695-4880-bc81-b5095afc07c3", "value": "6580579446983db99ba7f0870582a13a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0effdbcc-4e7a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637904668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904668, "uuid": "3b528a04-ee84-4a0e-9400-332866d6e343", "comment": "Malware payload (Mirai)", "value": "5fc0272f4a537f0bea4b1022cb215414", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904668, "uuid": "40b60e15-2f32-4b2c-a63d-db9e6556ab1c", "comment": "Malware payload (Mirai)", "value": "69ee7bfb005c16f65eb993246f117fbfe39dbf6ad2008f2823c58ff3b00ec244", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904668, "uuid": "93324bc4-adb4-4250-b3fe-2cb05d9920d6", "comment": "Malware payload (Mirai)", "value": "77bccb3f27e8afcfdc65fa9aa607cd87ec1539bd", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904668, "uuid": "49c63873-021f-4db5-b22b-637932280843", "comment": "Malware payload (Mirai)", "value": "5723b0e77f123f9ab4ab239d3094e8b0505c97a2f371d2720cc1ba2e9fefa695184b3dcf63d09c9f6639f4f98cd19b01", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637904668, "uuid": "db8d051c-ae2d-455c-b238-8eb6a0cbefef", "value": "T1ADE207031981CCBDC49D83360BBAB52AFAA3B07E1234F25C37917E27DD9DE121E5A056", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637904668, "uuid": "6da283a7-b687-4ea4-a2aa-3ec60f89f56e", "value": "768:ZzcENwtoc4T7O3+7rGjUfsIpbYfDsv0bDhb3eTBn:BNHT797rGlcsOODhb3eTBn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637904668, "uuid": "3a61c1fe-c6d7-4937-9d16-9f104a164354", "value": 34208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637904668, "uuid": "64c4a4c1-c2a8-49a8-aa0f-819c3d1dd184", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637904668, "uuid": "7ee67761-5329-47df-9789-093db13aa171", "value": "la.bot.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7e1988b-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637918669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918669, "uuid": "b4901032-bbd0-4855-b9d2-86473060f427", "comment": "Malware payload", "value": "64982f95c9502d6497c5b1b00be8a44a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918669, "uuid": "6b98ae8a-5029-4c65-85ff-b00ec9dd49bd", "comment": "Malware payload", "value": "6ad05537ec5377a9b3cc4b73cbb894938c6d8f5e2f206fc0427f74a4fb3fed11", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918669, "uuid": "97390cd5-12c3-44cc-a007-e9ebaba99c32", "comment": "Malware payload", "value": "273cd34b9217fa8263fa3c65b3ee4b49350e6617", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918669, "uuid": "cb537056-d442-4346-adc5-ef677bd7b8b2", "comment": "Malware payload", "value": "cca175f2365a00c4f174a4aa2332ff07d33850155f09cb1d38c88118189bbb083fa1806dba6fe3cdc5cb6cac8c99da0d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918669, "uuid": "54e11b9d-7c74-4164-a03e-37c75028433e", "value": "T1A28633C24D696CDDE02336BE022F47146F0EB5353F14F7B69218B48DD92F4066A636EA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918669, "uuid": "2be15c92-0d2b-4228-8737-e5b3d5e0dca9", "value": "f4938385711daded498908e840357fdc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918669, "uuid": "bafb4eb3-529a-4d2a-8dc9-7ebe491d4e2b", "value": "12288:GGzQYR4IeaAVB6ETW82Ku8UKfdndrNoSd3wrJMFg2f49+No/1iGN+wrJMFg2f49P:G8lgaAVB6evW8UKlndrE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918669, "uuid": "7babd216-b9f2-4561-8aa7-e1c758061945", "value": 7957184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918669, "uuid": "4c03eee7-7c23-402f-9c3e-80ad5e1ea6ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918669, "uuid": "d8e52a88-7542-4778-bfb4-036573740869", "value": "6ad05537ec5377a9b3cc4b73cbb894938c6d8f5e2f206fc0427f74a4fb3fed11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3eecf8ae-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918922, "uuid": "50db804d-661f-47e1-9402-050dd4b1851b", "comment": "Malware payload (Dridex)", "value": "1512aa31502548e90535fb698dcd81e9", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918922, "uuid": "88e92957-bad8-4915-8c6f-527edb2ea399", "comment": "Malware payload (Dridex)", "value": "6b52c3cdedbe90056bc1059f944e484e5afbd88a4665ed54e8d6ad94346785f4", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918922, "uuid": "d7180f6b-5467-4c08-ab4d-0775e31b653b", "comment": "Malware payload (Dridex)", "value": "736f8631610b6f8aa8cdfffc7aa28c7fb3235afd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918922, "uuid": "8e995bec-3e96-4048-9a45-55d0b49bf249", "comment": "Malware payload (Dridex)", "value": "b9348975c9f769fc27bea78acc35e7e2fa55a377aeee953f0cea09c324d7a70d078a6092d875895f86750bb00b62c607", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918922, "uuid": "5aafbccd-b6f5-4569-bafe-ce03cd2e6d4d", "value": "T15355E102FF9963E6E9502DF6D5F0F2A3C9B4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918922, "uuid": "300ffa10-5636-47af-87ff-295068ecf585", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918922, "uuid": "90f917c6-4076-40db-add3-26874780294f", "value": "12288:DZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:DZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918922, "uuid": "bf865066-486f-4ef3-b3d9-d8b72e7ae5d5", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918922, "uuid": "6879ac21-ea50-4f73-afea-b951dac26a78", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918922, "uuid": "dbce841d-f4f5-4fa2-8c7b-ab42de9544fd", "value": "6b52c3cdedbe90056bc1059f944e484e5afbd88a4665ed54e8d6ad94346785f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a15d5b-4e87-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637910551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910551, "uuid": "2bb41cf8-fcad-4cc5-ba3e-f612aaf6acca", "comment": "Malware payload (Heodo)", "value": "19f633f3666f541be7997ea72f83a5ec", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910551, "uuid": "a6acfdcb-a29f-4aa1-a322-8631157074b2", "comment": "Malware payload (Heodo)", "value": "6b648bdeee02ae5afdb80d9d7a14557085cdf53f00b1aec2a18d8b2d3c100a92", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910551, "uuid": "5377f3eb-9a81-43ff-a3f3-082b794e47e0", "comment": "Malware payload (Heodo)", "value": "33f4387c9c2c99ecb619638331a16bb683e2b000", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910551, "uuid": "ebdd4fb3-8cea-410a-8401-e7d56335a644", "comment": "Malware payload (Heodo)", "value": "65476b4925569c53154572ec3e856d54c606afc0aeaa40d85d60c514297ec513fc2097512ad152b188d31841e5c4e8b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910551, "uuid": "0e27422a-2c3a-41c0-8cd4-be68780a6433", "value": "T19CB4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910551, "uuid": "0d0264f4-56fb-41d7-8246-3d80cb3a140d", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910551, "uuid": "94870f28-8580-4898-a7e8-60c20c746c91", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDav3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkj6XC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637910551, "uuid": "166031b0-de28-41db-816e-4b9aac63f424", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637910551, "uuid": "717a1a88-365e-48c4-ba48-2e2eec27af15", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910551, "uuid": "6f5c3832-fe32-4ba9-8e7d-4783d9085866", "value": "emotet_exe_e5_6b648bdeee02ae5afdb80d9d7a14557085cdf53f00b1aec2a18d8b2d3c100a92_2021-11-26__070906.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ed3097-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637931062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931062, "uuid": "025eb2f3-c488-40ec-93c7-db1fd7625a9a", "comment": "Malware payload (Heodo)", "value": "d9e3cbcabe5ab3c6a3ac72157874fa9e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931062, "uuid": "41e6f4f2-9e57-454c-b9c8-a030cc326ca4", "comment": "Malware payload (Heodo)", "value": "6ba8fc7ae7bd0c0701fcb6fe7106650bf77eaafcc196f0c158550b8a78a14175", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931062, "uuid": "ca649a85-e02c-42bf-9ce3-5813d965621d", "comment": "Malware payload (Heodo)", "value": "5ab5785b25af5e3653e71d5b2bde9e3494cf6913", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931062, "uuid": "432384ad-3a51-40bd-abfe-fd56b9b6238d", "comment": "Malware payload (Heodo)", "value": "c76dbed62fa13ed428c1e39ae47e8755ea784b939faaa3e0b966f9ba8ea5cc52b97eb96cbf7cd8f212ec0617903296e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931062, "uuid": "ec209280-530c-4e66-b342-10f13600ff6c", "value": "T14CB4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931062, "uuid": "49601729-4578-4ae6-9771-b02a558fcfd7", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931062, "uuid": "8ae4fece-5801-4e58-9cbe-37419e9ca51b", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDam3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjJXC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931062, "uuid": "c6ffc6c2-c4d9-4dc0-af97-314fb48a48d9", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931062, "uuid": "f7288e27-7ef1-4fb9-806a-4b99bab93324", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931062, "uuid": "872ff467-6311-4e22-8abb-37bb208317a0", "value": "d9e3cbcabe5ab3c6a3ac72157874fa9e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40d2cc78-4ef4-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637957150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957150, "uuid": "8d31e6b7-2627-4b0f-b5bb-ed4d428dc2e9", "comment": "Malware payload (Heodo)", "value": "25021f167d3c8be2d654c4335d16de3f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957150, "uuid": "be9f382f-67df-4051-aef0-387b9baa19c9", "comment": "Malware payload (Heodo)", "value": "6be00ffd968201e34239683ec73e50617dc90b6b14801d796bf70f8b6146ee4c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957150, "uuid": "830846d6-b891-4532-861b-b7a3230c7521", "comment": "Malware payload (Heodo)", "value": "9ce2587b042e19b75bab4eb35206b4f9d41d1523", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957150, "uuid": "5bbee079-8c10-4db1-8a85-d4d263f9c9ac", "comment": "Malware payload (Heodo)", "value": "8995c23776031733eae4aa9a27d63a57f51e2412011d272c68d96aea0e255b2aaafd579bd9ea96fa534f74769f2dd72f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957150, "uuid": "14310e50-58bc-4045-8439-fcec397f0402", "value": "T191E4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957150, "uuid": "561a5743-af28-4b4c-9d29-5c152acf1e70", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957150, "uuid": "26675104-8858-41fc-a803-7075fb6ed7a2", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhLico09cDlB4Vx/ID:0uH0GCNeQJi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637957150, "uuid": "99951e35-9131-4eab-b4c4-97e274ee6ce4", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637957150, "uuid": "6c47a9bf-f124-4064-9baf-2038600c9a47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957150, "uuid": "ad6bd7e6-ee55-4a6a-9d3f-47ded83d7ca6", "value": "25021f167d3c8be2d654c4335d16de3f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba85016e-4e8c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637912687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637912687, "uuid": "e6042afd-97f6-47d8-9e65-b9dcfa616e26", "comment": "Malware payload (RedLineStealer)", "value": "7daab299fbfdef3d24f0aaf63d5129cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637912687, "uuid": "fd5e9659-fd62-444a-9248-d81df9f11a91", "comment": "Malware payload (RedLineStealer)", "value": "6bf72815b7831a968d757e3f1634d06532b20071e28bcd8ae88d4a24537f06ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637912687, "uuid": "9df2f876-7f23-4765-b99c-bfc089ccd15e", "comment": "Malware payload (RedLineStealer)", "value": "2bf4a38b8520d9c56d58b497486cffe1fc653652", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637912687, "uuid": "9ee6bbe7-701e-44bd-b310-7807d9a73506", "comment": "Malware payload (RedLineStealer)", "value": "2de6f2eaa53bfbd421e70ac0ec00cec6f4cd9fe2d600954de6d8e7453efab4c1b515c5da22d1972d888fd4348140eae6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637912687, "uuid": "0aabcad9-2cbb-4ecf-86a2-2bb80bebcc0f", "value": "T12DB4F1A276D2C032E52714305EBDA371FA79B9251B704947FFC10A2D7B32AE2D716392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637912687, "uuid": "3f9e3e3f-3a46-49c8-8ec6-87cbbd08b6c4", "value": "3eaa732d4dae53340f9646bdd85dac41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637912687, "uuid": "2981d846-f940-4c93-8f14-2fdc7129b2cd", "value": "12288:3w35dS4X8AnVqfvt3231ZwC69yKZD+bP139tKeLCjUbWO1+VuYZ:g35dPp43qeyHP13ygWamj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637912687, "uuid": "efb0b625-27b4-4472-9bd3-67e13ac79308", "value": 536946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637912687, "uuid": "09add66c-3058-4b55-aa93-adeae40a4a98", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637912687, "uuid": "bda277ea-77e6-4fe3-92ee-1265bc635fa1", "value": "Order_Inv#54648.jpg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3e7499c-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637921722, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921722, "uuid": "42044775-d213-494c-88eb-ee7be1c3d919", "comment": "Malware payload", "value": "0cdba2a8426dce1a72ad29ecdb07f493", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921722, "uuid": "c574b5ca-2eca-4866-bfa2-88a6a2c427c5", "comment": "Malware payload", "value": "6d424cc611f2409a72ffcca0bb3da1c9f4db476fca949bfa0434290a663dffc3", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921722, "uuid": "25f8528f-c0e6-4c30-ad3f-a32c15568a26", "comment": "Malware payload", "value": "dd1f9ae922ca235d1d3d0bd7f9697fb84b6bf1e0", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921722, "uuid": "e7395854-72f2-4624-af79-c5e4428cbfb3", "comment": "Malware payload", "value": "3757aac6d572a5a6a808f7f76aaba87f87cfd08329c044a203c2ccdc71eb06d72b722363bfb8722e1c3593a2d5cff839", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921722, "uuid": "a4d1affc-6066-48ba-99ca-6b8ea74a89ce", "value": "T1BB34120AB0758507F8D90A7B649BFD67C938EC959187F9C03CAB735472FB428A823719", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921722, "uuid": "18a4c3ac-d13b-4f09-8e6d-ed192ddd6788", "value": "6144:rJJ7AurQSU5RGoSuOPjOqZ74HSgR/ctQk49mIMlo9Ymz:FJ7drQXRnQiqZ7ViUC9mlo9V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921722, "uuid": "ef3af400-ee75-4850-a67d-6d99e67b7537", "value": 234584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921722, "uuid": "38442310-af6a-47f0-a4b3-d5a469ce5f5e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921722, "uuid": "77b79b51-3bb5-4b06-9d15-466006e3eb31", "value": "payment Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "053ed766-4e53-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637887901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887901, "uuid": "10bc2c76-d845-43af-ab30-eae09010db99", "comment": "Malware payload (Loki)", "value": "bf1a2b5006f69cdf2dac61c4a4c379de", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887901, "uuid": "e46f63ac-ae0a-4ac1-8977-9256fc668e05", "comment": "Malware payload (Loki)", "value": "6d6c6ec45350ce1d0cc329c1d4ad0226d428a8fb35379e5a7c467bdef06f5b92", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887901, "uuid": "8a165044-7cd8-40ef-8bbe-4586c08173e7", "comment": "Malware payload (Loki)", "value": "fb9c3886402f4c9081bb146f31b2fd52061c3f74", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887901, "uuid": "60e93c32-33e2-4bf6-b293-18bdb6b15747", "comment": "Malware payload (Loki)", "value": "12ac09e5d7a560c9670b95cb6b634c6a513316fdf69ec90fa7b7487536a663f1b2d319024e79adbc3ddd2ae75597ae7b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887901, "uuid": "aae4785c-d09c-4ef4-abe1-96803aacc5b3", "value": "T1C704BF2D32E1C431D3A7193064F48EA16A3A78736BB0424B3768276E5FB16D05BBC357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887901, "uuid": "ba62a0cb-3852-442c-86a7-a078bbf271ab", "value": "a2592ff0cb9d4716be385a37eb0faa8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887901, "uuid": "d672bac3-8818-439f-8fbd-c84665229cb2", "value": "3072:WICc3Epps9prWdiXTqJGHH7P2VB12sBptVRGtu1eAL2:5CCEpps9FVuJGnSV/1Au1ej", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637887901, "uuid": "1326a533-c169-4bf2-98e5-a4dd5961865d", "value": 181760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637887901, "uuid": "6ff8301b-3fb6-43ad-8763-19c7cc174691", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887901, "uuid": "5d58de29-c1fb-47f7-9742-02e3bee586b8", "value": "bf1a2b5006f69cdf2dac61c4a4c379de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08cd7b7f-4ed9-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1637945460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945460, "uuid": "2bc0c930-fd3e-4849-a735-d7ef70bbe901", "comment": "Malware payload (GCleaner)", "value": "194020bb0313b3175b0fb2e56d462e3c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945460, "uuid": "83406cf9-6d67-47f4-997a-3844ee466785", "comment": "Malware payload (GCleaner)", "value": "6dfd902231e6aa1301c11eca21f5a29456aa020bfe1eb19d05541ab32316a326", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945460, "uuid": "ed6c842a-38de-46a7-9502-438cd24558ad", "comment": "Malware payload (GCleaner)", "value": "e74b994ec9d6b5e966f730da9f335065fe8b6d86", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945460, "uuid": "83f9aa9a-6746-4938-ac62-823750368345", "comment": "Malware payload (GCleaner)", "value": "13c39af474f19f5955a3320a4ea765ed94bbcf55ba2cda3e79e9644de754428efc70185c70d81333a9ceaecf781a1701", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945460, "uuid": "183bb2af-8f49-4756-a833-1d33c4fe1a4d", "value": "T1872633A51EB6B63AF4123C336D11262E77B3B58F110D8E1B33CAC6DD62F5E42590A858", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945460, "uuid": "c3ec919c-af7b-42b7-9438-8cc96b6456cf", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945460, "uuid": "8725abcf-b3ff-42cf-9e4b-05577226cdc6", "value": "98304:yW5wzLQIzN3omu5t6pbfE5j5BSxVLCn5YtS+V8BXMPuhNRHuoNJh4dLfBoZSa:y0wnR4mKtA4r8xVCn5oS+1kHrNPAfCP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637945460, "uuid": "67d77c6a-c174-4e09-bdb8-b32b6a4a6d38", "value": 4732461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637945460, "uuid": "4ff8536f-9cb1-4186-a6d1-d7bada079282", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945460, "uuid": "c7edaca3-cd7d-4011-8595-5799d3ab6226", "value": "6DFD902231E6AA1301C11ECA21F5A29456AA020BFE1EB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bdc08d1-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918944, "uuid": "546c2e98-4e08-4c1b-a589-d486a7339615", "comment": "Malware payload (Dridex)", "value": "95a8147f694adad1655a2a158ba6d369", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918944, "uuid": "d8a87d21-1583-4e16-89d0-6edc6f546285", "comment": "Malware payload (Dridex)", "value": "6e90088bb8cc71fcebb71469a7e5668a0b6aacfa21fb274febbb523a427d8e40", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918944, "uuid": "e5d2c690-41be-4232-9f81-40cf4f18868d", "comment": "Malware payload (Dridex)", "value": "2911097d1da2ab8d364309a339f0f9afc78375ee", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918944, "uuid": "1224a969-222b-4b96-a2a1-821b1e8906ea", "comment": "Malware payload (Dridex)", "value": "bf5382511a258c14e0230e003a020181a0b479b27e41e961cdfbece4fa06ad8444b53cfefb8074eeab6ae2524be84b8e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918944, "uuid": "56c62ee4-55bc-47f1-b421-4f8674c6305f", "value": "T1CA55D162E36871E4C5739A31D03F551F0AB66D2268598205FB723A740D3FBC9BFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918944, "uuid": "ef5696fb-4c8a-4a58-9d97-184769a2a653", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918944, "uuid": "71aea152-f8b2-40c9-9717-2d02bcac5c96", "value": "12288:CGVNJAvuPFUl/faxuVlBLXKCgFfEK7JRLeHlX//ve7:33JAvRl/fKIKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918944, "uuid": "828e691f-12e7-4040-bbad-41bd32c5574c", "value": 1331200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918944, "uuid": "1eecbee2-6aca-4c6e-8208-065ed29aaf10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918944, "uuid": "f1870099-b5b3-471b-b723-0325d19281a2", "value": "6e90088bb8cc71fcebb71469a7e5668a0b6aacfa21fb274febbb523a427d8e40", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b875663a-4ebb-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637932870, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932870, "uuid": "f75a7c66-675e-4c0d-b098-0365c25d24e6", "comment": "Malware payload (Heodo)", "value": "53d6d244a4d1fe12d75b0b8f28b1a5cf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932870, "uuid": "1d7f87f4-fc53-4160-a54c-5b6e31ee28f5", "comment": "Malware payload (Heodo)", "value": "6fa5769fdccc306b8ea0a89c7001e3a105ae2aadd8ba3b8dbc320b4a144bbd0e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932870, "uuid": "70208986-fb00-4651-a718-2cfa85d27479", "comment": "Malware payload (Heodo)", "value": "347cfed9ac2a4dcb98e973e230896dcd97075cbd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932870, "uuid": "0e34c55b-5955-4309-b242-d41eeeb0d5be", "comment": "Malware payload (Heodo)", "value": "16cdea00003dfffb60da71714224eec6d7fb6723822cf27d058b9fb1b8e50803fb409991f74aacbe317221ec7f007606", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932870, "uuid": "c12ad809-e701-4245-91ea-06baca1c3882", "value": "T1E8648D11F982D072D1FE14303938DA964D6D7D654FA4C9EB67E40A3E8E302C19B36E7A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932870, "uuid": "7263f4f9-06b2-4a1f-85e6-67267bdd736b", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932870, "uuid": "d989a547-4075-422f-ae01-dd2f704f1081", "value": "6144:o4x8IbKnRzN0sI1AwDwPLESI1qi0AOnhjSOT:o4xZ0/tI1BD2LETv0FhX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637932870, "uuid": "535d1480-9917-4345-bb54-3b54a6670da1", "value": 332458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637932870, "uuid": "e854bbd9-54f6-4d30-a836-d67faf54f45a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932870, "uuid": "4f13ce8b-2b43-42d5-93c8-21aa1cc57c13", "value": "emotet_exe_e4_6fa5769fdccc306b8ea0a89c7001e3a105ae2aadd8ba3b8dbc320b4a144bbd0e_2021-11-26__132106.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9b5b50b-4e62-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637894647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894647, "uuid": "3a45b9ca-555f-4bed-9bb2-1e539415bc8f", "comment": "Malware payload (Heodo)", "value": "a5d44ead6d6e7f2f836fac346286cd7c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894647, "uuid": "5f2a6669-6b40-44c4-b683-f93253bf16c1", "comment": "Malware payload (Heodo)", "value": "715c7676ba880e1ead2d44f3569bae20b74c388df551ecb64cebba291dbfc50e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894647, "uuid": "00988a53-4d23-45a8-83e3-502f9d38d24d", "comment": "Malware payload (Heodo)", "value": "0281c437351340f6452403d6a8a1d8d65c9cf977", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894647, "uuid": "c5169269-8289-4121-bfe0-fcc8c00dc8ef", "comment": "Malware payload (Heodo)", "value": "91163d2c415fb88a415b4606fe9cf058d47305937310b6a9981216537f341c83605ad81aa21e4a8899dc2be7684e0916", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894647, "uuid": "185e6e6c-2b66-40a8-9163-6d96e53496b8", "value": "T18EC3F166E1CA5D96EF27127951DED1D6D3C3B2645C6E0BE03CA2B0F78CF284961343A0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894647, "uuid": "0f9770d5-709c-4d3a-9726-5582cea397f7", "value": "3072:hbcffUXwhJd0+y7ukYe4uYum1GdgOpVXGuhCUqM:BXw50+OukzVXV2uhD9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637894647, "uuid": "0773d7b7-b00e-4b89-854f-aa3979069a81", "value": 128319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637894647, "uuid": "326177ec-3714-4ced-9282-a3d0338e32fb", "value": "application/vnd.openxmlformats-officedocument.wordprocessingml.document", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894647, "uuid": "80948ac8-e7d6-46bd-b80e-b1d1bbc59b5f", "value": "emotet_e4_715c7676ba880e1ead2d44f3569bae20b74c388df551ecb64cebba291dbfc50e.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3994c588-4ea4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637922778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922778, "uuid": "6e38f16b-d21f-4974-b89a-0f16561f9c21", "comment": "Malware payload (Formbook)", "value": "28fbae0142208abc06ef1e7219310714", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922778, "uuid": "2e4e4f82-70d5-4d5a-bb9b-3d66fda33835", "comment": "Malware payload (Formbook)", "value": "723dc2166ea5533bec9f92b7547c6dff553c63b2f421d7ae26feea0c780c167a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922778, "uuid": "93e7bcbc-df90-496b-b5e7-70103579c389", "comment": "Malware payload (Formbook)", "value": "43f1f858ef89b09f5dce41abe5973573c48ff118", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922778, "uuid": "11091806-5b16-4059-b47b-efbc564626d5", "comment": "Malware payload (Formbook)", "value": "3c9cf9e8ca41eb2a01e23d82ea9fd81340be391eee63ebb3d781c3f3a9cc0ffa451bad4f900b772a452c05aeba2b01b3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922778, "uuid": "9299c848-c3b7-4783-a81d-82a58ff59e8b", "value": "T106A4022967B85231CEDE8B76643881905379E21EFA0FDB0A37D1F46814E670687227DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922778, "uuid": "abbd751b-0efb-49db-bf79-54d9647b6e86", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922778, "uuid": "6e35ce39-ad51-4262-8854-062854cdb80b", "value": "12288:CrQBU0f6ICzaEdc8zZqcCHNp7iszSAqixBFm:CrkU0YzaEm8ccCtp7V7qi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637922778, "uuid": "67856c12-bda8-4544-90e3-6263616ea223", "value": 467456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637922778, "uuid": "aa6245dd-c5c7-4fe9-ba7c-aa8015a66fba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922778, "uuid": "97bd3b42-f4be-4219-a60a-65763320b3b2", "value": "28fbae0142208abc06ef1e7219310714", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23cd53a3-4ecf-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637941210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941210, "uuid": "47c969af-6017-4799-8449-c14b6c1cd489", "comment": "Malware payload (Heodo)", "value": "7683ca58167c97da6b0498ae1e427e43", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941210, "uuid": "5ce25335-5eaf-43fb-97bd-115d4e8477b1", "comment": "Malware payload (Heodo)", "value": "723f3f73f211d969c69a2efb0d1472d24d63d3dd0b1ef6ea8bbfca045de9c0fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941210, "uuid": "5ec6f552-0631-48d9-a01d-5d60d6c9c716", "comment": "Malware payload (Heodo)", "value": "cb3df16e8260a1fc5a8f227784ccb6ec76a03cc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941210, "uuid": "2ddd3455-2603-45e1-b4ad-5b8f00c6553a", "comment": "Malware payload (Heodo)", "value": "9c36f28503456ed46876bd51b7bba223f567a5f7dc0fc6009223300ff90886da85344fc54e81a9946c55b925384f50b8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941210, "uuid": "561f5d74-54fa-4f2a-a043-d92b8bb47160", "value": "T1A8B4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941210, "uuid": "9cf2f654-af56-4f22-8086-8c5b329b7993", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941210, "uuid": "2bac86a6-d9ae-474a-ab3d-48c1fd210c03", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDaE3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkj7XC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637941210, "uuid": "6c842c7f-624d-49d9-9086-7c6dc8c53af3", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637941210, "uuid": "fd0c5ae2-8d74-4e33-912e-bf786d75b30e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941210, "uuid": "33dbe12e-c01f-4871-9709-b2834d7022cb", "value": "7683ca58167c97da6b0498ae1e427e43", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89be6afb-4f05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637964574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637964574, "uuid": "763c9f33-cd9d-441b-9cf1-2047a5d27189", "comment": "Malware payload", "value": "5cbc8dcd797aa781356452330db4ef6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637964574, "uuid": "cb85671e-3619-4e52-8fd2-87d9cb212f8f", "comment": "Malware payload", "value": "732648368ae3d977973d7dc765d5a5b749f25ad8326ec65ad7bc36169582b998", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637964574, "uuid": "02194005-2e78-48fb-85f2-c3f6a1eac87c", "comment": "Malware payload", "value": "14e7013fbbaf49704e6fe730bc6eb5aa50853ceb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637964574, "uuid": "f2250a0c-32c4-418f-a907-4c6ffbe0ca17", "comment": "Malware payload", "value": "014d05fd8cb7037c562ce41e183879730b0037d2c607f8eefcc0e0ab7886c06675b0f4c8e3af92e40ced86d9ac25d7d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637964574, "uuid": "a481d1a9-f4d7-46c7-a747-a58e623c7a9e", "value": "T159133A16BE508DB8D8A384B80B5D973BD0F2DC22452B8727F751F76CADB56C2290A489", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637964574, "uuid": "c69d0ef2-5f9c-4634-a8e7-b6138df1d415", "value": "b1648fa3df6125ec65a6890713bf6550", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637964574, "uuid": "0b6d7473-94d6-4ac1-870f-bf2d89aa8293", "value": "384:NrScZNbLe7Bi4p5hMzXyPiJ9vHsO8KGCkgeqaqn3A3vz58vrdTt1RdkQtm4+ClYC:Nrhfek++2O9vMO8KGCklot1arvIj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637964574, "uuid": "1c76f6a8-e6d4-4aae-8820-b81dde11bcd9", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637964574, "uuid": "049d3c0b-3157-4dfd-8744-3b1745e2095e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637964574, "uuid": "48399470-a704-4b47-9303-845a5e7a004a", "value": "gta_launcher_updater.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9cca1d39-4eb0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637928099, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928099, "uuid": "06c90594-eede-4b6a-aec0-daa9367df6e9", "comment": "Malware payload (Mirai)", "value": "2828a53b167800f69539eaa5452c9d4c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928099, "uuid": "fb07c6fc-6b21-49f4-b5d6-c3e15513fd98", "comment": "Malware payload (Mirai)", "value": "73db0142ab7642a4b6e37aa81c56edd43bd8d2f12fca72128cd2ef9166c35715", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928099, "uuid": "b0909df1-a6c9-4a85-810c-9a2bb8083924", "comment": "Malware payload (Mirai)", "value": "ec713dbaad26b341b733676f5d9fd33e11f7348b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928099, "uuid": "79cd8ac5-4433-45db-a7bd-b79b2bab2d87", "comment": "Malware payload (Mirai)", "value": "1121c315f4c0f58223bc2026ae1e987208904264cee72a386b182a6008de51fa97006b11ca7c035d79ff08d48fd9434f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928099, "uuid": "6eaa6b58-d30e-4830-ab3f-11b239c1ee52", "value": "T194E3A44A6F610EFBE86FDC3352AD174124DE554B22687B34BA30D818F24E24B16E3DB4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928099, "uuid": "7950489b-9229-48b3-9bf2-5a794de9da22", "value": "1536:sizp079eJb824rZ+yCf8z4+JYpIAJirtGuZOZwqGGf72B8VHMPrJi97TazZzl:/p079eJb8FjCf8s+JyuZOfGXmRU7zBl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637928099, "uuid": "3b5e0389-02b9-41d6-a39e-f87ea0aea584", "value": 153576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637928099, "uuid": "8424aee0-be64-4a24-a015-237678f762d0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928099, "uuid": "69786195-d1cd-41b9-82ce-82f532c56b44", "value": "2828a53b167800f69539eaa5452c9d4c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4599023e-4e97-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637917215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917215, "uuid": "11da1e05-91e2-4836-9755-5efde2d10a5d", "comment": "Malware payload (Heodo)", "value": "65e2eb7a556242501a095b8249316ea3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917215, "uuid": "e5191602-cf00-4dd4-985f-a6a2e81f7ece", "comment": "Malware payload (Heodo)", "value": "7602e725df3f2b046f7b9c4f6a7e400a53837b45367b97196f1eabe6dcef1ff9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917215, "uuid": "6487a0bb-4a78-411b-9ed0-6dfc3d6f0711", "comment": "Malware payload (Heodo)", "value": "24f9eec087eef53a1f78d3a74134ac859258e9e3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917215, "uuid": "91d42754-8aa5-4c62-b6ae-6816b3a2d6f4", "comment": "Malware payload (Heodo)", "value": "c7250586501c3f51f0b9b6d2e75dde131caa793b62a86b704b68094f05342b201ec0dc1dc1164043d03c26d85a07eeb9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917215, "uuid": "964f9733-5b6e-41fc-a5c6-233cd6ca6281", "value": "T1F2A4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917215, "uuid": "d8381051-f686-404c-9fa0-5cd6e8d417fd", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917215, "uuid": "7e3e2be0-64fe-46c5-b277-3abbef24891e", "value": "12288:o4xZ0/tI1BD2LETv0Fh1O9U6W8XUDaBN7a1vt:oED2LETvMvb6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637917215, "uuid": "63024e5a-a687-4f6a-8dc0-fa3f3d56d61f", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637917215, "uuid": "e2ef6c4b-6127-43bd-bcdc-e282bc11896f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917215, "uuid": "19765cf9-340f-4e5f-97d9-9516aa54ce56", "value": "Emotet_n2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "347738b8-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918904, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918904, "uuid": "86b1c8ca-8e1d-458c-8565-313bd7b46343", "comment": "Malware payload (Dridex)", "value": "f475890b3db27bd228eab93a66e834e5", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918904, "uuid": "4a5eafa7-6500-4d22-813e-704882fe0022", "comment": "Malware payload (Dridex)", "value": "763bdff3e9dfaea38a2c5f1cfcac8a850c531d4a0785bd46369a9d575c4d4eda", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918904, "uuid": "63b81b19-e20a-49f4-b64d-fd9516dafa41", "comment": "Malware payload (Dridex)", "value": "ef69eaf983de220c59ad835ba79ea403099dd2fd", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918904, "uuid": "b974ad11-b6b1-4393-a9eb-4f3945ea7897", "comment": "Malware payload (Dridex)", "value": "a45f95559512e5b13d2a4509a95d4318b2d9aa879319cc03f48d719957737ee22f86c4b73b7258cc5abdde97d79bab8d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918904, "uuid": "584d4e94-d564-484a-a94f-94dbd5502e6b", "value": "T17A55E102FF9963E6E9501DF6D6F0F2A3CAB0F5854C680229DB61405F9CA0ACEBD154ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918904, "uuid": "3a031a7b-58e8-4b89-bba5-8b456c31bc98", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918904, "uuid": "be3f15a3-116a-4ca6-b905-567b2fd3aab7", "value": "12288:3ZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:3ZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918904, "uuid": "ced36e43-0194-4321-aeca-17754c01887e", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918904, "uuid": "5b9cca97-eaee-484a-b552-6de7ccdc17ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918904, "uuid": "d9ad5bb6-ad74-4559-ae5f-7fbb840b065b", "value": "763bdff3e9dfaea38a2c5f1cfcac8a850c531d4a0785bd46369a9d575c4d4eda", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29170670-4ecf-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637941219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941219, "uuid": "4a176f25-ada8-4b27-a433-dbb097ed6d71", "comment": "Malware payload (Heodo)", "value": "c6e4253b429c085519e6fb01f3207ec4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941219, "uuid": "312fd75b-5dd9-40d2-a9f7-be0f00d6b8d0", "comment": "Malware payload (Heodo)", "value": "768e92ce1bdf6ec9d048c08e708b3401b89c810a54b1c90cb2e76a97b9ad2e39", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941219, "uuid": "4047ea1d-ec5f-4ac3-8bfb-74bc1aa908a5", "comment": "Malware payload (Heodo)", "value": "f4560ba8e0417049ecb2691d06df01c08d13bb05", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941219, "uuid": "195869e0-ae8f-41a8-a7a3-14a815398c3f", "comment": "Malware payload (Heodo)", "value": "a5b6d0c4f6bcea88b67a85b934349a14fdaa1ac3aed5cdab75fc83d56cb87ef579ceb5110c0b1354deaa2dc67e52024b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941219, "uuid": "1824e608-fd88-45bd-b05b-dbcbea1709c5", "value": "T105B4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941219, "uuid": "f5b05124-1eda-46e6-b0d2-9664e7f55e8d", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941219, "uuid": "2e214099-b7ce-4446-b94d-645ee660f987", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDap3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjQXC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637941219, "uuid": "992485ec-9128-4596-a980-c07d6db4c381", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637941219, "uuid": "00524952-51fe-4ac9-88ab-ae528517eddd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941219, "uuid": "bc887a97-fe48-47b3-be52-72c2c0a49c2a", "value": "c6e4253b429c085519e6fb01f3207ec4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9383d7d4-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637919064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919064, "uuid": "1f26931e-b667-42c7-a18e-d083f976633a", "comment": "Malware payload (Dridex)", "value": "ead4d749d5722a1c662bce029828c556", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919064, "uuid": "4dc1e160-987f-45f2-ba27-eb238df4f3eb", "comment": "Malware payload (Dridex)", "value": "77869beb8d5f5f603adcfb5e43d8e0255d5f23da1eca88f3f9623018f95acfcf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919064, "uuid": "d6f1f08e-5264-44d6-9318-14e0bfb45a74", "comment": "Malware payload (Dridex)", "value": "acb3bd23f749a53eb8c7ce63eae97cc7d613142c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919064, "uuid": "9059c0ff-a6bf-4740-9eec-a71d79fd9b55", "comment": "Malware payload (Dridex)", "value": "92ace2f51a919a9b09b9599e3a3d8b83fb6947361d0f767c583d5e3a71110512cf56c3d1eb0e74b0da6ea102c3523c91", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919064, "uuid": "a288bbaa-791a-4f17-9ae3-3057d2afd592", "value": "T1C745D162E36871E4C5739A31D07F551F0AB66C2268598205FB723A740D3FAC9FFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919064, "uuid": "fc335658-5751-4bc3-aa3f-1736212c0768", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919064, "uuid": "475e1967-008b-466e-9116-7889d942e254", "value": "12288:OGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:D3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919064, "uuid": "d9a88197-ffa3-4ec1-847b-4cde889a8752", "value": 1232896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919064, "uuid": "f21f79d0-4340-4ea2-bb92-4dd98c532c53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919064, "uuid": "4aaf5eed-2419-4823-a509-4929fd0b1b3c", "value": "77869beb8d5f5f603adcfb5e43d8e0255d5f23da1eca88f3f9623018f95acfcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cffa46fa-4efb-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637960397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960397, "uuid": "0a8f5d03-cc73-417b-a31e-d8a9fbd2c5f6", "comment": "Malware payload (Mirai)", "value": "c9717dbc8fff91e292bc3f505e7d2fe9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960397, "uuid": "41eb7f67-6ac6-4830-8db5-db1a1d08c7a5", "comment": "Malware payload (Mirai)", "value": "77ac778cdf210a5b0e3187b66676708719f480a4e61be7ae9aa4f6559539a1ca", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960397, "uuid": "fe3873d6-35a2-46bf-8867-2593fa315500", "comment": "Malware payload (Mirai)", "value": "9bfc256f81ca95ec53b99846707556bda602d535", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960397, "uuid": "8a570cc1-4f71-4c41-a14d-5a85535f3d49", "comment": "Malware payload (Mirai)", "value": "6acad2dd0beab7166a008df8057c7abf040673eb6e4b909200e02f1bc94db2525cbbb0a7b21d16bab1fff247a76bc0de", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960397, "uuid": "c9d8264b-18e5-4031-bd85-7257aae2ae1e", "value": "T18EC2E0881B8959E9D2F9C17C07B81B6C1DA40F9AF809DC8178E8F766DD8E4753023EC9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960397, "uuid": "e9bc0788-a42f-4c9b-85af-f4b557c865ce", "value": "768:f2G214DFyosXqgvV9o1ndB08DVJgGlzDpbuR1Jp:f2GdDgosaaO1ndtPVJuz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637960397, "uuid": "67b4f09c-10f2-4b1f-b5b7-478a400fc23f", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637960397, "uuid": "b5afe82d-de30-403c-a48c-1d2850c1d5f8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960397, "uuid": "4edced6e-d488-423b-a8c9-b74fcebed148", "value": "c9717dbc8fff91e292bc3f505e7d2fe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edda741c-4e52-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637887862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887862, "uuid": "cc9c1280-e228-4e73-a224-3715019ad97f", "comment": "Malware payload (Heodo)", "value": "07213fdd63a6718079850e92c374c251", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887862, "uuid": "80092d17-4818-4920-aa59-6317a08e4eba", "comment": "Malware payload (Heodo)", "value": "77e065b48288da132891c0c256be0738c0ae0ec7fa8a511301d79ab593149bc1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887862, "uuid": "ef74c468-cad2-4ee7-8862-39f3155d1edf", "comment": "Malware payload (Heodo)", "value": "2659e77e6d39338da0106032d35a9da1307510a4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887862, "uuid": "fc661237-913a-4794-a91a-1cda15f78e29", "comment": "Malware payload (Heodo)", "value": "6971a007e3b37bb49a9b12e3cb8cb9c7b7782fc656de107a3455dc622c6951cc04fb25498eb26284bc82c13f464a6030", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887862, "uuid": "d9fce6b2-2e0a-438e-a5e1-3643aa0ac042", "value": "T14DB4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887862, "uuid": "f3a25e7a-b689-4771-a829-65dcb3d617b8", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887862, "uuid": "0cd4527b-08eb-43c6-9443-6829c67aab00", "value": "12288:smVdIG2GDNBtIlD987snqrkZW+mw3ffEPy:sm4GDNBtIl6wNZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637887862, "uuid": "5fafcbdb-8175-4b76-af88-6484f892546d", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637887862, "uuid": "1dbe9a6b-c67e-47ed-8322-6c7d722c3e23", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887862, "uuid": "e4c173fe-5a26-4c64-b52d-de3e6cb8c235", "value": "emotet_exe_e4_77e065b48288da132891c0c256be0738c0ae0ec7fa8a511301d79ab593149bc1_2021-11-26__005057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe66e25c-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918814, "uuid": "97dff1c1-b48b-4992-b4f4-8ca8c6a9cdc2", "comment": "Malware payload (Dridex)", "value": "915d143eb22a1278b9d2d56abe7d6fef", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918814, "uuid": "b5b5dbf2-63d0-4431-a56b-414c02886f01", "comment": "Malware payload (Dridex)", "value": "7818fc1e2f9e7df1ba5688ddc87f54b59b3e12c3d2c60393b50f9b56447ac2ab", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918814, "uuid": "f05e043b-7da1-48d3-bcce-35f075ae0666", "comment": "Malware payload (Dridex)", "value": "32cb17ebd3a9da188a833c7f66f8018a3ad06b00", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918814, "uuid": "acd060a2-76b9-47dd-ac30-505b59cf7e33", "comment": "Malware payload (Dridex)", "value": "0c11b61f19181f95ff22261db3e62e945ff79a41d7543ab8db6c0719452fdf68534be621223ae923b8914e5835651ff4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918814, "uuid": "48aaa1a2-4a4d-447c-bce0-817be44f45fc", "value": "T19465D162E36871E4C5739A31D03F551F0AB66C2168598205FB723A740D3FBC9BFE9129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918814, "uuid": "54b75235-5118-445c-b936-5f2507d139e1", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918814, "uuid": "b5e759c6-3147-48c4-8048-67947d35438c", "value": "12288:rGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:K3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918814, "uuid": "0620ce05-4523-4fc8-b7c5-8a6568f9506f", "value": 1417216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918814, "uuid": "dba680c2-391a-4e77-8312-a7ba401414da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918814, "uuid": "6ec9288b-cded-4276-8911-ce4693d9c5e2", "value": "7818fc1e2f9e7df1ba5688ddc87f54b59b3e12c3d2c60393b50f9b56447ac2ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "446c5c9d-4ef4-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637957156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957156, "uuid": "3ce4edf8-3839-47d0-9e6e-10f67de4888f", "comment": "Malware payload (Heodo)", "value": "17d9126f625149cf90955f6768bd3e69", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957156, "uuid": "59309356-36e0-4d11-9ef0-075a5c3a2f2c", "comment": "Malware payload (Heodo)", "value": "7a0d373e738b79b1c206a5e9f7d42c47815fe784b39371cf0e2e18af777eeebf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957156, "uuid": "e2db1119-bbbe-4952-b82a-559ebdeb692d", "comment": "Malware payload (Heodo)", "value": "779a6a21926c84d04f1006017996ef23723a62ae", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637957156, "uuid": "d7d3e78d-5d05-4013-9297-829d532ef387", "comment": "Malware payload (Heodo)", "value": "e8fcf61c526eea81e823aaa4ec6c36b658913afe52d95172d7a1e2b09ff6bc96684bf0ef5024522cc560cef852e4af0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957156, "uuid": "5004ec8f-76c7-4b44-bc95-3bf3823f4df4", "value": "T1CAE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957156, "uuid": "f8cdcfc0-bc5f-4ba2-aa50-c5ff474e43da", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957156, "uuid": "7d7ba6db-6887-42dc-9f62-3c6e4898ece6", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhRico09cDlB4Vx/ID:0uH0GCNeQ3i7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637957156, "uuid": "27450854-93ab-4fea-99af-70c035c656c0", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637957156, "uuid": "ea497823-e06f-450c-913f-484844ba2ca9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637957156, "uuid": "67a2ce16-fd6f-4f73-a27f-8c46d15e36a2", "value": "17d9126f625149cf90955f6768bd3e69", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97ffaa94-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637921648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921648, "uuid": "7ba9d4b5-2b96-4a43-ab5f-9085d5d52549", "comment": "Malware payload (Formbook)", "value": "f2f2adc8d30834eb3bfa4ad63d0123e9", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921648, "uuid": "271ce477-b157-412d-877d-a1a4c092f312", "comment": "Malware payload (Formbook)", "value": "7a6ccd8c43d8b993660ff983a254c7f5de4ee1de5a5d8312f33f049a030579f3", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921648, "uuid": "0fa8dca1-7d5a-49e2-a3d3-b5a0d64828f0", "comment": "Malware payload (Formbook)", "value": "23406fafd1cf89ce11208c86b08d4b964c7bf4bd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921648, "uuid": "e53e8f3d-4301-4682-85fb-5f383c9a3f6b", "comment": "Malware payload (Formbook)", "value": "f140d2b9ad62ef7ea6e1fd6b1df19a6054434f6aaedb11498d0d30360fe1f398ab8ac49b6c8ec0a111f40b6be6612842", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921648, "uuid": "208bcf0a-a8db-4db5-8857-f24f459a4fa1", "value": "T11C34126F7E35E1C3FB22DBB91708A610966CBD593C09B07323903750E4B5819AB37AE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921648, "uuid": "adec6666-76e5-46fe-9d4f-19bbb5c17d77", "value": "6144:T7D51WhVpeyw8CRHpCw5lULhreeTd5btAM4ly1:XD51Wb47n3VULtVzbtTAy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921648, "uuid": "0deda4b0-4ed3-449e-9293-ca53c3d3fbfa", "value": 234408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921648, "uuid": "8420e83a-35e5-4122-b344-cc91043f6fe1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921648, "uuid": "3cda3931-a484-4921-9eaa-2ae4055e3631", "value": "Dumak Order.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff8dc336-4efa-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637960047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960047, "uuid": "1dea2700-5edf-4e3c-83c8-7e2ebee2f626", "comment": "Malware payload (Mirai)", "value": "4a7ab53453b9a3ce074f1231b9d1524f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960047, "uuid": "fe0ed60d-30e2-4e11-bf76-eb054a8dd477", "comment": "Malware payload (Mirai)", "value": "7b8dcb39dbd6707532606b7ec23fa9e5beb6f43b1386c423bc17213221072cf7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960047, "uuid": "e1656fe5-6d41-4b63-bfd9-d2bf89438fca", "comment": "Malware payload (Mirai)", "value": "6a95998796486a7fe691359d5945f330b96377f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960047, "uuid": "3bee9b6a-3c25-4009-99a0-b56874b4842b", "comment": "Malware payload (Mirai)", "value": "f0f0c4e523f51e46e353d8f4e584f8dbf98ed71a2b1e35ecd4fc31e22f38b9bde2da9455e009f6d251813ca7b9254955", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960047, "uuid": "b62ebf73-9ef0-4071-b494-504eb8e15e8a", "value": "T1C1333BD6B902AD7CF99BE6BE80270E0AB13123541053073777EBFC937E321949956E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960047, "uuid": "21cb1506-8970-427d-b7fe-aec12ecf2221", "value": "768:8CeKEfhe5XdrbentIYfNMQn5MdgFHj0iPuvWeffpqmUJTXr6Lu380D5n:dsfIBZeNlJDFj0imvppqmUJP6Lc8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637960047, "uuid": "162af6e4-8743-45d7-b8dd-5485d62b7319", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637960047, "uuid": "c24c8435-e5f6-4dc0-8a7b-8e04c87abf66", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960047, "uuid": "f61450c8-ba4a-404c-828c-5e68138db465", "value": "4a7ab53453b9a3ce074f1231b9d1524f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "581e13da-4e54-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637888470, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637888470, "uuid": "5436849e-baca-4020-8f83-b2b31bd3e31c", "comment": "Malware payload (Loki)", "value": "84cb95f84fcd1f0c280cfad8e477f423", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637888470, "uuid": "105edf35-68ed-4934-bf16-216e0c430b10", "comment": "Malware payload (Loki)", "value": "7bb52ddfcf718381a1accfe07ff1afc6bdea99bcdbc7a41c092f4b07952d1bb1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637888470, "uuid": "b256ac6d-46dd-48e9-98be-aee37a7b26df", "comment": "Malware payload (Loki)", "value": "5feed8f4e98abb6c7a8d8ba21d1246b9d061ae55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637888470, "uuid": "73dff8ea-8245-4f52-a65b-cf30f8eeaf31", "comment": "Malware payload (Loki)", "value": "18d3165c522e4edcc3c92ada5fc65d40b27f75e4dd010455daf16d1c463e0a106955a4765f16a4aa488f83901b1bda31", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637888470, "uuid": "f5bbd12d-a4a3-4506-bcf7-11f96286a200", "value": "T17864231B19F1A0BBD640443A1FF1EF6BEBB5869D02055E271BD8AB4F1E344E74D87222", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637888470, "uuid": "e566804a-c1e7-4125-a412-c45c2c8f6262", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637888470, "uuid": "7d0d4bc1-cd3c-4275-8aad-10c55354a110", "value": "6144:rGieCT3S+kNTx4FgGh+tVHNZoC5udTwqqD4cNRc3ngsX31Pz36R4:HbkNTx4fhujZ4w0cNRc3n7hz36+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637888470, "uuid": "91a0a804-03a5-4b11-85b5-728fbd25fcbb", "value": 313140, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637888470, "uuid": "df9d46b8-cbb7-4791-ac3e-b9fc9ad98d30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637888470, "uuid": "0ca72282-e1e7-480b-9c5d-025386b09b09", "value": "84cb95f84fcd1f0c280cfad8e477f423", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ab78a25-4ea0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637921062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921062, "uuid": "2ad88055-6497-45ea-8dc3-70f9ffa5f040", "comment": "Malware payload", "value": "93cc4fe64a22f7a9f37a711f862dbd03", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921062, "uuid": "5369261f-a93b-40f4-a99d-3530a7e56c69", "comment": "Malware payload", "value": "7bcc22149bcd6befed772134795c4fcdbca1d06156189b54094ad72d8c81f7fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921062, "uuid": "c001d47e-8e03-472f-b217-537d0edf005a", "comment": "Malware payload", "value": "ed490597622240d3f10c29cfa128624a3e7e305b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921062, "uuid": "9c313ef3-caf6-4d58-a3ab-718304d1a553", "comment": "Malware payload", "value": "d980b2ed252a2f7a44780b586e8628f7f7ccc2d8e4efe2c08e0207aab6ca57ce14d78cd78eb09aef91666a77436e8cbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921062, "uuid": "31363ec2-8f43-402f-ba82-daa92fad8bb0", "value": "T1DE0733BA4441B4E8F193FD61834AFAD1860B3127AEFA36740C17DCD64275EE5E286B07", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921062, "uuid": "20951fd3-e9cc-4239-9a3b-7a0e3d2e24ac", "value": "393216:DMpVpLrDxOd6CQCHd/aWlDtjEH3wTA3XVbNfkNgTzO2Gz3Mx3hwmbK3vHAZjiBlY:ApVpLr06nCHNVlDtjxTA3Fb5kNgTzucJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921062, "uuid": "0f39ed7d-81a5-406f-90c2-5b3ceec4eb6f", "value": 18358046, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921062, "uuid": "8795a451-009c-4e02-bf49-a0798f3571bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921062, "uuid": "0dc7a4ca-11dd-4c07-ade3-b846443c1ebf", "value": "93cc4fe64a22f7a9f37a711f862dbd03.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b6a3071-4ec1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637935317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935317, "uuid": "5f16f736-ae15-4e82-be2c-98efee7f7a9c", "comment": "Malware payload (Formbook)", "value": "dbae1bcf134f5165a7f52be2b5fb7cfa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935317, "uuid": "0e1e1945-b740-437c-be81-2238bf856944", "comment": "Malware payload (Formbook)", "value": "7c0e90c15c64f5929f682a190f06d1e1882e06e6cbdceceb3193c0353bacc219", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935317, "uuid": "6be5356d-84b8-437f-b4d9-de51c206fc76", "comment": "Malware payload (Formbook)", "value": "e76e61ed046e14650c39e2a58c8f5652abd327db", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935317, "uuid": "7829c65e-b060-4874-b7bc-69ae8e50e29f", "comment": "Malware payload (Formbook)", "value": "8fc70178a2dea8d27a9757b27409d19c1e7663137a4c9dea73ad0b7d12b46770a0b4ae7910018149b572c395fd5d7337", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935317, "uuid": "4f1c5efd-6ee4-4cbb-879f-4d6334030099", "value": "T163A4CF46722897F1D63D0BB37E43901D53B22DF5A961D2486ED3F2DB29B1B200E61A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935317, "uuid": "6202d5ab-60ee-48f9-9e12-d42245f61748", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935317, "uuid": "9bb81c9b-dfc3-4861-a244-8e4b7330bf73", "value": "12288:sOoLYixBFmxdBaTwd8N0Pxe+FIhlBwSJ:6si1gGoq0P41l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637935317, "uuid": "f07c4054-b295-4240-aef4-0bbcd848e6ab", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637935317, "uuid": "caa15ce5-c1a5-477e-9de0-82fdcc6f8f79", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935317, "uuid": "fc5c410b-ef8e-4b46-9a24-b67d7a8be3a8", "value": "REQ. FOR QUOTATION.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b73ff337-4ee2-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1637949618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949618, "uuid": "d4ffd7d3-b48d-4b92-a328-fb27023d6139", "comment": "Malware payload (Socelars)", "value": "cb12524aff6af64402c01cfb4cdd5b13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949618, "uuid": "d925bfd8-95ca-4434-8a5d-85987e03efc1", "comment": "Malware payload (Socelars)", "value": "7c39b30cc0cf28e584e3c61a9403de9380b978778d537caf6a4245281ba8b1d8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949618, "uuid": "96738026-d42b-4f25-9ff4-4d7d1a68f7c7", "comment": "Malware payload (Socelars)", "value": "797ce3ed137bd4ca9d0f960ef8911ed34555eb6d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949618, "uuid": "e2348717-423c-4a25-9f8d-73e3fefc4004", "comment": "Malware payload (Socelars)", "value": "86ba14b6cc8d4ec9a90f7527d718f8d97fdbfe147a42e83336611eab038886eb2ac673a2d2b2c7389f918ef1ac163cdc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949618, "uuid": "4b9f5a3a-36ed-4a2f-b406-3f0988cab23b", "value": "T11D659F11F682A036ECE3007282FF5AFE9D6CB621030854D7E3C45D695E619E37A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949618, "uuid": "1ce623cc-4cce-46d8-b783-9146808d2dc5", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949618, "uuid": "00e66ef7-c398-41c8-82dc-90237792c2d2", "value": "24576:VCjpXA4U35ozW03XRp/hESVE50U2xbVvBpVdnz4OVZg7CNnR:GpTJxPzlJ/dnz4OVZCCNnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637949618, "uuid": "88767a03-056a-4005-934d-734c5007bdcd", "value": 1489920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637949618, "uuid": "7ba5bd2f-15e1-4d88-89a0-7fd54f4fe4e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949618, "uuid": "79a03f2b-8df3-4779-93dd-e5ba19613fda", "value": "cb12524aff6af64402c01cfb4cdd5b13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cda3dfb-4ede-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637947775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637947775, "uuid": "4b34e139-6ce7-4d36-916c-28ddf55395b6", "comment": "Malware payload (RedLineStealer)", "value": "5f12b96b9ba70ceb383a5558275787f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637947775, "uuid": "378b7f47-bbad-4759-838c-3b20ba77d5ee", "comment": "Malware payload (RedLineStealer)", "value": "7c3cb0e297c2089838fe775b2e79702c8ea97ab5c850788f5e091ae2bfa0d9b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637947775, "uuid": "4b8f320b-8f9e-4734-a273-c2efc79eae37", "comment": "Malware payload (RedLineStealer)", "value": "9edc4ecd63f7c4b85bd91d83514497ceac61ae94", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637947775, "uuid": "8639d4e5-6aa1-4dba-972f-5a9b6fcde17e", "comment": "Malware payload (RedLineStealer)", "value": "4b3ac41bed548f3c79279b50cfccb7508b845f0350a811e1990aeebf43fe43c652559a414a3897d0d9d9dc4194aa24c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637947775, "uuid": "41058a29-4f7d-4246-a48a-f7735f7d5866", "value": "T1695533F76F8DB094E4092D72AEA7A642D2935F6EA0C4383DDF9CCB917DD1911CA250B0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637947775, "uuid": "57346b8b-0193-45f4-8b38-79221d42ad69", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637947775, "uuid": "723406d6-a4d7-4c89-b647-5f10fe844833", "value": "24576:ABSn5I7v38dyt323/G3tPCVgdTnsK7Ov0IHkfXx71cronkEaHNYK33jvMcvj:35IrsdIVaVgdswILkfB3NaZjEcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637947775, "uuid": "96aeb393-75d9-4951-942f-7d3fb33dcc13", "value": 1403296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637947775, "uuid": "ee399c67-2591-4e15-ab8a-1bfe679c1159", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637947775, "uuid": "f87bb2e8-744e-4664-b1f8-1c1c9806a561", "value": "5f12b96b9ba70ceb383a5558275787f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5e0381-4e84-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1637909256, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909256, "uuid": "0ff2beff-527e-42d7-8178-9af35f89b349", "comment": "Malware payload (RemcosRAT)", "value": "d484bdb07de3628f0621f8c167071186", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909256, "uuid": "2be9448b-4a1e-46e9-8033-7c823a492740", "comment": "Malware payload (RemcosRAT)", "value": "7c491171fbe25c5f47f560db3a857cfc716d0c4733466ac08660e8a8be9bc8cd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909256, "uuid": "7cf2f373-3c91-43cf-bff1-029d6860a626", "comment": "Malware payload (RemcosRAT)", "value": "396b3c786833f287477271a252b01954068c1a1c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909256, "uuid": "c0ad275d-6310-4980-846c-c0a87378d9f4", "comment": "Malware payload (RemcosRAT)", "value": "934072dae7d41cd68c68ae8f2f873895fa24de86b4d05ddcf0c3e2ee43474576d3121086495faed9a13d18775ca4584b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909256, "uuid": "9711cef4-6cfd-49b1-9acd-08cdf5de7e41", "value": "T10AF46D2BEB93B436D113057DFC2E97A07D1ABFA22A95F53D28D93C8A0E747926430171", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909256, "uuid": "fe3a6f9e-f37f-4b99-988a-9405071a8882", "value": "01f42bb56bd8196b0da3b3826e73efd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909256, "uuid": "673b0b1f-5bca-4698-b743-ee2d928e935d", "value": "12288:HOYMYlxIimj6qr9wMiE+wGFYjA2KY59roDBM6nGplGJY:HOJYMimv+9wGqfKY59cM6GplGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637909256, "uuid": "2b1b27c0-0346-48b5-828a-992090a223ab", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637909256, "uuid": "46caa451-0948-4599-8c92-c42af17f0a33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909256, "uuid": "625b591d-d4d2-412f-8dab-4c27e5de1154", "value": "26.11.21_09.36_Anruf.0613259177.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f975d2d-4eb5-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637930144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930144, "uuid": "926d49ce-ca8c-4b1e-a227-2e40443c8d4b", "comment": "Malware payload (Heodo)", "value": "e6b565199ee656b00fb6db9d372d01bd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930144, "uuid": "3ac87c70-d749-47d8-acce-ab6a9c291406", "comment": "Malware payload (Heodo)", "value": "7c705327dd11a25b42d806825e81e2e26c4bd3af930971bb02ffecdc2d75d089", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930144, "uuid": "37861aa2-f96e-4ad9-b0c3-77b2e239a4cb", "comment": "Malware payload (Heodo)", "value": "50a9e472322c4b191c3dca96b6d766066f97aacd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930144, "uuid": "6004b337-6b13-43f2-8ea8-853723300725", "comment": "Malware payload (Heodo)", "value": "58020f2b845d40c21ff51b6d7d58808dbb1a706c0d707951a80e0b7e78dc4f227af5a8ee7bcf08286601c6422357e2e5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930144, "uuid": "d52b714f-368c-43cf-b04a-5d15ba5b4ca1", "value": "T13803BE1EC251F9ECD23AD93A81D849A5521E2E105042B94D2580B58CEF7B2FF6BDF358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930144, "uuid": "c3e9d5d6-3d46-46ff-a184-5ccba79827f4", "value": "768:e/I83GhApRrjevZCwVIYgBZVWpf/wak8y0VItKF:enKAbIIjkpw78XVIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637930144, "uuid": "a85a07e4-2345-401c-8f93-c892ba4b093e", "value": 37994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637930144, "uuid": "dbaaaa76-a1ca-46b6-b406-4c1eff2b56e2", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930144, "uuid": "1dec7d88-48a9-4875-b8a6-2ddb0a6246da", "value": "DOC_100599173331300699893.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5249c7-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637931056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931056, "uuid": "ecd2d7c6-7720-4c6b-9d20-27b83ee650e8", "comment": "Malware payload (Heodo)", "value": "1181b608fd5164012990feb7225f71da", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931056, "uuid": "d68ef491-f08e-4aef-a686-7c32b4619fc1", "comment": "Malware payload (Heodo)", "value": "7cad1b046490ded26ddf2baed6994c74c9181d4595a45ef4ab682c87178a6580", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931056, "uuid": "8e368e9d-06e5-4a22-9bd8-857fd171bc20", "comment": "Malware payload (Heodo)", "value": "5d53ee3da910e8adf29aa34e997f46ef568b43e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931056, "uuid": "c7e71b13-b303-4137-ae20-b9cae7405bcc", "comment": "Malware payload (Heodo)", "value": "ed562964e21e1fffe9f741132806a0043aaa256bfe3c5ec31cce256187f95740bb2d82d1023117c2af1212353227ac8f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931056, "uuid": "d0a3418b-7db9-4ea7-8c82-f28567646ab4", "value": "T1CCB4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931056, "uuid": "6aee918a-bf00-4504-a876-bd803e53427f", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931056, "uuid": "5a52945e-5779-4db2-97d3-0d6b4674df95", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDa63P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjBXC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931056, "uuid": "0816b805-5034-496a-80df-5a1a360f2a3a", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931056, "uuid": "0707a903-ff2a-4a69-bcca-b06918d848f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931056, "uuid": "a8b09f20-c290-4aaa-8fb7-72dda4d5fc56", "value": "1181b608fd5164012990feb7225f71da", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "485dd05c-4e4d-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637885437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637885437, "uuid": "c332bba3-c49f-44e0-9509-6432469184b6", "comment": "Malware payload (Heodo)", "value": "02b670be02512590bf60b12748004b53", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637885437, "uuid": "6271636d-ba7f-4e64-83e2-7ee2fc839149", "comment": "Malware payload (Heodo)", "value": "7d5e7440b39112cfcfbc8818f86802b0a8ea6d33925fbc76b03491c4b9558a79", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637885437, "uuid": "30f412d5-e623-42ae-b5e9-14baedd7c173", "comment": "Malware payload (Heodo)", "value": "48d62b54aee997b37345bce6bb14879f7097f1c4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637885437, "uuid": "b13ee946-54db-44b6-ade1-2cc9c4650a0a", "comment": "Malware payload (Heodo)", "value": "4dd30a7bcee3d0239d7c4870bd5efcfbec3117d10444afc66ee1ac8b7a7407a00a815581d08ea249907c078b45c62d57", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637885437, "uuid": "160dc400-e6dc-43e2-aefe-5a35e83614fe", "value": "T19F84AD117380C072D27B3634496BD77466BABC305AF5D20B7F907FBE5E316928A2835A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637885437, "uuid": "ece5e2e0-096e-4156-9924-67ad7372d6eb", "value": "98314c63889d16d0b03b55430157c680", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637885437, "uuid": "242be528-2192-465e-bf8d-77ec6bd2f196", "value": "6144:SwgKH5nGQwn6I6EstfaY0bOjWhUs0G1G9zEoVuIdmF3AxeR9s58SYC:FlFQstfaYAutPJVTdmF3Axqs58fC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637885437, "uuid": "3f9f35a2-3754-4235-95d3-0cbcb36ce6d6", "value": 397312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637885437, "uuid": "7e82a6d1-3f9b-4660-89ce-a42aa0ba1ef1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637885437, "uuid": "a621ab44-e836-4f10-9bb8-1dc8e5f189cb", "value": "emotet_exe_e4_7d5e7440b39112cfcfbc8818f86802b0a8ea6d33925fbc76b03491c4b9558a79_2021-11-26__001032.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7dfc3b3-4e8d-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637913112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637913112, "uuid": "4cd6025f-059f-41a2-9931-c18d30c68d59", "comment": "Malware payload (AgentTesla)", "value": "498e3da9cf23bda6f3580951c0b8fdb2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637913112, "uuid": "05e3f1b3-c583-4e30-87df-e274a2dc292e", "comment": "Malware payload (AgentTesla)", "value": "7d7c6831de76f58f8568c9d778223e8cabcc55453278b0385e24242885bc193d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637913112, "uuid": "5fee59e2-c86c-42c6-8a89-d5869a6ff096", "comment": "Malware payload (AgentTesla)", "value": "1efdf9835a564e2d23f3f930fc44983146debc67", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637913112, "uuid": "25bd84c9-395a-4c29-acaa-4d9c4a3a5096", "comment": "Malware payload (AgentTesla)", "value": "ed7bd2bbd47fdcd7716b1eb4ed58784dd88c66a8ab01c8218e43b370861fe89d3b09dbb55df4fb4b761f3d7898a337cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637913112, "uuid": "26bfeb57-6bab-4ca3-82e2-2c7b0a915b3b", "value": "T14594F17D77043F27C99D657E4891B20053F5C25B7A22F389AEE174EA937A7A04B01E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637913112, "uuid": "1bbc11db-70c4-43fa-afcb-d32d713be889", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637913112, "uuid": "aa5b8e61-a81d-4fb6-b2a9-6a8fa8cb6601", "value": "6144:NB6pt1PWA4VPLZZdPv0cjV6YbS+GkkDqBD4iFPM5Cag77EXfs:NYpt1+AoZZdX0M6k5umJFPM5C7kf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637913112, "uuid": "513df7ee-0904-4796-b5a9-31bc8d4f5f55", "value": 427008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637913112, "uuid": "105c7454-adb8-4d8d-94ab-2be805bbbc02", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637913112, "uuid": "d5ced9a6-c9d1-4ecf-9934-97e86a1b8a53", "value": "PO_2213009018.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64aa1d81-4eb5-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637930152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930152, "uuid": "bde15a39-67ee-4c20-b5ee-3047c690856f", "comment": "Malware payload (Heodo)", "value": "ccf756ff81eb1e59b57ed7068f2e1e6d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930152, "uuid": "ddd4ad20-0037-4684-b210-e18625d11778", "comment": "Malware payload (Heodo)", "value": "7de0ca7542c82ce41fb6c6ac5195661f591280c90107a99ad6aaa7f512f6c728", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930152, "uuid": "2080af68-c982-4a0f-af4b-e82866e64489", "comment": "Malware payload (Heodo)", "value": "a2a803ee0f54e0bae8d02747f06d9107815f0de4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930152, "uuid": "5417a876-4ca9-4132-b4de-83b2af9a5f24", "comment": "Malware payload (Heodo)", "value": "a9492133dbc0df5bbdd5433c19216cd3dabc1264ea183773d63df24ccd7f899ac7490af9f3f3dd31347e1c2b14659846", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930152, "uuid": "67138f99-dc74-47b0-a06a-ba27db3e8be8", "value": "T1FC03BE1EC251F9ECD23AD93A81D849A5521E2E105042B94D2580B58CEF7B2FF6BDF358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930152, "uuid": "3c3a095f-cbe4-40d7-9e8c-5cf226e7e52e", "value": "768:u/I83GhApRrjevZCwVIYgBZVWpf/wak8y0VItKF:unKAbIIjkpw78XVIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637930152, "uuid": "5b22cb78-1e25-4b47-b242-e9ab50871d8a", "value": 37994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637930152, "uuid": "48b49f2c-fcd3-4719-8c95-47a5c869b806", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930152, "uuid": "8a2163e5-0713-4d61-bdb5-1afe1ae81bb6", "value": "INF_874974229991572.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76081ef2-4eb2-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637928893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928893, "uuid": "7ee7e2a5-b134-4d4d-a70b-73e1c79b1d15", "comment": "Malware payload (Heodo)", "value": "509fb9ab459e55f773f1bdb3e130f8b6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928893, "uuid": "ad651458-20a8-41df-a4e6-ed93d2e3dbb5", "comment": "Malware payload (Heodo)", "value": "7df6fe01fe3c1b53a4dbdf52758409d92b408b474dee69a226b50d83beb1ae45", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928893, "uuid": "3fcc4ecb-1c22-44b9-b605-fc1f0c2b53b0", "comment": "Malware payload (Heodo)", "value": "c7b5607c6238c4660a480cf40dbeb5982691a484", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928893, "uuid": "3139435f-7787-4905-996b-29d1f099565a", "comment": "Malware payload (Heodo)", "value": "84be8b4ed4969fb702ee18a8c3bd1db43bfb7570471c76cb6e4c29620b9505cdafc17e03bec01e56652d5d562400af68", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928893, "uuid": "4edfd035-ee1a-4afa-a822-19e30b161527", "value": "T10403BE1EC251F9ECD23AD93A81D849A5521E2E105042B94D2580B58CEF7B2FF6BDF358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928893, "uuid": "82d2e14d-0a57-4db5-b667-26c32ab72f05", "value": "768:y/I83GhApRrjevZCwVIYgBZVWpf/wak8y0VItKF:ynKAbIIjkpw78XVIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637928893, "uuid": "ccb4cdd0-0f3f-46c9-b4bd-e408127cf7b1", "value": 37994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637928893, "uuid": "4f9f022e-d03e-4ccd-ab76-3fffd6200a93", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928893, "uuid": "b56539c7-f92d-444f-9423-532da093948e", "value": "Report.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "318c394c-4ea0-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1637921047, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921047, "uuid": "5f2993dd-b0ab-451a-a120-4a0b734c79d5", "comment": "Malware payload (Socelars)", "value": "08dc4be16b35146df19463ee09c2b5f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921047, "uuid": "e7cf006f-bc65-47e6-a681-7a9940a71e61", "comment": "Malware payload (Socelars)", "value": "7e96ab55efa05c82a93d5acd59dca542dce7c9e49ea383e4b17f9da81d2b3cd8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921047, "uuid": "8a670e09-c576-47dd-8c7f-324224cce926", "comment": "Malware payload (Socelars)", "value": "87e9d4c9cd4ad30e944edb9afc8c9cb8134dfe65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921047, "uuid": "6c825ec6-889d-4d63-b581-97e5078a4513", "comment": "Malware payload (Socelars)", "value": "f9a99f87788dd448637c4edb135f5d8a884685b476b92fb38717fcd386e5b2d881a3be61b40b6ccaea8eda5274915be9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921047, "uuid": "fad55ea2-2042-458c-97ce-44e58c12022e", "value": "T103759F11F642A036ECE3007286FF5AFE8D6CB621030494D7E3C45D6A7E619E37A36A57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921047, "uuid": "14ff54bb-d760-4fa1-96ed-290754f599cc", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921047, "uuid": "110b9159-dc27-4e92-a1a8-50e233d84b16", "value": "24576:2CjpXA4U35ozW03XRp/hESVE5uU2xbVN6pZVnoYLhZgEQs8n:DpTJxPNlcPVnoYLhZfz8n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921047, "uuid": "3b49fed2-bc3e-4287-bba0-784f51d1b844", "value": 1552896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921047, "uuid": "36e7b1c5-d27d-45fa-aed3-56658fea4ffd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921047, "uuid": "1a6a27bd-5bc1-4e98-a55d-948dc00b1422", "value": "08dc4be16b35146df19463ee09c2b5f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03443af-4e95-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637916642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916642, "uuid": "65f12d79-86b3-41a5-95cd-0b2a9edc7f4c", "comment": "Malware payload (RedLineStealer)", "value": "674666a8bba0a384c1911750f31481db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916642, "uuid": "44eb5fa8-f803-43ae-981d-c89d4e659be6", "comment": "Malware payload (RedLineStealer)", "value": "7ea766da00634b64fd5178410bef330b4fd33aa18c78e09ed0a97c9a8efea116", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916642, "uuid": "fd58dc38-1571-458a-9238-4af7b2fb4ef7", "comment": "Malware payload (RedLineStealer)", "value": "3661ad4b8f5cdbbf7b5cf81b0f90f5cd12f6e724", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916642, "uuid": "6844080e-c634-4da7-a514-eed969e1ca57", "comment": "Malware payload (RedLineStealer)", "value": "626260f87d4295fc460b1265414392ed4755ec9de29cdb3578d570ed08aa72f17440966dc405741f8faec91ad983933b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916642, "uuid": "ef1a1b3d-7133-4768-a144-a6ec9c1742f2", "value": "T15D547E107BE0C435F5B75AB889B593A9A93FBDA1AB3890CF62D526DE46346D0DC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916642, "uuid": "cff26b81-4b8d-4e31-a198-59ddf54d7bbc", "value": "ef656273bfb85d28a2059cd3657b6b5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916642, "uuid": "2fb29222-da75-4a85-858e-d3e4430f8d7a", "value": "6144:aZFZUPapb6gR0Q2ww4SXuZet0yy8uo7sBJSFvNJ:afq46gOQ254SXuZet0yy8uvSFX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637916642, "uuid": "a4d13991-de5a-4263-a64d-0348c8ae7bd3", "value": 300544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637916642, "uuid": "e955e82f-bfa7-4cad-9b2f-f5a3d7ae1990", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916642, "uuid": "e28ae6b0-9436-4cd0-9ebd-6d6e63542c8d", "value": "674666a8bba0a384c1911750f31481db.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6b867cd-4e61-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637894212, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894212, "uuid": "ab315577-f554-4ba5-807d-07070b7fd1dc", "comment": "Malware payload", "value": "55c500d5c08c3a95cc0ac3e342ed8f90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894212, "uuid": "7a07ab6b-a490-41ff-8f0f-c9e96d8325d4", "comment": "Malware payload", "value": "7ed93d8f23a38fa0f93fa081117a967dde315135e995da6cd78f24c57515f2c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894212, "uuid": "81946b7b-64ce-483c-bc97-966473e5d278", "comment": "Malware payload", "value": "90224a2e903b9765a2451b8e12441996297d67ec", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894212, "uuid": "85ed9422-7b0e-4fb7-bb71-b529858040e2", "comment": "Malware payload", "value": "0f08cfeebb094a21e904dbd798dbd208f2e51903b8450b47185016d886e4253ac0035d0111a4c211001f9183b8f52fe3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894212, "uuid": "9ed0f557-f1a6-448c-85fb-6ec748433906", "value": "T18923E14F846D3958FD7936FC8ACC0B503E88B1E3A4D003191B654E99E698887BECF5A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894212, "uuid": "81989c52-6626-4fa4-9c4b-aef47f6c6ff4", "value": "768:uEEmRHE5V19t6I3/t88xd84KvssEwTUeqpkt8tV5I31jFWRvmSKpgYAxOS:tOHd84sNUeEzPSSzKAxOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637894212, "uuid": "06bbc73d-1f4e-40d9-894a-35bc40398084", "value": 47436, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637894212, "uuid": "6e2422d0-682f-493d-90c7-3352679a4aaf", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894212, "uuid": "90db7803-d871-458c-bc2f-b83086769909", "value": "55c500d5c08c3a95cc0ac3e342ed8f90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a4d8782-4e65-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637895668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895668, "uuid": "cac64044-3461-48a9-9579-2a4149fb0679", "comment": "Malware payload (Heodo)", "value": "ac953533e9417cd67d4eb9e0d74b51ef", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895668, "uuid": "a3d68276-388a-4a3b-b72f-c9dae2644b7f", "comment": "Malware payload (Heodo)", "value": "7ef08e74f75c349ac594377d7de5d16c9588eb9b19a49ed6957aff0ee9d5fd5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895668, "uuid": "3ec9cc68-8b94-4b61-9dbb-453b4c783233", "comment": "Malware payload (Heodo)", "value": "f83e9f59e0983cf3bef6e79896cd90ed5d4ed0b7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895668, "uuid": "52fd4b16-9936-4fa7-bd4d-f76dfc99082f", "comment": "Malware payload (Heodo)", "value": "96b1aaca6fcd5f1e33b149d4c532d7fd75f0582f6d3c9ce49dc3caf5dc7480737004cade4c19093d287b58d3007c29ab", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895668, "uuid": "531b33f4-2c2f-4c27-89ab-d68c84788572", "value": "T131B4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895668, "uuid": "e4a27792-a274-44d4-8a0b-1b2b78b92707", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895668, "uuid": "12a52261-dc01-4d7d-828c-51b9c1516838", "value": "12288:smVdIG2GDNBtIlD987snCrkZW+mw3ffEPy:sm4GDNBtIl6wVZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637895668, "uuid": "b99ef505-7004-4c5e-bb64-4913b7fb396b", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637895668, "uuid": "40b84087-b1c4-4fb2-b1e3-c9006f0902b8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895668, "uuid": "12145759-dab5-4ea0-a221-d19a37286c68", "value": "ac953533e9417cd67d4eb9e0d74b51ef", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c91a2635-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637918724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918724, "uuid": "dee15b77-56a7-420e-aa42-9406a06263c7", "comment": "Malware payload", "value": "fcf3b2b2868fb83bd6f5fd5d540f6258", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918724, "uuid": "fd29ea54-e059-4f36-b295-753d93e56cae", "comment": "Malware payload", "value": "7f91d8e6ecf53fc2fb61efc5244319a63882d384c7015a65e60d2a6132aaa593", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918724, "uuid": "6ec5662e-8cae-4709-83f7-0e08fd7f1d47", "comment": "Malware payload", "value": "f7c44c965d7f04d6eff58e05e8bdad99fb9607f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918724, "uuid": "2dd33cf8-5c90-46fa-9801-551c43fa84f8", "comment": "Malware payload", "value": "aec7f2f6b75e87b229f4f2a8c3b1be413823ec713b198bdb51dffa5410fe6e8b325cb65b4791d284825d4c4a66f665d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918724, "uuid": "19a6bd9a-124f-4e51-a972-cb02d505b8b5", "value": "T1FF8507311A493D0DDAE111F12DA671A763C17F51CD39F3B5A867FEAE89FAD080246B80", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918724, "uuid": "9039af81-b1de-460a-962a-0eb52e26983a", "value": "514c554c4eccf8b5d18d8453867113c6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918724, "uuid": "e1e0956d-f49e-400e-a949-f37983c5a333", "value": "12288:PHkVE/oStgnvXtPL/uKYdyI7NVhfUPvA2:cV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918724, "uuid": "e7c1d6e0-3d9f-4be7-98e9-a6d5983b6e85", "value": 1781015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918724, "uuid": "1ebc09f1-b59f-474a-8fa1-3b0898f2f456", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918724, "uuid": "3c7a5fda-1645-491d-9dc3-9f24b6d6f667", "value": "7f91d8e6ecf53fc2fb61efc5244319a63882d384c7015a65e60d2a6132aaa593", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39d3f89c-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918913, "uuid": "5058fd4a-236b-4136-bf7e-200f9b26521d", "comment": "Malware payload (Dridex)", "value": "d746a159642a08b5fcbf2efd9059b785", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918913, "uuid": "a41c37b1-fe34-4cca-9f9f-524142290cc6", "comment": "Malware payload (Dridex)", "value": "80078c8c2ae41981fe8bb5cbcf23f5999cd40f2ceb5c35183d890d75e64cd665", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918913, "uuid": "d2c9e4a8-080b-445a-8169-c16e16fe14eb", "comment": "Malware payload (Dridex)", "value": "af0e1db7af9c76413de1daefde55e4956cfc1135", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918913, "uuid": "f614dc4c-2d95-4dec-bb34-8ed51bce8da4", "comment": "Malware payload (Dridex)", "value": "dee182bed26848cc2c3a552643207342cb65351a83a6d003aa60df8d730d96210e18fc3404e7d834840a2fe87b8c9ebe", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918913, "uuid": "adaceeaa-d6cf-4477-9fba-74bebb5157d5", "value": "T1D355E102FF9963E6D9502DFAD5F0F2A3C9B4F5858C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918913, "uuid": "cfcd61fd-ecbf-42a0-ae22-675a9605a50a", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918913, "uuid": "5948cfd4-c9fc-4dea-b559-07d579dcca16", "value": "12288:LZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:LZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918913, "uuid": "dc39415f-f59b-4ba5-874e-7f8f38fc6c07", "value": 1347584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918913, "uuid": "f4f4bb74-5607-4aca-8bfc-0e0431137dca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918913, "uuid": "c00bd849-730c-45f4-b0c1-1698ad744bb2", "value": "80078c8c2ae41981fe8bb5cbcf23f5999cd40f2ceb5c35183d890d75e64cd665", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fa911a0-4e51-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637887194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887194, "uuid": "36036425-37cd-44f8-839d-45c200df109d", "comment": "Malware payload", "value": "db5016a5e219100d9c65a39ae70a8ce0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887194, "uuid": "06d8ddf0-559d-462f-a331-ce8a264e59c7", "comment": "Malware payload", "value": "827c34e465121beedeb46dc453935b7f5a27a284b665a650083d8e05d7493e88", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887194, "uuid": "a3587af1-b353-4074-9b64-d7ffd017a8f8", "comment": "Malware payload", "value": "21a8567fc94c5eedb3bb92d2a5fff18c81c196f7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887194, "uuid": "9ea0e6a2-e1e9-49f6-8c02-b8a5ca28e2db", "comment": "Malware payload", "value": "bc13a9388f79027d397f386ac52726b56af20d84c652f9eab8157430cfa83ba8710fa066e25cbe38b5d307ba63b0868c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887194, "uuid": "90fb6707-ac7e-46f6-adaa-28155b9e3604", "value": "T1EE56127E61483758C00A88385433ED48F2F6512F4AF9C6ADB2EFB6D0AB2F515D942F46", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887194, "uuid": "c349e4c0-b5b5-4d80-b0ad-78d75e2d3604", "value": "55d465b964ecd29464e0b6b7330b4b78", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887194, "uuid": "097ab37e-2725-45f4-bd8c-cab29978adfc", "value": "98304:6Qvyq8xdZ5sGHXwOgQF4zxCPOvS485L0HyXRfC1f/FbGx9zK1QdHD:cq8xdZ5sGHXwOgQFgxmkS485LwO5Go9L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637887194, "uuid": "379b38fa-9c97-4d16-aa2b-1fa44605b386", "value": 5912064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637887194, "uuid": "466727d9-28e2-4004-9577-2366794308fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887194, "uuid": "284c5ace-28ac-4448-809a-2a76492f055b", "value": "db5016a5e219100d9c65a39ae70a8ce0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4b85ce8-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637921670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921670, "uuid": "5396450b-3695-4d55-a484-7ef94f6cf624", "comment": "Malware payload (Formbook)", "value": "06888af099b63c6a3652fbc280ab4bb7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921670, "uuid": "4b8b4112-3fa3-4121-a40d-252b97dfb604", "comment": "Malware payload (Formbook)", "value": "8311bc66f9de871c5ad267be4852698655ba62c12b4da316ae2e00c397397938", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921670, "uuid": "64192614-5a52-45c7-9744-26227439bd9f", "comment": "Malware payload (Formbook)", "value": "c92e18113743d2d6f4d64b56114b80900a98877c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921670, "uuid": "0334af4d-f4c1-4710-a2fe-0e195d0402e0", "comment": "Malware payload (Formbook)", "value": "4165e4d95b6788ff25f8f996e0c5a2e4cba06a9c3d9bef9046b6cfcb473e1a5bdf94438e543683463ba257b9f5a12a2e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921670, "uuid": "94409464-80f5-45e5-853e-bb607b39edb2", "value": "T148341278BE7886BAE5B12C713370E4235B93DF4838283C7AB8E235506D75929B1D0ED0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921670, "uuid": "7447bf77-1850-4ede-993b-6dc65d9afe02", "value": "6144:+iaihQw6dBPLtOF1nHFU4CoNe0HpPbiaCaYe2Hz:Nbiw6dBPLtYnlfCozeaOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921670, "uuid": "5c562f8a-7f4f-4885-a965-a0b535e34d8a", "value": 234488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921670, "uuid": "3d9bd7e7-39cb-4c25-843f-a1278f653a76", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921670, "uuid": "74b33455-1113-48d3-bc1c-3bea84d9412d", "value": "PO400585950.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c14e99ba-4ec7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637938039, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938039, "uuid": "87a2af6b-7a67-47d9-b85b-c5e3188aacdd", "comment": "Malware payload", "value": "c7cc7adba8093ce2767b941514004d16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938039, "uuid": "3b5f68b0-797a-4d0a-b9c7-d310cca561bc", "comment": "Malware payload", "value": "831fc480fd44073d940ee55a1a44922f099ab584131f1c9ebf7a78b86340419d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938039, "uuid": "540c52d4-21d3-4310-a0fa-700a5bb129e2", "comment": "Malware payload", "value": "dd28c744cf6fdafeafd8be2100e4980a445f7dc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938039, "uuid": "44924ad4-ad14-472e-bd95-aae8f641e31f", "comment": "Malware payload", "value": "1f48b628aed58021b555ae1d7700e5ce61d4161e3f45a34d05cff07cc5d848607e3316bfa8d7ffc39f31272adaf2bb66", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938039, "uuid": "e114661c-cbbf-4400-9d47-5d730e90bea1", "value": "T15E82C012179AE4B5C3740C384EBECFC69B6F57F8E1A631E3BE8812684943D5E1178296", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938039, "uuid": "195f211f-6701-4f07-9464-f6a6a5df13a9", "value": "384:YMzyEH4nSzkrDrVOIdZPr4QCju5+8/vh7zTDhymdGUop5h4:sVSgrDpVr4Qcu5+8HBs3Uozq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637938039, "uuid": "169ed708-2de5-4c3d-9f59-9644702654e0", "value": 19040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637938039, "uuid": "718ca8c6-0a99-4b33-87f0-f679db5f51ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938039, "uuid": "62a48323-66f5-4c43-b3df-6b381955be76", "value": "c7cc7adba8093ce2767b941514004d16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55de0ef4-4f09-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1637966205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637966205, "uuid": "79a3dda0-dbef-4dc5-8fc5-c24834a890c0", "comment": "Malware payload (BitRAT)", "value": "577c166870c1be61b6f120179e8d53be", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637966205, "uuid": "4b92f86d-e578-43a6-96f3-1b80b995ab23", "comment": "Malware payload (BitRAT)", "value": "845b74b15ba4be9c025bb5feb29b106d39ebe824609d6c83273399ba7c8315f8", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637966205, "uuid": "31d39883-2497-436f-98bd-7b49f707ed31", "comment": "Malware payload (BitRAT)", "value": "4ec67e1a92b5300f854d40cde73e2c474ed55cf7", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637966205, "uuid": "bd0befde-ee78-40a5-bb4a-98c0fecb2b5f", "comment": "Malware payload (BitRAT)", "value": "9e92ef631384e42d3ddd40c1f9e7917e56850b18880820efc4b5af1e1c96038f39368fa8217b4c213e6d506256c572b5", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637966205, "uuid": "09230e7a-32cb-4873-9fe2-287afda0dafd", "value": "T1F385330C0AD94779D50956B37CADE106CFEA0A8F6C62D144B4CDE1A31FE33A98997D23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637966205, "uuid": "fa8f9134-a3cf-4859-8b19-10361ca9ce64", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637966205, "uuid": "76b74738-428f-4b0e-8a12-d5faf464becf", "value": "49152:VW0KxtdgKIeFzTDyLqfirT1Kq4xa+xQULwxWsGDjF9BenwGj:kDbF3GOtj0xWsGDjnBClj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637966205, "uuid": "150084dc-662e-4d0b-8c1f-c45fb66783cc", "value": 1838080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637966205, "uuid": "4f0fc1d7-a410-49dc-8b1a-9303c07362d1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637966205, "uuid": "68bdf77d-1053-4ed3-8e4d-0bab6c7d8ae2", "value": "577c166870c1be61b6f120179e8d53be.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34fb905d-4e8c-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637912463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637912463, "uuid": "93b4c6f9-5978-4151-a696-cf5e2ad76134", "comment": "Malware payload (Loki)", "value": "5e695d4451145b265da84a2122535da4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637912463, "uuid": "b1174683-703b-496e-98fd-82cba2f09103", "comment": "Malware payload (Loki)", "value": "84ebc64b48ecea825050c7691c86a0c05902f87727ee35988819a6d07af111bd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637912463, "uuid": "1b4fbde9-2031-4064-aae2-797275229c35", "comment": "Malware payload (Loki)", "value": "92fb17bdeec2bc758ac0282896a7956bf2b4dffa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637912463, "uuid": "65f525cf-48c5-483e-9a9e-8ecc3034e824", "comment": "Malware payload (Loki)", "value": "71f57439cc53da85e9461b9057cec1cc8afe1ada3d62347d4c4f42dedde5a1da23dcf82bcea73c5e28b16b800da0cde8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637912463, "uuid": "242d1025-8929-4eae-b013-8d4968a26912", "value": "T10284BD56356497F5E13847F3BE03A41E57B22DFA9961D2086ED3F2DB2871B200E90A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637912463, "uuid": "b1b5fbc2-81ab-412b-95c1-d3d53160dcb1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637912463, "uuid": "9142a754-6442-4e3f-aa09-06b5eec15309", "value": "12288:JOoLNixBFmdIIMpz/skjb0s0/YfLKMkjKU:RJi16WJ/skj4Z4LRkjKU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637912463, "uuid": "413abf3d-c9bd-4917-8a89-86786ac4cbd2", "value": 396288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637912463, "uuid": "708680bd-4d7c-4e25-ab1e-a9135d36f0a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637912463, "uuid": "5bd4e9c1-9eca-497b-a0ad-f210a702ba49", "value": "Payment Advice Advice GLVA29879055 Priority .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d82f52-4e77-11ec-843c-42010a9c0014", "comment": "Malware payload (Gh0stRAT)", "timestamp": 1637903425, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637903425, "uuid": "f879c9e8-680c-409b-ba5e-6204c90e250f", "comment": "Malware payload (Gh0stRAT)", "value": "d37916e0c208c80bd9acdcc8c792e0f4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637903425, "uuid": "1608daf0-7856-4910-84b0-88d8ad81eaaa", "comment": "Malware payload (Gh0stRAT)", "value": "85b28249fe4da7de9cb2ec4bd4b6d9729684b35cb6326462dac08a43accee58e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637903425, "uuid": "395c838c-635e-461e-989f-669b2f1295ad", "comment": "Malware payload (Gh0stRAT)", "value": "8c6565ecc408a0661826634fa079e3ee1cc08115", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637903425, "uuid": "0b40eb46-e83f-4333-994d-65b6518e22b5", "comment": "Malware payload (Gh0stRAT)", "value": "ea16ceac00a3bbd77adc4b6a0c8cd55ba4a0198ec6dd76526ceab21843465df42cbc3007b186a7220717934803921565", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gh0stRAT", "colour": "#8BEA32", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637903425, "uuid": "055db1c9-a3ca-4eb2-ad71-b1902f39cc91", "value": "T1734270237B586677C7124ABB28E1F2421060B10175FFF18ADFD433AE58192A5FA31B69", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637903425, "uuid": "3b3e5615-e0b5-4c70-82e2-efc92cef9cba", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637903425, "uuid": "b258b73b-897c-4768-b1e5-f28625069927", "value": "192:v54ynFTloR9WL79NvRagU8OtvoHOI/AQflp9S:v54ynFTs9WL7JVUnNCOCAQfZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637903425, "uuid": "f8a30bef-a90c-4830-92f2-344aa5888233", "value": 12800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637903425, "uuid": "77a0d2d6-448c-4a3d-92b2-5ef06e4e26fa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637903425, "uuid": "f0819d21-3721-4ee4-a9b0-5a3ce91962c0", "value": "d37916e0c208c80bd9acdcc8c792e0f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95b26e84-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637954286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954286, "uuid": "25d0d4d3-41bd-4f4c-aad6-fd5b258aab0d", "comment": "Malware payload (RedLineStealer)", "value": "6dff042241a4a9a8cdf00c4d395a703d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954286, "uuid": "32d75027-409d-4fce-a91f-5013a4b1990c", "comment": "Malware payload (RedLineStealer)", "value": "85f5c6865815fdf6f04b54b442809e0653b2b435abd0ccb8b03bb050e8a303dc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954286, "uuid": "efb7bd47-064f-480a-9e98-2f5cb964a28b", "comment": "Malware payload (RedLineStealer)", "value": "c6db8ecabfeb4cb4da432e7b952998c097d3166a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954286, "uuid": "9dcb2999-928a-406e-8485-7540809fc2d1", "comment": "Malware payload (RedLineStealer)", "value": "17d5db12347108bac5b0ae82e686c4e06dcea7879775cc9a0828b3d97b5b52bb49d355037362014fd4bc9600c49ebc78", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954286, "uuid": "8ffc71cb-9588-4cc8-86b7-167a5c9b627f", "value": "T1E654230592AB53B1F7169F346F7185AB9FC97D315DA7C44C9A1A1C386E80CF20B918B3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954286, "uuid": "5e87463f-08fa-4c3e-917f-31735ded8991", "value": "6144:c1eMN9OMrVLsH3cDTM+2O+AEpZgncmJWb2lkNtGsz5LYnEoDtP+:4eRygHzpgXkIOLYn3Dd+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954286, "uuid": "f2418af0-7240-4e48-bc34-16161ef9879f", "value": 287889, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954286, "uuid": "bfd397fd-343f-4057-ac9d-3312703c9d48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954286, "uuid": "f7c7e3cb-5347-46b6-b942-e52848e8f693", "value": "6dff042241a4a9a8cdf00c4d395a703d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ea77aff-4e85-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637909392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909392, "uuid": "cb5bc141-bfe9-48e1-b655-772bf64a9112", "comment": "Malware payload", "value": "0efddf0d42555cec5d3b62bb5ad93949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909392, "uuid": "4fc57df3-2c40-496f-83c1-9819b802cc5d", "comment": "Malware payload", "value": "867204c01e6d4bc8938eb2faa954bb39b0cc1640c98fb7a7211885991892edb8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909392, "uuid": "821df39b-077c-4b15-8234-e2239420984e", "comment": "Malware payload", "value": "1415d41210f9f37d894907f0f6c3d904ad236bd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909392, "uuid": "38b972a8-ad4b-41c5-9c12-9009bc1adeec", "comment": "Malware payload", "value": "adc0f7c344d361811eccfeb857fdfe62ff5b86e1784386079519dc331f07213518a25eb42d132e39191d129ea59a13a7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909392, "uuid": "62b20771-7192-467e-957f-cee2b411a0df", "value": "T120C4DF57316897F2E6388BB7BE13A00D47A22DF88A61D7486ED3F5CB1471B204E50A77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909392, "uuid": "96450354-e5d9-4219-95e5-84dae05084a9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909392, "uuid": "1b380366-9f04-4c6a-a71b-d0af8fb9999c", "value": "12288:noL0ixBFm6X3XTkbXMy6vPVBuGXQjDmtDW0UXzV3qkKhn7qK1Lc:oAi1zHTKX76vPVBuGYahGzVO7qK1L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637909392, "uuid": "2223d3da-b667-48c4-aba0-597e6d2878f5", "value": 552448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637909392, "uuid": "01edaf43-dd80-4ddc-a455-2b22ca1cd961", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909392, "uuid": "6e7e10c3-786e-454b-8cb3-4b12966d6d27", "value": "PROFORMA REQUEST _ LATEST PRICE LIST.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a07599e1-4eaf-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637927675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927675, "uuid": "e0bd9940-7f21-44c0-add4-30cd8f859334", "comment": "Malware payload (Mirai)", "value": "700f929d70e31c5c0583d63d9c9ebeb2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927675, "uuid": "62d637d9-90ef-4c43-8339-0e16235d6ef8", "comment": "Malware payload (Mirai)", "value": "87bbba1fcb4e89fbf535e56ef69b0bca0f455986ed2dee032fa61297627c34a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927675, "uuid": "fdd28ddf-1ac7-4d3b-84db-c34c1e091bb3", "comment": "Malware payload (Mirai)", "value": "9c23e8e7375ccafcc56330ec207c4f244f0eff03", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927675, "uuid": "d654ac67-0962-47c1-be29-c18b2f9fddc3", "comment": "Malware payload (Mirai)", "value": "928201656304db014856934a78ac7726ca04ccca874222e2a6160dcedcacf0b0203eed3d1094d09807650f9cb1162abd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927675, "uuid": "148ac5b3-b427-42dc-892a-9bdf9d270cbf", "value": "T193C30989E8815F14C5C606B7FA2F514E33161778E2DE72139E14AF64BBCB81B0F3A646", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927675, "uuid": "aa1c1d76-9d29-4781-8ca6-f5b2c30205c4", "value": "3072:J7DXhBRSd2ThiHlmQU4qt2yQa2Pv0un1DbZI6zd:RrzRE2ViHlYBQakv0OI8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637927675, "uuid": "1fe6e320-0003-4344-b8dc-a3950de9250c", "value": 128456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637927675, "uuid": "5b214990-4940-48ab-a28b-576071c978ae", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927675, "uuid": "e51a2a92-d4b7-4e36-b9fb-4a52953b2440", "value": "700f929d70e31c5c0583d63d9c9ebeb2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a446a123-4ee5-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637950875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950875, "uuid": "ec8742fd-d344-46a0-a016-197f854f0363", "comment": "Malware payload (AgentTesla)", "value": "a83b61598e32441b21cdff23029016a9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950875, "uuid": "c12e9990-e7af-465d-b633-fef7f4ec5a08", "comment": "Malware payload (AgentTesla)", "value": "880f28a951f2267979cb470bfe3f779f8b722cf04bc693c3a8e5f9b95b0eeb0c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950875, "uuid": "e5d07ed4-7779-4cdc-846d-bfedb3f74635", "comment": "Malware payload (AgentTesla)", "value": "40233546b63190b7ee2d5734726a4fe73973e892", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950875, "uuid": "51b77e2a-ba71-48a0-bb70-0e610360d65f", "comment": "Malware payload (AgentTesla)", "value": "7172f474c5fe19a159c2f8838b5b87c617221bf6e309c9de66d72e67ee80979d4eb3e3cfce9016a08fcf138f20dc8ff0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950875, "uuid": "46cc29ab-f872-4fde-9d91-e2d375104740", "value": "T187F45A9D361071EFC92BCD33DE951C68AA512CB6930BD203A01375ADAA2DA97DF141F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950875, "uuid": "b34622b0-e0bf-4779-8201-141ea1f3a3ea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950875, "uuid": "fbf9e506-eba5-478e-b761-a51426eb29d4", "value": "12288:0kzxDq877gloLVixBFmX52scNkZXt+uQf4NiHkB5L3i9jiqKDM2P008REPr8GIFc:0kzpZ/Ri1o2XId+u1e+LsByM600", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637950875, "uuid": "c4c8a49b-7c69-4f4d-99d9-72443d53cbc5", "value": 729088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637950875, "uuid": "f4b80abc-8c6d-466d-85f8-bdaa5242f97b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950875, "uuid": "be5492a2-2952-4ceb-a3f0-adcf5cb3b659", "value": "Pago completo.pdf____________________________________________________________________________.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba66473b-4ea3-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637922565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922565, "uuid": "aef85086-91ec-4a63-b835-0ea5751f6a91", "comment": "Malware payload (AveMariaRAT)", "value": "5c27bc8467af13b48683fa31482fd8fe", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922565, "uuid": "aa7c123f-ae6b-4686-89f4-7136c5f02f29", "comment": "Malware payload (AveMariaRAT)", "value": "8839239694453d40e3b400a18ad761c57fe9ba56e9abc31c01356736de367601", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922565, "uuid": "0d35039e-7f58-4739-a0bd-c32c2fb1d628", "comment": "Malware payload (AveMariaRAT)", "value": "efa130d824e29aeb9666010aeb5e013d29c8eeee", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922565, "uuid": "68399aeb-018f-46bb-8fb9-64aa0b166747", "comment": "Malware payload (AveMariaRAT)", "value": "2e5916260734b94f92fa5a7f88eeca3976543fc013c501a60a5f3b1e4340ffb1e9839b267168ea0e5205607a112e67be", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922565, "uuid": "bcba08a3-fd04-4150-b62b-09b8207067b5", "value": "T160029E56DE0A3C13CF495A3B092C563E27A8B651FA7AA94B3C4001C205CD97063ABCEE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922565, "uuid": "6bb566ab-f5a7-4d09-8fc8-298c131f6e15", "value": "192:jCPwS71WUyF3/qH7jc25/lfJbDhaFgvIpD4ty8WztOiBz8:jCPw41WrF3w/c25hJbVlv685WzrK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637922565, "uuid": "92057219-8db4-4b8f-aa57-698d8d17429f", "value": 8732, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637922565, "uuid": "db650b48-aa5c-43a9-a967-88aca6c3572c", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922565, "uuid": "5b395bf1-ebfc-4095-a711-c277fb51193d", "value": "Prep.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ca2d651-4e87-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637910409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910409, "uuid": "928cbce1-4ebd-4667-b17c-e508f6cf3c5b", "comment": "Malware payload", "value": "1ed0423b6655c50180e6eee78e0784af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910409, "uuid": "bcdb6bef-d788-4ff3-b4a3-3890a4967853", "comment": "Malware payload", "value": "88eaf54c0f1a272c07bc32b802bfe1c57a9fed0ad722ae7b55095df169ca4176", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910409, "uuid": "ab408a35-fb3e-4695-a557-057846d84e0e", "comment": "Malware payload", "value": "c7b446cdcd4e97eae8f3cad9e11853becb06b608", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910409, "uuid": "0dec186f-9643-4b84-a8d7-00afa8f72369", "comment": "Malware payload", "value": "8227976fe2110e54a69fb7d86e7cd7fa8ac850de3911c8a0a1ecfeb24be198caeb263a34ab0a888264a5970f49a6bd43", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910409, "uuid": "f3c71f61-418e-4c6c-b515-c8f2fdb8d528", "value": "T19FD4BE151D340109FEDE4EB2545842D32AE2EC136A69962FE3417F66C2B230DFDCA6F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910409, "uuid": "b10892fd-f91f-4e86-a35d-58d29ab9f190", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910409, "uuid": "d8166f1d-d781-4ecb-936b-d91c716efa35", "value": "12288:D03ixBFmqwXqjuL2Xlzq5Gn2khWfHJUu7Oj5v:D03i1lwXq6+zO7zfHJUu7Oj5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637910409, "uuid": "f7a85bc9-e803-4c15-8dd0-b2c6253ea886", "value": 608768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637910409, "uuid": "17c21706-5bd0-4ed7-9efb-574b2fe569b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910409, "uuid": "49759496-b7e4-4092-9f66-546ac507af92", "value": "Reconfirm payment_details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cf9e49a-4ee3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637949923, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949923, "uuid": "560ba691-d8a0-45e9-ad78-a4269a3009c0", "comment": "Malware payload (Formbook)", "value": "2949dc1b8990084c6c2317facdd3c279", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949923, "uuid": "86281bd3-5132-4ba6-9b66-2f1f88c77dd4", "comment": "Malware payload (Formbook)", "value": "8919f6b4e9a3deddde2e664e727304062d1046a6bc3d54920e24b2b68007090e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949923, "uuid": "ba2afbf5-5a2d-4ebb-8bd2-327ab73a43b1", "comment": "Malware payload (Formbook)", "value": "f014385e40bfc59f2d255bf3a62f83233277aa8d", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949923, "uuid": "7f7e6bf2-49cc-478a-a79a-55c9273f9b64", "comment": "Malware payload (Formbook)", "value": "972ba8eea3241ebbcec1274bc81432cb968fc4fdac020a8ebab1109308e5d64a722f886726ec8c6f78930404e727f28c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949923, "uuid": "e609efea-3b62-4202-a381-eeae0c66e000", "value": "T132341200BF23FC04D718EFB7E45B6528D235EC278A1A370A148A7758EA3C532657B6C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949923, "uuid": "4d4abaac-550e-42b5-8890-82dd7ec73677", "value": "3072:IClIGrMhNKY0fE4SZoOaLaY32ZFj5rsiZy4P9C1tezz5E6sT4yJBf4CHCtrj/:nwW0qG3j5rC4PDRE6S4y7wC+f/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637949923, "uuid": "42fee672-96cc-433f-9a32-cd651eb9b66c", "value": 234568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637949923, "uuid": "d26d5e49-9b85-4acf-885c-ea2a5c60ee59", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949923, "uuid": "31f11821-efcc-4b5a-a19a-e4c9fb2e3e2a", "value": "Item Receipt 40006.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "418e75e9-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918926, "uuid": "b46d0bd7-6cf6-43b7-a744-6e7f5b2df76f", "comment": "Malware payload (Dridex)", "value": "cd87697a9e2bdfac82d9b7154c3105ce", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918926, "uuid": "340ac618-072d-4ede-9a19-acdb616335d1", "comment": "Malware payload (Dridex)", "value": "899cac1d02beb489b43a5aad1ef87609f3783d891def8f5fd122d848c71da5fb", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918926, "uuid": "519ec153-b111-446c-87a1-6958687c0c3e", "comment": "Malware payload (Dridex)", "value": "963e78487647a3b7199211154b8fe7f6babe6bbb", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918926, "uuid": "9186783f-9c8f-42ea-9a69-4d2aa034f52b", "comment": "Malware payload (Dridex)", "value": "12f28fb6aa234523ee39d26d1b341403f27dcdf59e157bf22f8bbf8fa9878c485585ad3fbf1d967ac833793eb75d902c", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918926, "uuid": "277db41e-1f8d-4a6f-b945-72ec52ed24dc", "value": "T18055E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918926, "uuid": "3ddaceac-2f00-4755-a5eb-1022303de00f", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918926, "uuid": "48d0c800-53d0-4bd0-9db6-7d877d8fd7e2", "value": "12288:cZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:cZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918926, "uuid": "df2446d1-96d7-4b57-b072-b01a9ddbd71f", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918926, "uuid": "c7e3775b-b5a1-4358-8359-ef4c24286a21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918926, "uuid": "56bbe6ea-f616-4a13-ac75-aec279547d23", "value": "899cac1d02beb489b43a5aad1ef87609f3783d891def8f5fd122d848c71da5fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37807385-4e9c-11ec-843c-42010a9c0014", "comment": "Malware payload (Tofsee)", "timestamp": 1637919339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919339, "uuid": "da323b96-f685-4eac-9886-0b3c6d694f81", "comment": "Malware payload (Tofsee)", "value": "f61a85474cda3ab87bb89be28c2a7b57", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919339, "uuid": "53eab649-5d20-4bf0-a12f-d280970b8dda", "comment": "Malware payload (Tofsee)", "value": "89a6ab2bb3c870054a01c49befe4f52de08ec1a5a40bf4b9208eaadd9e89032a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919339, "uuid": "f75d5f75-d9e4-446e-aff4-bcae25abc6ba", "comment": "Malware payload (Tofsee)", "value": "d02c0baddbfdc0d36ffecc5674a6c63abc37fe11", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919339, "uuid": "991e9bec-7cd7-442b-90a8-5b8f59fc7ab5", "comment": "Malware payload (Tofsee)", "value": "28d928fe02554fc859fe26178067a7fa6dc1410d9bb682774ae06e086a9c1253cd2cce008fbf60cf4bc6bd721fab78fd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Tofsee", "colour": "#0155AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919339, "uuid": "d92b2b0d-7f0d-4c2e-8259-a2c2f53afa02", "value": "T101548D106BE0C435F1B756B889B5D3A56A3FBDA1AB3890CF62C126EE46356D0DD30317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919339, "uuid": "89ac001d-9abd-4d3a-9c6a-f584cb18452d", "value": "ef656273bfb85d28a2059cd3657b6b5f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919339, "uuid": "a6fff690-596a-4e20-aefa-50f238be756e", "value": "6144:RbarHWqmUYul0Ak24FtSXuZet0yy8To37XuSpn78o:RclmUYulNk2MtSXuZet0yy8TSeSpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919339, "uuid": "d63be2bb-4a3b-4e53-8b4b-3aaa4c4d12b7", "value": 299520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919339, "uuid": "2cb54394-01bf-44a2-b4c9-448276e73ea6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919339, "uuid": "d5ce93cd-d10e-4e22-b7b0-23698fbe75ba", "value": "f61a85474cda3ab87bb89be28c2a7b57.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f1eea7f-4e6f-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637900132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637900132, "uuid": "d6ea3062-e4a1-4499-9f28-57cb999de642", "comment": "Malware payload (RedLineStealer)", "value": "d8bab14ea6b73ec07acfdedbdb81ac68", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637900132, "uuid": "a7af6602-474e-48de-a854-5e0c0910b233", "comment": "Malware payload (RedLineStealer)", "value": "8a238409c8e182cc005bbca9233803149db3d0260d5246112f8b68c5a1dfa54d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637900132, "uuid": "09fc9534-ba3c-4385-b0e5-c21fbe36aade", "comment": "Malware payload (RedLineStealer)", "value": "6bb56e14ee820e11093cdd63bd6b493bbbad7915", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637900132, "uuid": "8c2ed8c7-7060-472b-8ffb-c977b6984ce6", "comment": "Malware payload (RedLineStealer)", "value": "b657ee0c55fd9a2d584d92664b31d01ffb42f42c618c73b5891c76f2563c14b931cfe2aa514a82b9e4acb987630e8a26", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637900132, "uuid": "11ecefd9-8246-4c38-91dd-c30ccecac1ca", "value": "T131321A457BE8867AD2FE4E7509F393108131E7479862CEAF3CC8508E6D637844661FBA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637900132, "uuid": "f8fc352b-1453-4eb4-bce8-4d2ec4fcec72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637900132, "uuid": "198daf56-2558-4e81-b4b0-a3fb48130a8a", "value": "192:/rUXCst69f/0Q2dFZl2zbpWl3hLV6prZMY5JgJ:/AXzt69UD2zbQlxLEZJ7g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637900132, "uuid": "15cdb69d-2d85-4c98-8861-3ed3d578a10a", "value": 11776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637900132, "uuid": "6b59b9d2-2a21-441e-8243-40111f8814d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637900132, "uuid": "1d8cd07d-c9dd-4a35-a99a-859ae398ccd2", "value": "6bb56e14ee820e11093cdd63bd6b493bbbad7915.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec11587-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918895, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918895, "uuid": "549eda26-3a73-4330-b36c-abe421054326", "comment": "Malware payload (Dridex)", "value": "bf1839ade874f6ca04aa9e4a7783a6d1", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918895, "uuid": "d6bdd3ac-1c78-4d17-827f-2abd8bedbf4c", "comment": "Malware payload (Dridex)", "value": "8a4e80e4a3f944c227eb6889457ef30477e7cdc96e1b387773d14e2bab450933", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918895, "uuid": "348c1927-b4b7-48c8-8b6d-3fc8f3d8c911", "comment": "Malware payload (Dridex)", "value": "64db32760738546c971c06b7c8af9747a37054c3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918895, "uuid": "c1525b51-89c7-432f-a28f-b8500ebe2d07", "comment": "Malware payload (Dridex)", "value": "bd700e7d16ae71457bfefffbe57d6508ba9dd6b1a1b470678411999f938503b7120354f2c0ce214e89829095d19dee68", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918895, "uuid": "15dea446-c4f6-4c54-879b-7664954e51c6", "value": "T1E955E102FF9963E6E9502DF6D5F0F2A3C9B4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918895, "uuid": "9b200cc2-ed3e-440e-9256-1d82b2634ea9", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918895, "uuid": "d18ac7ae-d635-423c-91e7-b328278a53d7", "value": "12288:4ZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:4ZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918895, "uuid": "94839641-c273-4df6-b59d-e466acffe7d3", "value": 1355776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918895, "uuid": "3277513a-e55b-4abe-b973-82a6fc10cbcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918895, "uuid": "10fe3b74-0b04-461e-9858-f5b154c07e71", "value": "8a4e80e4a3f944c227eb6889457ef30477e7cdc96e1b387773d14e2bab450933", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65bdafdb-4eb8-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637931442, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931442, "uuid": "34c6325b-4c1b-4a6c-bd64-2e8f6a155cf9", "comment": "Malware payload (Heodo)", "value": "05269f20d8d7ce550f063d7614a0fd7a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931442, "uuid": "6c164328-d757-4ccc-846b-c131d13a71ce", "comment": "Malware payload (Heodo)", "value": "8a8eb52b01e28b01df738c18f28dd902d8453226482d543e4d1f553c8b6afa36", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931442, "uuid": "5c04605f-795d-49a1-b31c-70803553753f", "comment": "Malware payload (Heodo)", "value": "235c548aeca8cd28914d965d6b004f83f051a308", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931442, "uuid": "84bac015-e691-4a3e-849f-1e633d93eb72", "comment": "Malware payload (Heodo)", "value": "adea4c81ad795f10fce031dbe9dbb97a8b2183646d49e1c66a73970dbd0e42df18ca74a302849f4fe910fe9c2ee82e72", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931442, "uuid": "d55b4d3d-bb45-4d3c-81af-48dc3d15ed44", "value": "T1A503BE1EC251F9ECD23AD93A81D849A5521E2E105042B94D2580B58CEF7B2FF6BDF358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931442, "uuid": "a2355495-de5d-410d-9044-364fc95e50d2", "value": "768:e/I83GhApRrjevZCwVIYgBZVWpf/wak8y0VItKF:enKAbIIjkpw78XVIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931442, "uuid": "76bfedae-b9e3-4347-ad4b-535f81fae49f", "value": 37994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931442, "uuid": "bd6e030a-6cfe-4c76-b59b-e3373713fd0d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931442, "uuid": "66c2531f-7c35-4ebc-9c65-7349b52156d1", "value": "report 11 26 2021.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0223f595-4ed7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637944590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944590, "uuid": "61f53d32-2de1-49f4-a323-7556b5bd5228", "comment": "Malware payload (Dridex)", "value": "ea17fa7e465d8347ed070af0612a76d0", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944590, "uuid": "21442f14-b6fb-4002-807d-c03bf38df3a6", "comment": "Malware payload (Dridex)", "value": "8ae9fa64000fe01fd2a4df581b672d75b7fbe975a3561b6b99b2f8e14bd01225", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944590, "uuid": "5d5be905-43cd-4c92-b0a6-cffe20b6e187", "comment": "Malware payload (Dridex)", "value": "27034ef9042fb1f984d7fbbbd3d7ca9ee8503f55", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944590, "uuid": "a3725844-1f1b-46a8-94cb-040f86d1506d", "comment": "Malware payload (Dridex)", "value": "2841847b6607633cd9e59802a2c07e69faa97d26f20833b4e0e851ca00945017009518c997cd390435b2b0ac51e0b4d3", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944590, "uuid": "ffab81a7-288f-45a0-8854-934055d8809c", "value": "T19883010D51AEA1A0C231EE3D8F0E16E795933E220F11AE4B145AFA9C4F692975F5F207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944590, "uuid": "d8457f16-7a3e-4c68-bc62-62b136c9c99e", "value": "1536:UWgHPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5hre1oIcVY83wANWRcP6gdY:VgTqmc3/q0dfaguKyre112YENWRcCgdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637944590, "uuid": "d8dd5aa4-3c9c-41fa-b7c4-a0a9900c3537", "value": 81361, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637944590, "uuid": "7ae4368c-30b5-4180-9e4a-b0c1f29e802e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944590, "uuid": "041bee1f-c9ac-40a6-985f-de5d1581bb11", "value": "048838933.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fdae239-4ea9-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637925017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637925017, "uuid": "56437aad-37b9-449c-ae9d-241e3993ab4d", "comment": "Malware payload (Heodo)", "value": "d9b8a869e56aae15de8a9158138261da", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637925017, "uuid": "c9ffc654-d98c-47cf-bf37-9617c910723a", "comment": "Malware payload (Heodo)", "value": "8d5cf489f219d2edde134f6dacc5d3c4c6a97ce405101a86a0be26f3f8c1c20e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637925017, "uuid": "53e31af2-5e9e-4d20-82c3-04e711f104e0", "comment": "Malware payload (Heodo)", "value": "0df3bcc15d51f3d087153a0478e6b9b2fb22dbe6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637925017, "uuid": "c78d9e1b-bef0-4d12-9843-895bbc9d0672", "comment": "Malware payload (Heodo)", "value": "e18f314373e29931537a0ed8f97e7269975e9288542cbf88f636654aa18cbae1f179eecfbc40feed0a8e568ae4fe6a14", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637925017, "uuid": "fd1db309-b57f-4513-8437-16c9b617aed2", "value": "T1D8A4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637925017, "uuid": "f4f1d785-5a71-4567-8455-b92fccc7367e", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637925017, "uuid": "dbcfbde9-e7d4-4f54-a808-d66903dfb6f8", "value": "12288:o4xZ0/tI1BD2LETv0Fh7O9U6W8XUDaBN7a1vt:oED2LETvMtb6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637925017, "uuid": "58321864-c328-4c2d-84d4-43645c27f38f", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637925017, "uuid": "4fcb04bb-f7cd-4c06-959c-e75474e65dad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637925017, "uuid": "19518c78-b80c-4db9-af42-514a4285cd32", "value": "besta.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d49e754a-4e62-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637894692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894692, "uuid": "a0728941-8e95-46c5-90e3-ec229c27f856", "comment": "Malware payload", "value": "9ec1f177c3b7a47ab6b84841c0d4c3b7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894692, "uuid": "ae8054a7-453a-48e3-9fa0-3633e2967206", "comment": "Malware payload", "value": "8d709d804d094bf8b24452756af2240d004a272c016acc5385ae31e570be84af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894692, "uuid": "0ba4f897-6410-446d-a1c2-ed3b41e61b9f", "comment": "Malware payload", "value": "eedfdb2b503d137de72478efe4636cd05409db9c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894692, "uuid": "67a97b73-c0c5-47f4-abf6-986098d9646f", "comment": "Malware payload", "value": "34eb205499bd51188687c9a183f00a3946c16d3288674be9f482807a4c8dae2b8418e60ae580b2148bb688dec66aba35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894692, "uuid": "3e287b42-007e-46ad-afc1-74db8044e875", "value": "T16523F156A1D361B1816019FDDB7A83005BAD3B7E25F026A9EA15C13E59F2C02ABFC44D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894692, "uuid": "8ca0245b-a76c-4f60-afb5-8ccac70c5b48", "value": "768:ed2vuVjeIbA8cKwfuunax79V8xOCaSPVVwDruX73UMezpGrBDyuUTeKndHEa:ew2jAWwmucV8xOCaSjwH4FEGN+eKn/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637894692, "uuid": "e02fad4d-6e0e-4823-977b-0385adf5cf05", "value": 46336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637894692, "uuid": "58ca6e07-6467-448d-a763-bd01e012d9bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894692, "uuid": "da0539ef-e87c-47e5-955b-38eb9242c0bc", "value": "9ec1f177c3b7a47ab6b84841c0d4c3b7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f7465f-4f05-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637964707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637964707, "uuid": "365d460b-fe93-433a-a8f7-51406147a95a", "comment": "Malware payload", "value": "d8d4eb825e42c73a4ab3870423c23016", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637964707, "uuid": "822790ea-db80-4527-964e-da92bf7d0318", "comment": "Malware payload", "value": "8d92ea90455999d21cbc9e638dc931255e54155364c4cf9b426bdae868a30bd9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637964707, "uuid": "6cbf11ef-4adf-42cb-997d-db9cccd15f01", "comment": "Malware payload", "value": "25ecd092058b5b2c39dc95d5c64d10db0976a6fb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637964707, "uuid": "51d0da20-b359-4158-ae78-53f9666b7346", "comment": "Malware payload", "value": "391303d1fc09b0c9054b7979718d50e2f996f666c1103f670102c05f89281b4ccef57821162d9997bb155ae2cecda057", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637964707, "uuid": "5728f37c-cead-409b-9a28-d45460bd26ea", "value": "T15754AE5276C680B7DAB312B18A56A32EB3F6A700073B69C75BD50C105B355C3E73EB1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637964707, "uuid": "0795c7e6-5525-40c0-b64b-4f5e558da9d9", "value": "6144:WKEUPDI8HTI4IPualOM8Vka11WqQtXwpomuU3rNOW1V1+:WKEUkuAOLka1miSmuYr1W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637964707, "uuid": "f7107b74-ccf2-40ac-bd8c-e455a7e6582a", "value": 300632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637964707, "uuid": "c6d4cae1-f687-4765-82a3-0ee3d367a3f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637964707, "uuid": "3c86214f-e286-4ebd-b302-f240c1563af1", "value": "emotet_exe_e4_8d92ea90455999d21cbc9e638dc931255e54155364c4cf9b426bdae868a30bd9_2021-11-26__221140.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "794ec7bb-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1637954239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954239, "uuid": "31996081-2786-4340-b9b3-14e81b521fb6", "comment": "Malware payload (DanaBot)", "value": "da6c99bedde145e8c612310b1b09d673", "object_relation": "md5", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954239, "uuid": "1600b19e-fc52-40f5-88fd-826a126bf214", "comment": "Malware payload (DanaBot)", "value": "8deb1074630e73bb34613f969b1424c5ab6d1ac09064f1eb4800f72c09fd0a11", "object_relation": "sha256", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954239, "uuid": "619dc74f-307b-4558-8c1f-a642d38c90df", "comment": "Malware payload (DanaBot)", "value": "b425c095b5373dde832fe866db8856990b73778f", "object_relation": "sha1", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954239, "uuid": "835f5980-164a-4aca-b9db-ea5e08765e1d", "comment": "Malware payload (DanaBot)", "value": "a91a396cc1adc61e2246251fca942609b71e1bbc47684192b6f59209780ea08637707c9c067056b6771448dba59347c9", "object_relation": "sha3-384", "Tag": [ { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954239, "uuid": "32e6c5cb-5dcc-4512-8443-522fa3bf8bd9", "value": "T13E958C51B602E726D6A86CB8FC00C5EF14F0BD49FE44D267F6C17F9FA932241A82519B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954239, "uuid": "55d966ca-42f8-4012-83e9-a484fae1edad", "value": "527adf6c5aa9658ca97ecd93b12d26e4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954239, "uuid": "a12ebf15-06f7-4777-b698-140ffef67aaa", "value": "49152:RQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BEekqfn8+nFFQCxEsJwKQJ:RfaNQh+NUABO/c0Y9AdVkqf8+gqJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954239, "uuid": "129d796b-b3f1-45c7-877e-2a85b015f717", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954239, "uuid": "54387958-eeb6-4bed-baa1-65a299a0e6ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954239, "uuid": "4088f030-47c8-4f33-babe-a92b115aa34d", "value": "da6c99bedde145e8c612310b1b09d673.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfc8950-4ee2-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637949359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949359, "uuid": "73e220c9-53f2-4441-82e3-8603be261f18", "comment": "Malware payload", "value": "5c1daf6acd3ebad8b0e95945eba36ffa", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949359, "uuid": "5fbce58e-7808-4359-b527-e31d92663fc9", "comment": "Malware payload", "value": "9177ecae9b501c2ed688b7d2499f122ff845eb7c4abdf76ac4845173c849b156", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949359, "uuid": "f05b350a-3be9-4068-83dd-8b4c51988962", "comment": "Malware payload", "value": "2a86f05991385eec20e487d5760c8c13fe93aeb9", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949359, "uuid": "60c1e5c9-b1b2-4f5c-b0a0-9fdde8adbb3e", "comment": "Malware payload", "value": "67a4fe1f13b0a6fdf1cfa9b69864b2bea017dc57173ea2911a0e7de77a08b799538cbe9ff1312e00a83f6fd4d85eab50", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949359, "uuid": "068a60e1-b121-415e-84dd-752d90afe921", "value": "T17A413C044567D4BFB4390C7E1C2E3FEDC741A1D58C209A84BE431C4425892DB68B7876", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949359, "uuid": "41a0a4cb-58e1-4b73-a7b6-1b173711d5ab", "value": "48:ZSYMBBToxTfVk/ixZ9GKgI4bGY+4TD3S33q4BDb:ZSYMBBsVr5GhPttYl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637949359, "uuid": "616a3f47-3116-4e26-9027-e342196a8527", "value": 2066, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637949359, "uuid": "847bdd11-88bb-477a-aaab-aa38506b9175", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949359, "uuid": "2ff5d339-88f4-4ab8-9b09-886e3f952ee3", "value": "A5200067.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1dabad6-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637954360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954360, "uuid": "87f110ae-4d10-4963-8f21-79731fc74fd3", "comment": "Malware payload", "value": "c3b7bf1f14d4359889e2233e9d3393be", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954360, "uuid": "1172e799-b6c8-40d8-93e6-bc5ec5cf2bd0", "comment": "Malware payload", "value": "91b5c318543587a212464565a4df06eae2ad2823338389134f06c4409047e18e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954360, "uuid": "76fa3e03-5ba5-4ed0-9ea7-3d97f7424f80", "comment": "Malware payload", "value": "c1054a0a99c42a759117c7b378b213764e1b0a0d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954360, "uuid": "20255d76-09a8-4769-a74a-45772f66eaa2", "comment": "Malware payload", "value": "17ed9a3cf326ff065608c410867a4b34673353ca2f075e386d6caa54e9ace689a1a6a06daa74b70ec5692ceadc1b5134", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954360, "uuid": "750eec57-65fd-44b9-964d-114c672e1ac6", "value": "T100F47D13FDA37436C5062579BC5F1E24D836BF203A14D87C2AF9BC0D0E7AA826A75176", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954360, "uuid": "40133717-cb42-4e4c-bfb7-e122803f4f62", "value": "01f42bb56bd8196b0da3b3826e73efd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954360, "uuid": "b7370d2b-e328-461c-9683-f94b96e63257", "value": "12288:HOYMYlxIimj6qr9wMiE+wGFYjA2KY59roDBM6nGplGJY:HOJYMimv+9wGqfKY59cM6GplGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954360, "uuid": "bdf88913-dfb2-423b-8bc3-4081e5bd0cfd", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954360, "uuid": "487b136d-dbb1-448c-8b3b-cc69bd75c24a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954360, "uuid": "f44a63ea-d1aa-4efb-8f25-13cfd73c25ac", "value": "c3b7bf1f14d4359889e2233e9d3393be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed9a182d-4e52-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637887862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887862, "uuid": "cc367716-9c84-4138-a48b-350dece45268", "comment": "Malware payload (Heodo)", "value": "2fb0464ed0ee2c1a2d8504519d4117f9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887862, "uuid": "6e6c0da5-c8ed-4ab4-991b-62f4aa761d6b", "comment": "Malware payload (Heodo)", "value": "9232e24883fea053f07bb08f9eaf3802e100b59c5514d9f6dc88f3a16a1cf683", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887862, "uuid": "38719c22-4428-46ab-a4bb-dbde6453558c", "comment": "Malware payload (Heodo)", "value": "600626e0a2b784b28cbc72d787404fea84b3ef57", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887862, "uuid": "c64c90b6-414c-490a-85d3-8aaea3fe6aa4", "comment": "Malware payload (Heodo)", "value": "42cab701cdc039eff558ef8e15266284e6ec2bed7a773c5fd3c8cfb70adf98a3e8404b0ef4fd58b498023cc2780a0c96", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887862, "uuid": "76434f83-32d4-49c4-a5aa-66c3b535470a", "value": "T1F7B4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887862, "uuid": "251a5c0e-a306-4f31-b44d-f50224f60f9f", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887862, "uuid": "6358bf52-01e3-4c54-9266-b9e52cf8e243", "value": "12288:smVdIG2GDNBtIlD987snRrkZW+mw3ffEPy:sm4GDNBtIl6wSZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637887862, "uuid": "f6b726d3-a499-4f35-bf11-034e7c7ffb51", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637887862, "uuid": "10409de3-cbcd-44c9-ba94-303e5c3d07d3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887862, "uuid": "4c7276ad-cd30-42ec-b30f-3dc1a9a6c041", "value": "emotet_exe_e4_9232e24883fea053f07bb08f9eaf3802e100b59c5514d9f6dc88f3a16a1cf683_2021-11-26__005056.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b4fd7a-4ecf-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637941473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941473, "uuid": "fd9d8a4c-0914-41a1-be20-a16101b7506d", "comment": "Malware payload (Heodo)", "value": "9df1d15e8b4a45f64dca92eb62879f23", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941473, "uuid": "9e4e37cc-58a5-43ad-a392-165c80a6702b", "comment": "Malware payload (Heodo)", "value": "94c03387a4c6d5d810c5f056b0aaa0ae42e3088066d12da4393409f8f1d7374b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941473, "uuid": "598cef88-77a3-4040-a395-a43f8f5617d2", "comment": "Malware payload (Heodo)", "value": "a9b8db9e3f0c1a84964988f91feeab0095b0d4c9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941473, "uuid": "3fd4b03f-a07d-44c0-8e5e-5d7ef46c2db5", "comment": "Malware payload (Heodo)", "value": "3f6e584d0ca09d9d2568cfdb0e4a27475e5d30d152c2f66a934689fb810473d35da20e33bd56087f0f171237a8d65080", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941473, "uuid": "33ec87b4-b452-46bc-b19c-f6418f549fce", "value": "T1CAE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941473, "uuid": "3f63756e-5207-4e24-bc17-0d2a882da478", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941473, "uuid": "d38e56c7-5fba-4f32-8bbf-b3d54c098617", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhXico09cDlB4Vx/ID:0uH0GCNeQhi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637941473, "uuid": "f83a1d84-659c-40bc-a9ba-ae2db68ae6bd", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637941473, "uuid": "f0d988d3-627b-4448-8196-c2be3f00f89b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941473, "uuid": "83c032d6-0cd7-4813-84e2-07dcb87f3d1e", "value": "emotet_exe_e4_94c03387a4c6d5d810c5f056b0aaa0ae42e3088066d12da4393409f8f1d7374b_2021-11-26__154427.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea17f28a-4efe-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637961729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961729, "uuid": "4bc28986-da29-4768-8a8d-173e406665e2", "comment": "Malware payload (RedLineStealer)", "value": "b99c30bca2c98bbe22f9894e1b4b9d85", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961729, "uuid": "0a9ff2f7-27d8-42d8-befb-65402cb27948", "comment": "Malware payload (RedLineStealer)", "value": "957ed2e3e12649457ccc30d7c67b31d3362460c9aa1b38208c522959e779610b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961729, "uuid": "35487bc9-0d00-44f7-ae5e-4fe8157cbee2", "comment": "Malware payload (RedLineStealer)", "value": "efb75def0f9cdec5b390debf9c3b14bd451ecf08", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961729, "uuid": "a51fb247-006c-449d-bbeb-08cedb99d2eb", "comment": "Malware payload (RedLineStealer)", "value": "e07b0048e2d5672482d3a3bc98002e0c399ad50faed78d6e4d68c15ad381c362740dcade3f14748d2d5c0c2d3493db75", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961729, "uuid": "ed385ea4-5f39-4d0a-9c4a-28e33234a78f", "value": "T1A76533CF0154EA2FC28E85F0F665DE9EF7544128BEE4722B6017C5CB5C029E5AF9488B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961729, "uuid": "d17fe8a4-fd13-4368-b356-d5a75f30fdc3", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961729, "uuid": "20f0647f-6042-4df9-8eb1-5dd78ab0e4e5", "value": "24576:EEt2sB+rBSZio7farb5pvwXBK5PulXD58214aW9O/qDzR3DDGMTblkEaHNYK3D7M:D2sBqSZij7UB6PuhV82p/qDV3vGQlNau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637961729, "uuid": "eac56b68-f73e-4290-805a-f2657716ce1b", "value": 1540384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637961729, "uuid": "73ef5fc3-7ede-4d06-9ee4-0cf126536ac7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961729, "uuid": "6c0eef74-0173-44a6-90c3-2bf005e822dd", "value": "957ed2e3e12649457ccc30d7c67b31d3362460c9aa1b3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a20e9824-4e61-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637894177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894177, "uuid": "9a32d98d-a355-4224-b25e-d8ac6785f26b", "comment": "Malware payload (Gafgyt)", "value": "75c25d0308a43656bf2fa8b5dce3e75e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894177, "uuid": "4f5566e1-6f8b-4753-b8e6-a9b3a2ef7c6b", "comment": "Malware payload (Gafgyt)", "value": "961c7b1cb3440664f91be094a5472b172b4267e412c4ae8a1cad6181f42e97eb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894177, "uuid": "dc9bab87-7e46-45ea-bdeb-a4b98db29e40", "comment": "Malware payload (Gafgyt)", "value": "857d113c2aa9d3487f3c93b7de49b8e9b12373b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894177, "uuid": "f4bcb40d-d1bc-4e24-a9f7-291709d34778", "comment": "Malware payload (Gafgyt)", "value": "10df2c2a2a59de3d99b6e1b1ac34b85423e8d4d26c5860cb0bd9d76d4a2e7baa05a8dc5d03b3869da264279a64098855", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894177, "uuid": "ef6f964b-7723-4729-b59d-6d67c5b7232d", "value": "T1A2B34A47A8624FB3C086AA7225FB5D300713A9A51B5F1A9975389BF0034F5DEB40FFA4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894177, "uuid": "e470dfd1-5dd5-41cb-8f1e-b0eb7e1e831b", "value": "3072:KD5H4DSZ3hLaXUvpWH+aAYc5hGHFgXDFf9t3rqwT95NR:KD5MSZ3hjhRuc5huFGDFf9t3rqwT95NR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637894177, "uuid": "94e68a22-d119-4a6c-93bf-fe4275a5c9b0", "value": 117119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637894177, "uuid": "e0185c84-b9ae-4b2f-a7d2-42e380627d5c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894177, "uuid": "5f9ebd29-2fce-4da9-9f29-9de1a7be8d3b", "value": "75c25d0308a43656bf2fa8b5dce3e75e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd2f2478-4efc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637960822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960822, "uuid": "5ebe72e8-12e0-4cca-a594-caaa80500c1f", "comment": "Malware payload", "value": "309d5c213c9da6536c9d0052a89dcf66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960822, "uuid": "c8b91ec0-8b85-40a2-bbe6-65d283c3d0a0", "comment": "Malware payload", "value": "9629cae6d009dadc60e49f5b4a492bd1169d93f17afa76bee27c37be5bca3015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960822, "uuid": "66366a83-660a-4b58-9bf9-4bfa1a7e8760", "comment": "Malware payload", "value": "fe8daef7a565ec4311f2b33dbcdd2d2e765a2b6b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960822, "uuid": "2494218f-8a3a-479e-9934-0d1b47d6a9f2", "comment": "Malware payload", "value": "b54cde38b97a46e91c625dcaf4883a3eb3d7e510cf56bb872bb24729aea5e39c2a99ac52edead628d7e40df0382549dd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960822, "uuid": "02a02f87-9a40-41e6-a365-e400c6ea8f42", "value": "T1A94522034798404AF5F72BB069BBCB365927FC205A71D19E06C2BD0B7930660AE7DF66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960822, "uuid": "eae265b8-fd3d-4abb-afff-62d1d6a9e08a", "value": "d61fce2fcbf2fe551328374db5d31acf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960822, "uuid": "dfd2014f-9b15-41ec-8681-92b8124fff05", "value": "24576:84sMizQfNz/L5vwEckJ8K/zcBQOuIvQrRfAm:8JMhROE6KbSQpyiv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637960822, "uuid": "8b8b1f5f-beef-43ae-b9b1-a65427583c5d", "value": 1229024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637960822, "uuid": "a12bbfc3-efc9-403a-9e74-b8bc3144c5f0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960822, "uuid": "283ec0f8-fb8c-4a7d-90b6-7f8705a3477d", "value": "309d5c213c9da6536c9d0052a89dcf66", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c60390-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1637918697, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918697, "uuid": "fd69545c-0147-4b3a-8f90-07a3bb84fff8", "comment": "Malware payload (QuasarRAT)", "value": "a0473d7325403476e7eb1a56e6f27cde", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918697, "uuid": "f58853c6-7c27-44ee-970c-caf3ee3de560", "comment": "Malware payload (QuasarRAT)", "value": "96393c19d6a8749a8772ad2cec560aa8715db7f4efc3edc6e33f1d5dc525af3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918697, "uuid": "4beaa6ab-de94-43f3-b640-29253b965046", "comment": "Malware payload (QuasarRAT)", "value": "168df478d24d858550c2cf6305786d8f554d674c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918697, "uuid": "812495f5-19b7-4760-8cb8-b7150c681769", "comment": "Malware payload (QuasarRAT)", "value": "b4c58509dea66427c11f5e99ad29c7e6e45c803064ca13ed56af669925781a94766c02b701450d71ae2249af4bb7f749", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918697, "uuid": "eb4a77cd-7849-4926-ac2c-e52d1a910391", "value": "T172A5BE41A3DC82A1CE6A4372BA36DB219B777C692634F70E1ED83D7A3E723521518353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918697, "uuid": "1db271f6-78da-44d0-83ac-349338697dcc", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918697, "uuid": "f0e610c1-6be5-4288-bff1-ee6e2fe175b0", "value": "24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYD:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9Y9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918697, "uuid": "adf40d07-c883-497b-adca-1a44aed7e7c0", "value": 2111624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918697, "uuid": "b70b59c6-6f59-42d2-8ce2-fe0d3e97f690", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918697, "uuid": "1516946b-9d4f-458f-b772-a2d9c51523c3", "value": "96393c19d6a8749a8772ad2cec560aa8715db7f4efc3edc6e33f1d5dc525af3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb713a97-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918809, "uuid": "4580e367-684c-4938-8058-9cfd137fd9b8", "comment": "Malware payload (Dridex)", "value": "310ff2d4c32854b9bdbcc78fbcb58bcc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918809, "uuid": "1058dbb6-a408-48a7-8cb2-08cc5e403e2c", "comment": "Malware payload (Dridex)", "value": "96de5810e971a8db608ef7932e4fe14a7fd9c48cf630df5b46f75ab9d60cedaf", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918809, "uuid": "6caa2155-32a8-4ffd-96fe-c49f9a74ef05", "comment": "Malware payload (Dridex)", "value": "b85029ce9032492b65d29e10e8686b17b23eda8b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918809, "uuid": "9adec5c7-ba02-402e-906c-5b40f6c6cdd7", "comment": "Malware payload (Dridex)", "value": "4a4d523f2972121f6451930453a8d52ee6d522642d152efc61a8a564320dee5cf2d66627acc15fb061f3da586877ef09", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918809, "uuid": "db14a8b4-dc7e-467e-9386-0ab88e75df9c", "value": "T1B565E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918809, "uuid": "b71212cc-329b-4249-8044-1ea27d83c503", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918809, "uuid": "5a3be8bd-922a-4f12-944e-6b215d23a254", "value": "12288:zZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:zZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918809, "uuid": "948b8d84-378b-46eb-bf72-9932103d0ffd", "value": 1417216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918809, "uuid": "16b3536e-37e4-4f9f-a6db-f6826355ee4e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918809, "uuid": "f87732c4-f45b-4822-a332-06afcd9d7f77", "value": "96de5810e971a8db608ef7932e4fe14a7fd9c48cf630df5b46f75ab9d60cedaf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36f02674-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918909, "uuid": "bdc845bb-1f77-4f31-854a-3baca9338469", "comment": "Malware payload (Dridex)", "value": "1f6485c87621bff97a63f506040b8288", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918909, "uuid": "7bc364c7-7b15-4606-a134-01fa95b071d7", "comment": "Malware payload (Dridex)", "value": "96f10e16e783acebd689db4f3e11b3b949badbd76e4ebf642a604314ce6df395", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918909, "uuid": "f18a4382-9978-4961-9670-6b3a04d8d321", "comment": "Malware payload (Dridex)", "value": "43e5b5a0abf8ef0cbf6fc3ca95f009022b89dec4", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918909, "uuid": "7ca2325e-8447-4c71-a209-e3607db4ea59", "comment": "Malware payload (Dridex)", "value": "7e90ad4b168babb7f6bb503cfb580d2db56ba79ec8095df2f126defbe2cf4ef570f4380e9ae0fb8cd4a40e400b11eefa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918909, "uuid": "b0b695b9-8a8d-4da1-a39f-2ca4f9906b8c", "value": "T10255E102FF9963E6E9542DFAD5F0F2A3C9B4F5854C280229DB61545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918909, "uuid": "669fd099-602d-4e59-bf54-7dfdc947034a", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918909, "uuid": "fb26a8a0-19e6-4872-9ddc-b1b9ad58c144", "value": "12288:PZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:PZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918909, "uuid": "091458ec-1b06-4a7f-893b-0f1b85695a5b", "value": 1351680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918909, "uuid": "59573bf7-3539-449a-b040-a8c8b59cf7b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918909, "uuid": "23c55619-69b3-4172-b29f-280ab195019c", "value": "96f10e16e783acebd689db4f3e11b3b949badbd76e4ebf642a604314ce6df395", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98c1c6db-4ebb-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637932817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932817, "uuid": "48201aa6-5649-4882-b93d-31b1fb5cd02e", "comment": "Malware payload (Heodo)", "value": "e43c4151d6194ee5010320771a5013e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932817, "uuid": "38a815e8-d739-4e98-9144-8922ac0cac26", "comment": "Malware payload (Heodo)", "value": "985a17ca131d9142c49c14a06dc496aeeb0a05cb24e574dd7412beb1213564c7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932817, "uuid": "22be7272-5a16-406e-bcf8-e58acdb26db6", "comment": "Malware payload (Heodo)", "value": "6a1b6367db82853bfbe23bdca6b1c9a0ea888d1d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932817, "uuid": "148e61eb-2459-4e25-bb4d-39c281db098e", "comment": "Malware payload (Heodo)", "value": "e3c06d8fd218d47f073e1fc1a2126184d69117f9e6c8e8cd449f48e1e42f5c754ed2610b579a48bcd87e770bfa7b37b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932817, "uuid": "ae703fb6-62ea-48d3-99df-b03a1b7f8fc6", "value": "T1DFA4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932817, "uuid": "e860aeb5-9378-4e0e-a81d-a4752d9bcd98", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932817, "uuid": "3acafca1-a244-4be6-8a13-c01dbf847dcb", "value": "12288:o4xZ0/tI1BD2LETv0FhSO9U6W8XUDaBN7a1vt:oED2LETvMgb6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637932817, "uuid": "3853209a-a3ec-4145-b722-1b0669659c1c", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637932817, "uuid": "01a03bbd-6a89-436d-91d9-8924527df309", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932817, "uuid": "fb3290e6-8096-46dd-8c96-ee8f00a50e17", "value": "e43c4151d6194ee5010320771a5013e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9fb129-4eba-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637932345, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932345, "uuid": "2da5c726-d2c2-4d49-9da9-b28be1bac351", "comment": "Malware payload (AgentTesla)", "value": "935f1638ab97cbcdbd1be6c0ec505e8b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932345, "uuid": "3e2adce4-950f-4d17-a4bd-b4ea34429c17", "comment": "Malware payload (AgentTesla)", "value": "9895b7b1c03c91fdc2151bcd998adc53506fd51ead9c40b1b28e435fe3d8b52c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932345, "uuid": "8d855f48-02df-4c22-b54f-4144d444c7d7", "comment": "Malware payload (AgentTesla)", "value": "b00d68c7bbd2c82ca1e57a5dd7178a25098f0afb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932345, "uuid": "ab6dde17-7ab6-447c-a331-7c2cacfedff5", "comment": "Malware payload (AgentTesla)", "value": "23be8b17a3aee1e3045443d5465805c16ec16255ef67e975b7229c883f7f9ba42cf97f892a50d62fcc755399baea950a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932345, "uuid": "55212268-003b-4de1-b21a-d33e31858327", "value": "T10BC40119322E6F10D47C0BF788C2A590A7F9A5635601E34E5DC330EE6AE6FF9014AA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932345, "uuid": "38eece68-88fc-4f0f-be2e-31cc3a710791", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932345, "uuid": "60487cd1-6e8a-453e-a3e4-fd796c6a3295", "value": "12288:LyS6hloLhdzdkw3pp6TepxHIdonG/AuheB32j4+FkTixBFm0:u9iTpkHTepF8F/9QxbHTi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637932345, "uuid": "98ce39fb-9c11-4eec-8a13-50ed75ebbcc1", "value": 547328, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637932345, "uuid": "c61531cf-3b44-4e67-9814-0ee453d47a7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932345, "uuid": "047e77dd-c56f-4345-93aa-a09a06d6356d", "value": "winlogon.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b0dd73a-4edb-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637946537, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946537, "uuid": "a09158b9-f447-45dd-b44b-1e60bc5cbf00", "comment": "Malware payload (Dridex)", "value": "d6cef9a209360d2f38ee934b12064fdc", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946537, "uuid": "8ad74f94-38bb-496d-bae0-d1f8069e0ac4", "comment": "Malware payload (Dridex)", "value": "98f655b81232dc9c1cbf0b659a79670396d52a2575ada7821db39f88c14e128e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946537, "uuid": "a6db994c-485a-4e28-9c6f-3e867ccf22aa", "comment": "Malware payload (Dridex)", "value": "eadd29152e7e7916bb01e294d967dd0e2e68def5", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946537, "uuid": "dc5ca739-7411-4bdb-91fd-a3d33488a532", "comment": "Malware payload (Dridex)", "value": "f4c71f9d422117660f31752cebb584a1190f91ed76707acfed02dca017608ea77e688cffebcddb4302f54f27cba56ec9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946537, "uuid": "89e64da8-3eb8-4d2f-9312-9f637ad881a2", "value": "T1BC63F122CA98F860C9FB85BCC2645FF57C0716688964E15F39B0B31896607CB93CB35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946537, "uuid": "b9da897d-fb07-4d8a-a0a8-c56635adc4b6", "value": "1536:UWiPqrE3gpMokPF58Ik4kosQFVvSuMf5FZaxJ9ArgXaHUgdzf3:VXEwFkd58IXkOFVvMfnY9Ar+WUgdzf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637946537, "uuid": "8d9a5da9-3d9f-4ff8-85ec-39d66d4744e5", "value": 69088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637946537, "uuid": "4b150c44-1605-44e9-b1b3-e8390f14a397", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946537, "uuid": "6842b4dd-4a9d-48b0-98db-af4faac7e2d6", "value": "subscription_83558.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d73000f6-4efc-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637960839, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960839, "uuid": "45637d58-5ab2-4508-a6b1-8e4d0d877a16", "comment": "Malware payload (Mirai)", "value": "1e34679c4cf95a91ccd6fbb888e50874", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960839, "uuid": "f5f4f8a5-78cf-4233-87fd-3be0e07c06f6", "comment": "Malware payload (Mirai)", "value": "9940faa87fa6065ca2cf25b291afd1dbc2794fc6bd2f220f3b89c7bac42a0041", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960839, "uuid": "42b98c07-30d8-42d4-9834-7dbdde0d367b", "comment": "Malware payload (Mirai)", "value": "3e96ed83573e2dd52cd3c9d9089f3469975fd6bd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960839, "uuid": "10800373-6bad-4a15-99fd-7abacdc064f3", "comment": "Malware payload (Mirai)", "value": "adfe316aeef5ccc66d2329c85c6b96890bb46fd6032d834afc88fafee0ebfd04a89bc4ce9bd86804ff6f8f8c01050a44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960839, "uuid": "826adaad-ca7d-40e8-b47d-d7343e809144", "value": "T1E8C2E1DFB49A7885CC1C5CBC259D56D11AA9A2C3234A9F0837203DCCA67655FB8DC8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960839, "uuid": "aed35f71-0b1a-471c-9d7d-f8361bb68e3e", "value": "768:MuCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBkW2:5CrJgHiOJrfwmQrctc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637960839, "uuid": "72390344-338c-4885-8652-9d83b112a122", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637960839, "uuid": "606eca20-daaf-4ef9-ab68-c25bbe7c86df", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960839, "uuid": "97f227df-5db5-4001-adb2-06e5d3667f85", "value": "1e34679c4cf95a91ccd6fbb888e50874", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6d3193a-4ec2-11ec-843c-42010a9c0014", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1637935954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935954, "uuid": "ecee9f13-4882-423d-84ef-465792593f2f", "comment": "Malware payload (AveMariaRAT)", "value": "dc62206c0870e2cd540383911928ea54", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935954, "uuid": "a986cc0b-adb3-4c79-8f93-9c8fbb4bcdab", "comment": "Malware payload (AveMariaRAT)", "value": "99b346c5c0d0246a941bcc8bb3ea7ecca1b0017d7ccf4018e43212a9ed7ac437", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935954, "uuid": "52cba762-a63a-4b5b-acff-d35ea5e7e0a0", "comment": "Malware payload (AveMariaRAT)", "value": "8289080813715afb251e9db988b0d21a60e8e3e1", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935954, "uuid": "60bd2100-4ee0-49ba-ac06-546e18a20ad0", "comment": "Malware payload (AveMariaRAT)", "value": "b849c246c6cf7b79f5eca6490e22e60cd431b54081db7aecb3b9edee16c967a95ee6bcd90e42a9d28a9da9789358c4ce", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935954, "uuid": "16404c6e-1180-4e3f-bbce-05ab8d2f69d7", "value": "T137F4CE1272EC99DFC26E06B85C21B14827B2AD16605ADEDD4C81F0DD16F1B425AF3A3F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935954, "uuid": "79482ce8-cd40-441c-a79b-b5ee9cec4cb7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935954, "uuid": "651cc671-702c-42d9-8068-57c27e56ac80", "value": "12288:tBzcmhiTgjq6b5PfvWTTBwnOnwhd9N6YPkJ5A/a3eF4u3DxrR8jj2sixBFmRqTw:tBomhiMDXW8FbMJ5A/a3EtDd2jj2si1d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637935954, "uuid": "1a191c49-4f0f-4278-98fa-9a047aa921ec", "value": 753152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637935954, "uuid": "87f88f07-5c75-48d7-af92-20a0f1f254e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935954, "uuid": "371aff9d-ef67-4273-b627-bc3efb9f7200", "value": "PDFW.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f237508f-4e83-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637908915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908915, "uuid": "26716e9e-52ff-4e33-962b-9e084384a041", "comment": "Malware payload (Formbook)", "value": "44e721d6474e631e409f6060f4fb6d0a", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908915, "uuid": "637da7bd-23e8-4119-8150-fa9796428c8f", "comment": "Malware payload (Formbook)", "value": "9b4af1ad9662321be7d1da77839ac8b527810d934f8b5c21594e71afcc1d5d63", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908915, "uuid": "b4bbdbfc-9836-4c79-a445-a6d4aa727a3a", "comment": "Malware payload (Formbook)", "value": "30b549715736b5a6fef7b90162275063ef6e1462", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908915, "uuid": "d5c4d705-93df-4a37-a3dc-4390e25cedd1", "comment": "Malware payload (Formbook)", "value": "1b3dc2c13c87217b0bb6471125cd87ced7ca42072a83dd57b8da61dba5462a1a8a550c451727e75e553dfa1180436808", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908915, "uuid": "858790b9-b0e2-45c9-8fea-21f688e0c438", "value": "T1EC84235A160BFA49A24C397FF4118F933166D61B5EF29936B74C5B30F2D23A72C84670", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908915, "uuid": "b30dcbc2-b4c6-4599-9898-625aa9e5abbd", "value": "12288:3sAw9izv7RZoYG201QZteYvFDOBiay6vC5N+Ia+xoVkV20ha:3s/4v78l5we+D0iay6K5N+Ia+93a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637908915, "uuid": "c9e2e9d6-e195-4edd-bb22-c010a9367cd5", "value": 394280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637908915, "uuid": "5d161c45-7a75-4818-ba7b-54c449ad2e86", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908915, "uuid": "6b56f9e9-40fb-4541-9804-debfe5e105f6", "value": "RFQ_445556667887_ JPG IMAGE_.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb334a9e-4e52-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637887885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887885, "uuid": "c9b351d5-f2f2-4c3a-8206-b62f93953cff", "comment": "Malware payload (Loki)", "value": "3c9af05b87e46e7cbdbee5aa9b7f99a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887885, "uuid": "554d80ea-91ae-4883-852d-e58ab11212c5", "comment": "Malware payload (Loki)", "value": "9b5faf793a40d86ad9633bf4577e78feadb33a38ee18a58dc7c9858e6eb0494a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887885, "uuid": "216dbaa0-7376-475e-a50e-b81465ed9a6d", "comment": "Malware payload (Loki)", "value": "f78abba132521fccdd50a4caacf3c64982b13425", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887885, "uuid": "94b95329-be58-42ac-80f6-f33f8da314bb", "comment": "Malware payload (Loki)", "value": "5a63fc70f174b7bb264b4d144f5998340b41fd12e69816bc9351a2c1e653c6920e3c35a53595fb2d67493b12ef3ca4cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887885, "uuid": "fe616ce7-b53a-44da-945f-41b97ae1fc2a", "value": "T15F64230272D164BFD9E2AA320E7976BF83F8859913127D4F1B546F2F587390345493A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887885, "uuid": "094a4f63-589d-4ac8-9081-d57495cefbb0", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887885, "uuid": "966e8e3f-9202-4ebe-bd38-acbd5704b01c", "value": "6144:rGi2IRfhMUGzmgFnoCE46iJiE6RP9Oyc3KM+RpTwLmsGEpfOt8ccd5oA:JRfhMTCgFoCE4zAHc5aMCUWtyToA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637887885, "uuid": "5b3b074d-e0af-431e-9e7a-205a597454dc", "value": 312955, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637887885, "uuid": "448e6671-86c5-47ee-864c-89f6032b31a5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887885, "uuid": "32bd2f64-04ab-489b-a6d1-6bd847f83417", "value": "3c9af05b87e46e7cbdbee5aa9b7f99a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9ce8985-4f11-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637969836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637969836, "uuid": "0c52955d-fa69-4e10-b32c-9fc0cadf455e", "comment": "Malware payload (NanoCore)", "value": "771c6aeb778958d09c0244753c119e63", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637969836, "uuid": "d88696b6-1073-42d8-976a-29f6e031a96a", "comment": "Malware payload (NanoCore)", "value": "9c59a0dff782fc7334687a70a6bf7694ac315ee7b404456204d6b9dd04589b42", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637969836, "uuid": "69a305b5-b26a-4880-8f51-1264ed33d5a0", "comment": "Malware payload (NanoCore)", "value": "86a6e0088be78523e9c9c9d2931d426e903db62a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637969836, "uuid": "29d5c5e5-cde4-4017-8abd-30f5d4a0e251", "comment": "Malware payload (NanoCore)", "value": "52f65f136fbf6bec0cc9a413d5e22608e24fb5e31bd6eae5be6d3df65cdfded0aeb2f8416b51cdf88aaa4a285f5e149a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637969836, "uuid": "ead221fb-f450-4b07-9c4d-168f60c72318", "value": "T16BC5BF42B3D5C0B2FF9AA2B39F29B6424B7C69354133842F13982D69BD711B2523D763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637969836, "uuid": "a332015b-3c24-4d2f-a050-6a4a277baf2a", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637969836, "uuid": "e73db504-5523-485d-bec7-ee22ef30e29a", "value": "49152:bh+ZkldoPK8Ya8bh+ZkldoPK8YauAcfjC/:E2cPK8J2cPK8FAw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637969836, "uuid": "65f0a516-ee24-4330-97ce-a29dab23e1fd", "value": 2510080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637969836, "uuid": "e6a358c9-faaf-4473-879c-356e4f6eceed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637969836, "uuid": "364de488-c4bd-4924-a468-c7114982aad2", "value": "771C6AEB778958D09C0244753C119E63.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78a3b9bb-4eba-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637932333, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932333, "uuid": "bb95de18-540d-4b61-901e-4518c5852921", "comment": "Malware payload (Heodo)", "value": "50ec23e38592ce12ea8a42c10a8a1b78", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932333, "uuid": "3c93754a-93ab-48ef-9697-bf9da550f3c2", "comment": "Malware payload (Heodo)", "value": "9d99ef08cb12ef4e0f1626ccb58c9adb591dd570ffa02060db49465a074630ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932333, "uuid": "1ba9c721-25f2-463b-8dec-4d3bb2e90b9f", "comment": "Malware payload (Heodo)", "value": "999c1befce8dfdf044f0b379c2af0ae1d7acc84e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637932333, "uuid": "2dcfe0f4-c346-4a2b-a9e1-2c7dad021ed9", "comment": "Malware payload (Heodo)", "value": "b5a1d30251d34f579fceaf5dd28bad1ebdb8e5b524645e4ef729624424fb90186f9e6de78348509980208c07d2f03db1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932333, "uuid": "e9bb4dd9-cada-41a0-969b-402fcbbf7535", "value": "T168A4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932333, "uuid": "8f167f69-5aea-40d1-af32-b34ba32ede06", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932333, "uuid": "bf620b84-d393-4741-b13d-36cdd4ec0d74", "value": "12288:o4xZ0/tI1BD2LETv0FhkO9U6W8XUDaBN7a1vt:oED2LETvMab6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637932333, "uuid": "890b59ea-b82f-4af5-81f1-e5d9c6d3422b", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637932333, "uuid": "01110550-c564-46e4-8e00-058b91b46c53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637932333, "uuid": "1decbe5d-aa35-443c-9b58-a900d0541051", "value": "besta.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac829c5a-4eaf-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637927696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927696, "uuid": "74f5d7bd-fe1f-451d-9bf7-4ac116c26048", "comment": "Malware payload (Mirai)", "value": "a595096d416b02d0410ecb6eaa7942ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927696, "uuid": "b136c791-e4c1-46f6-96e6-59718cd61db0", "comment": "Malware payload (Mirai)", "value": "9e674d7fe247d05c6079437c9697c92238c43d17b2011b432ba5270692ba77b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927696, "uuid": "82ed43d6-b1f0-4d33-a5e9-eec7f778934b", "comment": "Malware payload (Mirai)", "value": "bcfb233e9baed3df674374c037b8106571cec21f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927696, "uuid": "6e87a108-9b0a-4777-9eec-809efdd1d28a", "comment": "Malware payload (Mirai)", "value": "c183cb7c09dca1c7284614bc59f21d5a771c2cfbf58c54d6d8aa7f523156e96e5073d67dcb02ab288dbc4a439a045fdc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927696, "uuid": "cfdfede8-c711-48e3-8904-1ea8a9f24dad", "value": "T1E6B38E66D0305DB8C1174AB572F8CAF45322990062677DF5A295CB3C1047EAEF62D3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927696, "uuid": "13973741-397f-4820-b9ac-98fcef4e126e", "value": "1536:I/cZpHaLLy64naHytLsESN1mjU68KzNV+Z1LQCRekgEdi97TgzZk:IEZRMy6MmySjebjzG1LQ81zq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637927696, "uuid": "2d3bd5b3-9917-4662-8d76-2edb2d6e21e9", "value": 107996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637927696, "uuid": "49ae976a-e57e-4d20-88ee-5f6b7ba6b576", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927696, "uuid": "7c34ba14-459b-4e1b-841c-2d98de91eb59", "value": "a595096d416b02d0410ecb6eaa7942ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "588b5e10-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637954184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954184, "uuid": "89d67427-9b8f-4bac-8dd6-c81b1a913753", "comment": "Malware payload (Heodo)", "value": "d5bbd8959b7dd5ebb06448674c19a837", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954184, "uuid": "d857d4ef-a8fb-4c42-9f67-c0380de126c5", "comment": "Malware payload (Heodo)", "value": "9eb386aa81b0e86744f795e05eeff88dc711adb21e5f35547421dbf4b5f1e417", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954184, "uuid": "1bf0cf59-9238-422e-82e4-93c873123deb", "comment": "Malware payload (Heodo)", "value": "0cf55313263f9c575a1cec6adcedd93e40b8e258", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954184, "uuid": "bc940254-bc2e-4478-9ed5-385006533a49", "comment": "Malware payload (Heodo)", "value": "810bcb271522bbe4106e5346b57a3be1cb01dbd7901996f37fb10dd2906e7ba6bc73a0671ec19384c5ca82795d31d0f9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954184, "uuid": "39ea733f-fd6a-404f-a50f-4b3ab2c8c9c7", "value": "T185E4AE1277C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954184, "uuid": "119d55ce-1737-473f-8d8c-4923680cf9cd", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954184, "uuid": "8ed336da-e98b-407f-862a-edc3d9a28834", "value": "12288:WKEUkuAOLka1miSmuYr1V7+AobS3qTHPR101D:TEQLka1nBViAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954184, "uuid": "7efbe615-0acc-4d0d-884d-6ad2db4f9fd2", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954184, "uuid": "6f5478c1-3408-4699-8236-cf3c2fde340b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954184, "uuid": "32b9ad96-bdf9-4a4a-87e4-8eab55d8b3ea", "value": "d5bbd8959b7dd5ebb06448674c19a837.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce928128-4e84-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637909284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909284, "uuid": "02b2f3f1-96ce-44dd-96f2-be0c479e762f", "comment": "Malware payload (AgentTesla)", "value": "cc93b507b463912e81c83bff394b7019", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909284, "uuid": "4bb2af00-658f-494e-9d02-5fc37826b702", "comment": "Malware payload (AgentTesla)", "value": "9f647818c43bf856407378899fd7351b37a2f3008a23b1ad642a7e9039d8610e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909284, "uuid": "6fe63cf3-5e50-40b5-8193-cb49f9bc1d38", "comment": "Malware payload (AgentTesla)", "value": "2eb22a336219e0e5a90349b71ffd66b818d609ee", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909284, "uuid": "4d7365e8-2074-42a5-84e4-b415a314216f", "comment": "Malware payload (AgentTesla)", "value": "8ea07613287b30a76ba36debc2010eb99bbaf39cc3046d9e87767cae07b06280750695692810a53054bcd6bbb48c7601", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909284, "uuid": "ad731470-b42d-4628-8314-b76107c517d3", "value": "T11794022EB7883F27CD9E617A05D19B0142F1C2576622EB88ADD174D70B7ABB44F02E47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909284, "uuid": "b61b39f9-9e06-4c34-a8bc-7487ba4d096f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909284, "uuid": "0ae69da6-1983-481c-be1c-4606adf35c5f", "value": "12288:NW5ZNL7TLkIKnlPIvbpsDvxvrdMhy73hAGqp:Nu73rKnhI28hYhAGqp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637909284, "uuid": "8b4c59ee-1749-4575-a377-1937d27917a3", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637909284, "uuid": "f223a788-9382-4a49-9332-e4d376bd2514", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909284, "uuid": "a95b9397-4114-47dd-a551-dfd077762b7e", "value": "TRANSFER SLIP.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38347f39-4e84-11ec-843c-42010a9c0014", "comment": "Malware payload (RemcosRAT)", "timestamp": 1637909032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909032, "uuid": "548aed06-2ede-4b48-bb1c-a53ea5da374a", "comment": "Malware payload (RemcosRAT)", "value": "2cb79bcce5050528580bf880f47d9d61", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909032, "uuid": "f65d1d23-85a0-49a2-a114-1c0dad3252fc", "comment": "Malware payload (RemcosRAT)", "value": "a00a856f0d85fcb7f485777ae81a0b1c52974bb1cd2482ba5e987a7ce8207511", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909032, "uuid": "c3297b7a-a639-4397-b685-a49442673a2d", "comment": "Malware payload (RemcosRAT)", "value": "32e93d278b70caf5156e8bb1d7bfc8e29658fccc", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909032, "uuid": "2cdef474-67b5-4b80-9419-9ad04dab9833", "comment": "Malware payload (RemcosRAT)", "value": "a758423bf4b26733e9e149318218a4e800d7e82876dd96d6a0e4f22967d6ddf4205b77879bc7156256c8b8c2f45db4f6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909032, "uuid": "0185f866-4374-4709-acfd-806a69d59f25", "value": "T1F5F45B11B2919C72C1772679DC3BB6945F39BE806AF47C963EF47D480AB8381742E392", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909032, "uuid": "1015747a-6cf8-4643-b80c-bdfe51e94994", "value": "fa05048bfda17ad908358f66259767df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909032, "uuid": "0b28ef53-798e-48c1-bb89-f81d4f9362dc", "value": "12288:a+3V1iARDZ1Wv7GFdc6v8cnr3pB7PeDhxYjAKJtWcpEL36U:a+FrZ1Wv74d9lTrbeDhmxJtWf36U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637909032, "uuid": "43b969ea-7d69-47c5-b3a9-497532bcbf05", "value": 773120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637909032, "uuid": "8b1313c5-0e00-4aba-9b5a-7bf533a97472", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909032, "uuid": "3602ce91-29b0-48a4-8ba3-9dc9259bd44c", "value": "BKLULYOT.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5699de7-4eec-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637953990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953990, "uuid": "53508851-0352-4beb-9fb7-72f7cb5e1458", "comment": "Malware payload (Smoke Loader)", "value": "68b4dcc4eaf74f09528b92708b1b6c15", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953990, "uuid": "d540112d-871a-4762-aa28-bcf3d02255a8", "comment": "Malware payload (Smoke Loader)", "value": "a11c01f16871a5f5edcceeb3bb4e86d100e43652104a3b29dcd471c131a589cf", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953990, "uuid": "fc44ee42-8f07-48e9-bf8f-a54543a06d1a", "comment": "Malware payload (Smoke Loader)", "value": "d8fe83470f4562f0549952c7b5ca2d8fa3585658", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953990, "uuid": "18bdea12-32c0-48e9-818c-0258b774b2bb", "comment": "Malware payload (Smoke Loader)", "value": "5451ab59365c3056e740e5ac135c8712472f0cd4ca8bc7756977e719b75cb196d1d46a2789cf8d4b156a50886d8a08f0", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953990, "uuid": "0326bba5-0c01-4f45-9195-c58218f4a491", "value": "T1B1E3AD1032E0B334E2E72A3068F0EA741E7ABC732674854F3797626E1F716D14AA5357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953990, "uuid": "0e1427ad-88b0-4851-8805-2596c85a5e92", "value": "60ac7a1fa68561a3b4c22b3ea42db989", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953990, "uuid": "fa0f3615-b3ae-4df3-bf7c-179f47783c2c", "value": "3072:4gxe4PoC8PAUxLNNwDfZVUmRQV5KB+pf4oad2:Uk24UxH4Z+14o3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637953990, "uuid": "966a6a1b-7bb6-4f0d-a9d2-08a36267a4fa", "value": 151040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637953990, "uuid": "50552848-0f6f-4df1-a63d-b164561e41d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953990, "uuid": "c09d4426-8b7a-40e4-a2b6-d9fc425eb78f", "value": "68b4dcc4eaf74f09528b92708b1b6c15.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7bfb5e4-4f03-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637963819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637963819, "uuid": "15439fdc-9509-436e-8997-b34a90e056b1", "comment": "Malware payload (RedLineStealer)", "value": "47160b3fcde0d898911cd3403c98c49a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637963819, "uuid": "86f8e9c1-2917-4b90-977f-7124a247d37e", "comment": "Malware payload (RedLineStealer)", "value": "a158d3d7d2c71b3b0bc2ccac067a87510e3510a3b8648ae573c0518ccd19ff01", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637963819, "uuid": "7dc51428-7974-472d-95b7-49453e21db97", "comment": "Malware payload (RedLineStealer)", "value": "5520e67e7ad36eabcf9e79d6366890bd2673ba43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637963819, "uuid": "c162920d-6e7a-4da5-a98f-4bc24bb70b04", "comment": "Malware payload (RedLineStealer)", "value": "9114f76f1de99a49ab052bc780a396521bf8accff8baf2c1ab768a96050873d0563d581c2aa12e14fc508f9807f8e08e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637963819, "uuid": "0a6c6772-a0e4-4ecc-9421-cda3d712f0de", "value": "T14794CF05A7EE5A7BCED83376B029069487F2E44AF207F31B035D7CF95E637485A052A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637963819, "uuid": "f4912c4e-f4d6-4e93-81f4-a7d787cba25f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637963819, "uuid": "82c447a2-595a-4311-9e07-765380e2b3fe", "value": "6144:MAYcuuINVHdnsz28kfC5EQRKSYkLoITdgFCG6yHpkV7V6pYV9BevAyrL:lXf+9nsz28kfC5EnnwoITa6yJ+PBe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637963819, "uuid": "0c2a13e3-5144-4ae4-b176-fd19dbd1f904", "value": 423424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637963819, "uuid": "779768bd-3e38-4cd1-a3a8-533354d8be88", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637963819, "uuid": "16e2a044-51e9-44c2-8ad4-38c38a0409c7", "value": "A158D3D7D2C71B3B0BC2CCAC067A87510E3510A3B8648.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc86be2b-4ee2-11ec-843c-42010a9c0014", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1637949681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949681, "uuid": "c8ad0cd0-0f10-48d5-ab8c-669bd85ee46c", "comment": "Malware payload (SnakeKeylogger)", "value": "c5f854e1182088e92599cb6a6fe61146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949681, "uuid": "5850b3cc-12d7-4551-82f1-9e916e6fe8b9", "comment": "Malware payload (SnakeKeylogger)", "value": "a1d3d73284b65272004821c267cb29a89aa26d827652ef0a91d6aac2b486d07a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949681, "uuid": "d9da0e2a-4e8e-4790-a81e-a40762958dc9", "comment": "Malware payload (SnakeKeylogger)", "value": "7faf17578a8764f2e43109a4ffcc251d601fe168", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949681, "uuid": "c8b7eb8c-a886-49cb-ae80-eaef1e735255", "comment": "Malware payload (SnakeKeylogger)", "value": "4906f37d167cce60af0ac66ea419eab9014874d119b4688e94c2ae805f33c70eb7e007059a9010076a137c2f82c11812", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949681, "uuid": "9034a48f-1c9e-4a64-a655-41b8f59da446", "value": "T14AD4490D6605C143E25839B0C4696FF043519FADF503D76BAD853AABFBB1FEC08425AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949681, "uuid": "cd2a1a5f-a802-4083-a4ab-251b93600fdc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949681, "uuid": "d6f37966-f624-48b4-8e1c-ecdde8172b8c", "value": "12288:a3WPySExhCoLdixBFmd8Il4KhvYcB4BHkMOtGr:EWPGH5i1+LlThAH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637949681, "uuid": "24cca3c0-96ab-4322-8a57-efe115b90d64", "value": 617984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637949681, "uuid": "d68b584b-7b51-4aca-9d27-3dd3b2724e92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949681, "uuid": "81c55a40-161a-4298-812e-525a4159b26e", "value": "ORDER INQUIRY-PVP-SP-2021-59.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aec61e73-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637919110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919110, "uuid": "e5890631-6a04-49ba-9f9c-acc9a7f1ce29", "comment": "Malware payload (Dridex)", "value": "92d2b982db190dd73a46815f69730460", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919110, "uuid": "9b7e1f6c-b3c2-47b3-92d6-ae6b8a8603c9", "comment": "Malware payload (Dridex)", "value": "a25acf9e95fa653dde6830bbe1dc4406804347b9d3f9a037f53f0a8e79296fe2", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919110, "uuid": "6fc62774-d8c6-4623-ab88-4ede9835ef2d", "comment": "Malware payload (Dridex)", "value": "fa22116b54799ed06e28dca5a813c4ac29f24184", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919110, "uuid": "ab5ad3ec-37d9-435f-b042-833037b3fff9", "comment": "Malware payload (Dridex)", "value": "5f49761421bc5521f737298322b27fed163a83f280987ee82aa62c871d1c2985d96c1bd4fda66872bbcc2ed98730b422", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919110, "uuid": "1f3a20dd-e27f-46b3-af0f-00f82b85923d", "value": "T1CD45E102FF9963E5E9502DFA95F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919110, "uuid": "6cf0cd5f-c138-47d9-908c-29b04a158dfd", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919110, "uuid": "8db879dd-c511-4eab-b1a9-f5c58275e4e6", "value": "12288:aZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:aZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919110, "uuid": "14aaaaa7-730d-4e75-9133-be120e112647", "value": 1228800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919110, "uuid": "9110861a-a7ff-4e97-9db5-8a69df150815", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919110, "uuid": "4663d110-d248-4675-ac08-0907a41d0ce1", "value": "a25acf9e95fa653dde6830bbe1dc4406804347b9d3f9a037f53f0a8e79296fe2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9885138-4e58-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637890378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890378, "uuid": "f50d4aa4-67c2-45c7-a33f-e57610e48d8c", "comment": "Malware payload (RedLineStealer)", "value": "cb0df05d4e0566e10266daa8f5519218", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890378, "uuid": "0329c80a-0c7a-48a3-8ad8-bdeffa03f641", "comment": "Malware payload (RedLineStealer)", "value": "a336a8555a0f41331a9498980c11a1b89e55a8263012efcf139c307157c5ecc6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890378, "uuid": "11559a97-c84e-45ed-9a5d-2a170fa2e57d", "comment": "Malware payload (RedLineStealer)", "value": "78b0115bcda0f0a4e8aef4d064dab68aaf965761", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890378, "uuid": "e4810da4-20ff-46f4-8f29-e204431fdab0", "comment": "Malware payload (RedLineStealer)", "value": "1f133d1b9dd7eb48cc1764654d95604371c968d0c4c336048b8952b212f9c18b9fdcb6f6ac4bf4b37e5f265dc4cdd294", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890378, "uuid": "ff7204a8-bde1-4107-b510-8258c2c20cf1", "value": "T1A8D4EE5B23D39E26FE84273686A397204B9531C3531337EB7B08B5E38A87195EFC5294", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890378, "uuid": "bed547d8-9803-42e4-b240-80084732601b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890378, "uuid": "54cefe31-ab30-4558-a070-b7cd36b9c8f5", "value": "6144:sBayHiABL8X4zstehk7i9U3x3wLqfCGQmU8bwbZRUAhsBwJRcpBlc3:EHpSR34CHAhsTBW3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637890378, "uuid": "f8c65f39-9425-40f4-a53f-38f436e6a2d5", "value": 636824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637890378, "uuid": "83357e3e-6a5e-4097-9ee6-f959d1dcbe2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890378, "uuid": "2f5e23cb-8449-4e80-a0ba-79cad27e922d", "value": "cb0df05d4e0566e10266daa8f5519218", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbe35389-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918729, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918729, "uuid": "89e15f2a-32ff-4e5e-8f17-71dd97777bee", "comment": "Malware payload (Dridex)", "value": "6bad7f03803d4f94524b181c5d6506bb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918729, "uuid": "94f3b744-7acf-409e-9218-61da7ddf0349", "comment": "Malware payload (Dridex)", "value": "a35a441cebe6101f1b6c2bccc4ef43fb86e45374628763843f4992bcee41d58e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918729, "uuid": "cc72e4cf-8555-4861-938a-6b9ad0c60973", "comment": "Malware payload (Dridex)", "value": "93172fa64d9af49115ff46fda12470f698e618c3", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918729, "uuid": "a5f3f810-0654-4330-bb56-72d06b855f5b", "comment": "Malware payload (Dridex)", "value": "274b07c114b1602e76b50a5384242d6b7664763d1efcaafe4ded21052d571cd144e524525f303853f09bad21bd083c84", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918729, "uuid": "be977d3f-a469-45cb-b82d-558ad58ea43b", "value": "T1C075E002FF996FE6D9511DF795B0F2A3C9B0F9854F680329DA61441F9CA0ACEAC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918729, "uuid": "856daa84-c3d2-466e-9f84-89fbb791d7be", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918729, "uuid": "cd81b4ef-340b-46d3-8372-158f95c3f0fb", "value": "12288:VZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw+h:VZK6F7nVeRmDFJivohZFVw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918729, "uuid": "889d5e01-e4c0-45c3-a33f-2eb2edf6e125", "value": 1634304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918729, "uuid": "525972bd-86a1-4893-b1cc-dcd80d890026", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918729, "uuid": "38a8ba90-72a9-4c65-b207-9eb5620fc30d", "value": "a35a441cebe6101f1b6c2bccc4ef43fb86e45374628763843f4992bcee41d58e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44241dfe-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918931, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918931, "uuid": "cd350344-cc96-40da-968f-1235b53de5e6", "comment": "Malware payload (Dridex)", "value": "96a1a6247fd9266b2df8e83e40ec5066", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918931, "uuid": "7186092a-3639-4f6b-9463-b4d2c4dc6251", "comment": "Malware payload (Dridex)", "value": "a435f616d20bb7534e2a3a7ac480e52792c472ee0fd1e83c3203167af1c93407", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918931, "uuid": "28d311b2-454a-4651-b43a-0b9e9416c414", "comment": "Malware payload (Dridex)", "value": "5af3279ed13f24ed21fc1c5de232f81e9a8defca", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918931, "uuid": "1649d134-eefe-498f-a191-3e9c1452640d", "comment": "Malware payload (Dridex)", "value": "12a4a7295f356412308defdb66ed77e32d0dfba7ec93dac341bd4ae4251d234769d91746bd88a5950b644c635a007148", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918931, "uuid": "f7704a22-14f5-41ac-b60a-a419167a24db", "value": "T1E955E102FF9963E6D9502DFAD5F0F2A3C9B4F5858C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918931, "uuid": "e6622777-a803-4df5-a02e-bf86013dc12d", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918931, "uuid": "2d7e75ec-c98f-4929-bfb7-9568fc26d0c6", "value": "12288:MZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:MZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918931, "uuid": "7652d5f0-bf59-4b88-b9e1-16ec3430ac6f", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918931, "uuid": "537fca28-09cf-4e63-bc5e-74a6a569c828", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918931, "uuid": "2630085a-31dc-417a-b16b-7f984358fa33", "value": "a435f616d20bb7534e2a3a7ac480e52792c472ee0fd1e83c3203167af1c93407", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e87f8b8-4efd-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637961173, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961173, "uuid": "35ab3161-a7c8-45a0-86d3-1ae2c0f2593b", "comment": "Malware payload", "value": "9acda36bfd465480283f51dc24c93533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961173, "uuid": "ae8e01d1-1619-4094-b9b3-da48a9887415", "comment": "Malware payload", "value": "a4a4f1a3cf2a43318aff7001ee729e97decbcae9c632a023e8dac02b3a1e26b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961173, "uuid": "3817ed25-e2e8-4054-9022-fa0ba6f653ca", "comment": "Malware payload", "value": "3e3bf32bfe93ba72fd19d272b79692a7b633f1cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961173, "uuid": "52650409-8c4a-4756-843c-7745dd22a1bb", "comment": "Malware payload", "value": "35ffec49937edecdcc2698e11ac65c9e949958a4ee9396e6c51a355b54cdc662f2b74a2b1e01ee1c7aaed6337abf9f24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961173, "uuid": "1fc365ba-1e6f-4d9a-8235-c47c046c1338", "value": "T1084513535399C192F4F52AB0AE7F06578919BC16497AA39F0E023F0A09381717A7EF37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961173, "uuid": "1f44b7f8-5e45-44b0-a943-48137083c325", "value": "6a23726de98b324826f7f915f11af8ef", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961173, "uuid": "f190f4b0-28ea-4a44-aa80-7da8e04c4a50", "value": "24576:CJomh4sMizAfdz/L5vwEckaziVPIozUAsQjNAoLHA:EJMxBOErPIGUAbjmqg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637961173, "uuid": "1db71466-acb5-44d6-b4c5-5f3836f548b4", "value": 1224512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637961173, "uuid": "e92b921a-7dd8-4f1b-a50a-5a10d98b1314", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961173, "uuid": "0f98d95e-5f0b-4728-8aaf-6483605d95b4", "value": "9acda36bfd465480283f51dc24c93533", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e2538d3-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637919055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919055, "uuid": "00025747-6d3a-4df1-ac93-556ae0efc935", "comment": "Malware payload (Dridex)", "value": "0d2d32a9d4d31d4448df2902ef9590e2", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919055, "uuid": "e25dd8f1-9367-4481-84e5-c99e332a9909", "comment": "Malware payload (Dridex)", "value": "a5282ab1f03b543c5876030240e56ada6e64c2d94f0acea8819d133a5d653d5d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919055, "uuid": "4de763f4-9c9d-4832-a236-67797399094d", "comment": "Malware payload (Dridex)", "value": "eb31c27903cc0d4bb2a9a4a6760bd0e60416a276", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919055, "uuid": "19280496-03a3-463e-a937-1b135aeb866e", "comment": "Malware payload (Dridex)", "value": "b5c062d457a39922e3085027c23bd314d32ed88f81d04cbe927638bf424c56b652fb6a9e32a4595d7652a92123e1a613", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919055, "uuid": "6a3fe81e-6130-4a2c-a1ff-8aae259c8e04", "value": "T13045D162E36871E4C5739A31D03F551F0AB66D2268598205FB723A740D3FAC9FFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919055, "uuid": "9536f3da-fbd3-4929-a635-c8714869cdbe", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919055, "uuid": "766e0621-6d3f-4a29-85af-452aa438300c", "value": "12288:fGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:e3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919055, "uuid": "825e8a55-2c9a-4f79-9c4b-73fbd9bae2fc", "value": 1241088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919055, "uuid": "dd21c8ea-f0d5-4cd2-8b07-c3f86b3a0589", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919055, "uuid": "07c2ca83-ad28-4f95-a20b-717b10a90fd7", "value": "a5282ab1f03b543c5876030240e56ada6e64c2d94f0acea8819d133a5d653d5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a748225d-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931123, "uuid": "2a81c9d2-23bf-4cdc-a018-12c5e3a0a664", "comment": "Malware payload (Dridex)", "value": "8cbd752ef7947c9dbcb0f43a43ffe095", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931123, "uuid": "7fc14e07-f8e3-4a61-be88-d0b793a7fb63", "comment": "Malware payload (Dridex)", "value": "a5e556540ab8d540b16ec6b9cca7abc93b1281052297e623c0ff8562851e043e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931123, "uuid": "e07a4c65-79ba-4962-bda3-4487fcf1b638", "comment": "Malware payload (Dridex)", "value": "5005d72199eb53d434e52901e033b6ebb8a83b1a", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931123, "uuid": "c2450004-56ca-4545-bed6-9ee2e2f62088", "comment": "Malware payload (Dridex)", "value": "79259c7040f2ce95f3254be9a8624fad902fc9f95f58b70a7406ec839ccec0e245a503e3849dec43534b1f14d603f255", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931123, "uuid": "1c7426ae-1eb3-4d78-a8b8-b4fe5ca267fb", "value": "T18183020D8422AC24C566173F01AA4AB1391C676FD9CBDD5B307181640DDA2B76FFAB7C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931123, "uuid": "d839cbdc-c1a0-4aa1-9313-714bc6eeff05", "value": "1536:UWHP2CET+S+agP7nA9u9DE2f/BhclEXgF1xopwUIc7gdUk:VIT1k7TASw/Hefngdp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931123, "uuid": "b55edfda-4983-4664-997b-d065a30a85a4", "value": 84148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931123, "uuid": "1e98f83f-7458-4a06-a6f7-7f2bc49a666f", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931123, "uuid": "315111d2-c95e-4ccb-b499-c2ef5596ac9a", "value": "subscription_1515911.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1062da47-4e7f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637906818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637906818, "uuid": "73041acc-491a-4af4-ac3a-352479f8b109", "comment": "Malware payload", "value": "7508db2f79c4e11001f09d3a3dbb8b8c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637906818, "uuid": "6475882b-8bb5-40ae-81ae-bec5f8a7690c", "comment": "Malware payload", "value": "a63a43b2f14884eb5d1e5b78008f2c1b3a52ef8bdf8203866f928d9ccd678cad", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637906818, "uuid": "f9e6f819-8228-469d-a71d-1c22d0008396", "comment": "Malware payload", "value": "559e53a8196ce603cad2c022a7bf9a6b05c79a69", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637906818, "uuid": "5c1390dd-1233-44db-8de5-8920e6b3e2f6", "comment": "Malware payload", "value": "f3eaf3d84a7cf054eba0d1a22bf0cd8914f4f962a6d72e497de1590afecf606417d3e7b2a96b7b8e98ed26e13f32d4fc", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637906818, "uuid": "03e933f8-4670-480a-94d0-76366ed0cc43", "value": "T1A6C312BCCB73C5D0C9D39C22608C52253AA1C297DB524F3C86FA3021ADAD97C7965ED5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637906818, "uuid": "c528e182-bc70-4e65-83e5-469b12540fac", "value": "3072:cCe5hvxbX7KHVCjESOpTQ2eT9j4uQTPfIl6Lc3wQ:cCsZbX6VCSM2eT90uQDAqQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637906818, "uuid": "c4950142-9606-4195-8dbc-a1d6e1e7f7e7", "value": 122093, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637906818, "uuid": "8e71f73e-e5c7-48f0-b9f3-4e2c04235572", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637906818, "uuid": "40949d29-b06f-4f05-9f93-01b47d1c09af", "value": "318418.114.50973.911629.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e1b0846-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637954247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954247, "uuid": "5619333e-3638-42c8-886c-25301166bb72", "comment": "Malware payload (Heodo)", "value": "c85661bd2f086d98142c1045616c65fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954247, "uuid": "48b94155-1d90-4def-a60a-2622658079b4", "comment": "Malware payload (Heodo)", "value": "a6502a35d43e2207f92bc7013dffb54471855451fd4ebded5e4c2e8feed4a715", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954247, "uuid": "8794de48-95a1-49f6-8614-d2b2257d27b3", "comment": "Malware payload (Heodo)", "value": "b2bd8dd321e7760d55f6fd27b565c95ecbe02162", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954247, "uuid": "7e0eea40-c081-490b-801a-a0fccd8b0b2b", "comment": "Malware payload (Heodo)", "value": "28fe726450dcabad9fa34dd6fc847f4a2aec6823944e223fc938dc8d824f999280c56fee6256b9104a9b5a4941e5232c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954247, "uuid": "31c6f69a-2fca-493a-a496-b8fce0a25699", "value": "T12FB4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954247, "uuid": "e41e084f-e4d0-48c0-a1b1-3fff03ef85c7", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954247, "uuid": "439fc087-3955-441e-bfb9-b5e10b92c14b", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDaA3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjrXC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954247, "uuid": "73e67535-830f-48f8-9dc2-9d4d346e24b7", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954247, "uuid": "f6a5ae83-2af2-42b6-8508-57211adb6318", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954247, "uuid": "d8603234-4a08-4619-999e-941c8c5ef3ba", "value": "c85661bd2f086d98142c1045616c65fa.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2e4f676-4ec7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637938014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938014, "uuid": "c9c12e68-058d-4ee7-b522-4557313e7b90", "comment": "Malware payload", "value": "7f01f48320eecf9c826ea4c011b41a1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938014, "uuid": "cc60d581-287e-4a6c-bd84-fbcea2ea3ef4", "comment": "Malware payload", "value": "a733c76ad535403b92e927d4c147630047ee3877150f79015991dba75a162a7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938014, "uuid": "bdf121ec-c8ae-4f81-8866-8c7d1e47b2bd", "comment": "Malware payload", "value": "e346918e184aab164b530a181c1e976674e3e378", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938014, "uuid": "bb49584c-413d-4cc9-9182-eaf95bb102e9", "comment": "Malware payload", "value": "35ff4c013a332e8ff39d81da432e5af95bc807cac9314cb88f0bc61354d5ac614cad69c91da87fd320bf004481dbcd7c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938014, "uuid": "85587b81-8e06-444c-a3fe-38d52d142bb3", "value": "T102D2E25245BA24C3DD34DD3471BDD5D33CB18E7CA4DF1A872641D2296ABA04762ED203", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938014, "uuid": "3ff1cc09-9f80-4982-a0d8-8c7a9040cf99", "value": "768:e0VFeWcD8EgEezlR36K/0axONtN7HtWFqsb9q3UELk:e4OQEgJzlR369mOnN7HtWF96Lk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637938014, "uuid": "bea4d48d-64ae-4f7a-bfc0-883f200a53e2", "value": 30432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637938014, "uuid": "5ab2a73a-214b-4c85-8e78-18cf4bb41b11", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938014, "uuid": "a560e70b-b931-4aef-8ef0-c60765001256", "value": "7f01f48320eecf9c826ea4c011b41a1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51c434e5-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918954, "uuid": "aa8646ab-cba9-44bf-a18a-1775d5efbba3", "comment": "Malware payload (Dridex)", "value": "3e98bb4d39b7a7b9750ba84ec892f61d", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918954, "uuid": "495d2a6c-a2d5-4899-9788-782cf2677fdc", "comment": "Malware payload (Dridex)", "value": "a784e2fdd1ab991dc8e8be58fd5d6c8f5c1403f92d49661f29309268738cdd8f", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918954, "uuid": "7a4d39b7-620c-4c62-bf08-b9d19bf09a13", "comment": "Malware payload (Dridex)", "value": "a0fd28e7af024c4a1a7ecf10777744407eb306f7", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918954, "uuid": "641d87f4-67d4-412f-a73f-10fcffe159e0", "comment": "Malware payload (Dridex)", "value": "dab3b43eab3863716e6c159a4c20df2dc33296d18bd2617bd684ef7276c3f2b16d8a76f8eb9dec19ac464db81b469e7e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918954, "uuid": "e6d6aaf4-9afa-47ce-ad01-35f0055eea2e", "value": "T1B255D162D36871E4C5739A31D03F551F0AB66D2268698205FB723A740D3FBC9BFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918954, "uuid": "29c73478-3964-4bf7-8fa9-278e57b67b44", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918954, "uuid": "28d554fb-edc7-4183-9684-7a8e310f2104", "value": "12288:FGVNJAvuPFUl/faxuVlBLXKCgFfEK7JRLeHlX//ve7:I3JAvRl/fKIKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918954, "uuid": "c96bca5c-ab57-49a1-998c-b60df9190dc7", "value": 1331200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918954, "uuid": "54216bde-57b2-47d8-a7a1-b5f5184e285d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918954, "uuid": "5e99ff8c-cb1b-44c3-ad4e-f15c92412ed1", "value": "a784e2fdd1ab991dc8e8be58fd5d6c8f5c1403f92d49661f29309268738cdd8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77ebbf27-4e94-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637916011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916011, "uuid": "1a0a158c-0d56-44a2-9232-443b7db203e8", "comment": "Malware payload (Loki)", "value": "59ad878d27a36c475d35321751f1a4b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916011, "uuid": "bd7811b7-fa09-4398-acf5-6649b9c10c1c", "comment": "Malware payload (Loki)", "value": "a7a44db54cb13ee6e9767b9cc1a6525b5cecc5fa532a510c7cca2c8114d7de16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916011, "uuid": "0d2cf0bc-7797-421b-b69f-baad46318478", "comment": "Malware payload (Loki)", "value": "2b76a4c56c6fd5c0b9d5c0f6b2518f25c28cf8b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916011, "uuid": "de8390ba-0a8a-454c-b350-b4cf3214bbde", "comment": "Malware payload (Loki)", "value": "414f7a8373567b575ca02f7a1bc6de48b3929a46c73e21e5ca695d10cb2479089c0ee2d5d60f41450f5a4738280a3280", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916011, "uuid": "3a896f86-2dc2-4603-893d-1309973ea3ce", "value": "T17B54121027E2CBB7FEE556310477BBA6E7B689840905491717E01F6F78A35CB8E093A2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916011, "uuid": "09e9003f-3129-4151-b78f-cead5ce32ecc", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916011, "uuid": "7e881f1d-bfa4-49c9-ac66-64f2aabd8cc2", "value": "6144:rGidm1F0z9K4DcPxzdByedFCsD6FahQV7cVBqh:xmzU2fc2kVksh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637916011, "uuid": "83a868bb-5bd9-40ab-820b-3bd4b819210b", "value": 288522, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637916011, "uuid": "a501a973-8bbc-43f2-bb19-1afcd26dd144", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916011, "uuid": "015c7b90-85ef-4323-bdf4-dd461e674fb5", "value": "59ad878d27a36c475d35321751f1a4b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b848d707-4ec7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637938023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938023, "uuid": "a32976c0-10a6-4c8d-aecd-026cb440b724", "comment": "Malware payload", "value": "2ff0e7888c326913b895ab3770220621", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938023, "uuid": "63b983ea-4750-48b3-97f8-92472663e111", "comment": "Malware payload", "value": "a7d64344efba8f91ee5a1e44180befabc0c245dd7311fb4124b889344cb15287", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938023, "uuid": "98bd2851-a40d-48f7-9191-8249b6929eb9", "comment": "Malware payload", "value": "dff5f13e8b6300fbbc0dd5a78d3986291bef288f", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938023, "uuid": "066acf54-61ed-472a-bdd6-eb54854f28f1", "comment": "Malware payload", "value": "6d4a9d288a57e4799bd1c6be74c72770812fbc9fe8207ca46214f8bd94f437aace4b430595efab6e18dbf4f7dc9c00ce", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938023, "uuid": "8855f8da-3375-42e5-87c3-3e47cc73f411", "value": "T1F492D0B3A6796352C049C735AD2745CF9CF63E32EBB5915BACC899CE10A4174C3A2E03", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938023, "uuid": "9d6e982a-ef03-4213-a37d-133f5861bc7a", "value": "384:UfzyeUaJSMoYLxThl2XE75d5wfrn0EeQcNVmswyNl+0fY8HocIiFqcJvl:StHSSll0EqnTcjmxyNs0fY7Jspl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637938023, "uuid": "1e366d6e-2d5c-42d2-8eff-ba532ff6a7b2", "value": 19908, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637938023, "uuid": "dabf6341-680c-43ef-a136-85d19c66b83d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938023, "uuid": "0e76555f-9eee-483a-bad7-65c293b38065", "value": "2ff0e7888c326913b895ab3770220621", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c65d0d2-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918918, "uuid": "812edfc1-a313-4c61-bd3e-7e55ed7f5d7f", "comment": "Malware payload (Dridex)", "value": "7bdaee4bb6adf9e4b601e6d577759dac", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918918, "uuid": "a79be26b-7651-4d6c-a47c-4b60b072fe8b", "comment": "Malware payload (Dridex)", "value": "a7e4a244a0c2c589c237ed8ee1870017ee62e84809d589cb0824db74ca64ec99", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918918, "uuid": "c8a684d7-d951-4851-9a66-8ffbb83b5e2c", "comment": "Malware payload (Dridex)", "value": "887a4784967fa269affaa90866bb5c2527b66474", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918918, "uuid": "5c4ec7fd-21de-4a10-b1a2-64fc5a4e726c", "comment": "Malware payload (Dridex)", "value": "e7dcfec0ce3697d62a753c388946809a50c3dd67c6c8c2bd35693895fcfe305a1f3a8005a6bfb68979a214170feb1774", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918918, "uuid": "10559827-cdf9-45cc-becf-211e870d5554", "value": "T1F755E102FF9963E6D9502DF6D5F0F2A3C9B0F6858C281229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918918, "uuid": "0b3005ae-3712-4b53-8c23-0aedf3d55ce7", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918918, "uuid": "460b15de-7f87-4920-a39a-ba406f536012", "value": "12288:aZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:aZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918918, "uuid": "55684f44-9c2e-4345-8563-95923b9ec908", "value": 1347584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918918, "uuid": "3b97ecb1-a64f-481b-ba53-80d8d683aa9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918918, "uuid": "0c0e97d2-c137-49f7-b83b-15c88e3d4d29", "value": "a7e4a244a0c2c589c237ed8ee1870017ee62e84809d589cb0824db74ca64ec99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2dba5b52-4e5b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637891405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891405, "uuid": "c4c6d560-19a2-451a-90c0-99e27defe30a", "comment": "Malware payload (Mirai)", "value": "bc988537412371956e264a7b8263c0ef", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891405, "uuid": "20ecda56-9b7c-4294-a057-cd35245383a4", "comment": "Malware payload (Mirai)", "value": "a7fcb7abb806a0bd6d627a9e19c0781549294a628eeaa94a981ea1bbfe9c9a74", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891405, "uuid": "6d12db37-72b1-4141-a4b9-e73d098a57e5", "comment": "Malware payload (Mirai)", "value": "7b35fe51739739bb7a24a14f339382577a51fdda", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891405, "uuid": "de3064d3-6fd2-4032-9e4f-06bd8f5dc0a0", "comment": "Malware payload (Mirai)", "value": "cb7bfd0b31140eac6a45b11c5e4a04a0c9e5afecf4efd8670fd419f22c64791f7ff0536001cccc8804e475df5784adc6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891405, "uuid": "dd707217-09da-4c4e-a9cb-9904875f9841", "value": "T197F2F142C5F64264D57A2073E48D7E97E89875CD5998F6C7AAD0A07F2083FA23A1C0C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891405, "uuid": "336a67f8-40a7-4b64-8ec6-14dac208dd3e", "value": "768:Eys/gLIkarCwykIQT0YbtYBDTOPxp0yvq8yNv0aifgnbcuyD7UHQRjH:QgEWkIQ4YRIePVZ9arnouy8HyL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637891405, "uuid": "8e02eb4e-93ce-4640-87a5-6320904fa187", "value": 36104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637891405, "uuid": "46b6f980-2dcf-4c66-802e-5830274c9e4d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891405, "uuid": "586ac748-5ae0-4b21-a181-c365358f70a4", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "632fd803-4efa-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637959785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959785, "uuid": "91313f75-53e7-44b4-936f-782136835328", "comment": "Malware payload (RedLineStealer)", "value": "ec5916f496b6afbb1a8311519030682c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959785, "uuid": "e7c70aab-fd83-4472-b726-82b56afc5043", "comment": "Malware payload (RedLineStealer)", "value": "a8185fca28c43c3515ce4782989caeece516875143674477b408e403ef2c9278", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959785, "uuid": "e87f0298-4b2b-4112-8b84-03a7a4e12d3a", "comment": "Malware payload (RedLineStealer)", "value": "1c8373b67d5af4494e4f4c88e6d4fbd6afb119d0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959785, "uuid": "b51328aa-91fb-48d6-8e89-cbfe3ac64e51", "comment": "Malware payload (RedLineStealer)", "value": "031a3900a9911514f4603c9235aa0021a85030bc85e4528a4290074885f7f81a4c9c289669f08e9002b12da91f162dc5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959785, "uuid": "b6288c0a-afbc-4a33-aed0-9619b689f71f", "value": "T1D8A400136DC8FB18A0911C7782CF2E291BD22DD28B7255462B59FEF512A42416E3BF7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959785, "uuid": "4ea15fa2-fc44-44cc-9aa1-46f83822baaf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959785, "uuid": "8c403a58-9e2d-4088-aa06-c0e1b526751b", "value": "6144:beZs7ImwpRgBNuashSkZ9rPqtgXuoKazfBBoZNJ3csr0:yT3GNdshr5gYfb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637959785, "uuid": "6e1bbea5-a7cd-4801-9ae4-4341b348ac3f", "value": 458648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637959785, "uuid": "40c7ef2a-0098-4996-a03c-c7bcfb203e07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959785, "uuid": "2e25e889-132c-4f46-a0f0-4c1648ec3aab", "value": "ec5916f496b6afbb1a8311519030682c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0bb565-4ee6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637951101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951101, "uuid": "b6027bfe-6cfb-4509-9d13-05b62f86fdaf", "comment": "Malware payload", "value": "dbb5fbb924a4f868c2f8b722e0b4240e", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951101, "uuid": "0e366f8c-e8a5-4884-9f27-6991e65ed252", "comment": "Malware payload", "value": "a8781061c7281f24a99e6f47aa84f0b91ac92ed89b4cd8af3db1044f0a01f09f", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951101, "uuid": "952db93d-61d5-4c42-9e80-855cf4dc24ca", "comment": "Malware payload", "value": "b026c5f6073f2a3c9dfaa222541fa97e80f5d49c", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951101, "uuid": "dd02c4fe-5cc7-4f6f-abc0-bc48b4953a3d", "comment": "Malware payload", "value": "3788192a8715bc84103586b44826dc3f412d50fe89c61729aef2406e9d664c84dead29f66c3b468fdd1b998646f38f6c", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951101, "uuid": "fed1f4ab-fac5-4a40-9d38-dcce78fa6106", "value": "T132A30255266A76FFE28F8D38441E334BEB9205419A4A7CA21DEDB54F785C8E30302D9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951101, "uuid": "cba12958-9eb4-4c00-9f4d-79623c06a9b3", "value": "3072:KdOKZu86S3Roy9uFwZlsaFPOHYonHBxqPZ1N7+:KIYuS/IwZltFPgYonHBxqPZ37+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637951101, "uuid": "9d054c35-32c8-4e6e-b133-49d37b75f60f", "value": 105357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637951101, "uuid": "89663652-0711-43a7-b070-8035a9f750a7", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951101, "uuid": "883f7633-d3b8-43cf-9ca4-7b16af9356a2", "value": "GPL_10036512_007.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af592101-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637921688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921688, "uuid": "4c10af74-c3cc-49f0-8648-51fe67439196", "comment": "Malware payload", "value": "aa5406ab279b3a720dbfeb07b9ba4d9e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921688, "uuid": "359f2c27-afc3-46a2-afb4-b35b81c942f3", "comment": "Malware payload", "value": "a8aae0a892e62e3fd5b0ad57eb5e40de2159ed79f5b819e83ea1c43d72612cc9", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921688, "uuid": "d192989f-bc2f-43e0-af66-9b68366b1fd2", "comment": "Malware payload", "value": "adfcbf5f8185198570b80c1142496d7cca046771", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921688, "uuid": "a1d9019a-9ae8-43b2-99a0-c84663af084a", "comment": "Malware payload", "value": "f7d0ad5625cc6ef53dbb8ab0842a5c103b743b62602ae3d5b8abf5f4e61710b152d448dc215c47a3a9494b8e10f17343", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921688, "uuid": "85547cf7-0403-4f3e-91d9-263b3acadf37", "value": "T10234122DBB112D9EC78E5DF8D9E5E7550FEEEE2028974DC1A322B4030835DEC52934A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921688, "uuid": "e41d915e-387f-440e-a732-05389f6441a5", "value": "6144:YNyQgkOfVGhTniNrhRTGQAH2bUhBooFIyx7WkxGq7pt:YUQwATiNvTGQAWoToohak4q73", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921688, "uuid": "0159c056-e33c-466d-b556-96739070783a", "value": 234376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921688, "uuid": "59db972a-5cfc-4659-bddc-c589a8f6fb5d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921688, "uuid": "147aab04-1e9e-47c8-9788-9abd0ff155a6", "value": "RemittanceForm.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abbc1848-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637918675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918675, "uuid": "93364cd2-55ed-4d74-b98f-0e7832fbea60", "comment": "Malware payload", "value": "2aaf66e667b0f5343e773a10daeba5ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918675, "uuid": "88ef13ec-3a2f-4bea-98a5-dba7cd2f400d", "comment": "Malware payload", "value": "a8de5a381415d39368645cb036944ded077a04d70c3ec26ad500f64348223946", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918675, "uuid": "ceceb765-47f1-4dd4-a826-d45354f62183", "comment": "Malware payload", "value": "e3c7532c1a6381a192e39694d4097dba047e00b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918675, "uuid": "94c61802-f69b-4cbb-ac7a-76e3f2c60581", "comment": "Malware payload", "value": "6cde87d53358571021fcec5158b9ba36889b3efc278b7b2895cdd9cafbb8816032b735bd0a9dda253bb46a8e618962d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918675, "uuid": "1cb842bd-7f27-4725-9d49-c3de2f122864", "value": "T11226B21173F94995F2F36F30ADF481555B3ABDA99DF6CA2E3144024E0A76A40EE31B32", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918675, "uuid": "e621056e-8b3a-493c-97af-a5bef77fd861", "value": "29c4c5f8766667965cf6248336ce2ba0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918675, "uuid": "f947e471-77d3-44e9-ae0a-ed0dc38b0816", "value": "49152:u0pxbF2ZjeUNZZH46HsnHYFNZDOl3+VDI+TEqn:z6eUNZZJHsHI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918675, "uuid": "73071b56-86fd-4bfc-ac4e-9ea7fbec486a", "value": 4530176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918675, "uuid": "a42c71c9-8e71-462c-b370-6858e8ce2c1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918675, "uuid": "ee49c762-a7ea-4591-a3ff-6230164d5f8a", "value": "a8de5a381415d39368645cb036944ded077a04d70c3ec26ad500f64348223946", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93ec4b85-4e9e-11ec-843c-42010a9c0014", "comment": "Malware payload (SilentBuilder)", "timestamp": 1637920353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920353, "uuid": "ce37e6a2-6cb4-4491-bc85-15aa6d8e03da", "comment": "Malware payload (SilentBuilder)", "value": "36a2c10d132c5f3b75112024e7118324", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920353, "uuid": "a5d70ca1-ac92-4500-b955-ac14891e1c0e", "comment": "Malware payload (SilentBuilder)", "value": "a95b66c0efec94847055ae4cf3bcc169900645b873e36f291f1161df5ef31cfe", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920353, "uuid": "bf713308-25f8-45e7-ac2d-22f3ba648cdd", "comment": "Malware payload (SilentBuilder)", "value": "0217cb7b61e88495d33097b7093a780342c11f4d", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920353, "uuid": "3d5ea297-193c-4115-98f9-ada268fa61cb", "comment": "Malware payload (SilentBuilder)", "value": "45d49c10293d7839c64fe50b4c5f5c3ac4f097ffab8adaf24266566a6765f1ee4a965fb6708c6279aa5de15115cd88bf", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920353, "uuid": "6f23f72c-58e2-4e48-a654-515b0a732171", "value": "T10234E046796CC8DEFA57833148C75BAAA333EC204FD71A8769C9722C6FB4DB47912006", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920353, "uuid": "6730e280-726a-4afa-ad6e-bed7b86df16e", "value": "6144:MKpb8rGYrMPe3q7Q0XV5xtuEsi8/dg0cfZw6th1j7kVWyOqMg63OjzmvN8DMtP:tZrth1jE7XriNl8DKP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637920353, "uuid": "837132d2-99c0-41a9-9b89-29f50e5bf23e", "value": 252928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637920353, "uuid": "06c89efd-9b7a-4da8-b171-629a28c3977c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920353, "uuid": "67c9f9e5-e4c6-4924-b0d9-09b3f9bcf4f8", "value": "research-1242184644.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd214caf-4ec7-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637938032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938032, "uuid": "ad6b6b63-dc5e-4eda-b9f9-4421fd0a9ce0", "comment": "Malware payload", "value": "8c3c9390470d022930d7ab03770eedd5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938032, "uuid": "969f2518-bdd0-43d4-a6b7-cab43976dea2", "comment": "Malware payload", "value": "a970e0c7d0a9eab9a3e7a8d639df2a95b3cc9662678eb0756b132d53d15896a3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938032, "uuid": "5e3f4847-55fa-4141-9979-b665aa8f8bdc", "comment": "Malware payload", "value": "d436f3bdb64bfa27d81811a19e866a639df0d01f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938032, "uuid": "f41b4935-1583-484a-a38d-2557c61a42af", "comment": "Malware payload", "value": "0e9efbdc38c2cc9fde8bc9c30f69b90ce3eb2697fa7112873eb1d1a0bb316187c026c39e6c20918c18df4ec571e17110", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938032, "uuid": "1585ee33-c35b-484f-b658-3c0b0e5e791f", "value": "T15582D014514C6E42D102D13E846F9E9824F43ED04F7BC6936B4EDB928AFD2E8527DC5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938032, "uuid": "85a992e5-3b2a-4a5e-aa1e-ad1cf696eb6c", "value": "384:MyLA6I0pIL65Z7cO3TQ3Oz4ifcPcCjU25aYZlXrTiOcG7YB+PMv1R82:LLHI27Dk+Ef0fUaEvn7Y982", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637938032, "uuid": "29669f3f-b3d3-42eb-88f3-56db229dc29a", "value": 18024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637938032, "uuid": "a2f1b211-58d3-47f3-9745-a1be0374487e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938032, "uuid": "a0dd01d5-dcce-42e1-95e5-06e21eb085dd", "value": "8c3c9390470d022930d7ab03770eedd5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a420d6f-4ee3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637949918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949918, "uuid": "1f20262f-e0bd-481b-ab50-f0acae82cfe0", "comment": "Malware payload (AgentTesla)", "value": "a19a9574cd4e14a94c509f285dd677d9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949918, "uuid": "40d80be4-dea1-4b72-9573-d9fdf02c56c0", "comment": "Malware payload (AgentTesla)", "value": "a9c045d3a660af8e20a4a1d02ff7e02a3416a9893b37f950df11fb3e0adf8838", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949918, "uuid": "8315aa3b-72e6-490e-9de3-8469f0dacb4e", "comment": "Malware payload (AgentTesla)", "value": "20b89be60093e7243c404c0382961d200daf5378", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949918, "uuid": "91b9f825-4f92-44b5-8911-5044abee1196", "comment": "Malware payload (AgentTesla)", "value": "7561d5b264afdbbac30bb25059a387fe88e24a54412b4afae82fedab9dcd04c1366b6515428b2956fca4d9006ad64611", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949918, "uuid": "a451894b-2860-4e03-9823-6f3b943259d8", "value": "T1893412E83E248AE3F313C1B6298466423372CD2FF248AACA346C767E50FCCA55C556D5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949918, "uuid": "46adac75-d947-4d1f-9122-ffc06f156d43", "value": "6144:0STdz2z1eTl5GFv2B4WppU17LOKxYGYN5gznEt:jz2heJ5AuB4cUJFbYXgjE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637949918, "uuid": "b15b9584-7524-44c6-aaf7-19a284cc8c8b", "value": 234440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637949918, "uuid": "7ab45079-35e6-43d2-a621-74cbb1ab317f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949918, "uuid": "2bda85cc-75ef-40fc-b538-c2dc1a2226a4", "value": "1-Detalle de movimientos (2021-11-25) 00.35.29,500.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46aaaafc-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918935, "uuid": "d8d4e201-7e0b-4cf6-871a-2914516c9981", "comment": "Malware payload (Dridex)", "value": "29534b5fb245c4b5ff146d14d9da9c54", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918935, "uuid": "e0eb2927-4a9f-4aa0-a0b4-7090201c1045", "comment": "Malware payload (Dridex)", "value": "aa13ee7937305e18ac2da00c90a73476f802ba0ae72863a811dd7bcb29eff095", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918935, "uuid": "7dd9cd18-3b68-4576-83eb-e5d6f9f27d2b", "comment": "Malware payload (Dridex)", "value": "fbaa21729651810b5db05e4c421b4bd269ea3825", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918935, "uuid": "ab863fdd-f436-4bf8-b87a-003a45395750", "comment": "Malware payload (Dridex)", "value": "c705868004a97619d2c94fa422f4f014a67a61c3e55d30ed4d021be7fcac83424089bd7e32789fee1fa42b905a1aa839", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918935, "uuid": "415077de-3062-4c23-9cd6-81c64dec2dd2", "value": "T10855E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918935, "uuid": "91077981-1ce8-4a19-974f-194ccc190da7", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918935, "uuid": "f1307907-a14b-45cd-8e84-b40fc90918f4", "value": "12288:PZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:PZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918935, "uuid": "b4434df5-8ef8-45b8-b2b3-a04346fc1ec6", "value": 1343488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918935, "uuid": "b3fdb945-a3d8-4135-aef1-aa1a0e5ab943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918935, "uuid": "7ca1fb9c-e57e-4395-8798-56275e4f765c", "value": "aa13ee7937305e18ac2da00c90a73476f802ba0ae72863a811dd7bcb29eff095", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcae2e3b-4ebe-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637934219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934219, "uuid": "620ab1a1-5e96-43d5-8ebd-8ccd5ca08e99", "comment": "Malware payload (Heodo)", "value": "0e16b6984134f95e5578d7c29516891d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934219, "uuid": "2e2f6deb-f8f0-4a62-bd84-0316b35f6b4c", "comment": "Malware payload (Heodo)", "value": "aaad904fae54bb3d3b82b60752c331213ca58c44b4e281eb004e39a2ee7bccb0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934219, "uuid": "667d3a22-45ef-4f40-ba3e-43560535b1d2", "comment": "Malware payload (Heodo)", "value": "087729470d9553160f89bdf6a76428c87cda2716", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934219, "uuid": "feae1caa-91ae-489f-94a1-9e294f903d19", "comment": "Malware payload (Heodo)", "value": "ed2ad87796f214bb40a82e3cef1369c6fe9b75269a74ec181e7cd58c3efac2bb745f3d6c9b1fc62c66ffa992f621472c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934219, "uuid": "4a257aef-b5b7-4bad-ad93-a33acc320915", "value": "T1F1A4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934219, "uuid": "3d73a86e-4b5c-4fc4-ac51-060864297d49", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934219, "uuid": "9c547eaa-6824-4c99-ab07-d2fcdfd2cbb8", "value": "12288:o4xZ0/tI1BD2LETv0FhiO9U6W8XUDaBN7a1vt:oED2LETvMob6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637934219, "uuid": "8eef3570-64b2-45f4-85f3-7c91f53bb88c", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637934219, "uuid": "7234fde1-213a-422b-91f6-1572e626cb21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934219, "uuid": "4b17e876-6f25-43cd-8077-ed4a14d10141", "value": "0e16b6984134f95e5578d7c29516891d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49ad85a8-4ea0-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637921087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921087, "uuid": "42fe0bea-c09f-4c58-8292-a9ef06fb1683", "comment": "Malware payload (Heodo)", "value": "a928c06c93c47832b6fbdc600675cc6c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921087, "uuid": "bcc6abbf-b445-44aa-9c18-93cc50b5fb6b", "comment": "Malware payload (Heodo)", "value": "aad5e1477095352773c0eeac9e167e92c24b44a56bfca179feece4009bf5236d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921087, "uuid": "98f10847-8d52-4c39-9815-f61f2fd66ba1", "comment": "Malware payload (Heodo)", "value": "174e3a90f3768f17766221cc61258392a966014b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921087, "uuid": "38baa8cf-7376-4bf4-9ca4-4955b851101d", "comment": "Malware payload (Heodo)", "value": "9b0de30a2f1dc4a358f403f53820205d8f0451d5d02afabf1db1773e0e6aeafc9fda6b2bc2cba5eabb5ce6325f964480", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921087, "uuid": "4c98e728-49e4-4170-8a17-b757e323c01a", "value": "T1C5C4BE11F3D2C436D0AF01357616DB9927B9BE61AE758293FBE47B4E1F314C28A38642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921087, "uuid": "137bfe38-c1f4-47e3-84a4-2f8f96fb6fd3", "value": "43031315f82b6fa0235c2c3dae2afd94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921087, "uuid": "eb215928-af9a-427f-afac-cf17bb961d0f", "value": "6144:fJ4kSRXCb0GNf0QNR+hbspY72fZ84iP/MaDO3H0XqD/hN4+XWrS4raGIKRCBKh:aC1R+6PfZ8l/Mz3HwvTO4p8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921087, "uuid": "6590988b-0692-497a-a5fa-de7b70acab7c", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921087, "uuid": "3ef69354-7188-4893-8e73-e25ef6e39a8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921087, "uuid": "b5ca5548-4a21-43d4-b506-5005c3d40d84", "value": "a928c06c93c47832b6fbdc600675cc6c.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3bdf6a6-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918769, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918769, "uuid": "dcaca5fb-2b3b-43dc-bb55-4815d8c814e8", "comment": "Malware payload (Dridex)", "value": "1e4c7c247cceb3a4b9c588c638bc878b", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918769, "uuid": "a54cf071-40cf-4152-afcb-fd93da88fcb7", "comment": "Malware payload (Dridex)", "value": "abadcd128b404c4966990d6664163526f2cb49d7ce235eca9f5c7f1fcb545b41", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918769, "uuid": "3cb2ddf5-5668-488c-a531-61b09fdf5ebb", "comment": "Malware payload (Dridex)", "value": "f72d2ad6c232ae4772f22e32ea40e1bf5d2abf4b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918769, "uuid": "a8398e07-8452-47e0-bc76-02d4861bc1d6", "comment": "Malware payload (Dridex)", "value": "2b14b4c5d315c1b91241d23609df75fd7e63a2c8a7e5b7bdaf9b3cdc7c9bb805ebb409ed0dc05e6a9e90bd63b926dcfa", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918769, "uuid": "51ad8dd2-d79f-4315-9b1c-6798ac1bf5ec", "value": "T15B65E102FF9963E5E9502DFA95F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918769, "uuid": "90a57025-8230-4415-8a23-71469f6e226b", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918769, "uuid": "f12e14b0-9af1-4b3d-a317-e551d5e5735c", "value": "12288:SZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:SZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918769, "uuid": "6d5e5dd0-7473-4c60-869c-fad778ccc57c", "value": 1458176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918769, "uuid": "90cd169c-a0dc-4495-8768-d0267ba98632", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918769, "uuid": "39377ac8-479d-409e-81e8-4c9414d4ad75", "value": "abadcd128b404c4966990d6664163526f2cb49d7ce235eca9f5c7f1fcb545b41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99fd5282-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931101, "uuid": "710d0ea3-cb23-41cd-b561-28bdf3330d97", "comment": "Malware payload (Dridex)", "value": "ef22498a7380ce5b4306bd1494f329ff", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931101, "uuid": "528886d7-4cd6-4038-bd9b-110891b706fa", "comment": "Malware payload (Dridex)", "value": "ac5cbc081ce07f1b3a55b9a4f1f9be88995919d9612816398e8d11537bdffc16", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931101, "uuid": "7a41e091-b40e-40e6-9d50-d1d927c706b8", "comment": "Malware payload (Dridex)", "value": "752f0d14c533a2b62977413126dcc50e99b3ecc8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931101, "uuid": "d0d75920-a968-4164-9cd1-8ed18ca7c03f", "comment": "Malware payload (Dridex)", "value": "2d00fde152e4ef95e8fb006644bb202c2d42c41015063c507d6e1babc5963805bdcb087fc224c756a3ada10d743e18c6", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931101, "uuid": "407fd913-83d2-4017-836e-52329f3d4150", "value": "T1C063F1168A5EFCD1C3F7153C842C2FF1A50F1B5C9A85E00F26E8F614DA6279B638D629", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931101, "uuid": "809c582a-c712-4dba-a617-f782f13c9d55", "value": "1536:UWPPqrE3gpMokPF58Ik4kosQFVvSuM5u7kdS4mZw5mIgdgYcsX1:VyEwFkd58IXkOFVvM6SRmZrIgdgul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931101, "uuid": "4b01568a-caf2-4c8d-838c-8ae8047d55e5", "value": 67753, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931101, "uuid": "cbed60b1-0cd1-4bec-9a62-da4f4c8b29a9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931101, "uuid": "7a15aa1c-1ae5-42bd-9410-6dce14bdb0f1", "value": "offer_94852.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c0132b4-4f07-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637965303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965303, "uuid": "0d2d3db6-12f0-4bab-8b29-03d52baa3e8f", "comment": "Malware payload (RedLineStealer)", "value": "528792c7f620d007485017619091039d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965303, "uuid": "e8705c32-856e-44cc-ad1b-52dbb3088609", "comment": "Malware payload (RedLineStealer)", "value": "acb1525127f3a3c319c8147db4f1e0e444aee154c46fea7f834bac84157636ea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965303, "uuid": "96b1d600-ea5f-474d-b575-118979aeb3d0", "comment": "Malware payload (RedLineStealer)", "value": "453c1f617f5334f57d2e1948603ddab8f3f33ed6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965303, "uuid": "285f72cc-16ff-4f7a-b0f6-c96de8b23ad8", "comment": "Malware payload (RedLineStealer)", "value": "a4d2a5ad96ea1fd8dc527c654a38be163c96aa6d7a31c412c365998ccbb9fcd0a1fde8a39aa2c4bce66ade9951481e4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965303, "uuid": "6754e7de-7e11-4318-bd44-a10659218342", "value": "T1D7D4BE6AE743DC52E26C27F0C2D74FA4192769E072A008179BB25B383DB53E57C2EE44", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965303, "uuid": "6632dac1-938c-429a-8ead-7c74105be1cd", "value": "e84432e0ba34597cc522fac13a4bc219", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965303, "uuid": "0be9a3d2-f5a4-434d-8f3e-ac1877da3c69", "value": "6144:yWmIjbSJkbMD4HsUTGAo+XGiMENDU9DrWEgEeeP+C7VxHDBtwZFJF58KhK/pQbUn:PmIj+JkbWqkWG66gEueLLwZP38RM72", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637965303, "uuid": "7a53a155-6d4a-4572-b1f6-5ed859a9ba65", "value": 630784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637965303, "uuid": "e3b3dae0-a432-4020-bc3e-d9fdd931620c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965303, "uuid": "c8ac9e59-4e4b-4358-8ebd-d61ed4f44de2", "value": "ACB1525127F3A3C319C8147DB4F1E0E444AEE154C46FE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f4b050-4e83-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637908891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908891, "uuid": "eabae63d-f40f-4e43-b076-ab0432e371a7", "comment": "Malware payload (Formbook)", "value": "e74f27f6976becd6ec54a2be39583b0b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uu", "colour": "#50FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908891, "uuid": "1a093d6a-7c6d-4b8a-8134-4653a535741d", "comment": "Malware payload (Formbook)", "value": "ad437e05c9fe33a7b9a0368f65a663f7449a96c583a53483f85a88a95b815d1d", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uu", "colour": "#50FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908891, "uuid": "0cce1801-f614-419b-bf62-d26a74715298", "comment": "Malware payload (Formbook)", "value": "b12a4f9758fe8b053ae0f410086120347b61f3f4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uu", "colour": "#50FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908891, "uuid": "52ae3ded-ff99-4455-a385-0d34155d6e23", "comment": "Malware payload (Formbook)", "value": "87e45d3114a5f6482846dfc92f79c12f04e5f329ecf6ba4409eb6dea2aaea2028e433fc309afaae1cf54e9a397c3bdab", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "uu", "colour": "#50FC26", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908891, "uuid": "4fe1a97a-b3b9-4d62-9eab-653983b18ffd", "value": "T17184235A160BFA49A24C397FF4118F933166D62B5EF29936B74C5B30F2D13A72C84A70", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908891, "uuid": "fa14e6d0-028f-44af-9a13-22be8b2f1770", "value": "12288:VsAw9izv7RZoYG201QZteYvFDOBiay6vC5N+Ia+xoVkV20hZ:Vs/4v78l5we+D0iay6K5N+Ia+93Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637908891, "uuid": "a27cac57-2f94-40c0-a428-81fe5b25ecdd", "value": 394290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637908891, "uuid": "41f71ef8-684b-4851-9a68-53e334fcf60b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908891, "uuid": "8a127abf-b8b1-4d90-b583-77ca75d5561a", "value": "PO_467889999087746346_PDF_.uu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd01ce60-4e87-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637910597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910597, "uuid": "e28fe0fb-31e4-47f4-83e8-689a615859a9", "comment": "Malware payload (Heodo)", "value": "c085bfa546f57d2b8ec7ce61cf33cf55", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910597, "uuid": "d04a2819-cb47-472b-8318-a4986d8af05a", "comment": "Malware payload (Heodo)", "value": "ae5bee350da559dd63b589800525f0aad79836471db8c5afbc83a8cc02205d58", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910597, "uuid": "4ca53655-b045-4405-bd86-bb15767c44af", "comment": "Malware payload (Heodo)", "value": "f57a753aa0010565ebfa486da50bfc0381554264", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910597, "uuid": "952af116-e279-40e2-ad5f-495533f97241", "comment": "Malware payload (Heodo)", "value": "5aac06c28fa0c61b3ef139c64a90c5625fb73e1d02fb0005f8e9b75c251f5e5007ec6f54d822dc2f2a9f20b77ddaa889", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910597, "uuid": "f097ad91-705d-4353-a06f-801546287c48", "value": "T145B4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910597, "uuid": "19ff59dd-0f26-4865-9f5c-8c26f792e000", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910597, "uuid": "a8c8ef14-0e79-474a-ad5f-1c627884efce", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDae3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjFXC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637910597, "uuid": "7d598192-c639-401f-b0ce-456224b14c48", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637910597, "uuid": "4999a297-490c-456e-b52a-014caa8b6c0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910597, "uuid": "f3a86c49-8efe-4d19-a700-879a176a45ba", "value": "emotet_exe_e4_ae5bee350da559dd63b589800525f0aad79836471db8c5afbc83a8cc02205d58_2021-11-26__070953.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d31617ce-4ecd-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637940645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940645, "uuid": "60641991-180a-4421-8796-d0f3ce23b59f", "comment": "Malware payload (RedLineStealer)", "value": "52933cb29e94e9a7ffbd28730e77e28a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940645, "uuid": "9de48ed4-aff0-4063-bc18-ab214e81db5e", "comment": "Malware payload (RedLineStealer)", "value": "ae8d1a3405dc5b9ed1b477c643c42c631d96b6d4f7a8c20164784fa5c28bd51f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940645, "uuid": "abeea801-653c-4cdc-95ff-9172b127e34e", "comment": "Malware payload (RedLineStealer)", "value": "c086c68ad242fd9e8383ea9e56032ca602006a45", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940645, "uuid": "91d96902-e52f-4464-8bc8-fafb00fc63fd", "comment": "Malware payload (RedLineStealer)", "value": "72991922f464d1580b0387367eca8a491d796008a2f9c23f11037802fe67df44c43cbbf63969661484b4ca091ee818b1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940645, "uuid": "df5cddcb-6808-40bb-a564-e43b7e4db4a7", "value": "T164A40F036DC8FB19A4911D3382CF2E291B922DD28B7255462F19FEF412A52056E7BF7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940645, "uuid": "88e5f359-7da4-4391-8c06-4d87f7695165", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940645, "uuid": "1e606b24-c234-4e7b-a8c8-e332e8fb9f30", "value": "6144:srBnlW7JG05duGA4UlVGA1k066hWn24TK9dEmeNWTl8ChALo:ABlWQ0sv1thWQTBA0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637940645, "uuid": "bcafd057-9c75-4154-9546-10b69ebef016", "value": 454040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637940645, "uuid": "28377941-4b70-4f70-abdb-8395ea99be0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940645, "uuid": "36440f22-d9f9-4083-9269-24918ae0f2b7", "value": "ae8d1a3405dc5b9ed1b477c643c42c631d96b6d4f7a8c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2b1a2a-4e7a-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637904660, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904660, "uuid": "1e58ec47-be10-4089-9afe-6e39c4a8f668", "comment": "Malware payload (Mirai)", "value": "97970526adcd0088451d0567e36d166a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904660, "uuid": "1b93f727-b21d-45b4-acf8-47520e126acb", "comment": "Malware payload (Mirai)", "value": "af413d4544cbc16f31fdce03b334997e6aa0b3d22c6b99817204e879d0ad45d7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904660, "uuid": "6f2292e3-fd2e-468a-bfe0-40e4cc12aafa", "comment": "Malware payload (Mirai)", "value": "e0047457fcdf78b13fbf8d2787253ae28747f25f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637904660, "uuid": "ff764027-1009-4cc9-8cc9-032447402787", "comment": "Malware payload (Mirai)", "value": "0dbebaa78a4f21587650abfd4f578c5356dab87165c1208ccd811086ef1560d7dd9b6380f0e91146971a6bfb1b359959", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637904660, "uuid": "f4e0c433-4b8e-49b7-b0be-37f9114a82b7", "value": "T16DE2F845BE829E07C5C94377FB0E028C376523C8F2EE7213EE153F56E68A917099B4A5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637904660, "uuid": "7b501d7f-569f-432e-a66e-e67edd9f9004", "value": "768:CN543de47z/sMT02DYTmnFiwoq4mGw3uLTwTHwbZn:M63YszvDzngbFmi4LwbZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637904660, "uuid": "9722eef4-8c5a-40e3-9d94-6e2bd0ebca9b", "value": 33768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637904660, "uuid": "40258a53-d027-4052-afcd-fa580da546de", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637904660, "uuid": "abd59bba-69d5-4d9f-b1a5-84e8dff90bca", "value": "la.bot.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308554d4-4eec-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637953687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953687, "uuid": "50ba5728-5831-4ac8-8a06-a71a92432302", "comment": "Malware payload (AgentTesla)", "value": "b6fee6b0d01404bf580624d925e149c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953687, "uuid": "a9e50c5e-aa35-4800-a550-8f06729608bc", "comment": "Malware payload (AgentTesla)", "value": "af793b7a58d49f7d85eb641b4df6a34d79e77ecfc708c3ada1ae12730f5853a8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953687, "uuid": "f75dcf9f-9865-4150-a5e1-c27e45c6a242", "comment": "Malware payload (AgentTesla)", "value": "52477754d26cb7324475f305be68218be016dcf2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953687, "uuid": "af2a60f8-57e0-4eae-bec0-574e0be61d62", "comment": "Malware payload (AgentTesla)", "value": "ffcc8d138021eb5d6766b9dda547bf07ed8bb79d4f296c589fb589baf4df0e697b429f3e55c901a6edb9d888f692c044", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953687, "uuid": "d48553f4-f11d-4b93-8975-7e001e49c3dd", "value": "T16FC40215762EBF01E57C07F788A4E420D7F659AB66A0E25B8CC331DA2D66FFA0105D0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953687, "uuid": "7c72db3c-5bec-47a6-9fbb-40b816497aac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953687, "uuid": "bb1c2d7a-8b18-450a-8a13-f9dc9597dac4", "value": "12288:H7jpMQJ4hSoLwgJMVuCOIRepElG4JwrCTfKAYFnixBFmXH:H7tBJCXfMVuCCpE84fcni1c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637953687, "uuid": "57359de6-8c69-451f-a4fe-de7ad43bc631", "value": 543232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637953687, "uuid": "36799250-09dd-4fa7-b6bc-da4b9842bbc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953687, "uuid": "72d502de-887d-499e-9bf6-f8f649cf7156", "value": "b6fee6b0d01404bf580624d925e149c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b49b79c5-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637919119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919119, "uuid": "ea8802d6-c362-44d7-baf3-b6e829e9d52b", "comment": "Malware payload (Dridex)", "value": "12a2429bc9990f1631ce12341895db8c", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919119, "uuid": "de60f756-53fa-415f-907b-1f455acea426", "comment": "Malware payload (Dridex)", "value": "b00840048749257957b81d41979187a60a83d52fbe57998630873729a94ffd79", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919119, "uuid": "593cf41b-8d15-4175-a006-9fbc9400e7e4", "comment": "Malware payload (Dridex)", "value": "0ee8f6d9b2ce34403e841a39a5f92c6d8138dc42", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919119, "uuid": "83f3aa05-1056-4958-a9b0-3c607e631f3b", "comment": "Malware payload (Dridex)", "value": "1a767e580c4b1ed738aee1ada3ca7fc09fed8667b7fb95d659e7b01875ea48d20844205690ec0bf59447aa32a3514ca9", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919119, "uuid": "e902377c-8eaa-4193-a44a-3e3827729043", "value": "T1EB45E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919119, "uuid": "f66e43b1-6178-41d4-9f5a-7fadf53b9779", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919119, "uuid": "5f320f6c-8e50-4b7a-824d-7ea6faa1323d", "value": "12288:aZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:aZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919119, "uuid": "06ed4d60-28b2-4dfa-9df5-87833a5fb6fb", "value": 1224704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919119, "uuid": "47f8df8f-164f-460f-87a8-88da1e363007", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919119, "uuid": "c39be54d-688e-452a-b019-568a41369dbb", "value": "b00840048749257957b81d41979187a60a83d52fbe57998630873729a94ffd79", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32f7cf3b-4e5a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637890985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890985, "uuid": "5554d3bb-e882-43b9-b071-ecfb2a9bc4fb", "comment": "Malware payload (Heodo)", "value": "793d195cd3e4f6873bd675a30f86a808", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890985, "uuid": "22e31537-afd7-4641-9f3f-33e7c3e75ce2", "comment": "Malware payload (Heodo)", "value": "b00b784688317f0a25d57c9a4c72586fdad45229cbfe7f2898527ec657a02206", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890985, "uuid": "aed7a01a-da8c-40bb-8dbb-e2fc0da9477c", "comment": "Malware payload (Heodo)", "value": "962a31e9ad8f4f25cc2b3e5fdebd3df608fb54e7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890985, "uuid": "ccf5c0a0-480e-414f-8960-dd10beb3fa10", "comment": "Malware payload (Heodo)", "value": "a82ced6a073b2088887c7088f85081df3720743f5ffbb61c517ade92bec93a4683ea92c5e0b56beefafecf2cc8bd10a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890985, "uuid": "f30a0979-2220-416a-9eff-29bcbfea2a63", "value": "T1D2B4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890985, "uuid": "6d460ea0-24e6-47ea-9bb2-cb01e6201273", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890985, "uuid": "dfdd7c06-b488-4e09-9e5b-f8a63462dbc5", "value": "12288:smVdIG2GDNBtIlD987snBrkZW+mw3ffEPy:sm4GDNBtIl6wCZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637890985, "uuid": "c226323c-1d61-4b0a-ae4a-7c8221bd6e00", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637890985, "uuid": "63db2ad8-38fd-4113-ad61-fec1ddb25bd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890985, "uuid": "c90880e8-234e-4aad-ab2d-b0edd4db4ee7", "value": "793d195cd3e4f6873bd675a30f86a808", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1b994ea-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (DarkComet)", "timestamp": 1637918685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918685, "uuid": "57ce082b-742d-4ad3-b141-4bbd8ca7929f", "comment": "Malware payload (DarkComet)", "value": "2cf3eb771c04e4ed84a63808a2fb0c3d", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918685, "uuid": "07d4bb4e-6ad6-46a6-826b-1643c804ed96", "comment": "Malware payload (DarkComet)", "value": "b0eb4ce85592a82923a653f90e19f3827bbdf1a0ea1666e82701dde9a16edd6c", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918685, "uuid": "603595f4-dae1-4f99-8133-947cc7989f0c", "comment": "Malware payload (DarkComet)", "value": "30c8c09d26faae01a0bdb4f7cfa0dbd666769a4d", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918685, "uuid": "5490cbcf-f134-450b-908c-23f9a2aedccc", "comment": "Malware payload (DarkComet)", "value": "eab4626d24f316468d9cb2e0f9317e5de0903d727940db507d7541a8d90399c171e537331283de3a962b86b986a7f690", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918685, "uuid": "884bbdfb-c020-4007-b98c-feb382a197e9", "value": "T115063343758C403AD47033F129BDA6831B68BCB38676574970B4724A49B7063DEB7BAE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918685, "uuid": "7fed540c-a516-4725-970c-8bac672b758a", "value": "646167cce332c1c252cdcb1839e0cf48", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918685, "uuid": "69e5f2da-599b-4fa2-9c3d-52c094bc1e29", "value": "98304:xviz/27qWGq/TzuqCDl2Ptao7jYGaCls457UNa:xviq75/TzufTz4GNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918685, "uuid": "d9c7a9cd-3921-4b62-82b2-7fc087d38bd5", "value": 4011008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918685, "uuid": "9051810d-a1e6-4ebb-8d3a-b36a97a04c47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918685, "uuid": "8efa4b42-0d9a-4e77-bc92-c861cca4b922", "value": "b0eb4ce85592a82923a653f90e19f3827bbdf1a0ea1666e82701dde9a16edd6c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85d40247-4ed5-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637943952, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637943952, "uuid": "a97254e1-69c8-424b-acaf-931e32d16ec7", "comment": "Malware payload (RedLineStealer)", "value": "19008dabdac3c666e9006648027c4754", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637943952, "uuid": "19cba0a7-77b8-4ec1-8c8a-97f3733aabd6", "comment": "Malware payload (RedLineStealer)", "value": "b10274561191cedb0b16d2a69fdcd4e5062edfe2621842eacd55945ffded3f57", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637943952, "uuid": "d3515141-3cdb-4960-9cc5-a2dc87e8d042", "comment": "Malware payload (RedLineStealer)", "value": "6a054be41ac9a5badab8d38552b8703c12b33cca", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637943952, "uuid": "726d6216-b26e-49bb-aaf5-1037aeaa5e2c", "comment": "Malware payload (RedLineStealer)", "value": "af9a439e2ae057912ab83bf1f7dfc5239ee4aeb4c54ae6aa69044de42add78481ed23f216992a2efe6e03f5786cd9cc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637943952, "uuid": "01e4b85d-b82c-487d-9e01-fff64dbf2a4f", "value": "T1B806333039CAC4FAEE8132395D199BB795FEC74D063A64D77330D5AA8E1584AD33B01A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637943952, "uuid": "9a509302-5782-4b9f-af65-2861d7a43096", "value": "32569d67dc210c5cb9a759b08da2bdb3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637943952, "uuid": "16cc63c4-7d8e-421f-a620-99de776c9d69", "value": "98304:xjCvLUBsgNnyceLlQgFzTU7V2y/VroqAG7oGF:xYLUCgNngQETe7j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637943952, "uuid": "1d63e59b-954c-4b33-bb94-297a13a7f7c4", "value": 3783763, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637943952, "uuid": "69866464-db6e-48fd-9412-912878b217ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637943952, "uuid": "3530b505-9494-4ae5-a9fa-6dafbf322c7f", "value": "B10274561191CEDB0B16D2A69FDCD4E5062EDFE262184.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b8dac25-4ef6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637958027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958027, "uuid": "858cdf36-861e-44f4-9176-6bb7a6b88eed", "comment": "Malware payload (RedLineStealer)", "value": "e0f0ae88a776e11c1077fa610b891770", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958027, "uuid": "a4331437-0438-496f-9e90-b9cacbc18914", "comment": "Malware payload (RedLineStealer)", "value": "b105a2fc6a3ec224d81f8360ae05e5c953206c64f725e54288ff9a55b0e49b62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958027, "uuid": "a3017c12-dcab-46fd-a2e1-cb08eaed6af0", "comment": "Malware payload (RedLineStealer)", "value": "5827e35e21fb9e606ee025e4536838dc681282d3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958027, "uuid": "f248a7f5-fe78-47d4-9098-2f7389897535", "comment": "Malware payload (RedLineStealer)", "value": "f3d332ff9c94dbcc8661eaf1f01dcbd20d47d59e02e6474ade5933b5ff5a3a4287b724a2f57107bf2c7baf15a529ef23", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958027, "uuid": "b83ccb0a-03ed-49b9-a489-4d966c3935de", "value": "T156A400136DD8F718A4915C3382CF6F291B922DD2877285462B59FEF112A42062E3BF7D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958027, "uuid": "b866a5be-b831-44cd-9b50-e0aa9fe837f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958027, "uuid": "3e802287-c5b2-4944-ab72-26b271f52582", "value": "6144:92n8uDs6cZUM5Sxb6orkdf4o5jd5Z+t4Iy0C600bTSUIGQmp:MwBzqGXzj0teDEbGrGtp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637958027, "uuid": "783c2ca1-f0cf-40a4-9eff-00683fba5d1f", "value": 482712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637958027, "uuid": "afa9efec-20db-4e94-a616-cecc48ddab13", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958027, "uuid": "faa14608-4c13-4f48-979f-a0a972b4bbf3", "value": "Cranch Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f62164-4ee6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637951227, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951227, "uuid": "ccf12aa3-7110-4a77-b619-95e1d8b83f2a", "comment": "Malware payload", "value": "2f12dccc7f18f950f2ea3b13bd2764b6", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951227, "uuid": "f9b20610-bae9-42b7-b00e-6c12454b1834", "comment": "Malware payload", "value": "b18c87aea2b0dd0b2bbec69f27aa7eb51203da8989d70e9f12890e289f7ed29f", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951227, "uuid": "46142848-9f84-4f08-a158-fdea5722cee6", "comment": "Malware payload", "value": "2efd6d93d5843be124b03e0054c2e6f032707d9d", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951227, "uuid": "d244e7c1-d280-4092-abf0-b74b2a8a93fd", "comment": "Malware payload", "value": "6a4654f79acbaf7d476f932c75c6a9463de975c0702da9bdf6f8cc7b798d4ce162253c9a59851e07ac9e74762fa08ed6", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951227, "uuid": "a9a2dcc7-83dc-47bc-8376-03eda78ab5ad", "value": "T159A30295366E75BFE28FCD785406330FEB910A4598467CA60EA9B14F785C8E30702DBE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951227, "uuid": "402a9bae-ccde-4954-b499-699d95ec93a6", "value": "3072:hzOKZu86S3Roy9uFwZlsaFPOHYonHBxqPZIzS:hiYuS/IwZltFPgYonHBxqPZz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637951227, "uuid": "c386b711-700e-4134-8d10-a17ff06609bb", "value": 105338, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637951227, "uuid": "a4d94599-fbd5-4b5a-8b42-ce3a198e6ac3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951227, "uuid": "612aa2ff-273a-4314-b15e-af731147e45f", "value": "NEW_PO_78741000022031.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ddcf6a8-4ecf-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637941200, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941200, "uuid": "b5c087a7-f15c-4f7e-b00d-b72a2ad464b2", "comment": "Malware payload (Heodo)", "value": "7b66eae81c5788bec3be571bdb81b1fc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941200, "uuid": "10d04103-1dec-4a24-8e3b-1095612e46dc", "comment": "Malware payload (Heodo)", "value": "b2254e608e35f052ac302bc56f2c368970b3995998e4639f5bdcaf290dd8dc64", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941200, "uuid": "0dc878e7-d422-4b60-99f6-bf37bfc586e1", "comment": "Malware payload (Heodo)", "value": "738febbdf08cdc4173477fb1085419378963f9c9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941200, "uuid": "bc74fdb7-d18a-40ba-a381-416c242e44f6", "comment": "Malware payload (Heodo)", "value": "cc404a964d2b9e7b4534b2e15b8173edf66926930a1821392c22d620309d16199bb63e060f168474f6e2399aa25ae383", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941200, "uuid": "a820161d-f822-400b-b5f1-275b1d38cbc0", "value": "T186B4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941200, "uuid": "48cfdfd7-8aa4-4b64-86dc-cf86cc2d6d6a", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941200, "uuid": "269ca029-7ad8-4ca2-9e86-d2b68f08f866", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDa03P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjTXC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637941200, "uuid": "dabd3fab-0047-4829-8431-f2e842a8eaea", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637941200, "uuid": "3e641aee-52d1-44b4-a64d-4477557e0828", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941200, "uuid": "b12ff264-bea6-4e05-9b6f-8ce0c76b22a4", "value": "7b66eae81c5788bec3be571bdb81b1fc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc40e577-4e62-11ec-843c-42010a9c0014", "comment": "Malware payload (Gafgyt)", "timestamp": 1637894705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894705, "uuid": "7002f037-3136-4b0d-afa7-e25f0179bb37", "comment": "Malware payload (Gafgyt)", "value": "b99e72ec7c5c325dd3032e2b024c731b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894705, "uuid": "3427fccf-39b6-471e-a3f8-e6539364acba", "comment": "Malware payload (Gafgyt)", "value": "b2cbc6a88d4accadc82201b821ffefd74870d76c4520f9bbe2ce34422fd0d000", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894705, "uuid": "82074fa9-7e1d-4a72-b4d1-0cf251465a76", "comment": "Malware payload (Gafgyt)", "value": "90eb89469d4246627ba48771521b9ad22f68e5c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894705, "uuid": "d21998b3-67f0-47a3-94f9-4d6a36e262c3", "comment": "Malware payload (Gafgyt)", "value": "4e94d41a46697694b8006874fb4552ce627f917b7b6170f2c45d4cd92d3f81b2e56f57d99541b388531f6c7038c45dcf", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894705, "uuid": "5b326eae-7045-46ac-b3a7-9147b17f5a0e", "value": "T1B713012532BE9B44D0AD18BF342B7E2B4852737AE1442AF1FFA421B74D25389379C485", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894705, "uuid": "e7174c4b-6d16-48eb-a501-7b1ae31e0f5d", "value": "768:JnE//Ke6UgAnqNpihRM4PmyUZ55AXbYgs2W/Qw3wXfe36G+nbcuyD7UryqIf5VWB:2/Se6UO/OvUL4RWIwQot+nouy8mqIf5o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637894705, "uuid": "cdc10122-ed3d-434e-9357-a3b53817fc4e", "value": 43348, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637894705, "uuid": "4809c7bd-9d18-4733-b067-6dda089c7030", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894705, "uuid": "a5e50968-49e4-43c9-9648-8d117363a234", "value": "b99e72ec7c5c325dd3032e2b024c731b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ceff157-4ed8-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637945064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945064, "uuid": "6cee3404-6927-4a9e-94cc-9b73c8ea336e", "comment": "Malware payload (RedLineStealer)", "value": "c453b77923f24da5f2f21baea17a3494", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945064, "uuid": "fa800c76-7ba6-47ad-8233-2ede02629de5", "comment": "Malware payload (RedLineStealer)", "value": "b3a797fb5308e5ddf17d688cc28a669b48f7474617ea2553bbfdccba77ad107d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945064, "uuid": "492e9c71-1f65-4dc0-9a9c-de71830c8034", "comment": "Malware payload (RedLineStealer)", "value": "e67bee498e2437442471af85e99ffd4c2eee3528", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945064, "uuid": "ac6318eb-a5ce-423a-8f95-133a539d078c", "comment": "Malware payload (RedLineStealer)", "value": "adeb31a98a92bafa84bb6d4f5f100d97a6230599bc54a8b25f477fe405557b393a90880d5e89df033005c4d86a9e9a4d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945064, "uuid": "913ea52f-fafe-44b1-9b92-72a728b648e4", "value": "T1B7842528687FC05940E3EEA62DDCA8FBD99A55E3640C743701B4A33B8B51B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945064, "uuid": "cbb2e01e-57cc-4ecd-b4ec-0df7991d6fd3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945064, "uuid": "f6aec91a-f16a-4eac-846a-ee6d741e2616", "value": "12288:zErip+Lri/IZmtEwYIdZCXPkMLdX4QBMDo:kiM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637945064, "uuid": "1e27d2f1-d838-42e9-86ca-402827e3b7a7", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637945064, "uuid": "7b0ea32e-8543-45a4-9d44-f4c26b43a82c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945064, "uuid": "711d33f5-1ed8-40b3-be42-ec4c6b3faef7", "value": "OfficialKiddionsModMenuV0.8.7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3048cb6-4ea4-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637922982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922982, "uuid": "88e004bc-33a0-4842-8182-6b4679b500be", "comment": "Malware payload (Formbook)", "value": "ae989ee08e517c4f6579907fd38f689f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922982, "uuid": "19d29186-4276-435d-9cd1-e22ad0bfd958", "comment": "Malware payload (Formbook)", "value": "b3abc09be3775f75fe01c084e3024371dcf7bba8b91e97d5ecf35862f9812ee2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922982, "uuid": "ec0b812a-7ab2-4159-ab87-df2bb7529a8f", "comment": "Malware payload (Formbook)", "value": "b7c250c68374b9893308acc7dea16c05c9446723", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922982, "uuid": "3e9af028-1ae0-48b3-914c-0c89f81b8bc0", "comment": "Malware payload (Formbook)", "value": "c346256b49aedb16585f591a203c022b67c784a171cbd21f2eb4b7d359bc53b550fb74bec1d033f9242cebcb0a42c7d9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922982, "uuid": "efb49f5d-9fe4-4e43-af04-a902f01aa2d8", "value": "T177B4023036D8A273CC260F761D31608127737A51BD11EA8F7CC9229E6D66F9B4B217A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922982, "uuid": "bec06c2f-573b-4751-9ad7-85118a9d1533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922982, "uuid": "acfec7eb-5bde-4454-b8d0-dca54993e145", "value": "12288:zdUEfQLTimG/GvYOLwfyQZjbvge/OUkSypSMkq6VoRx7VM:zdUnJrsfDx8oOrSokvVg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637922982, "uuid": "df5e5eb7-09ec-4a3c-a123-ec2ea7b77559", "value": 503808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637922982, "uuid": "92983e16-499a-415d-b254-e945ede8d08d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922982, "uuid": "8a83eafb-2b81-4b87-91f1-54570cbef03d", "value": "New Booking # 1443026 Wallem 221 S376 DELAY NOTICE BY WHL.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0da9384a-4e9e-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637920128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920128, "uuid": "ef2d9dbe-1386-4521-a513-eb1231770982", "comment": "Malware payload", "value": "a50cb264d1979be3b3d766c0a7061372", "object_relation": "md5", "Tag": [ { "name": "cronRAT", "colour": "#B589F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920128, "uuid": "e9fb12b5-3765-4b0c-a520-5c13a7143685", "comment": "Malware payload", "value": "b46e51a2e757f4d75f1a1fff1165c6a0503b687db6c7e672021dcaa9bedf2d88", "object_relation": "sha256", "Tag": [ { "name": "cronRAT", "colour": "#B589F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920128, "uuid": "62dd65b8-54bd-47fd-8f47-3e5199b46785", "comment": "Malware payload", "value": "abe46855df32b6b46b71719e6d2d03c24285d1f4", "object_relation": "sha1", "Tag": [ { "name": "cronRAT", "colour": "#B589F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920128, "uuid": "82d4a5dc-79e7-484a-95d9-526d550bb484", "comment": "Malware payload", "value": "59278ced48c3d59502def9107adf8ccd6860ec7e325c842f59fe762b45490553aa75297c2cb4edba5f87714d345ae047", "object_relation": "sha3-384", "Tag": [ { "name": "cronRAT", "colour": "#B589F6", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920128, "uuid": "4eb1895f-23a1-4394-8965-fd93660d214e", "value": "T1C9E3A85A795028FDE484C236A6BE4183D2E0F08D52B67B1E5FCA1F143F15E60A53B7B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920128, "uuid": "93f5350b-f40b-4481-8994-72501abcff37", "value": "1536:poV6aBbMBgLY6A5UJ7zgNUeXjT5wTm6LyCU9iM7TMkH6cmH2F4vZls4mJnfPYKrp:OKrgmKAyzX9BxttHJVq8s3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637920128, "uuid": "32bb8551-4823-484d-8bc9-354da33e7ee1", "value": 145448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637920128, "uuid": "39da6041-6311-4e01-99a8-9ebf7c89ff10", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920128, "uuid": "fabcf359-53f1-4182-95d7-eaae79bf2c16", "value": "b46e51a2e757f4d75f1a1fff1165c6a0503b687db6c7e672021dcaa9bedf2d88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6839de46-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637918991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918991, "uuid": "300b0315-daa3-4a77-9eb9-778dc3393306", "comment": "Malware payload (NanoCore)", "value": "5af6c2c54483ca405ef4a2d4483a12db", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918991, "uuid": "41e24cb3-089c-40a0-9d72-3924961c35d2", "comment": "Malware payload (NanoCore)", "value": "b4c7950a7ed88d523d0f700428562d6d1eb6b8b9ecfbe5c57fbab35adbefd33a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918991, "uuid": "8b1fbb13-784f-4f33-a9a5-6700c18a3f81", "comment": "Malware payload (NanoCore)", "value": "4ad1bc8348372fb43cfe58b0c26256cbd767817b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918991, "uuid": "43656442-5c7d-4bf3-a543-aa7fd5b5c38b", "comment": "Malware payload (NanoCore)", "value": "da02ea4d975e590f3d379d52eff42cb07d830df5a7812d7c23e94e76cffbcfcd92bba9b4c2697dde27fe59e13ad4796e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918991, "uuid": "b1926648-8263-40e2-9035-19af5cd5ec73", "value": "T19D45BE02B3D5D036FFAB92739B6AF22256BC7D250123852F13982D79BD701B1227D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918991, "uuid": "973a35b1-904b-4ac2-9cb8-77656d222b46", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918991, "uuid": "98a0e43d-1d6b-4c48-8a96-4d4cc65359ad", "value": "24576:9AHnh+eWsN3skA4RV1Hom2KXMmHaFZyrh9QI/C+EZCBqUIYXmf8MuvWzq:ch+ZkldoPK8YaFZyri7QPIYXLMi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918991, "uuid": "78ac7723-e09c-4056-aac3-c884223c14ee", "value": 1254376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918991, "uuid": "1e106304-7eeb-4e39-b3c0-7547337366e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918991, "uuid": "89f9f609-0636-4d3b-83be-3358161d4922", "value": "b4c7950a7ed88d523d0f700428562d6d1eb6b8b9ecfbe5c57fbab35adbefd33a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e5ca699-4ed1-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637942087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942087, "uuid": "9a5705d1-b68f-4f5c-aacc-9a3c20909248", "comment": "Malware payload (Heodo)", "value": "f17d794791a94fa0328033e701f261b8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942087, "uuid": "e2a5a83e-f80a-4060-bd8f-e60b9953ad5b", "comment": "Malware payload (Heodo)", "value": "b5eded0d9bd9c0d1a49d42c573200b4c360b65467e5b7419bd559ad71e2c2908", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942087, "uuid": "2b638e10-ee9a-43f3-af5d-b2a48fa3316c", "comment": "Malware payload (Heodo)", "value": "a12a03136b6283e5a2e977de0b2747cea9a611df", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942087, "uuid": "ac5f455b-0462-46e8-a81d-3cba36c61f1f", "comment": "Malware payload (Heodo)", "value": "48421ad59875601bdea631ec774ad0990a40f4c0829a488eb720efd58b868d32cd98ca8f8eb810f20c9386c6ed6f42fa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942087, "uuid": "e0ea9a3b-8bf0-4ea4-a5cf-83ae85a94cca", "value": "T100B4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942087, "uuid": "be66d54d-02fb-4863-95c0-25beceb804dd", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942087, "uuid": "4e3984ea-6b8b-47f5-9a92-01521a032450", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDah3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjEXC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637942087, "uuid": "35e78985-e73d-491f-82f7-2eff19815f64", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637942087, "uuid": "de8e4a04-9751-43d8-bbd3-b91bf7678214", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942087, "uuid": "38d29fb0-d696-4330-ab56-73c15a0dfb1e", "value": "f17d794791a94fa0328033e701f261b8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f52d9289-4ec2-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637935978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935978, "uuid": "d131e220-b313-44f5-aba2-69f113d8de8f", "comment": "Malware payload (Formbook)", "value": "58c9384ab6d0eac1b7686eb26ca34dad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935978, "uuid": "144a1c59-163a-4c75-abd6-4c22381dd39e", "comment": "Malware payload (Formbook)", "value": "b643a147a3869ff55b9caa8b86b1b66ce42dc92d893a19f97e165494b713d722", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935978, "uuid": "a31beca9-87ab-44b6-b93b-7870a5b9e536", "comment": "Malware payload (Formbook)", "value": "868218af2f1ac916e6e6c2e1865167516f25d160", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935978, "uuid": "403fa398-289d-44e6-9ecd-cfb88212cb23", "comment": "Malware payload (Formbook)", "value": "48762ebafe029a4df64731149e26f2b7be4b59c101782bd4c6e703508c93cc6721e550b2200224855fc125a2d423ef42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935978, "uuid": "b5998ff5-73c7-41d2-a672-a1adc65c270c", "value": "T1BC641256D7C1999DFB9802712EB67AB5CB7A8E840278F3C747CC2F4F3955643A21048B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935978, "uuid": "300f5951-10e6-4415-b759-b39d1cec4fba", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935978, "uuid": "4052a692-6be1-44fe-b18c-33b40bf4481e", "value": "6144:jGiWAaObkdX72ZyakgbtUPaJujsWOYm1nCXEB/BmEbwNLDe:+OAdr2k0UPAujsWORCUBJm8aLDe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637935978, "uuid": "b452241e-4a3c-4da4-a316-a2acc679997e", "value": 310364, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637935978, "uuid": "3338a1da-58db-4434-b08a-27f35633bdc6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935978, "uuid": "e28b763d-cc9e-4794-945a-d9159521b636", "value": "RO20-1902.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a50b784-4ee3-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637949865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949865, "uuid": "e057aff6-52db-4814-9513-0c60318873ec", "comment": "Malware payload (Formbook)", "value": "2808d260c990d593fe0d8e42904cb584", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949865, "uuid": "1a28cdf6-f8ef-4f9e-a8e8-d3f1926e5754", "comment": "Malware payload (Formbook)", "value": "b662eddf8a5d5ee654a0d62e7acc3dbbcf0d7b1f9ebcf87118e18410ccbc958d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949865, "uuid": "d8d16a2c-dd6f-451e-a3b2-3f18ed1120dd", "comment": "Malware payload (Formbook)", "value": "714f05dde064075b3d18939477392c4f103e09c0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949865, "uuid": "59c8a551-7ca5-4fdf-8677-d0797d5a91fa", "comment": "Malware payload (Formbook)", "value": "cfc5b449a56af470f5fda196562fae6d892d0bedbe7c65049ff8bbb78b1bc715d6abf4cd1cb3aa1b62dbf28d48ccb7a4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949865, "uuid": "4055422a-408e-4d82-abf2-5c61c05810af", "value": "T1C6624FACC4AB41988F89BBB4272F9F89118C762DF744E5737138A73457D2D36402297D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949865, "uuid": "76c16a57-dda0-4884-ab2f-f278d6b15e45", "value": "192:H53cmEPAL0kukGcuODrD+8FIz9WPMyH6d3tMieNSB4spqM:H5smtg2D+8yVtMieHs5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637949865, "uuid": "5751b8f9-8dd9-4985-945d-72b5d08ff336", "value": 14602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637949865, "uuid": "ecaed1d5-1121-4dd3-95ab-d4c73458de24", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949865, "uuid": "106bcb17-e537-4710-b517-bc10e20f50f3", "value": "58674932.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2785526e-4ea0-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637921030, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921030, "uuid": "ebd2d71e-6a19-4e42-b288-e61e20a081d2", "comment": "Malware payload", "value": "895a80a68c07270e54544018e8b8033b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921030, "uuid": "eb7b3b6d-da75-46d5-aebf-03dc67eabe91", "comment": "Malware payload", "value": "b66808a555a9777d7d6e6da5a7aac7518fa46cfb92c04593b0393e1804ff16e8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921030, "uuid": "67a30aaf-7a2e-4c18-bd6c-07bffa874dac", "comment": "Malware payload", "value": "a6e6fe7e098c248c432c868ab00b5e759c240104", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921030, "uuid": "ad43df8d-9d21-401c-a5c9-79a2f4b12323", "comment": "Malware payload", "value": "13c06aecc1099d68a1624990f73bbe7eab904fc0a401dcc3e439b27dcd6d8bcbdec99252e7ec5ac6b839eef6f3990813", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921030, "uuid": "0c79cb4f-e7d2-452b-a375-756b77d63f99", "value": "T11D55311244D1E0ECD67910F3D591DBEBB29F85B00F4EBBA109A333FD64582B84E96B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921030, "uuid": "77238bab-b91e-4a9a-94a4-74b293eeff67", "value": "12248c39ba88d9051079411ba25e7df6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921030, "uuid": "84f54c0a-d3ca-41e2-9bcc-07b424d3f193", "value": "24576:caNHj6u68VfT16eK6ImXMuM5tz1N6dDN7lFFF6:zHjimXMvtz+5N2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921030, "uuid": "1ec02588-5550-45c9-814f-6f9676b19755", "value": 1316150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921030, "uuid": "181144ac-171e-4528-baae-789ec10adafe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921030, "uuid": "3432638d-7701-4cff-9903-6474ce7c2dbd", "value": "895a80a68c07270e54544018e8b8033b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "034ef23d-4ec0-11ec-843c-42010a9c0014", "comment": "Malware payload (HawkEye)", "timestamp": 1637934713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934713, "uuid": "1f58fa1a-38e9-4fe4-9666-0ca31048cc76", "comment": "Malware payload (HawkEye)", "value": "b00427bf215a957a313f9c497a0fe8aa", "object_relation": "md5", "Tag": [ { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934713, "uuid": "1f211eb6-19e6-4c5b-8bc1-865ea1c39874", "comment": "Malware payload (HawkEye)", "value": "b6f5099db781d9c22a2b862a0807ce38e96ef4f80d1cae473bf2713734f321ab", "object_relation": "sha256", "Tag": [ { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934713, "uuid": "c4863d67-0049-4edb-b226-cb64d2bab7b1", "comment": "Malware payload (HawkEye)", "value": "b342e2ddd28ddef2fd46a289c722cc61687bd20d", "object_relation": "sha1", "Tag": [ { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934713, "uuid": "06eee2dc-fc0a-4711-a224-5a6996841036", "comment": "Malware payload (HawkEye)", "value": "6182f44a58cac4b60eaa5f7aacdb7c63d245a6f64ba3b00a161b8840d6ab85569a494cc37674fdd797e559f28df8be47", "object_relation": "sha3-384", "Tag": [ { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false }, { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934713, "uuid": "95efc6e0-1b11-4e54-a2cc-e7f4eeeed87c", "value": "T18F41A55B6B26A931C1918138ECF7D9481A1FE5B7CC51AD1038CC45DCA8D8D780BFAED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934713, "uuid": "5491a205-488c-4f4e-9792-d07dd7e9b761", "value": "48:hA4AlG8u3Ic/oTEHhJRYmPQbDIPtNiOTGDOXnH:hrjPznPfFNiOTG6XH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637934713, "uuid": "658d5eef-d184-4424-954a-8bca0f1e1517", "value": 2068, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637934713, "uuid": "8dd8d5ad-ab33-4908-9d36-9e67c74aef61", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934713, "uuid": "68e89e34-4ba7-4950-bca2-7a705c20b84b", "value": "racoon.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3042747c-4eec-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637953687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953687, "uuid": "5402e31e-fbf5-4dfb-90dd-31bf79340bdd", "comment": "Malware payload", "value": "859f77d8b40fd18d2ae15b0e7c52ac89", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953687, "uuid": "5ce6fef7-90d4-48e4-bf9e-87b27f9eda02", "comment": "Malware payload", "value": "b72e48f5e44ac62ff8a6946d030f1d156d0ecd2c6f6a38e42df69b1290d7fd7e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953687, "uuid": "e1c1e564-dbbf-456c-96ae-3ca8bee14652", "comment": "Malware payload", "value": "f19158d6ea615de63eb63636999629898af787d5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953687, "uuid": "593daa79-bef7-4e33-b1ea-fd0b4f2c565c", "comment": "Malware payload", "value": "28f621e25259180be54cad6b3897b9a4ddebb70b0f2e5c0f3a7acabdf9d90e7026ca684a7fe8e5b60d58d5687908e8fa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TNT", "colour": "#1DC8B2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953687, "uuid": "1c1798bc-066b-4090-b1bf-3fd0e50e983d", "value": "T107F53303B0F87C18C47222357B3686FAC19DEE4D1A09854D38CAE42DE97D46F76E59E2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953687, "uuid": "bf7e3068-526d-48d7-9e2e-da8b3c7b07a7", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953687, "uuid": "20798b10-aabb-4bdc-9640-dc93f89426f1", "value": "49152:UVj8aaM5zmujBveqF82BMHk+CD91i2HufM1ARQE8C+ottHeGipwcR5qlc4Cs:AoaaM9vKzoD9FHufM1A6EbH9iKcfqHCs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637953687, "uuid": "feb81469-a977-4130-868a-b3e50c58f828", "value": 3476226, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637953687, "uuid": "d27d9f40-10ea-48cc-91d3-0ed52e4986b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953687, "uuid": "e58c2de0-2fcf-4732-a10e-5355fb5368bc", "value": "TNT_AWB#049203457.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1be98799-4ebc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637933037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933037, "uuid": "d8e0ce4d-d591-46ad-806d-315c3896a634", "comment": "Malware payload", "value": "93e4e3a7fd517570a42debecce16f6ab", "object_relation": "md5", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933037, "uuid": "febb635f-b50c-49ad-b359-44092490fd72", "comment": "Malware payload", "value": "b7376049b73feb5bc677a02e4040f2ec7e7302456db9eac35c71072dd95557eb", "object_relation": "sha256", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933037, "uuid": "6fbae2ba-82dc-4d16-9ff1-4dfba08d2c4c", "comment": "Malware payload", "value": "2b184f5dc2e24b67c246ed4806395cbe87c2b771", "object_relation": "sha1", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933037, "uuid": "cb089cfa-6f9d-4c25-a4c7-cc95c29a7b09", "comment": "Malware payload", "value": "4a8cc7f7930a3867794db48ea52320c9696b3b4a788dd95c96d4958ad70ca420eafbf2dacfd6984db25b36e779297a1d", "object_relation": "sha3-384", "Tag": [ { "name": ".NET", "colour": "#FD5312", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933037, "uuid": "4c10a982-e40a-4ec2-abee-f724b913caca", "value": "T10E14F70C17ACF26BEE9E83B8ECE556454BE08CEA5C0FEB89978A70E54D43793944414F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933037, "uuid": "c92208c0-b3d9-4bd5-9ff1-a71acd50039b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933037, "uuid": "aa4f26ae-c8fc-4e8c-a1e4-f7a5694d7f87", "value": "3072:OsRPDKoTMR8bXPLRiCRny4kvNNSij27QK2lJ28C0:pDbBRnyJvNNTjK8C0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637933037, "uuid": "343954a9-bcdd-4aff-8b4f-6ae39562626a", "value": 192832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637933037, "uuid": "02168b00-1da7-41a3-aeaf-89bb4bd65e8e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933037, "uuid": "43fbfcaf-5a22-4d99-b1b9-de2de8659012", "value": "wsprotocol.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e504250-4e5b-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637891406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891406, "uuid": "c6dc17df-bd1d-43eb-a966-f4e55c45fe7b", "comment": "Malware payload (Mirai)", "value": "3aab839470c8f2807a6d2dd8ae9c0928", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891406, "uuid": "c87a9be2-ee59-4e7b-a28f-cfac059a71fb", "comment": "Malware payload (Mirai)", "value": "b794bdc303e6dfb785f01eeb3968f97ccff1d06a62251e814d954ebeca370a6a", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891406, "uuid": "851f1fe8-d752-46e9-8181-a36165b1e852", "comment": "Malware payload (Mirai)", "value": "e2d7299d68ba3731dbf7b47776aedcd7a36c30ed", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891406, "uuid": "37c8d450-11e3-4997-91b0-de94cc42c405", "comment": "Malware payload (Mirai)", "value": "3828f00b9852d25977bd4fc767bdf6a735a3b03e5b766f225e3f05512888e4610fe06adf8ad552b7fcfe7ce8f983cd26", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891406, "uuid": "7b126ce1-bb6d-473a-9096-fcbadd43e2fc", "value": "T1B213F2311B58ED74C2F11934A25093880357A7B893E9F61F2AF4DBA8A191C8C5F34B9B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891406, "uuid": "fd7c28ad-4b2a-4ef7-a405-1cec90aeb7da", "value": "768:qmn0Ck+e4wsNVhAjrA8/8wx2VQ7bbvVq6L2Kjm6vj9/mCs0QpnUU0Vbcoss3Uozj:qeRe4wsNVhSrEwxMQDtq6aK3vJps00na", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637891406, "uuid": "f10b2516-ba4c-4bb6-a6c7-6b8f1b27786d", "value": 43984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637891406, "uuid": "bd230062-bfa5-466d-8953-4aebe2a46e83", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891406, "uuid": "2afe9c41-fdbc-4c6a-8751-e9fdb59fca09", "value": "arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0793e65-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (QuasarRAT)", "timestamp": 1637918710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918710, "uuid": "59e4e484-202a-4148-af91-72e54f113867", "comment": "Malware payload (QuasarRAT)", "value": "2c9855cc20b1b3a9baf2e2c7d2c01718", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918710, "uuid": "e80b7c13-f2bb-456c-8991-ea42777cb258", "comment": "Malware payload (QuasarRAT)", "value": "b7b94daf07f73603e9cfe3ffc082ce9a63db71e9815c2cf1105d25653bb1d32f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918710, "uuid": "c33884fd-6c19-471a-9261-d61923f7e137", "comment": "Malware payload (QuasarRAT)", "value": "a796f3740c9c82373661b107dfe59b1d23c7ca43", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918710, "uuid": "5278665a-bb6a-43e8-ba26-e401dc1eb470", "comment": "Malware payload (QuasarRAT)", "value": "5ac09220a1ee496b61a7559499d1ec4c85f0f96fc21379f4f6f9d0e57615d72498334b70fb3c4b3263f7f0b6f16f306b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918710, "uuid": "ae6b2f74-5d8e-443b-87c5-d151d19c2d2f", "value": "T11DA5BE41A3DC82A1CE6A4372BA36DB219B777C692634F70E1ED83D7A3E723521518353", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918710, "uuid": "ddd997d9-161e-43b6-9cb5-2a9849d9d95c", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918710, "uuid": "c1f90804-28b2-4a70-bfc7-26709f42f66b", "value": "24576:su6J33O0c+JY5UZ+XC0kGso6FaI1IXgM6YmenKKSUlmDaGJTA4Pqa6jUvOkQwKYq:2u0c++OCvkGs9Fap5aLKLkDl+dUvO9YE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918710, "uuid": "d8cd2862-e218-4932-a923-d411951b7b15", "value": 2111608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918710, "uuid": "2eb4debe-207c-466f-aa71-eee7ec44a879", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918710, "uuid": "2484057d-8696-4d35-8943-6ce1f3809ba9", "value": "b7b94daf07f73603e9cfe3ffc082ce9a63db71e9815c2cf1105d25653bb1d32f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1e9d4d8-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637921665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921665, "uuid": "b4dd85d8-75db-486f-867e-bf2679287140", "comment": "Malware payload (Formbook)", "value": "4ac40136d9a07f9e0ae1d42dc5da0b79", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921665, "uuid": "e2a154bb-d7ce-4e27-8bf0-5405fe1239d0", "comment": "Malware payload (Formbook)", "value": "b823d41038aed6cd295584dacd25975a8190f45fcabe52b2826addab93c32b22", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921665, "uuid": "fc7eb6a7-97fe-44cb-948d-0a356712daeb", "comment": "Malware payload (Formbook)", "value": "68ace369af950d22cbddb10d075477e3baf9e966", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921665, "uuid": "182e5f5d-b9f8-4ef2-8d8e-b1a25fc07753", "comment": "Malware payload (Formbook)", "value": "e04346b83bc1b4d5ee9ecba8a2a1193be13264b750f369f8d958d73dde1f3a931ebcae262392caaba45d38de6a26a4b8", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921665, "uuid": "e8dec526-926c-48de-b0ba-8fb79bf337ba", "value": "T17034134C7572FB9AF4BC22791B0227F0CC45DF280944B8F1E16DB20A96399D5EB861F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921665, "uuid": "6eff7f99-1d5c-42bb-bbf8-494afc25ad26", "value": "3072:BD2fyV6QuFlHNkE0PUnsM+LKvc3ds4F1gJR2lGfCUXWt2x2KsEHo7K3Y8KpxXgrk:B+yO3tkEcUnoLKvctb0Rsb642xrT3o0Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921665, "uuid": "75fbb880-a982-4c92-a61c-8eb59bc33159", "value": 234680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921665, "uuid": "bb5a6f66-a7da-45fb-b12f-392d8318b137", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921665, "uuid": "66525167-4898-4490-a254-b777b1a1b9d8", "value": "Quote Request - Linde Tunisia 1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc974825-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637954378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954378, "uuid": "c41339cb-9138-4241-ab03-158401e023f8", "comment": "Malware payload", "value": "bc339b906428b06dadaaa81c245c16d3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954378, "uuid": "260e8f42-2571-4014-9a71-1f4e174d92c7", "comment": "Malware payload", "value": "b8f1bd86184cf3e1fc5b37f415ded3f17f750c694eb8755dadffa5587bf2f665", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954378, "uuid": "d6ff1634-8a48-484c-a3dd-faacbe70824d", "comment": "Malware payload", "value": "6b4b8dd2656a3ba8d68ccac3655f8b3b68b39ba8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954378, "uuid": "cc4c3a55-3646-480b-a2b0-d2cf27483b1d", "comment": "Malware payload", "value": "74bd7311496cf34bcf9ed8bc12addce4a2fa372c02f4d94f2d55cbf66b55aa509e66caefe8f31c48b6b7f5f9ffbcfe2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954378, "uuid": "f17069c5-9440-4d60-9ebe-b8727557e342", "value": "T1C8842388CE074FB6C79661306259E5FE51A9CA3EF41084B601AD731EDDAB283DDE603D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954378, "uuid": "dc8ef8a9-f4f2-4709-9b07-181a4c8a6e27", "value": "6144:X8KQHK/AL8eXl6A4lPeiypXFYDN4m69lSBHD9kZ6IqhYYmeOshNbKXiXeXHx9PCg:/QHK/CxRCPeiswB5lTTtuXiIx9PzTiI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954378, "uuid": "0aa4b781-b2e1-4186-bf44-77be986906de", "value": 371873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954378, "uuid": "b32bfd85-c53f-42fa-9fe1-552f5c4baf5d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954378, "uuid": "42722622-f38a-4b98-b1ec-434cc8554b9a", "value": "bc339b906428b06dadaaa81c245c16d3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ffd4089-4ee6-11ec-843c-42010a9c0014", "comment": "Malware payload (STRRAT)", "timestamp": 1637951216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951216, "uuid": "f7825827-fbc3-4989-a2c6-616896daf05f", "comment": "Malware payload (STRRAT)", "value": "73da8c0e5b6b69c2e951c3a941ff2c79", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951216, "uuid": "ccd3a409-7a5e-473c-8f5f-69a4c6c696d9", "comment": "Malware payload (STRRAT)", "value": "b9cf076f5b53babe02a51ed0e82b100eb59279d5eaf703cfc6c15312bfca4c0d", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951216, "uuid": "04698180-0742-4bd6-b28e-5339acafca56", "comment": "Malware payload (STRRAT)", "value": "006d2f8a475c61d2c8effdedb9d3926d5c687448", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951216, "uuid": "aeb95282-05bd-490b-848b-680cc5f20f4e", "comment": "Malware payload (STRRAT)", "value": "b4bab3c807a73795e976328973926069086d9f07709315b5acd2d10382014f0ea2d6a4fec4254f28b038f2b9b72d0585", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951216, "uuid": "14cce752-cac4-48cb-8823-b6162317a5c4", "value": "T126A3C03FBAAB827BE80B91B481059222670D5794C1C5A61B3EFC146B5D36C5C0763EEF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951216, "uuid": "2d74546c-c26a-48ed-a547-d625cb238afa", "value": "1536:MI1Ufh8aHPQt6jL9tjmKqgi41lb/HZ8YG8kGDyV/ghRK9PJaQ:MIYtHBfmKqJgvZ8YGbGDm422Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637951216, "uuid": "5ca48134-6b9a-44a3-860c-31d7d9bd2e89", "value": 97678, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637951216, "uuid": "8c975d16-feee-4748-b921-4f16385e6fd5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951216, "uuid": "77d87f91-e7f2-48c4-84f5-ad1cf2d8ea5b", "value": "IMG-26112021.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c664a1eb-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637954368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954368, "uuid": "00430b6b-b426-49e2-bb90-d3cdb7cca81f", "comment": "Malware payload", "value": "22d8516704e1c3cdfd8d971832b31e95", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954368, "uuid": "e9eff40a-b726-49e7-bf0d-9cbf644cd643", "comment": "Malware payload", "value": "ba10b4ebe4ae3556a1320c7a9b8cb14da16042061c33f1ded73c193cbac8f346", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954368, "uuid": "9f22d5b9-f4ee-46e1-a405-badd37f2f981", "comment": "Malware payload", "value": "706335c526248f527bfe6eaed83ffc5ac66ee511", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954368, "uuid": "0e8e71aa-fbb2-4b16-957b-4864218808f7", "comment": "Malware payload", "value": "c34e3db4d99064744ae91625fe835aa038e02835d5022d86f098026aa0e9d8f2180106936f144ba9adcff73fd5db7453", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954368, "uuid": "6fd55531-6656-4f3e-9c99-23b6db644db4", "value": "T16A940255637C0521CE9D4B7B60E15254573EE22AFA0ECB4936C1F5AC1AEB71383223AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954368, "uuid": "eebfad89-7fb9-4558-b01b-ad05f59018d3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954368, "uuid": "e05625d7-5b0d-4daf-ad0d-e1a022d4cd65", "value": "12288:V3k0tixBFmrRIh5u/CSSycc7T1QLlaENPjyUP:Zk0ti1mRIhUp8gUP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954368, "uuid": "c752338f-6dc0-48da-8586-7fa331e24d82", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954368, "uuid": "075ad76b-e502-449e-8694-c9db7296a3e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954368, "uuid": "42da7002-1371-4ae0-87b9-77f0f0d2b090", "value": "22d8516704e1c3cdfd8d971832b31e95", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "724afa4a-4e99-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637918149, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918149, "uuid": "d7eeee17-34e2-402a-96f3-ad193dc0c5bd", "comment": "Malware payload (RedLineStealer)", "value": "c71baa0ebd74fe22e4bee2ef1eddeb02", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918149, "uuid": "fdd72a11-d033-4859-bed7-853cea1e8881", "comment": "Malware payload (RedLineStealer)", "value": "bc248535fb71303f724017ea79603514661c3cd9716e43c8e7b78703409c0b0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918149, "uuid": "56602dfd-1177-4898-a9b7-8ad91b2c7b01", "comment": "Malware payload (RedLineStealer)", "value": "df9abc8fcae7773d1858267259439ac2de0e9116", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918149, "uuid": "cb39dbfc-86c4-4c6e-87a4-7f484ad9f5a9", "comment": "Malware payload (RedLineStealer)", "value": "8d4d37ae838ddcf0ec2427100500334f34a4b558911f04b2e90a17f7e9274df86df135dbb02725fa1a39e06a1c0e1f5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918149, "uuid": "fb32af9d-d3df-43bb-b0a1-57f88726bd13", "value": "T1C7E3AE3172E08335D1A3993028B0DBA51ABFBC725975464B37A816FF1F603E04AB576B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918149, "uuid": "ddae1f96-3c3a-44df-af85-e261da9279b7", "value": "a967f53cbb69a203dbf386eac93050cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918149, "uuid": "eb674b53-56c0-47f5-90fa-dbd60ee30baa", "value": "3072:la8eanZqCrEAY6GK4qunXQtS6bpMsdQwd2:6MTEAY6GvBXwMl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918149, "uuid": "233dbc08-87db-451a-bfde-be13f9d4a098", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918149, "uuid": "3748d241-d072-4f0e-9ec3-f800a58a9b93", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918149, "uuid": "d87a9bec-8663-497d-8e72-70d2d50919b3", "value": "c71baa0ebd74fe22e4bee2ef1eddeb02.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b65b1e6-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637954054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954054, "uuid": "47369cf6-0500-461c-8bea-20bfe40ea5d9", "comment": "Malware payload (Formbook)", "value": "e80b384d4465c98720ae1c0d2e965a5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954054, "uuid": "6385f0ea-2c98-4292-a970-68fe3b566314", "comment": "Malware payload (Formbook)", "value": "bc42c1e528e70d0f4152e78278ed1a0e4bacf4cab8bb21da9ea8f99a48676355", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954054, "uuid": "6ea292e6-f457-4f9f-be11-608429b5b0ee", "comment": "Malware payload (Formbook)", "value": "254274c5ccdd0e94590d89a9d852a462584eb482", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954054, "uuid": "c9950dc9-7085-4981-a977-bf9497baea40", "comment": "Malware payload (Formbook)", "value": "e5498ac69ca91375100423ca3a6590c3c91a7bc053de389c723d0bf1a9d087a6260cb8b51764defbf07fe195627b60d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954054, "uuid": "71c5db79-9a82-42ed-9067-74992c57134c", "value": "T1DBF4AE75F9838435C6770D7E790E6B145224BE882BA5B43F16E8FC4D4BB4396283A237", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954054, "uuid": "7d9860de-6c48-4c4e-85bc-7e0219655457", "value": "01f42bb56bd8196b0da3b3826e73efd5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954054, "uuid": "e04cb0e8-7bf7-40b6-8048-d2bec2d99082", "value": "12288:HOYMYlxIimj6qr9wMiE+wGFYjA2KY59roDBM6nGplGJY:HOJYMimv+9wGqfKY59cM6GplGJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954054, "uuid": "3efc3ac8-0d2f-4e84-aa40-8d79446a2426", "value": 740864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954054, "uuid": "9bd45da7-93f6-4479-94a6-a68904ea7534", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954054, "uuid": "234bb582-1163-461e-b784-5440a727d5d8", "value": "e80b384d4465c98720ae1c0d2e965a5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1435dbfb-4e7f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637906824, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637906824, "uuid": "b6dc8b72-5208-4426-bb77-83483303ff94", "comment": "Malware payload", "value": "9bc114c36b31b11466287b32d409e7ff", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637906824, "uuid": "b7882be3-6b4a-4a32-9c12-51cc953cf5c8", "comment": "Malware payload", "value": "bce48ec3b80249139b88d43fef0b6f99aab42c80c1d8fc09b20d721a285825d5", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637906824, "uuid": "a13c0396-a21b-4168-b823-7128e135f25a", "comment": "Malware payload", "value": "87a7137469282ebbdea48ee66ff0a46ad50deefa", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637906824, "uuid": "3acd904d-ce42-47dd-87f6-9f84af091b9e", "comment": "Malware payload", "value": "c16ae9c35ce858451007d8e8d541f2c4911d06ac766d141072bdbe3c7ea6e1b9b48da042cfbd92e229396bc0363342f2", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637906824, "uuid": "a5b7477b-6699-4c64-b603-67688f0f10d3", "value": "T10C446B513BC9C13AD2AE063785BA9766363A7D310B30D0CF77947D6C9E306D2AA39352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637906824, "uuid": "f5bf7e10-b73b-44c9-9e58-1c2de467d285", "value": "3072:o3spAtOImXwCGjtYNKbYO2gjpcm8rRuqpjCLw2loHUvU4yGxr53qM2a8KVTH07:oBtOIiRQYpgjpjew5LLyGx1qo8yHi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637906824, "uuid": "13361dba-aeb0-4332-9d56-b27d560525e7", "value": 266240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637906824, "uuid": "b503da30-e358-4789-aa2d-7ad57536f568", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637906824, "uuid": "27decde7-f487-43c4-b7db-513cbb1fb919", "value": "318418.114.50973.911629.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ccd1b6c-4eb9-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637931830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931830, "uuid": "35c29783-ab67-481f-b184-c20c5c5c2c88", "comment": "Malware payload", "value": "73a16cc56a83fde79554f69e7effb3d4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931830, "uuid": "f4fe7999-1567-49bd-b2db-547fff765490", "comment": "Malware payload", "value": "bd8f9f6dabfb081a5f0dc233d8d017923de3e0d10df2b40da280078d7c4c47ff", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931830, "uuid": "d8d2e31e-4b3e-496d-8276-ab7d1e506066", "comment": "Malware payload", "value": "11c7bbde503937a63b6e3be38ea0543c21452c3a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931830, "uuid": "fa15e21d-82d2-4bd2-a2ba-c4172da2c275", "comment": "Malware payload", "value": "4268102c89cd4fcae0b70cbefd4dad07913b5bb2d60d27265ac85f3e58f27e97606ac447005d1df4ba72cb0d534fc492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931830, "uuid": "564585e1-8ed8-42c8-999c-7e50e91d7d5f", "value": "T1E30319273E9E2607DB0993B3AB63E0109A33DE427EC1ED9D6CC751D85915B072E8065F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931830, "uuid": "954d8531-bc5e-4b10-8568-d3312cf27aa3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931830, "uuid": "57b18518-5cff-48c2-9244-073552c9458d", "value": "768:qCgEhMSBr3ekkGUFCE5tzFlczuv6PLxx+ZQihJ:HgIXBr3ekkGUFCE5tzXcIE9x+ZQC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931830, "uuid": "4a13b118-a2a2-4268-98ab-0039e03ef7b5", "value": 41400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931830, "uuid": "1c1f8d4e-298f-49ff-9186-dcdd992bfb1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931830, "uuid": "b57d08bd-c87f-4c19-8326-9fcddf96b33b", "value": "Hong Jin International Co Ltd -Order Specification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b9fec4f-4e9c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637919346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919346, "uuid": "e177d217-e5cf-427c-9c11-cdafe796be24", "comment": "Malware payload (RaccoonStealer)", "value": "e3ceeca656c188206b14d3c5b0e4ea62", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919346, "uuid": "6f4655d4-dd41-4e7d-a9d2-0f7185bfac74", "comment": "Malware payload (RaccoonStealer)", "value": "bda36628d3a78e79e78b50227f9a3480227d959ec3452830d9e37402748c967d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919346, "uuid": "d25f995a-8124-456b-a263-26b552a8e96f", "comment": "Malware payload (RaccoonStealer)", "value": "36ec29d3ca534955a2770446b1b99f9a0285852e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919346, "uuid": "5f82a796-bb2c-48d7-aa8d-b4def907d3a9", "comment": "Malware payload (RaccoonStealer)", "value": "0d4594aa797c8bf24ac4e74128f461f0f5bcc9de37fcc520858da3fe84aa3b30d6ccbf37bf1b5a022f2acf70e1ae5d56", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919346, "uuid": "24795193-c43b-409c-ba29-e514a0ff2104", "value": "T192E3BE2073E08031D4A7163128B09B61AE36BC727570727F779F262EDF706E05AA476B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919346, "uuid": "b6677f0a-00f6-4a37-836b-1606d14de121", "value": "a967f53cbb69a203dbf386eac93050cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919346, "uuid": "39dbcb2b-6e08-4a13-93a0-c69794dadaa3", "value": "1536:+/y8eanRHPSXubr1md2cG4WnCZXlicOfsC28+PKbCWRGI6fK6PqxlwifOYmzZK/2:+a8eanZqCrEAY4cE2ryb7xwBixLzo02", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919346, "uuid": "a6c2aebf-8f73-4db8-a48b-39253011bddf", "value": 150528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919346, "uuid": "ddaf9732-dfa3-437f-aa62-7e5d7a1cbd5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919346, "uuid": "46be0285-ea9c-4a8a-a594-06dee9426e4d", "value": "e3ceeca656c188206b14d3c5b0e4ea62.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d8cba02-4eb3-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637929308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929308, "uuid": "7e1cdbc0-c17a-4661-80ab-60e6a34d7f74", "comment": "Malware payload (Heodo)", "value": "56a3de9c91261cc4fd6d57d924b04a20", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929308, "uuid": "6d6e01fc-9e2f-4444-bbea-7537b4bb2fed", "comment": "Malware payload (Heodo)", "value": "bde527dd46dd574b2b5c8bffcef555dde051701d148b40af4a0d5bd6aff10a66", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929308, "uuid": "089bd042-0af6-4f7e-aa47-297d8cc91471", "comment": "Malware payload (Heodo)", "value": "b146b81fa730bf9b406712a8a624f396c0254a4d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637929308, "uuid": "81b9b887-1a85-449a-942f-4eb2fb0f001e", "comment": "Malware payload (Heodo)", "value": "392e73f523609c80be793644a3126be3d67debeb03dd941ca15182af33a0ccba4d5add29da685470baba27d8813f9584", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929308, "uuid": "b0991e34-308e-4d82-a0d1-06615e02ba62", "value": "T11BA4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929308, "uuid": "ec2e4e91-3b61-47a9-b0e9-b29119073636", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929308, "uuid": "8ab1f77a-a7b5-4540-9965-ab3ab459779a", "value": "12288:o4xZ0/tI1BD2LETv0Fh9O9U6W8XUDaBN7a1vt:oED2LETvMTb6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637929308, "uuid": "bc6b1d89-4602-47d8-8785-7dcad9f3549e", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637929308, "uuid": "ab3ecac0-4b1f-49ba-ab6d-76d59db1e970", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637929308, "uuid": "7b5baa1e-ae49-4d25-9457-cbaf9a36d5d4", "value": "EMnCUC7ra4bHfjjWB.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "150d4636-4e6c-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637898665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637898665, "uuid": "e8150256-7d49-4e3d-bfee-bf3c617a5261", "comment": "Malware payload (RedLineStealer)", "value": "d1a0ebfb69ce7e1e7842186a1b1b6ea4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637898665, "uuid": "2bc785a3-2763-4554-b434-b914e46a4fd6", "comment": "Malware payload (RedLineStealer)", "value": "be6486971a9a8a35dcbe7269d9b749d9ee77551a35b91d3464acc8f4352ca3b3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637898665, "uuid": "d495238e-0de0-4902-8a35-436fdc41acb8", "comment": "Malware payload (RedLineStealer)", "value": "55de6ca9c78d2c169b4527ab2b8e9ff6a3d261e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637898665, "uuid": "63dc91ea-8f38-4ee9-ab1a-aaae178aabdd", "comment": "Malware payload (RedLineStealer)", "value": "5e7c8a688c763b77eb392bc2ee71c7448f48be6a01bccd736e4b0c6dc3a10d4a410ac0824c93bcdf28f0904331893f6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637898665, "uuid": "95dc9095-e08e-4ca8-a759-98987583513b", "value": "T1E7351255FA05CAE7E4CD4BB05E80DAF195207D313A54076BFACDB26EEE370A36016271", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637898665, "uuid": "68abae78-6909-49ac-ae61-1317223dd32d", "value": "844521430a685c0852b2326a4c64cca8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637898665, "uuid": "da0ce9af-206a-4813-8a85-78aef3171787", "value": "24576:cHdgLGe7RR+eb6LCK+TQ0rIQfoCXJyygzXV3dHa//2805Ix1jSyY:c7e7RR+eb6LlKQ0UQfvZyPe23ejjS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637898665, "uuid": "65a64776-2db7-4041-91f7-3fc141cefb24", "value": 1153008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637898665, "uuid": "22359470-cf42-41f5-8ffb-22a83d34103e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637898665, "uuid": "e2f79e11-04df-4803-9156-dd107ef48649", "value": "be6486971a9a8a35dcbe7269d9b749d9ee77551a35b91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "baa05289-4ead-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637926860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926860, "uuid": "91288949-3faa-4c52-a339-e3a5343f6c1f", "comment": "Malware payload", "value": "960001aca6bdbe50e3cad25f2444f977", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926860, "uuid": "7a3d1809-b74d-4362-8f58-152c16daa933", "comment": "Malware payload", "value": "bed9532e2b1c2a3e0dc549a53ef9a11aa56828935bfb3f0fdb9f24751bd78435", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926860, "uuid": "ab5a06c1-9014-46bb-83ec-576387912f17", "comment": "Malware payload", "value": "8cf38d3edeb846e09cdefd54bea5f57dce99c8f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926860, "uuid": "d7bfe8fe-dd6a-438f-a244-da55276cba52", "comment": "Malware payload", "value": "d4293c53f0436cc616459b99234f10d70ac753a256d02847ee05ac6b1e21db83de9aef551f8a96862eaed749e1fac764", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926860, "uuid": "d7dd8905-a041-4db5-a37d-af6cfeb1a93d", "value": "T1D6448C2276C1C036D2A33471821A967966ED6B305BF6D2CBABD05E395F341D3963CA0F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926860, "uuid": "39cc9fdc-dda9-47d4-9f52-91285dc8290f", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkH+:HVqLOGNVDzZtIlHN3nke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637926860, "uuid": "6968dd98-a724-4235-8738-0f24117e7b7f", "value": 268774, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637926860, "uuid": "8b3c1e8f-2361-4a82-b4bc-f1ca38e621cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926860, "uuid": "f760edfe-b59b-44ca-a67f-107d9f526ccd", "value": "emotet_exe_e4_bed9532e2b1c2a3e0dc549a53ef9a11aa56828935bfb3f0fdb9f24751bd78435_2021-11-26__114055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b7b9cd8-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918836, "uuid": "859d3d09-eef7-44aa-9e40-51c142802904", "comment": "Malware payload (Dridex)", "value": "ea8f8ba711d9aed9d2f3fa4315dffb76", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918836, "uuid": "852185b7-87fb-485e-a501-2b613bbdf0c9", "comment": "Malware payload (Dridex)", "value": "bf83f413c510cb1e99240183337a4056615f16d4a579d4227f74f080dffbfed0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918836, "uuid": "f48d57c8-7ea8-463e-b8d0-1b965d7137c7", "comment": "Malware payload (Dridex)", "value": "234ca58512cecae30be256089c1d9f39bd55d116", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918836, "uuid": "21b88b09-1b55-463e-9e9f-94051540e3b5", "comment": "Malware payload (Dridex)", "value": "8c58fbc56d3908ee0236ce6e11a2c227758aa2c7ddccb4881aabfce542f79be00fb5b6c7dbf96a3b7fc9958b8cad8514", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918836, "uuid": "d5919b06-e092-4fcd-a5bf-532330dbb265", "value": "T14855E102FF9963E6E9502DF695F0F2A3C9B4F6854C280329DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918836, "uuid": "ac5c3653-f5cd-42c9-befa-89297b64935e", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918836, "uuid": "9d8a1d72-dada-4baa-96d2-3c108122b303", "value": "12288:3ZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:3ZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918836, "uuid": "680c4a6a-7483-4d46-878f-f1a6deca367e", "value": 1400832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918836, "uuid": "99ae4626-1dc0-478c-858e-a45dabad070a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918836, "uuid": "4e4f2e9a-30f7-4231-97f5-7804dce23a57", "value": "bf83f413c510cb1e99240183337a4056615f16d4a579d4227f74f080dffbfed0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba922161-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637921706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921706, "uuid": "ff67645a-31da-4bc5-98e2-0d913b46983d", "comment": "Malware payload", "value": "bdc504e5f2af16db455315a059c90d15", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921706, "uuid": "355d1d59-bfa1-4285-aad3-4beec3d72df4", "comment": "Malware payload", "value": "bfdd696691ad57b98635e4dd0797ef2f1b45bb0edf59c9ee4785f89ef3ae815d", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921706, "uuid": "f6330f00-5ae5-463e-ab56-da4018faeaf9", "comment": "Malware payload", "value": "1d6f67fcaae61942347e1b9175cf9831d7de70bb", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921706, "uuid": "3382e031-39cf-4e7e-abaa-1cfe9407057a", "comment": "Malware payload", "value": "11509355468c756b0d8c15cbfc79e2e77dd9ae69ef5757aa12c5e4cfaaf3628eb06411f7a9fdf539784cf97a775d206e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921706, "uuid": "7581ed3f-4dda-4ac6-9adf-fb587ec711ad", "value": "T11734122A77139756FE7EA2792D2A62284F3FFC04D67CC4D3964AF308287ED04828555A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921706, "uuid": "bdfa9651-5671-474d-95a6-52fc18ccb41a", "value": "6144:CLpCumxMZORAW/QSewVAPvMNaXwufbdRYouo+:Zu4MMAW/EwVAPE4f7duo+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921706, "uuid": "1a148f26-550a-4833-8a6a-c5ef16802ed1", "value": 234552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921706, "uuid": "c9d1173c-9f5f-4b60-bd9d-715d1394f573", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921706, "uuid": "053dafc8-7d96-400f-8f3b-47e970d33a49", "value": "TT Bank Application Form.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3b5f10e-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918742, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918742, "uuid": "00183750-697b-4ae3-b0b8-22ec3ebe7315", "comment": "Malware payload (Dridex)", "value": "15555a38f1aa91ee649e26d718d01dd7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918742, "uuid": "bb2fcb94-6ee1-42ef-8569-d1ff64c3ff1c", "comment": "Malware payload (Dridex)", "value": "bfe5653f57a75c6a17486b23168450984a2bcccea39f6c8852a274a8eb1246dd", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918742, "uuid": "65cee2a2-d095-41b9-8176-40c6d6da9d0b", "comment": "Malware payload (Dridex)", "value": "4928d3f1c8a0b39ec84686aeeb5f5de0c62212dc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918742, "uuid": "2d7abef6-3b8f-46c4-a75a-77e7c6a33800", "comment": "Malware payload (Dridex)", "value": "73a1236450621a70faa4a3eea7ac4850070af6893cef2ec9d00a4f8b30977310e24fbac9c8ce4b2a3ea02a8f071babb7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918742, "uuid": "963678af-b4c4-4ca1-b1de-f8e00505a9b4", "value": "T16375E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918742, "uuid": "17ba3b8b-e0fd-43d1-9049-94ee1e6cfffd", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918742, "uuid": "16e15557-9976-41bf-ac8a-fc4154fa6354", "value": "12288:ZZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:ZZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918742, "uuid": "52525514-5c95-4a43-8450-f72b54cf456d", "value": 1609728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918742, "uuid": "e60340f7-696c-498a-bd8f-f0a8b0cb5c1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918742, "uuid": "ea56892e-ccd9-4cb6-8010-0737242cef01", "value": "bfe5653f57a75c6a17486b23168450984a2bcccea39f6c8852a274a8eb1246dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b6a7b6-4eda-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637946148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946148, "uuid": "e54492fa-845b-47f6-ac4c-fd44fa2f5eb4", "comment": "Malware payload (RedLineStealer)", "value": "5403f033cc44b4ec0804c113fba810ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946148, "uuid": "25a52681-1f33-4399-89f9-d8628e54318e", "comment": "Malware payload (RedLineStealer)", "value": "c18cf6f2677277c4885ccb069d4e65b8c97c96c0ea72cee5d8e6a2d018d74ed0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946148, "uuid": "3ef3f76b-6c8a-4dc4-9431-c47ff621dd68", "comment": "Malware payload (RedLineStealer)", "value": "c597caa30b38a9bb052b3208d10d73bad206bce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946148, "uuid": "c8d6f6c7-5def-4e11-8b9d-cd34e9f0bbb9", "comment": "Malware payload (RedLineStealer)", "value": "0730328b4b680e38d1ff324e5c01a3d3e2cade28c31994de05f97b13c7a3aac30c8d6230be2a0ffc18967d945ad9e8b0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946148, "uuid": "c6972fe0-e579-446f-a66c-d4c862a3a633", "value": "T1B45533FCED20F8DAC7172075259EE7AD215C667BD6AC60C4D3B983D03D240A4EA689C7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946148, "uuid": "83ecfc37-45af-4ced-8dcd-36771cf9c0c4", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946148, "uuid": "af8462ef-8bba-4c0a-a2c9-a13322bd350a", "value": "24576:C4T65Zj7xuh6FvMUSIddcmtmHI+sJcLOan9aOuhPQYKU7KPpkEaHNYK3kXUB+2:pT6jj7shPIVtmHJsaXUhd7mpNaF+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637946148, "uuid": "928ffe66-a817-44b3-9f0d-77c71193be0d", "value": 1317120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637946148, "uuid": "c64497ce-9ade-4d8c-be09-d59945875a59", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946148, "uuid": "42e1eeed-2fd9-4cfe-b7e1-41b49f69c229", "value": "Fortnite Hack.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f0b4eed-4f07-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637965308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965308, "uuid": "2b36920b-39c4-4912-ab0a-2dcdb023f95f", "comment": "Malware payload (Mirai)", "value": "6d9d624428f04da1912e233c0f9a3975", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965308, "uuid": "d6488176-b90a-41ab-a914-670fddef2987", "comment": "Malware payload (Mirai)", "value": "c1d2631a8faca10a2f90c4c7955bdcb04c9f4dcd4b9d62fe15f67190e231bafc", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965308, "uuid": "40e7ae95-11a2-40f4-94d2-c3aa3ed3273c", "comment": "Malware payload (Mirai)", "value": "6918a242364036bff1554c26c792347d4f3e805a", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637965308, "uuid": "97af18ec-4dec-46eb-8ec0-24c1eb3e5264", "comment": "Malware payload (Mirai)", "value": "4a02209dc473425af4d6d1361e4c7abca92460bbdfb8038176d130239b6214bb7fc6f79e82627764c99fd1afd831c614", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965308, "uuid": "bc24bb6e-07c3-4d2e-a3fa-1bbcca112f1c", "value": "T162735A13658084BDC44AE2345FBF522AF523F47E0234F59E63D87E22BD4AE211B1A5E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965308, "uuid": "42e6d88b-0d06-4558-b755-50e429da1a8c", "value": "1536:NxkDCsxozDX7O5DS2mupN2/jGquOmZyQdkcLYeTBnkG:NxkOs0DL8m2m22/j4OmZ9kcLYeTBnkG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637965308, "uuid": "9a8e8cf1-db96-4eea-9022-84d9b8f4a422", "value": 75808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637965308, "uuid": "3b3dcf2d-5b81-464b-98e6-9dd3f6a7e2f4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637965308, "uuid": "c03fbfd7-08e5-4774-ba60-1244d84e80fc", "value": "x86_64-20211126-2221", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1249fa62-4ecd-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637940322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940322, "uuid": "b4e80719-540a-4a4b-b3b3-966d5bdecb66", "comment": "Malware payload (Heodo)", "value": "3f61233d08e74e230acfd791ae8f05f3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940322, "uuid": "5593c2cb-f834-4ed5-bf94-40a11e726208", "comment": "Malware payload (Heodo)", "value": "c1fc5240d97d51468441ff1e49f6ceeadffcc6a202c03c8380dcd129abaf5cc4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940322, "uuid": "5db40e29-dba2-472e-8273-af9365b2de29", "comment": "Malware payload (Heodo)", "value": "711c276f7332446f84fabe27193b0e24d4793286", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940322, "uuid": "f2744f18-a24c-4d7d-8a6a-7b0468ff3cab", "comment": "Malware payload (Heodo)", "value": "de3d63e5a087cc536a4bcf69b99059aad0e2c63db35f2f7e6c3c97e62c08e124c0b76841d9890f15be63c190a00f284a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940322, "uuid": "54272695-fe53-41fc-b7e1-a00119797eb7", "value": "T16DB4AD11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940322, "uuid": "db0d0218-f2e1-429b-8633-d34100c2535a", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940322, "uuid": "20421dca-a3f5-47b2-bb86-3ac99b497320", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDax3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjUXC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637940322, "uuid": "9f9f095c-4fa4-491f-9088-5e3f260dcd31", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637940322, "uuid": "5c103a28-bef0-4d81-a5e2-1031e228dc8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940322, "uuid": "7c2b8afc-e652-488e-aed6-a7a8de513453", "value": "3f61233d08e74e230acfd791ae8f05f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5e72fbc-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (DarkComet)", "timestamp": 1637918692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918692, "uuid": "8c6f03a2-5413-4011-8995-249c4d754819", "comment": "Malware payload (DarkComet)", "value": "1ea8da0a86e0e15239e64069149c948b", "object_relation": "md5", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918692, "uuid": "267f926f-3a3d-4101-b0bb-21d04bea4968", "comment": "Malware payload (DarkComet)", "value": "c21fcea0b53efa059364381229bc280b4a5facb556297c993ce4e68ea09a0a32", "object_relation": "sha256", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918692, "uuid": "31a9d816-24e9-44c1-b4cf-20b72871a628", "comment": "Malware payload (DarkComet)", "value": "2ecf84c9a1afe868b5c06490b6012fb0932d83e8", "object_relation": "sha1", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918692, "uuid": "9550848a-a558-4c4f-891f-93b68bbf94f2", "comment": "Malware payload (DarkComet)", "value": "7c0e643c2ea8aff1d26d1a1c90e26978ab405f9b3e196b768650c4c300d0597a786d43b91ba5a1d6ec17650d737c97e7", "object_relation": "sha3-384", "Tag": [ { "name": "DarkComet", "colour": "#CC1453", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918692, "uuid": "415639e9-6ca7-4234-89e1-399d4c6a25cf", "value": "T1430679FD654F2C62E98BB627411B7317F68629A360478E00498346EB1EEFF17BF12446", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918692, "uuid": "35002635-b972-4d9b-98b8-e9db8a6bc1e6", "value": "ba503d5ca41abe519df36e8db42dbbf5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918692, "uuid": "1286d372-b164-4738-a6d5-27db9b7836a7", "value": "98304:vJwakG4fYrq1HJvpliCQHawbzBbGSlaUEI96kdQDanpqHrO3ndI3/lL/v7zVwwXN:vJwakG4fYrq1HJvpliCQHawbzBbGSlaX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918692, "uuid": "17a15605-6db4-4d43-b7d3-52854bac42e9", "value": 3960461, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918692, "uuid": "4a1cb02d-bd55-41a4-aeb0-22d2379eb0fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918692, "uuid": "a16bcb44-56a8-4751-9751-b26d480d213f", "value": "c21fcea0b53efa059364381229bc280b4a5facb556297c993ce4e68ea09a0a32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00cc8cdf-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918818, "uuid": "f3e2443e-c1a8-4349-a627-15f289a0a686", "comment": "Malware payload (Dridex)", "value": "5ac689f9ccb4c602698c05dfb0714eb3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918818, "uuid": "37d556d4-16d3-4eeb-b770-468a8459714e", "comment": "Malware payload (Dridex)", "value": "c3d5f929965ae352fcc0342db1174af2f23ca00d95e60011572f14ca7eefd87c", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918818, "uuid": "336006b8-3926-4f9d-899e-8930c3cabb67", "comment": "Malware payload (Dridex)", "value": "dbd1d5a444c921826c7bd0aabb33f4d24a48146d", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918818, "uuid": "380df56c-e11b-47fb-8d6d-8e822939d1df", "comment": "Malware payload (Dridex)", "value": "efdaad24a1e05557ec6eb090f944df6757c34f46f0315d260130517b0681b9d445cdc7f8523e14366820c1eca1a3ddbc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918818, "uuid": "d5c766ab-8d9d-42d3-a297-096586e31bb1", "value": "T19C65D162E36471E4C5739A31D07F551F0AB66C2268698205FB723A700D3FBC9BFE9129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918818, "uuid": "0f3e50de-1ceb-41c7-928d-a636898f5a9a", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918818, "uuid": "1ecf6950-e884-43f7-a24a-23828a1b6fba", "value": "12288:7GVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7YC1:63JAvRl/fKQKCgFfx4P/vaYC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918818, "uuid": "d250c429-578d-4d8e-ba84-8557a370f98e", "value": 1417216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918818, "uuid": "d451e34e-f364-4cfc-9003-25047b5c3543", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918818, "uuid": "a68ef9d5-faba-441b-8dd6-29965aee5e4d", "value": "c3d5f929965ae352fcc0342db1174af2f23ca00d95e60011572f14ca7eefd87c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b85cbf18-4eaf-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637927716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927716, "uuid": "ffc8ac6b-1fbc-4890-80dd-8fff7d33ce46", "comment": "Malware payload (Mirai)", "value": "9b6dad8f80383e4f0788e9f09f9e7d57", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927716, "uuid": "1c175ad5-4164-48e3-9485-c98800b2dd4d", "comment": "Malware payload (Mirai)", "value": "c46f8b79d89992740a192dd812522f14cfcf2253bbb372eb88f820d6949c1b8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927716, "uuid": "5d3e4974-fd6b-480f-b474-6309fdbe3a0c", "comment": "Malware payload (Mirai)", "value": "7ed69181c456a9519a14d39c67f8a089b4e6c78f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927716, "uuid": "48e89480-bdaf-4f2b-8e24-cf2d725e6b58", "comment": "Malware payload (Mirai)", "value": "b86372502b7ba297be0f2706cb1e5f8da2b504e7fb910997fd9f74fdfd5788d7bfcda11b80955ad97134fa9aa5069e58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927716, "uuid": "763a4e49-d681-48c1-a106-4c4367257d54", "value": "T19CC35BC7F801DEBEF84AD7F6455B0909B5206341AFA30E26B797BE97BC320D09D12946", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927716, "uuid": "ce589d61-a70f-4fa6-90c5-7e7535f122cd", "value": "3072:CG1bEpqyTcD56HEDV1nnB4IqZOryqx3z2p:71bEt4DRV1nB4Kyqop", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637927716, "uuid": "cd623970-02f1-4bc6-a587-d9d1c3935878", "value": 121672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637927716, "uuid": "a27412e4-01d1-4950-9e4e-a68f238b7130", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927716, "uuid": "18c429ed-d063-4d12-a34d-3f1d11ecae98", "value": "9b6dad8f80383e4f0788e9f09f9e7d57", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d483f19c-4ee2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637949667, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949667, "uuid": "7f0db18e-51f2-47b1-94f6-e7053df54c2b", "comment": "Malware payload (AgentTesla)", "value": "47c0d5fb1f3559068ee1fbd7a83abc2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949667, "uuid": "b01d572f-8683-4b63-8400-6b767c7982bf", "comment": "Malware payload (AgentTesla)", "value": "c4fb2bf8373e8b672898d6f9e30210076c57916e0f79cb8f80b56164ad57865f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949667, "uuid": "dded7bdd-2bd2-4432-8ee1-a5391c255d62", "comment": "Malware payload (AgentTesla)", "value": "71689ad8b0094daed7793ab2a9064652f4697ea6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949667, "uuid": "dfa28d8a-3f73-48db-8023-c01930fd8633", "comment": "Malware payload (AgentTesla)", "value": "f52c0ad2d167bff7aed29a0de3b7aedf549f88bb1c98d7c9388cd226ca82351eb6c01266252dbb5e8fe2996a0eaaacff", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949667, "uuid": "f7262ce6-7c17-423f-b1ed-50ee82769cc3", "value": "T1F8E42393F7DDF425D2F1AC34699C663C02B8569F54A43A7B2B942D2E72D01890F3EE48", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949667, "uuid": "da751d76-d39e-4a01-b16d-aabebb2bd2f6", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949667, "uuid": "111a7098-50dd-4c64-a17b-6c96355a5d6b", "value": "12288:DIow5bBao7Tf19SlXlRjv3aUoMjS9zvADxUOyo2xdJS+q0yB4Ea0sIDj0yPppUDq:DvwNJTfI1FeeS9bF1o0IePIDoDizx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637949667, "uuid": "a184707d-21c0-44fa-afa3-4059a02c0dc3", "value": 707806, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637949667, "uuid": "abf26e3a-9016-4ea2-b9c2-71348b79cbab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949667, "uuid": "c0144a87-3fff-4369-8b11-70adef6e8974", "value": "YPJ-87655.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb890e01-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918782, "uuid": "6810dff0-e6a4-4b94-af1f-35318b4ac953", "comment": "Malware payload (Dridex)", "value": "b10d7d1c405f81de7d52bff6a6feb9ab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918782, "uuid": "48262ff5-4ba3-4ae3-86e1-c5d4eb457a53", "comment": "Malware payload (Dridex)", "value": "c595d93c190e487562ee3edb78b351567be676fa2fe73625c3e61985f656e204", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918782, "uuid": "26ed53d1-3df2-4d68-9013-30c04d452899", "comment": "Malware payload (Dridex)", "value": "14c1d523e1e0a7fad2016534ef731c546f365fe9", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918782, "uuid": "767a929a-bc87-4083-9912-24c1dae27fbe", "comment": "Malware payload (Dridex)", "value": "e111a8b4def4506cd64167a8f62072fbc328ee23d756d3a7cb76142c4ccabd3b41fe566fe0a55312b915c8ea28606460", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918782, "uuid": "68ed1159-9862-4c70-97e8-6ee572775796", "value": "T1F665D162E36871E4C5739A31D07F551F0AB66C2268598205FB723A740D3FAC9FFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918782, "uuid": "755a54f4-5975-4569-ad1e-bce33868d261", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918782, "uuid": "df44b003-c2cc-4228-86b2-e27a4bda7fd5", "value": "12288:xGVNJAvuPFUl/fax0VlBLXKCgFfEK7JRLeHlX//ve7:U3JAvRl/fKyKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918782, "uuid": "2f2a5fde-61f8-4804-a491-81196e366297", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918782, "uuid": "b92ea106-df8c-4b23-8b0a-658c06aca864", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918782, "uuid": "357387d3-98d9-498e-8fa6-482ec4e4e02c", "value": "c595d93c190e487562ee3edb78b351567be676fa2fe73625c3e61985f656e204", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "321d4ce8-4ecd-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637940375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940375, "uuid": "af4a8027-9ab3-417f-b4e7-efcc6af73eaf", "comment": "Malware payload (RedLineStealer)", "value": "69871d866f2358408ecb91a47ca2e3ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940375, "uuid": "80f23180-f295-4ba7-81f4-1733847a4d64", "comment": "Malware payload (RedLineStealer)", "value": "c6ecd36cb35191af35e1bb9f9be0f66c6d1cefe0317dbd55f772719c92e5661b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940375, "uuid": "3d590dd6-fca2-4dd9-b4bb-3228766da65f", "comment": "Malware payload (RedLineStealer)", "value": "1dd76ad455465b5a84571ce61f9086651575c019", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940375, "uuid": "17637c7d-da8b-436e-b47d-f93196b0d18e", "comment": "Malware payload (RedLineStealer)", "value": "76aeb0fda652734635cf328ba94328ad2f75f0f7009632e023d6f260a09ea9c485adf5e9b93c3e38c44a6bfb120a61d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940375, "uuid": "90cd51c9-7444-463d-b2d2-a5c1f2ee13ee", "value": "T161444A5A83258469ED450130DC2ECF777924DCDD2802FBF876D98F7B7812749E8632AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940375, "uuid": "6287b4e3-82e4-4e40-8612-e9c0170fef72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940375, "uuid": "ac36af48-47ff-4733-a0c3-82a27fe69a99", "value": "3072:Vk+Ax1qFu+QgIVfI9pasj8jTJ4A/Jh3o9P2L1Fa5iDZso20/4uJTb2G2lFYaWVb6:TuEEfI9EwwJbxh3o9P2v0ilZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637940375, "uuid": "be579878-1011-4c46-a60f-fb6bef487b52", "value": 269824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637940375, "uuid": "7956bfc9-d936-41ea-9d72-aef37edafe41", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940375, "uuid": "91e539e0-3463-4a24-8a08-54b3640cc690", "value": "69871d866f2358408ecb91a47ca2e3ac.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f7128e7-4eb9-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931835, "uuid": "09b4133b-d518-42bc-ac47-ed7159e68bdc", "comment": "Malware payload (Dridex)", "value": "26cacc389140623e23117d0159e27ce3", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931835, "uuid": "04439cc9-ebc3-445b-ad46-9ddf95ed44d9", "comment": "Malware payload (Dridex)", "value": "c71a44c8689de4a94ccc9fda5a9763f6d2f61b75c2023f21fcfea4df61869646", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931835, "uuid": "6f9f018f-f5e4-48e4-9144-ffaddc991c1e", "comment": "Malware payload (Dridex)", "value": "a039d63157b2b8520abbe5ad7bd71f542edc4abc", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931835, "uuid": "63414fd7-9d13-4c33-9535-dc7a6c38cbeb", "comment": "Malware payload (Dridex)", "value": "15d1d52de656e47af5a1c15eb032566ccc31d132c1d8de3688b60a03564c1e81f2c21a7cf0df885bc00264fe64849dca", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931835, "uuid": "1c516a97-5165-4445-add4-652a6b0c3905", "value": "T17653E02F8616701BC8466D7D0A1D48F4B496B4FCF8C1D91A38A05EA20AF61C7D3EE5B7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931835, "uuid": "b20f6a11-23a6-475b-9f3f-0303cefb441f", "value": "1536:UWiPIbZ853SAJbpJpt+a+5hzBmZYx0PYgdRlK6:VLbC9jt+aOCg0AgdRlp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931835, "uuid": "2f777fda-00ce-40e1-8a6c-74a6dec34106", "value": 62773, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931835, "uuid": "d71a6233-6d42-4dff-9edf-c59bafef5981", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931835, "uuid": "2aedfadb-b65d-465c-9e88-c8e60679f210", "value": "number90791611.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54c62a7b-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918959, "uuid": "9a6b3284-3476-4ea0-aa5f-3140a29806b6", "comment": "Malware payload (Dridex)", "value": "3264df29f9af6fdccad5f6c62793f158", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918959, "uuid": "01ed8393-0e6d-4b9f-a0a9-628e1268cc9b", "comment": "Malware payload (Dridex)", "value": "c80a6055c1607efc5254747e5993f4f505da72a7519104e92f2c32189be5ba3d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918959, "uuid": "743c9e70-3c50-4d26-99ab-e711192d1960", "comment": "Malware payload (Dridex)", "value": "2901853e6dabaee7a82549952a17997caaacb046", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918959, "uuid": "b1959431-97d0-47ea-a1b9-2f72f05c141d", "comment": "Malware payload (Dridex)", "value": "ff51dd42bcf7dd05992c01de4576a6524e42994e6c7d7f9d5a028167f530b41382ee92a6363aed2591c9c2c1ec7aa002", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918959, "uuid": "e747ed45-65af-4d1d-ae1f-51de71231b64", "value": "T19455D162E36471E8C5739631D07F151F0AB66D22685A8205FB723A700D3FAC9FFE9129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918959, "uuid": "94d23942-8a64-42c0-9940-dda25acbc2b3", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918959, "uuid": "8ba77c47-fedf-4598-8f42-30406a175d5b", "value": "12288:OGVNJAvuPFUl/faxuVlBLXKCgFfEK7JRLeHlX//ve7:D3JAvRl/fKIKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918959, "uuid": "6b1938ca-1b29-45e5-bd7e-28df76fae1a2", "value": 1331200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918959, "uuid": "c476a3f7-a5fd-4bdb-ad95-ca904b2a0a2f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918959, "uuid": "b598bee1-84d3-49a8-82a0-97ebd5296b75", "value": "c80a6055c1607efc5254747e5993f4f505da72a7519104e92f2c32189be5ba3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d656ed11-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918746, "uuid": "f934e8c8-6662-420d-a7f0-312e18e16cd4", "comment": "Malware payload (Dridex)", "value": "9b7b23ecfe0f8461fd0d9a7e5e590e31", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918746, "uuid": "cc74f162-9a10-4bad-ac13-e965ceff52f8", "comment": "Malware payload (Dridex)", "value": "c876113220b534ba1da612f3ca0eb30a735548a20e6b70b5bf547bc7ce3e1794", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918746, "uuid": "32a95801-5240-44a8-8a1f-7400c208e18d", "comment": "Malware payload (Dridex)", "value": "616a00949db4ce3fb3e13ddfda0f288ad39d2877", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918746, "uuid": "0bcf9b21-c1ac-4dca-bfd5-0c3b39c8d932", "comment": "Malware payload (Dridex)", "value": "571129bf708a51da89a060fcfdb622a5c3e851b086d2f13b425d4280567cb84c26b3ad10a5a60510097c4597b132e649", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918746, "uuid": "97c636a7-bd08-4907-a84d-6a78d3a21719", "value": "T11B65D162E36871E8C5739A31D03F551F0AB66D2168599205FB723A700D3FBC9BFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918746, "uuid": "56d0c043-fa52-4dcf-91ce-165e4af9db24", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918746, "uuid": "37a55af5-3161-4ade-983e-5842acafec97", "value": "12288:aGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:P3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918746, "uuid": "7a0cff60-174b-4966-ad09-850961ee6126", "value": 1527808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918746, "uuid": "08522f79-c37c-4ba4-ab57-6f4c68f9f887", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918746, "uuid": "32deb623-8948-4194-83a6-7e5e7970caa2", "value": "c876113220b534ba1da612f3ca0eb30a735548a20e6b70b5bf547bc7ce3e1794", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3543d414-4e98-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637917617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917617, "uuid": "1dbd9e3a-3cd0-4015-9365-5300065e1c0c", "comment": "Malware payload (AgentTesla)", "value": "76e32e80d65a6bc604fb19d900846356", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917617, "uuid": "46056b71-0c7e-4a5f-8428-488f7e2f1c2f", "comment": "Malware payload (AgentTesla)", "value": "c9a81188add8b80467da4b6aca7e3dd8d4fa803be5f17d7df90a71c2bfc618f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917617, "uuid": "2d26f632-d688-4a72-86ad-29915f2f9db2", "comment": "Malware payload (AgentTesla)", "value": "dd6d28cbc53fa16aac04f96dae71d49e9435f214", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917617, "uuid": "3bb65289-eba1-4602-ae06-05960a1589ab", "comment": "Malware payload (AgentTesla)", "value": "30a75a0bb8c0820ed2bd60eeb695f676305fd910b58f078f65bdb9f5f770d77fa995b617dd4796cd2a95ee06bc30f596", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917617, "uuid": "2b5b66cc-d47a-4dae-84a1-bdaddfc8c5b8", "value": "T1B094E00FA2B881AFD45845B308B9D07DEF71ACB49C85611733A0BA561FF72260D45AF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917617, "uuid": "0de63f73-71c2-459e-8457-b4af08925aa2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917617, "uuid": "214a283d-28b2-4e00-a3a2-8b38b70c69cd", "value": "6144:TGiNrcL1UHKPjCvlFE5uWXiODJbYxWd+NBgK/aE1q0UY0d9Bzek88o0USVs:ZrjYCvbE5/SuJygKCE1ZUFd7qk88o0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637917617, "uuid": "facd9401-0dcc-482b-bce1-b08273a2ada1", "value": 425765, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637917617, "uuid": "677d9eec-6538-4307-afd4-3edbb4d40b33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917617, "uuid": "2ad32330-e877-4c4e-bdda-8a154053d803", "value": "Urgent Quote1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974cdb9e-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1637954289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954289, "uuid": "813be565-f95b-4942-9aa5-509c3852e200", "comment": "Malware payload (ArkeiStealer)", "value": "d1d54e2b8c751c1093e6a0e0e09b899e", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954289, "uuid": "1067009d-21b7-4211-8704-6e06ac3846b4", "comment": "Malware payload (ArkeiStealer)", "value": "ca5bfe5d1baa1423a43e98ead6e96df99582bace3802be84209cf9afff1c0196", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954289, "uuid": "ffca412e-a3df-4458-8377-93771e7dcb8d", "comment": "Malware payload (ArkeiStealer)", "value": "69ed9c4250fd34db6aee01d973e9b96c21a1bd9b", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954289, "uuid": "4a99e544-f34a-463a-93b6-d7a3f5a3dfa1", "comment": "Malware payload (ArkeiStealer)", "value": "87da3cfd053b4093a76f991cf83f72adfb7c75d6a9a321a49496b177ef6b3b1a152dd5582b654c74f38087147ad5db3e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954289, "uuid": "92931398-5186-4aae-85b5-31c89f80e9c6", "value": "T1E714CF3526D3C4B2D5EB163028B0DBA2DABB7833167184BF33642A2E1D602D549F675F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954289, "uuid": "f2426528-a7b0-4048-861e-5797d8c2b545", "value": "18236996516f1699a9cb95ecb494d7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954289, "uuid": "28f54f2f-53a5-4784-8b5c-aa8ce6534cc6", "value": "3072:E9eShFrMrpqFEM/pGh+oER+i9IBRQl9appCeoWpRFNAXcjruV5Xd2:tYrMgqMxGhTdTQlEphoy2Crg5U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954289, "uuid": "82ee4dd7-32f3-4af4-8b78-17ea09eb94e7", "value": 205824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954289, "uuid": "7e6df275-66ec-422d-ad04-80f2a4ebaa5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954289, "uuid": "80d6b6df-6b16-445f-a250-f1b2eb92dcd6", "value": "d1d54e2b8c751c1093e6a0e0e09b899e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a543a62c-4ef6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637958178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958178, "uuid": "ce5beca5-1fb6-49f8-80d2-27b2c16994fd", "comment": "Malware payload", "value": "b8c90a171f634f9c467207aa9ff790e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958178, "uuid": "89493f1b-37e1-44dd-91b4-9e941e8c07ec", "comment": "Malware payload", "value": "cb0587a25b111fc641b0dd0ecb4f7577fc65480b6a6f2aee951022bb87423633", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958178, "uuid": "7d16107e-5e86-430b-a34e-8645d7921e4c", "comment": "Malware payload", "value": "0cf46366e883992f8c0f6823fa85ca7aa22ad59d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958178, "uuid": "ebb66173-a6cd-4688-ae9d-ab2930e82535", "comment": "Malware payload", "value": "06a3565b5e11baf9f127a0fff52bd9308e42907bdf54b24eec4401cf8349b2f125572e04ba341582ff2dab57a5020b76", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958178, "uuid": "6bcfbe79-7c87-40c9-95d1-c8a127ccc2fc", "value": "T16AE4AE1277C1C076D5AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958178, "uuid": "610ae4f4-c3bc-4a47-9372-d6594e783769", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958178, "uuid": "29aed7aa-d648-46b4-a75a-f9cef6b4b24f", "value": "12288:WKEUkuAOLka1miSmuYr1V7aAobS3qTHPR101D:TEQLka1nBVmAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637958178, "uuid": "067eb060-9ff5-4ae0-b24a-ed6a6a9f48ad", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637958178, "uuid": "9e133f29-43dc-4878-834d-c98864a5b5a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958178, "uuid": "6f2bdf76-05d2-4581-a643-ca65216383c7", "value": "b8c90a171f634f9c467207aa9ff790e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0dfe800-4e55-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637889021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637889021, "uuid": "0b9b269c-3a3e-4832-98a4-42ecda089147", "comment": "Malware payload", "value": "e242147950443efea04c965cbf65f533", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637889021, "uuid": "c3775ea5-0354-467c-89b8-b7b1729cd1dd", "comment": "Malware payload", "value": "cb4762a4b947de25150efdc53c9ed03e6ee66ad18f2c686af4f70c9a5de00e7f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637889021, "uuid": "4090f4d6-e8a9-4ff7-a851-4c12c3bd5563", "comment": "Malware payload", "value": "cf1c6ef4cb070cc6365b0afe6e79be02796e3e01", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637889021, "uuid": "ac488e04-628c-430d-928e-83ccbe51f0d1", "comment": "Malware payload", "value": "03063ccf5cf953ad04a0fb6bc4dfc6791879048311147e603688e4bd4b531b809a778f2e1645a3a0408d1137b22b0003", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637889021, "uuid": "3828a685-9795-4cc7-a121-14b1bb3faf74", "value": "T11BB4BE20BAD28072E1BF2934766493651AADBD305FB1C6DF73985A7E4F740C1463CA2B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637889021, "uuid": "a6453274-5559-4589-a9ab-63c114e8a6d9", "value": "6144:AJ9Lf/vAlRkVQVdQqoG1NBmbvD8gvSaX5EAoiAO0X1Ab8JOKXDebPG0+Z0C4OGU0:smVdIG1Gf8QlwiaMYe6DZrzGyWA1p", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637889021, "uuid": "ce022c4c-37db-4e5d-82d9-6bb537905c17", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637889021, "uuid": "462c197a-a867-42cb-ad7b-c2036499058c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637889021, "uuid": "a2540863-f712-4b96-a5ae-ac02bb04d987", "value": "emotet_exe_e5_f424434e48eef51f4725bdf61139fce7c6eb9d5d2d75b456c9fde25b687af02c_2021-11-26__011015.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d68e5c0-4ef3-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637956715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956715, "uuid": "24d3fb5e-7eb8-4ed1-ad29-3d65c240f3cb", "comment": "Malware payload", "value": "826ee7fb2a01664b3de92d65e2329d3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956715, "uuid": "614ff0ad-97b7-42ee-a087-8941ebc40d91", "comment": "Malware payload", "value": "cbd830c745bbec26733214798fe144c61ef4bac342c853f8a08b682077b2178b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956715, "uuid": "8e98d2fe-1528-40a8-94d2-8c689c9f6683", "comment": "Malware payload", "value": "82f146d6542a0b2741c5b750bc6ed1675358c7fe", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956715, "uuid": "e0e7d75e-8597-4ef5-a094-3b6f62798aa8", "comment": "Malware payload", "value": "5b08c48d5ddc1b0d04183b9eb265a9a9edb165bc117763fc6349580945bf1569b52dcbf3a7b3d3ff6645f5b7a864e2d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956715, "uuid": "50ea4d72-61a5-4a7e-b05e-648fe094b72b", "value": "T17A34CF1736E450BBE8379678C4934A06E77678205360AAEF03A4473A5F277D19C3AF78", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956715, "uuid": "a59e610c-dfff-4eb1-8d31-e05a80cb61ef", "value": "b01abbf9bba0f1daf3b4d5629e6a666e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956715, "uuid": "c6ebe5e4-f75a-4ad7-8c66-57e36f0d177d", "value": "6144:46biUu1hG08YR8dt5/XOqHYNJJ1uK4vzYp2:46bM/R8V7HYTJMK480", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637956715, "uuid": "c77a6ccd-40b7-473a-ad70-f70bf0d1b592", "value": 249344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637956715, "uuid": "4ce41cb3-93e6-4844-a95c-234965373482", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956715, "uuid": "626e57fd-b32b-43b4-8308-626fb09d41f4", "value": "826ee7fb2a01664b3de92d65e2329d3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3468287f-4ec0-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637934796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934796, "uuid": "dd4aea24-22e0-4280-a0bc-0db8e43da92f", "comment": "Malware payload (RaccoonStealer)", "value": "bf6941f34e9e72e97258e086580f1bc1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934796, "uuid": "f508279f-cb02-4509-931a-b29e1b16b42a", "comment": "Malware payload (RaccoonStealer)", "value": "cc3637883e09b5efbdd1b94b3485967781f26cce87a612c7a01d40163dd94063", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934796, "uuid": "b4f18746-b387-4972-92b8-7c5b8e9700a2", "comment": "Malware payload (RaccoonStealer)", "value": "08ebb10ee66a4f03c16b20cb5c00ee0bad4b6c12", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934796, "uuid": "242494e1-99e4-4c12-8081-f722aac0a551", "comment": "Malware payload (RaccoonStealer)", "value": "d2c1da8e97c7a72d9f9a121524618a483d0368e4c882a372781e6834f3429b9fbd803a54b55e7bcb32c8a8796adf55e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934796, "uuid": "3fecc922-aa63-40b7-afd5-c971ae8245e6", "value": "T11DA54B18697FE01960F3FE916EDCA8FADADE55D3240D743B106163274B22B81DE8B439", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934796, "uuid": "b9be3174-4f10-4424-aab4-e91a083c2dab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934796, "uuid": "099be8c9-6696-4d9c-91fc-00140171c408", "value": "24576:d5qI2dcLbugVEIkVWo2DizDiUpnNzzme/TxO5jg4V6lxHWFsR3CrsPzQ+Z5Rqwb9:d5krymjR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637934796, "uuid": "5eada76f-2ae6-4665-b449-5c2f992db728", "value": 2088960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637934796, "uuid": "cb69b450-2cb9-4ac4-9822-07a93d853079", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934796, "uuid": "00fa6781-d3cf-4f5f-827b-9259fb5cee76", "value": "file5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1fa0320-4ee3-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637950012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950012, "uuid": "d83e1072-d096-4a7f-a493-73b70c2a02f2", "comment": "Malware payload (NanoCore)", "value": "85d3f14e14d181e4511e5f728acd68c9", "object_relation": "md5", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950012, "uuid": "cb875ff8-70b0-4f1b-bc7d-42f89978fddf", "comment": "Malware payload (NanoCore)", "value": "cd7acf9861bddf2014d101e6f3492745f4734ab55c6f13a65a09566f41e40792", "object_relation": "sha256", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950012, "uuid": "4f608220-f784-4123-8ff0-60af6bf02aa0", "comment": "Malware payload (NanoCore)", "value": "040db81b95a522453622c838c63627d18129890b", "object_relation": "sha1", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950012, "uuid": "7a45cef9-f64b-41e9-8832-f7f3bd52f0dc", "comment": "Malware payload (NanoCore)", "value": "88ba644c71d215ef9e7c5685a10f01211b324b44124e9ec559384f418911eb0d799741564caa8cad4d28430e972516e3", "object_relation": "sha3-384", "Tag": [ { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950012, "uuid": "9001be02-6dc2-4b53-a925-e9fb1e54bed3", "value": "T13A31BD3DFE2765860D31E82D936A5EE3CCAC4407CF70E531519943895672879299C07F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950012, "uuid": "4efe8f1b-ec37-46c6-b931-8d332dab63fb", "value": "24:p4OtGAKvzjepfMWPnENAiOASMVQ6xV3cJeWB23LV7ANAtGApaAdZJA4yoQNAx4hZ:egG/vWpMXaiOALxsJDIZ48Gdq9ce4hfB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637950012, "uuid": "58061a2a-4fda-4619-8aff-7001a5c39a15", "value": 1510, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637950012, "uuid": "10f62d63-24a2-42b5-8430-02575145ee56", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950012, "uuid": "3e219f2b-ef41-4af1-bba0-be765a816da9", "value": "947165_Payment_Receipt.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0aa188a8-4e98-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637917546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917546, "uuid": "8199f5ed-479b-413a-864c-61c25672d154", "comment": "Malware payload (RaccoonStealer)", "value": "ad89adac856584fa4a281f47b330b2a9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917546, "uuid": "bb6ee31a-dec8-4d91-94ae-a2fbdfd13734", "comment": "Malware payload (RaccoonStealer)", "value": "cdb1bd296b106f2910eea357f82cf8b58f9b2e96a0ade88e4917db74fc988573", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917546, "uuid": "093d15f1-af7d-4c4f-8c25-96d9e6ff7de1", "comment": "Malware payload (RaccoonStealer)", "value": "bfb901a6c7b1ed76ea8d48b2fa91243c72dcb3c2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637917546, "uuid": "aa036e80-5e5c-4786-b8ab-741355ec3633", "comment": "Malware payload (RaccoonStealer)", "value": "2221928d806355d9459e86aee6b011ea019d878b0df69ef82513bd934637b7fff9b4494afcee989d78d08970d92c2dc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917546, "uuid": "04be79af-c425-4e5b-9f08-1f33fcd5f45f", "value": "T1B9E3AD3032D0C436D7A7E53168B4DAA11E3AB8726675824F6798123F2E703E14EB575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917546, "uuid": "248370da-6e50-4093-bd09-80edd0c160f3", "value": "a967f53cbb69a203dbf386eac93050cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917546, "uuid": "a9c64b8c-6be3-411d-bb49-8f40a49a91e6", "value": "3072:ez+eEnTqCrEAYGF4CY8fCsalanT0swlcxq2:OsTEAYGF4C76skcKcxV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637917546, "uuid": "681a7813-8042-49d7-886a-4641c3f7c566", "value": 150016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637917546, "uuid": "54038eaa-4f1c-430a-b351-459f2bc0f807", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637917546, "uuid": "80208fb7-005f-4b6f-b8c6-b7f5de08c6b5", "value": "ad89adac856584fa4a281f47b330b2a9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de66580d-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918760, "uuid": "997eb8c3-f637-45e8-98b3-f0a25dbfa5a6", "comment": "Malware payload (Dridex)", "value": "4244b84797b11f3485b889d9892fae56", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918760, "uuid": "4b01b185-4517-4218-9865-b24337e2563a", "comment": "Malware payload (Dridex)", "value": "cdcc3f2dd3e431f823c0401af294f897f0a837610642447b58c772d38a0fb805", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918760, "uuid": "963dd742-32b3-4cfb-b4a4-f2017e8ae9ca", "comment": "Malware payload (Dridex)", "value": "b81d43676dfa6e9b09edcbee6cb2817a557d4a6b", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918760, "uuid": "4220389e-ac04-442a-9035-029f5e80d77a", "comment": "Malware payload (Dridex)", "value": "458d208c8ca93df33f294e4d2e7eb4a7b6fcfb66384c839fd75f38d2d23af08c8d0cf10af22b89e98b746d04fe5c9d50", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918760, "uuid": "aa56c0a2-0447-4003-8e17-2da42564ecb5", "value": "T10A65E102FF9963E6D9502DF695F0F2A3C9F0F6858C281229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918760, "uuid": "b789d50e-65c1-44c4-8ca4-4f538091f65e", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918760, "uuid": "628796d1-4316-4407-ba28-650382d9d58e", "value": "12288:vZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:vZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918760, "uuid": "e24655c2-bf52-4258-a08d-192a5d61f21e", "value": 1462272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918760, "uuid": "6897b88d-644c-4122-9f34-99f82f1133a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918760, "uuid": "1b6aadb5-5a62-4c4f-a30c-1699444f893d", "value": "cdcc3f2dd3e431f823c0401af294f897f0a837610642447b58c772d38a0fb805", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad75ecf4-4ee5-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1637950890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950890, "uuid": "d50252eb-8bce-4067-a5c9-b118654bb612", "comment": "Malware payload (BitRAT)", "value": "e6ae3c5fb255854c979b90697b243afc", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950890, "uuid": "e478674a-2987-4600-b566-8ddd8d1bb934", "comment": "Malware payload (BitRAT)", "value": "cdd87d57a250721a6269d8b12b09657a2f5258dbdbdba1cc35dc0866dd99b647", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950890, "uuid": "d5e8a068-311c-456c-aefe-f73d7dfead06", "comment": "Malware payload (BitRAT)", "value": "731cabf179e2991bfc55d737ab08e471c44c0a45", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950890, "uuid": "b3c1c92c-ae22-4301-a03d-da778100096a", "comment": "Malware payload (BitRAT)", "value": "6f93eb8b0210d9e317ac5980c45acdb110ef2db396fc944a0a979e05f43df50bfc27ab099410f55d8a444aac1ba27f8e", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950890, "uuid": "b369b6d6-324d-49a0-9fa1-756f7a5eaa62", "value": "T1F384029172767F16F6B947F60868728447F1322E29A1E31C4EC5A0CF58B5F082B56F2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950890, "uuid": "adf26bb0-ae81-4826-a06f-3d9715fc1cb4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950890, "uuid": "74bdc5a5-85c0-4954-aeee-38b7c99a13ed", "value": "6144:Kkj4V5sbil6s/gA5gC370nJwdxoF8beCWBMAXjjgKhJ6fwLnAHQO4rdtLVw2uL2i:Kkj4Iil6s4A5gm70JwjoF8b9WBMAz8aO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637950890, "uuid": "65c41f66-f2be-46a4-8b1a-c1ad1dafdcf4", "value": 375808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637950890, "uuid": "26899fac-a5da-496e-98b3-d66cba6f3928", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950890, "uuid": "08d0b301-0271-4568-b01a-7719634b08c4", "value": "Better_1602_dXwRYX.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "341a0977-4eff-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637961853, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961853, "uuid": "f28cc5de-ff48-4d5a-bb29-d936d33ebf33", "comment": "Malware payload", "value": "91e182f1f8bb856a604bcf4b2b646aea", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961853, "uuid": "9183ad58-dd47-4ae9-ac58-b4baec42fefc", "comment": "Malware payload", "value": "cee3ea84c830c09cd2728fda6a2088d23ee49a298d2001a1e30a8e24277ea6f1", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961853, "uuid": "c2c5d58b-b5c6-4a83-ad36-aac933f878b4", "comment": "Malware payload", "value": "002630e1201464e1d915ed22f8857a518f7f096f", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961853, "uuid": "d0e43521-dd61-4da6-bf34-1dcd126fac01", "comment": "Malware payload", "value": "6474abc92b68e3951857ced0d3a1d98242beb2d4ad2ae326d94c5e59dd5fc3a32bb65ca2fbe8cf76b6cd47109b27bc5c", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961853, "uuid": "3fbf30a5-cb40-4cb8-8b7c-87e681cec58a", "value": "T1EF96AFA2BA05B2EFD06F06359427CE12CA3E63F406114D43E9A8787DDE73D8125CBE59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961853, "uuid": "9bfa89bd-83db-44b1-a06b-4e8407f80c68", "value": "98304:rYceCA5dKS9F4MtgFXCXvTl4kGkTGo6jiYYZEg7aS7HEOFp9MnGoKH0U:2US9SM6H/gN7kOfMnGoK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637961853, "uuid": "23634c73-e1a0-45d1-86f3-a015a7db4640", "value": 8697856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637961853, "uuid": "66d2af27-8723-40e1-a9f4-1d638fda9fea", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961853, "uuid": "2436d4a5-399b-4d56-9197-d65f85ffa1ab", "value": "048-16.VRB.VA.io.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ec02a71-4e5a-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637890978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890978, "uuid": "822561b7-b6a6-4ee5-ba1f-73b9468ec72b", "comment": "Malware payload (Heodo)", "value": "44a81856e41ad09684c409ae24fd6c4b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890978, "uuid": "72681ff5-24b0-46e1-8ebf-ef1d0829be4d", "comment": "Malware payload (Heodo)", "value": "cf7de8da620c828fe6378b2e7b6b0da15cd3b6b43c0cdfba4bb8f38dea72c878", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890978, "uuid": "6b0c9609-bd03-4092-a964-b403f4ea590f", "comment": "Malware payload (Heodo)", "value": "aaf2c73423cb129dfbcc0ca196507fb4a8cad7b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637890978, "uuid": "861cfdaf-2800-4a3c-8114-edc0cdc8d5c4", "comment": "Malware payload (Heodo)", "value": "0ff8d34a8a7dd6258c98d35811492b98faac0d2b98a9dfca51b564de62f66178e0b79efd25d8d397d6cd25d943dd726d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890978, "uuid": "10e3ab36-e94c-4c1a-a6b2-6e1cb6882247", "value": "T16CB4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890978, "uuid": "b27ffb81-82ed-40ad-a895-b09655cba8e7", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890978, "uuid": "210ae94c-96a9-448a-b7fe-c0e796ec2170", "value": "12288:smVdIG2GDNBtIlD987snIrkZW+mw3ffEPy:sm4GDNBtIl6wTZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637890978, "uuid": "0aba61d9-8272-49d0-ad5e-6f748b971e9e", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637890978, "uuid": "e3c8daf2-fbe8-4c9d-8209-a8896f0f5068", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637890978, "uuid": "5b8068a2-a3e9-4f74-aca9-edb7762b4b99", "value": "44a81856e41ad09684c409ae24fd6c4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26f66175-4e65-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637895689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895689, "uuid": "13a4fb02-35ee-4e2e-9da6-6a4b92e0ff2d", "comment": "Malware payload (Loki)", "value": "77c2fd5cc06a1a31c092f864f795f1a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895689, "uuid": "5546a51c-558e-4e8e-bfdf-818247830a29", "comment": "Malware payload (Loki)", "value": "d08c28ba95419438a1bcbbfb7ed6ed7729004be5106bd8a42920387974afeda5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895689, "uuid": "43e5378f-6fcf-446a-95fe-a767e448e5e9", "comment": "Malware payload (Loki)", "value": "c38e8ec89777f5e7ea7c24f55547b73f4aee2acd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895689, "uuid": "b67e5c11-b7f9-4a25-a016-4ecf24a8ebf6", "comment": "Malware payload (Loki)", "value": "adce6ea538befdc94d4c645a8c09ac8e4424cd7f018b53dc82c9661f077d0b0c4115666501f6217c658f51ea70f5e953", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895689, "uuid": "a58f850b-0ff6-4bd2-817c-8d94a0d8c35d", "value": "T1FC64122BDAD7853FCAD105731171DAFCF3FD9268419A2A0B1F747B2B386285B4E48261", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895689, "uuid": "be00851c-12a9-43c7-8e48-38dc07ea9dce", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895689, "uuid": "7ebf906c-0613-48de-a4a2-46118f0d6015", "value": "6144:rGiawOxLS+lpjQlw94adtCDM165FsdDfD9ECk27B0dN3Vztk9euNXeT6fH:qzQlwvgM65PvlztoXee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637895689, "uuid": "7e935191-a512-4d75-9a18-d5d7e97ef893", "value": 311825, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637895689, "uuid": "1f0a3a95-967c-4e81-941e-43939ef9a3ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895689, "uuid": "250f6960-7a55-44db-80a1-81e754115fed", "value": "77c2fd5cc06a1a31c092f864f795f1a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef03a97-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637921606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921606, "uuid": "77ec3724-cbba-424b-868c-2d1279f7b154", "comment": "Malware payload (NanoCore)", "value": "65622437250f01b7e88aaa34a109dfb8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921606, "uuid": "696f3f49-2586-470a-b775-1d046d2416e6", "comment": "Malware payload (NanoCore)", "value": "d0f77eb32066c49a1a819784c848168a05408c1fa2d5018ab73c9d8e9faec410", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921606, "uuid": "c9a29723-2bde-40f4-bc9e-31b4b5a0a99d", "comment": "Malware payload (NanoCore)", "value": "9645d4b32ce8e735d55232742e07720ee6780851", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921606, "uuid": "84eea075-8ad9-4768-a206-cffdd0c03a31", "comment": "Malware payload (NanoCore)", "value": "d5ef60e9d0a020b1b7b0acfd3430ede0369d87bd58ae8f292d659c156902adcb448023b35df0677a655580ec6798f07c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921606, "uuid": "1ace42b9-b372-47be-9d07-036ce1b28b3c", "value": "T1D6D4E04632646BE6E13C47B7BE53981C57E22CF8AA20D2886EC3F2DB1571B514E50E73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921606, "uuid": "8022a280-4690-4ab6-ab4d-077d9726116f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921606, "uuid": "061b0368-ffa7-4773-bf81-dcf7b327909f", "value": "12288:MoLNixBFmhzzBb5aWf5jCulh+Vw2NY6TtCBRPqAcyZ6IOoFOom0:l5i1qHBNaWfdq9tCBRPcyZPFOG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921606, "uuid": "4f6f31b1-ec34-4e3f-8309-8a348c954fc6", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921606, "uuid": "5ba83131-232e-4984-ba3c-5af983c4b3b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921606, "uuid": "db219a36-df49-4b66-8cf8-4aa765a3113f", "value": "dhlDocument .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef065309-4eec-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637954007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954007, "uuid": "6064983e-0079-4d6d-b6ce-11452cbb952e", "comment": "Malware payload (RedLineStealer)", "value": "adc7b15cfce4048bf6a49cec43a068cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954007, "uuid": "2984cf92-0d13-415c-a213-7f1d8514bfef", "comment": "Malware payload (RedLineStealer)", "value": "d1439d1a3c8bd8495a07ea2d22e4480b7cd837deb3b6c5576e98592de7f67996", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954007, "uuid": "cf99179d-c710-421b-be3f-4f3786295e23", "comment": "Malware payload (RedLineStealer)", "value": "0d6b9ecc51d132d3421956022bff8df83c6849dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954007, "uuid": "e172f87e-3bcc-4ca1-b1aa-3085ce25485f", "comment": "Malware payload (RedLineStealer)", "value": "fe3f6fa142a51d4dbe271dcf2f48f3e4a223be13839fbe48b2a9d92ce9b0c0b03301a4e8dd3b238507012e5a726d0973", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954007, "uuid": "c3bdc410-0bca-456a-8378-81273583f241", "value": "T1DAC4121162F29432D1A621B12970DE692FF6BC765631459F2734232F5FA03F08FA6367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954007, "uuid": "c04e8c97-3916-4bbd-ab3c-77615dc6a20e", "value": "0870c1337a760ee1593b3bf581332ebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954007, "uuid": "436ff4ca-6ff4-4c83-b5f7-083fb1703935", "value": "12288:Arccx7l+ib/5ggaaBKmc5V6hzGXauaHIss5MbiPvBlnCFDZZ/Ae:ALx5+i/qNAfU6hJVHNSMbY9axAe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954007, "uuid": "895ab06c-b7f2-4e85-bccf-7bd49f52ef19", "value": 568832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954007, "uuid": "3c53ea99-ec7d-4c43-a597-2dca479b4d40", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954007, "uuid": "e8f93813-37ec-48f8-9ee7-a6c8a933eeb5", "value": "adc7b15cfce4048bf6a49cec43a068cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0b1b2e0-4ecc-11ec-843c-42010a9c0014", "comment": "Malware payload (BitRAT)", "timestamp": 1637940131, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940131, "uuid": "a24b6640-4e87-4a56-8716-3db583bd75a8", "comment": "Malware payload (BitRAT)", "value": "0259717b22ffb17a126ba877aa77e0d1", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940131, "uuid": "98610b2e-2966-467f-b23e-8a987263b183", "comment": "Malware payload (BitRAT)", "value": "d18dcc2a03d5536abb7bb6cc1704bcf268534b02fac3563a3c4ea771901b9254", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940131, "uuid": "8a81f758-aa4f-45b3-aa5d-811c0285ef48", "comment": "Malware payload (BitRAT)", "value": "1ed1802de56b4483a624ce5a07e74d922313f84b", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637940131, "uuid": "f5decfb5-5a41-41a8-a410-ddbbefe97dd9", "comment": "Malware payload (BitRAT)", "value": "a6d844eccc862e4045bf595953697dd1ccb36b1468c7a7b7ec29f929dde9cf5295e82abb9d118682dcc1a0378ea3ab75", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940131, "uuid": "ec79dab3-5db6-45ea-a83c-585cc539693c", "value": "T1FF06CF02FA46C562D2170230E96E77BE053CF9354B2085C3B3946E6859B66D17A3BF3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940131, "uuid": "af3e45e1-ec0e-41ee-a42c-bd788165bda1", "value": "71955ccbbcbb24efa9f89785e7cce225", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940131, "uuid": "14d44f59-d91a-4a95-b4e5-843f5b2aa0a4", "value": "98304:877Pmq33rE/JDLPWZADUGer7B6iY74M/FmlwXVZaFB:K+R/eZADUXR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637940131, "uuid": "afd32682-ce8b-4ed6-a3a7-3e77b72b11ca", "value": 3943424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637940131, "uuid": "5cad2047-4c94-4e16-974d-d694545c8809", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637940131, "uuid": "f613cc29-a1e5-4fde-be18-8a137426b670", "value": "D18DCC2A03D5536ABB7BB6CC1704BCF268534B02FAC35.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "091d255a-4e6c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637898645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637898645, "uuid": "06113546-8aff-42bd-917e-62fdfde91eed", "comment": "Malware payload (Heodo)", "value": "919b93598a51a811b9d565ccefa51c7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637898645, "uuid": "5cfcb27e-719b-4dd4-9d33-1942ee92b702", "comment": "Malware payload (Heodo)", "value": "d1d856d66eb31a1d7a687acae102721c1c4f26b0ca4a0c7ff5007646ff23c865", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637898645, "uuid": "0b3cd538-de90-46d2-a738-63a7d30a3bbc", "comment": "Malware payload (Heodo)", "value": "cf45d09c0dc4336c675ae01fb57203ae3be49171", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637898645, "uuid": "0335174a-cee4-46c3-b69e-4d27316288fb", "comment": "Malware payload (Heodo)", "value": "ca0aff666bb2a63546d45bb2ae71832d7f50dacb7577d66c19bb0cdb4380eb07f2faf516872b37babee216de3fc636c7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637898645, "uuid": "ac08fa93-8917-4264-b673-81a8d3c0d085", "value": "T1BCB4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637898645, "uuid": "b2e51479-5a8b-46f3-b940-c26f0d4ecbb6", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637898645, "uuid": "d2615715-908e-4a03-aef4-3c1692a5172d", "value": "12288:smVdIG2GDNBtIlD987snZrkZW+mw3ffEPy:sm4GDNBtIl6wKZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637898645, "uuid": "9e05e203-8fc3-4b7a-a1d5-8b25a8e33999", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637898645, "uuid": "6dbefcc1-c77f-495d-ae23-3b4e64dcb660", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637898645, "uuid": "e7e0ac15-3e5e-49e9-aa69-67629b639a2e", "value": "919b93598a51a811b9d565ccefa51c7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0e8faa-4eb8-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637931534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931534, "uuid": "c1e9a006-4d39-4160-9937-3a5d33d83175", "comment": "Malware payload (AgentTesla)", "value": "91cc0ff644d0d1952205ee281c4f2363", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931534, "uuid": "8dc5cc1d-9922-4528-9507-f46ef1350231", "comment": "Malware payload (AgentTesla)", "value": "d22002d420de48f363db1b02edc655a1dca0b35165bba3129f1133e860ffb959", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931534, "uuid": "0c000c42-ff4d-45a7-ab5c-d287cd09538f", "comment": "Malware payload (AgentTesla)", "value": "d90c64880c24c0544ff99bd7bae173d741c8cf81", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931534, "uuid": "6c5ed4dd-b593-4ddd-aafc-751e2d025cdc", "comment": "Malware payload (AgentTesla)", "value": "327306c30892023d83a4c3d13c30335bf181e4ba4da82747c531b315998485b05e4d0e44289ecb616f3543a59e60837b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931534, "uuid": "cb9700ed-7c43-4202-a9b5-0cbd7604d9b6", "value": "T15A34127DB0DAF716D2D3DFBC45AE8F226E18EE55CA382ED164033A1B153D822960097D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931534, "uuid": "354ce492-eca8-4415-a816-4be17b4cb98c", "value": "6144:7IaSqIg3skSGyfwDIwZFNue81wfj7DSme:f8VkSGyfWI8FNue86XDSme", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931534, "uuid": "624d42b9-b6eb-41e1-8c54-a7d4e30b48b8", "value": 234360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931534, "uuid": "81a12c8a-ceae-41e8-92f2-c89b7771e0d2", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931534, "uuid": "ab51478c-12aa-47ba-a3fb-f1ac77f6a52a", "value": "20211118 CIRCULAR ANULACION CUENTA BANCARIA BANKIA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7cd1a2e-4ebe-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637934211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934211, "uuid": "19f19d60-82f6-4b4f-ae55-61f5b02662eb", "comment": "Malware payload (Heodo)", "value": "f4cfb05ada9a208b8fadec1417b1c24c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934211, "uuid": "181716b8-5780-40a4-94ae-8bd01bd76a06", "comment": "Malware payload (Heodo)", "value": "d336877ca043946b3731e93d587f5dfa7263a7b364d1c4efcdee7a8d0322b914", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934211, "uuid": "70576e19-68a7-4665-aab5-a34f34762397", "comment": "Malware payload (Heodo)", "value": "6f03a37d2adcaa4ed1ca57d306c76a39fc0d953f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934211, "uuid": "f5df9e03-561d-420f-8c91-724b20267c93", "comment": "Malware payload (Heodo)", "value": "d1bb4a78b636103427f803517cce510435b698dad696b325e2d771478e4a04a79eeb143e221816c1001fedd4b8e981f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934211, "uuid": "f22e3a22-cdd5-406a-8e00-141251f85256", "value": "T112A4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934211, "uuid": "afcf2c70-06ec-444e-8389-f4668761c4cc", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934211, "uuid": "052d0fa2-b0de-4033-ae44-bb2516d87a42", "value": "12288:o4xZ0/tI1BD2LETv0FhHO9U6W8XUDaBN7a1vt:oED2LETvMBb6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637934211, "uuid": "6d14a629-2f46-48ac-afc6-5c053007c9df", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637934211, "uuid": "fed1548e-fed6-4e60-9e0f-7dff1a226b36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934211, "uuid": "88dbc557-eb8c-46c1-b348-9afbeffda80c", "value": "f4cfb05ada9a208b8fadec1417b1c24c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3149c48d-4ec0-11ec-843c-42010a9c0014", "comment": "Malware payload (HawkEye)", "timestamp": 1637934790, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934790, "uuid": "dd3eb683-bb48-4ef9-953d-6645cc1e2596", "comment": "Malware payload (HawkEye)", "value": "1d368d5b842ebf13854b951a72ecf7dd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934790, "uuid": "c19b46ec-be0b-4659-a1bc-155ac461f6a4", "comment": "Malware payload (HawkEye)", "value": "d41295c513c151fa5a6a0afd777b1f6cd7d8b7c94af994e22d76f6c7b402f796", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934790, "uuid": "94325586-8562-49dc-9c36-f2e77ba91467", "comment": "Malware payload (HawkEye)", "value": "9aecf5f83a446d660c72a2d7790888d7c5ebdea4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934790, "uuid": "d55a755a-ba33-46ce-8f7b-2635ae695ab2", "comment": "Malware payload (HawkEye)", "value": "8fa9a94b52e5b441fe22a3c2851fc0cf04fe3949af7cd8b180ed51b8c5f0e40059803cdd64dd8c2d4ea8219d29e46c08", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "HawkEye", "colour": "#E7159A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934790, "uuid": "ae05a9ab-f2d1-4042-9acc-c0c63526d687", "value": "T10C23820227E64114F1B64A35AD76C2300B37BD59AE32C62E15CCAD8F3BB7B144D92B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934790, "uuid": "b0f7d645-8c9c-495f-a520-dda50f72f9dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934790, "uuid": "5fc44d83-4314-420a-ba7e-a8bf8648759a", "value": "384:gA6V/KaqKsWMCaeSCzhihc51rcj5Us6vCIXYQPhYVDrgHa/Dw1Im7HPxGZ7XSj9h:gTHzM1Qhihc51f2Kwk1IGpG89yW4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637934790, "uuid": "c6f7b601-ff82-4ec6-9b50-62b6ea8c1ddc", "value": 49920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637934790, "uuid": "9a4896e3-49b2-408f-9399-042c5a58f718", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934790, "uuid": "063ace4c-9a28-472b-907b-17ac5b825715", "value": "d4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd41b417-4ea8-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637924744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637924744, "uuid": "26221138-e044-4b00-a2e7-9e18e7bc015a", "comment": "Malware payload (Heodo)", "value": "9374fae36e1155302b1928bb0ac0aa9a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637924744, "uuid": "c34e2861-f6ff-4655-ba26-42f3d1359bf7", "comment": "Malware payload (Heodo)", "value": "d41c5a81a036d77492c512f1b57ba9945824d09e1deec53ad7e8e588fd7872aa", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637924744, "uuid": "dbd72761-aed3-4f85-8ae9-e933998bc454", "comment": "Malware payload (Heodo)", "value": "9353c9314de8cd402ba521524eb5a50ca56f956a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637924744, "uuid": "f5b39047-9f27-44b0-b4b1-a22cacff4a0b", "comment": "Malware payload (Heodo)", "value": "1ce767d454a9c1979918adddbe89c66b966d5a8a87b520d000cc8e2037fbe9cb937b2499390cfa0042ce12b06aa7dca5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637924744, "uuid": "ade443e8-71cc-4219-bfec-8ee49fa94ffb", "value": "T15103BE1EC251F9ECD23AD93A81D849A5521E2E105042B94D2580B58CEF7B2FF6BDF358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637924744, "uuid": "be6ad4ea-0d0e-4fd4-8813-013a0cd93aee", "value": "768:+/I83GhApRrjevZCwVIYgBZVWpf/wak8y0VItKF:+nKAbIIjkpw78XVIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637924744, "uuid": "ed67c398-997e-48ab-b2d4-282e1218620c", "value": 37994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637924744, "uuid": "e7841e3e-7f6c-4b79-8085-b40247a76e19", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637924744, "uuid": "7aab35d3-ebfe-4677-b45a-ebfdbbdfdb66", "value": "Invoice.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4433cdb-4ee2-11ec-843c-42010a9c0014", "comment": "Malware payload (Smoke Loader)", "timestamp": 1637949586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949586, "uuid": "44a14f72-01e2-44a4-a0f3-8f41f1ce2b69", "comment": "Malware payload (Smoke Loader)", "value": "e6b7aeb49d9a94ed964391b0911cd087", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949586, "uuid": "fbf42e9f-d224-4f42-ab41-f4b1ff4c0ff6", "comment": "Malware payload (Smoke Loader)", "value": "d442c03b863c57f28018cf27bdbb0397a395cc1fb7a27bd2f76cb01ac2bdb233", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949586, "uuid": "c004b7aa-8ad4-46ba-86c7-084e0c84e58f", "comment": "Malware payload (Smoke Loader)", "value": "380a26ef3083d19702d8e1df60f81f2a9dc942df", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637949586, "uuid": "522e184a-f85a-479f-a927-01ed04948d75", "comment": "Malware payload (Smoke Loader)", "value": "aee12a19d8f40687f1fd554177d923e514c84be3b2a9564debb0a85bf172eacb1e5ef31251da9f37164329b2f8e9fb8e", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949586, "uuid": "1cde0b69-2102-4070-be6e-94f95a05c5fd", "value": "T1CBF3AE5133E2CC72E5E7763164749FA15A3BB833E631418B37A4162E6EB02D08EB9357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949586, "uuid": "7df7871a-a9d0-4ff0-818e-188a59516411", "value": "18236996516f1699a9cb95ecb494d7df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949586, "uuid": "f1e0c5cd-eb5e-4b53-8413-f871069b55d6", "value": "3072:Pwelg0QDCXSaioJ7JCC0+zyDpBAXXW/3ALc6d2:JOr0SaiKs+8pqQALcX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637949586, "uuid": "572cdc0b-aa17-4d74-8cc8-d3ef6eccc753", "value": 159232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637949586, "uuid": "d8a8854c-e00f-4fc1-bae8-1f2c00adb47b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637949586, "uuid": "74de2b8f-763e-4a62-b2e5-71ff3b05a381", "value": "e6b7aeb49d9a94ed964391b0911cd087.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380c6657-4eff-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637961860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961860, "uuid": "84d4e362-d51e-43dc-b24d-7afd7f79460e", "comment": "Malware payload", "value": "f1c1d03c18d4de26c255c0dd29ee3484", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961860, "uuid": "6dd69e22-b0f9-4a30-bd8e-fb588c8752f1", "comment": "Malware payload", "value": "d488301ae8e5ee7418dd2fbc715cc32edd5e4804b66cb002bf7e0dd07ebd5e23", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961860, "uuid": "12be5963-6322-4420-b3ff-c71920aafe8c", "comment": "Malware payload", "value": "cabe228d1afff4d67b89c0eb9a0c0b34fcf61d17", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637961860, "uuid": "281ec5f5-2730-40b7-8543-c1d2648f3098", "comment": "Malware payload", "value": "def38a0526f7615abd3e175afd4b9d9d505396ac5d9a98f6972654997bdb95e7949538bf7c39733eb2ef2fbbea6433fc", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961860, "uuid": "e53c3379-4d3a-43dc-89cf-53017708e01b", "value": "T1976523F69EE47719E06812F7E64586A04DF06103BB399D3EF66C5443076F0188FA8EDA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961860, "uuid": "ada8e652-9823-4426-b4a3-5ac2eef366ed", "value": "24576:SthEVaPqL3L2DxJOANfq/PA2HqYzTHFyHZPIG:qEVUc3L2fOoG41YPYHZP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637961860, "uuid": "b40b86c4-3f45-4346-8ec6-05c5c056661d", "value": 1441792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637961860, "uuid": "12084571-b9de-4a3d-a80e-611c36ccec41", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637961860, "uuid": "35c8ba8c-84eb-488b-9e10-00a9baac61e7", "value": "Pago.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1abe803-4eb0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637928107, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928107, "uuid": "1654b92d-6848-47f9-a57e-bc1f75d13f9c", "comment": "Malware payload (Mirai)", "value": "e413d5e64aba10fb72c8e6376a283071", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928107, "uuid": "ae102bb2-fb18-469f-ad9b-89185cd85a36", "comment": "Malware payload (Mirai)", "value": "d4e5e331a76cd4604b4d5a89e34c94653e1cf9724d5e471fc4b3e4cfa0033ffa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928107, "uuid": "035e0a76-cc0f-4597-ae89-c27fce1a1fce", "comment": "Malware payload (Mirai)", "value": "295ff37f4158d2e704d3be4463b80485d5aec4c8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928107, "uuid": "dd95555d-fbfb-496b-ba4f-ce8197e6f612", "comment": "Malware payload (Mirai)", "value": "722410c2179418032455df6a0446597b641a948d173005047875ce30e5c45fc12deb692df5845ee777feb12df34632ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928107, "uuid": "9635f927-2000-4d0c-ace1-716d4c5044b9", "value": "T12DB319C0F58740F6C9475C3570ABE33ECA71A5A58075C799EFC59E26DA2BA01923238F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928107, "uuid": "f60c738f-6b82-4247-bdd8-ed5833794ef4", "value": "1536:eqQklItg/vnmcxj2WzZcfKM3WadfexWKO6MrsQ8Yv4cl8nbWi97TFzvH:eqqtg/PmctzZcf33lHplsQfv4c2Bzv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637928107, "uuid": "b6fd1fc4-a123-4e59-a250-5f388730113d", "value": 115952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637928107, "uuid": "694c43de-706b-42cf-96f4-531febae133a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928107, "uuid": "594fb082-b53a-464f-b061-b6c4a41185cb", "value": "e413d5e64aba10fb72c8e6376a283071", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e134b1f-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918867, "uuid": "ecff69a9-d2b4-49ca-9bf5-f09db9ff883f", "comment": "Malware payload (Dridex)", "value": "3dac09bac7c22bd4e97528dcec777a67", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918867, "uuid": "fd44e28f-f63b-4595-b511-7478c31164e9", "comment": "Malware payload (Dridex)", "value": "d53f4a066d6a3d7b6f55ede5e054b04747a662d50c5765abbd3a48fb638a6248", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918867, "uuid": "a28e6d3c-f2f6-4421-a5a7-f096e5ac1fed", "comment": "Malware payload (Dridex)", "value": "9dd5b0604a06b696d8a797188c46e39c1883ab73", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918867, "uuid": "f8c3ac16-95dd-4613-a0c5-4837b5a8a3e6", "comment": "Malware payload (Dridex)", "value": "24e469b956c5d465b0e46be26a00d30ca9f3b1e11e49ac9d6ad0009f65aa7fe7dc05f3deae63b276ce7802cd97111b3b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918867, "uuid": "a25ae2b4-e8dc-4748-97a0-ee7ce51fec71", "value": "T1B455E102FF9963E6E9502DF695F0F2A3C9F4F6854C280229DB65545F9CA0ACEBC110ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918867, "uuid": "a462ce54-43f4-4ebc-baed-95bdc2376623", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918867, "uuid": "83d7985f-ece2-4947-b726-e936e90331ee", "value": "12288:0ZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:0ZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918867, "uuid": "e24f5fc2-8e7a-47b0-94f8-4625721c677c", "value": 1368064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918867, "uuid": "075d5178-a161-4de5-9236-cbd272554d36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918867, "uuid": "11ff2d8e-87e1-49b6-b958-af6e67c7332d", "value": "d53f4a066d6a3d7b6f55ede5e054b04747a662d50c5765abbd3a48fb638a6248", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e46afaa-4ec2-11ec-843c-42010a9c0014", "comment": "Malware payload (Hydra)", "timestamp": 1637935725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935725, "uuid": "cd0a0377-153b-467d-a533-717c66408ed9", "comment": "Malware payload (Hydra)", "value": "2cc9b0f73c834830b99ef2a9e0c3da27", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935725, "uuid": "bb693749-00bb-4730-b8c6-ae8c7f6e270b", "comment": "Malware payload (Hydra)", "value": "d5a63c4ace387cff8d641ad9aeedf9e406684b0f3bdcfc79e97de80eef177bee", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935725, "uuid": "78062162-ea1c-40ce-bf27-086f66f6864c", "comment": "Malware payload (Hydra)", "value": "5d0b20afb0f45c5acbdcfee49b41f83cee3fca83", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935725, "uuid": "ce76afe1-6db3-40a1-aee4-0d42e832e6c2", "comment": "Malware payload (Hydra)", "value": "ae15b6775d18c8cfbb02cb5fdc80c6544e5bd88b8bd11086ddc5c5bd1dcf91449d89b7ca24002c546cef97e44c4aa615", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "Hydra", "colour": "#1B8975", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "torhydra", "colour": "#33F7B3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935725, "uuid": "ce472624-6461-481a-8ea4-b0b1a3948d67", "value": "T15A96337BFF1EE189DDB471F6184131836A36AE500E0A97536F16731D38B3BEA9B06160", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935725, "uuid": "3d37d8dc-7559-437e-b59f-5437abaed7a4", "value": "196608:/du68M1x1lvZsI9lyN4agP1J9G52iLy/b5cCTIUeCnbX:/dus1dZbkN4aQBxRb5c3NQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637935725, "uuid": "4bcb1cea-cefa-4450-b7ba-b57237871312", "value": 8621248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637935725, "uuid": "b90f9049-9f36-4a31-862d-e3ed4f5b3cec", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935725, "uuid": "34de4fbf-023e-450f-9b37-8399716a070c", "value": "bawag.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86836cd9-4ead-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637926773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926773, "uuid": "ff48515c-b43d-4f86-ae3b-693927cbd7cd", "comment": "Malware payload (Formbook)", "value": "5795ed8a22538bbe99cf78823e0d4993", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926773, "uuid": "88c55767-eee8-48dd-917e-824e037115c4", "comment": "Malware payload (Formbook)", "value": "d5f714301345a7bd1ff1414c0f0ca54fa6187283e4319835610c36ccc3f4d9a5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926773, "uuid": "0c88624e-d557-4bae-b9c5-b0e3da2fb4f6", "comment": "Malware payload (Formbook)", "value": "23c1115cba789372dd9a6a22fbb6ae0b26f1cd78", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637926773, "uuid": "6baf41fb-8850-4eeb-94de-1df29e197728", "comment": "Malware payload (Formbook)", "value": "93a37326caf575ab57f29657bfe432d165f61c0899f84deab5aa8eda743d0005cae4caa50d6bf30f761dba55c04f17a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926773, "uuid": "300eceea-3468-4903-8a17-29623addd06d", "value": "T17EB4392227562F6DF03ED734C025409883F5A917D325EBDE7DF740D5A6A2BCAC2A2D12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926773, "uuid": "1b28272d-d660-4930-b596-c462125a4526", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926773, "uuid": "ba077341-dc5f-432d-adf6-a766f555d0d5", "value": "6144:UdLp39uO2r+VyIIV9pxXB/R7bJJyzAu5TiJEeqIpWlkh:2LbuUVyIIV93x/Zb6AuwW3l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637926773, "uuid": "ed74dbd3-af06-40fa-b90c-8e4945a4ee0a", "value": 505344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637926773, "uuid": "d4ccbcf0-93f3-4ec6-a6c1-724de051c021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637926773, "uuid": "2c995d33-d2af-49cb-a1bf-337b498370f5", "value": "5795ed8a22538bbe99cf78823e0d4993", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6086bc4b-4ede-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637947755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637947755, "uuid": "9891e65f-61b4-4fa6-9b27-9c62b73aa727", "comment": "Malware payload (Mirai)", "value": "c19deb71a69faed8f0fe8e41cd5978df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637947755, "uuid": "fe706caa-877e-4997-a205-af76881b4ba6", "comment": "Malware payload (Mirai)", "value": "d6a99ad5595b073830f571defe840abc14fba0dfb6b4d406bcb00b78b92c5fee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637947755, "uuid": "1f5109cf-7e53-4f7d-a370-4763ed5e0c94", "comment": "Malware payload (Mirai)", "value": "bbeb258a2d2b144b95166ffbd748d4dfbd0dd546", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637947755, "uuid": "7de79e4e-c1f2-44d2-9e7e-d0f958f9aed0", "comment": "Malware payload (Mirai)", "value": "fd12bbc0170a4b3db4906dd1e7ab9356665627de0e6ef5966689fca4d2171c505cc30aa39f63a3477296c2905593dcda", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637947755, "uuid": "26bdbada-7c75-476b-9885-a8022562e2c6", "value": "T10164E1CAED01AF75F9C506B9FA5F074973B38BA8D3D7B100E624C6143ADE6468B39184", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637947755, "uuid": "14e41ee8-fb68-4c22-9509-5b49f341497f", "value": "6144:7O/QJHZweEL/NOjCHm7FZZncqa77oNsKqqfPqOJ:78QpZsKCaiqa/HKqoPqOJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637947755, "uuid": "3dd3f388-defb-47aa-8533-5ffea4ed5ad1", "value": 307960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637947755, "uuid": "6c5efba2-891f-4168-8277-0a5142a9f5ce", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637947755, "uuid": "e652dd73-6d35-40c3-8739-ac94092916e7", "value": "c19deb71a69faed8f0fe8e41cd5978df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3401951-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918795, "uuid": "0eb6c194-14ea-4b5c-b477-d2734ea74938", "comment": "Malware payload (Dridex)", "value": "596b0cac5ca82de0f301f5ae4f72ec31", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918795, "uuid": "5739e031-699f-48b1-9e65-c43182685a27", "comment": "Malware payload (Dridex)", "value": "d6b765e0c278fe4383427e864d9baf366cd2ce7895cf9d038aa29c15174e2caa", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918795, "uuid": "8c5aa9cb-f104-41d6-96a5-89343a4fba15", "comment": "Malware payload (Dridex)", "value": "ef280c3f84f2aa68dac81b7c511a55d18035c644", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918795, "uuid": "971bbc64-6ab1-4c36-b1dc-f7b15a55264c", "comment": "Malware payload (Dridex)", "value": "8d3a220407f2f29dff9760aa03771e7edbdb605b7b757623efcf016ffbc21146354af05c5d1455a9b700069457e96cf7", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918795, "uuid": "3f846954-e2af-4f88-ae29-2ee48309f9f8", "value": "T1E265D162E36471E4C5639A31D07F151F0AB66D22685A8205FB723A700D3FBC9FFE9129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918795, "uuid": "7b9bfab1-967f-4ea3-b5a1-35b7e3b6cdbc", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918795, "uuid": "b152a5c9-5b35-4574-a8de-11d8015784b5", "value": "12288:uGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:j3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918795, "uuid": "a8140a78-ea8a-4ad9-beb6-fc298b9659b5", "value": 1421312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918795, "uuid": "c290f339-3764-4bcf-9d2b-ad251782648e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918795, "uuid": "0a2903e1-d8d7-4040-85e1-bec114fc767d", "value": "d6b765e0c278fe4383427e864d9baf366cd2ce7895cf9d038aa29c15174e2caa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a25ddd1-4ef8-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637958803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958803, "uuid": "aa52e7b4-f04f-4ded-ad00-75538751f5ae", "comment": "Malware payload (Heodo)", "value": "6042776131aa05383acb795c5f38039f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958803, "uuid": "0c5b3a7c-0394-4c31-97cb-2e6e8b17a87c", "comment": "Malware payload (Heodo)", "value": "d6c75e436184636062a8fcb679f8482666783917fbbe9a32099a45034feddbee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958803, "uuid": "eb83d181-c99e-4305-9fb4-44017a3c2cb5", "comment": "Malware payload (Heodo)", "value": "d35b4924f228c85c3b4a997d9637e35bca208239", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958803, "uuid": "681991e4-a862-4ea7-b9f0-c1e8c0ecb11c", "comment": "Malware payload (Heodo)", "value": "b1c00ae39d849fb700e215bd027999faf32ae8df9392c56273371c81e711dacc4152bc6861285105fa9244a0a3f551a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958803, "uuid": "4cdafd8e-89a3-4f4a-9f50-583afb799103", "value": "T1E4E4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958803, "uuid": "69665467-3a9e-45f7-ae5c-aa42c1c3821d", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958803, "uuid": "decbb23f-cdce-47fd-bad5-35d4b4d9ab3d", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhxico09cDlB4Vx/ID:0uH0GCNeQ3i7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637958803, "uuid": "5a98015e-7ccd-4ef5-b4f9-5b55db51766b", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637958803, "uuid": "fc1eef3d-f8ee-43dc-b4a1-499cf56ec4a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958803, "uuid": "969928e7-53d9-4916-aee0-3339fc89d8f9", "value": "6042776131aa05383acb795c5f38039f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72740c96-4ec2-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637935759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935759, "uuid": "40d58ca9-b9e3-41f4-acc3-493eb793e7bf", "comment": "Malware payload (AgentTesla)", "value": "8c322cbf7f7d5dee612149da8212a231", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935759, "uuid": "403ba559-e42a-48d3-acf3-a5419ad050ca", "comment": "Malware payload (AgentTesla)", "value": "d74939e7fb45263c024ff6e71f754bae2c541dfeabb79dd8aae0a71f8a3aaec2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935759, "uuid": "835046ca-8c7a-4e6b-96df-99acc1e308a3", "comment": "Malware payload (AgentTesla)", "value": "f183d7a4070754599fc8ab09f4fc8c45a01033c0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935759, "uuid": "45d8638d-f961-4c1f-8e62-fc8a4d30eb3d", "comment": "Malware payload (AgentTesla)", "value": "a6597ae8dec1c64d0a2e16400578cd0125837fe894a974c8d5690b1c759b73492ee36f254b1d9a07487e8f0ba16b36e5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935759, "uuid": "dd0414fa-b336-4419-878a-bcc7057f4957", "value": "T1D7D4AF2AE79ECEA6D3579170D4A3E2B007246DACD297C21F21C43F4B38F5382456BA57", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935759, "uuid": "d45f6611-42e5-4aae-b53d-5bf4a63b51b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935759, "uuid": "61681a04-b556-4762-ab6b-eb5f4b7424d5", "value": "6144:3/lDju7wucmZb6lecfc6O0Out/PTBJumgm/eu7p25s2WTHNaSjBF5xjZ8GYrcj:Nu7TKNP/PtJum4ulnBTHNaSjTtX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637935759, "uuid": "15e0014a-cb81-4c8a-bc1e-6ef687c179ca", "value": 623104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637935759, "uuid": "32ad2f9c-42e5-413e-bd8b-1cca78611541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935759, "uuid": "64477bb6-aa05-47db-909c-d1550f8eb185", "value": "xeroxscannedcopy20212511.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "beddad9f-4e87-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637910547, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910547, "uuid": "ff18eeee-fd48-46b3-8ba5-a490ed70a472", "comment": "Malware payload (Heodo)", "value": "bf49dc53806a4a8a598a3fef09af04dd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910547, "uuid": "d3ce8b6e-072a-492d-bb55-bb3b5c23e614", "comment": "Malware payload (Heodo)", "value": "d834394cead3998ab9e947f2ad8575ade7c57f2b5f8301baec2462f2e0ed95e9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910547, "uuid": "7d43a1a0-daee-44ed-9ab7-97c430444318", "comment": "Malware payload (Heodo)", "value": "ec86e869596764181c316f29f77ff14f4f12462f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910547, "uuid": "83b41029-b90f-4bcc-8a97-ca0874f64fca", "comment": "Malware payload (Heodo)", "value": "a717d67f222ea3245059aea2d054f9d1f7ca49b6a7feb9a1c466843ced5cb467ac574d348f3edc385761f1fc9b19fb61", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910547, "uuid": "0dc9ea7b-9fad-4474-8fa6-cae25b383121", "value": "T1D3B4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910547, "uuid": "0bf50dac-b5d6-4670-84e3-b1eda8d67775", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910547, "uuid": "6f1731c5-f3a8-4a76-8ce8-ff8ac3a4b5f0", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDat3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkj8XC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637910547, "uuid": "311f7f55-6e77-41ac-9c3e-2e4a8abc35bd", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637910547, "uuid": "aa542f11-f503-48f7-9805-e98a85a8c917", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910547, "uuid": "8d3a98dc-c53c-4992-b36d-5f22a85dda87", "value": "emotet_exe_e5_d834394cead3998ab9e947f2ad8575ade7c57f2b5f8301baec2462f2e0ed95e9_2021-11-26__070901.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b05a9fe-4ec2-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637935612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935612, "uuid": "24864ab6-a91f-4e96-9b6c-9bbdb36d17cd", "comment": "Malware payload (Heodo)", "value": "316bd949cb675c5322ddcdac0e0dc1e2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935612, "uuid": "70ad2064-7181-4bee-9390-291feccb4b12", "comment": "Malware payload (Heodo)", "value": "d83fed9a74ddd842ef565c411c3c49fa7871f8fc0cb5398677871e104a2678e7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935612, "uuid": "cdcfd42a-d38b-4b88-943b-7824acdb94fa", "comment": "Malware payload (Heodo)", "value": "59df01e171a5175535823ed0832a56d9a067d10f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935612, "uuid": "ed25cd1f-692f-4bfd-b7d7-52c793da6969", "comment": "Malware payload (Heodo)", "value": "0919936ede44dbc452598f6fac52ea412c231b5ca0dfb50fcde057d81904f32528bed9812ce6ddf888c5d0799fb395b8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935612, "uuid": "c732ceee-edac-4318-99b9-01c31ddef660", "value": "T12103AE1EC221B8E8D235D93A819845E5521D2E116086FA4934C0B58CEF776FFABDF36C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935612, "uuid": "1ee1629f-0a4d-468e-95dc-d2c4cc923663", "value": "768:Ih/I83jpRrjevZCwVIUUqgBZVWpf/wak8y0VIF/:IhnjbIIUekpw78XVIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637935612, "uuid": "ce9ce64f-a6e0-44c0-b4c0-19070b2e9ed7", "value": 37974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637935612, "uuid": "974e8231-e0f4-4430-8d82-35057aaf4e82", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935612, "uuid": "e729f7a2-0876-47bf-8797-676a9ddccd8d", "value": "Report.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0fa6883-4eaf-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637927703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927703, "uuid": "2b17f014-56e6-4c75-9d54-2d87d2c0b6f2", "comment": "Malware payload (Mirai)", "value": "854d5389e19b0f0a103f90483b7a94e4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927703, "uuid": "b0dbc561-46bc-4c3f-be27-6fcb75247751", "comment": "Malware payload (Mirai)", "value": "d99842478ff4e843f80fe02138a4a6f9cd7f92d6b3c80f0329fe86e3efff3caa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927703, "uuid": "a5908672-ef4d-4006-8c89-fa1e1e496bfd", "comment": "Malware payload (Mirai)", "value": "f76996cf0b88fd195ca23dd2c832be5a903f320f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927703, "uuid": "64d33df1-33f7-445d-afb9-200267f6838f", "comment": "Malware payload (Mirai)", "value": "4ecfa951de8fe1f138aa48adf64e6e0523be82081f8e6e6dafc32cf4050441bb75a38466044f399dbafcbea65d26b249", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927703, "uuid": "f91f1d27-8a70-4017-a998-6af7161102b2", "value": "T160B35B0137398E43E0E61EF57A3B23E493EFED8221B4F444264DAF1E4135A73595AE88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927703, "uuid": "1027e305-ed87-4a76-9487-8ed87dc20eb4", "value": "1536:K4hivftANiMXHF9aiMikTZBOqc/HtU5LvX9ZbBR4LKn7c6DaN2sHti97TgzZak:KZANiMXHK0cZgqTXzbGK7c4Ozgk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637927703, "uuid": "f8ad896e-7fb0-4a1e-bd77-ee2c853473f2", "value": 113104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637927703, "uuid": "b5196194-2178-4d10-b422-c5aa0c940fc0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927703, "uuid": "b3dfdb90-39ef-40c5-8718-e156bebc3575", "value": "854d5389e19b0f0a103f90483b7a94e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "693d5dc4-4ee6-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637951205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951205, "uuid": "a0c76c71-b9dc-4e3c-a091-ef688eb76e11", "comment": "Malware payload (RedLineStealer)", "value": "40ee54a30ed1f8392a583d47f16a385d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951205, "uuid": "89e5cafc-bf5f-4b9e-812b-e31641359828", "comment": "Malware payload (RedLineStealer)", "value": "da345875693f608c924d1cd7cd6644bcf7dfd37d0876204ed723e1e6a8ad6936", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951205, "uuid": "48569e1b-8e38-4159-aab9-b74a30e700c9", "comment": "Malware payload (RedLineStealer)", "value": "80f9c5e98372bf4545965ee8627a101dca5dd2f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637951205, "uuid": "f51b9a6f-f0d2-48e8-abd0-6e775cb41cd7", "comment": "Malware payload (RedLineStealer)", "value": "d7e01415214533f4220fe3baa4cc887e8a158d4cd57f737c30a1357796baaa9e9c71c115bfa3c06645668dbe53b47160", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951205, "uuid": "3e7f1db1-af7d-4c7a-8464-828406eb1a3f", "value": "T176F39E15FEE2C4B2D5B6A1302474EBA01AFBBC73153185CB2B54266E4E702D08EB5777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951205, "uuid": "750b21d3-adc3-48ce-9df3-513c4de82997", "value": "0870c1337a760ee1593b3bf581332ebb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951205, "uuid": "e8f6af65-551d-452f-b77b-b93fd4a0068b", "value": "1536:myNeue3ri+yinTo7e/8hQnug9+OuHFiMwW99h0S0lAQukVWF06kySue1Rj8bd2:vNeuwwwF/z9EfrheAXwW/61Rwbd2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637951205, "uuid": "273bb578-abbf-463c-8d53-c94d87b8b130", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637951205, "uuid": "0f6c1aae-3a8b-4db2-8efd-b93efae546c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637951205, "uuid": "d33e3c28-5619-40e3-9dfc-589e128d3cda", "value": "40ee54a30ed1f8392a583d47f16a385d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb939bbf-4ea3-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637922567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922567, "uuid": "30b02665-011e-415f-a940-cbe6c45f0cc0", "comment": "Malware payload (AgentTesla)", "value": "f29b523a0eabe25fd8aaa23193a1e5da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922567, "uuid": "e95af752-f724-4d69-a6a6-cb25dfe33c8d", "comment": "Malware payload (AgentTesla)", "value": "da9107ed171c9d00268cbb6654e7e53282d01989145b2dbcb25e49390dea63f2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922567, "uuid": "705183cb-0e35-4df6-9fec-2c7d0b07978e", "comment": "Malware payload (AgentTesla)", "value": "d0fb5c21cd54304a69e6eb1e590bec45cacdd1a6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922567, "uuid": "0c85e6f9-3af7-43cb-a93d-1176f673a76b", "comment": "Malware payload (AgentTesla)", "value": "5e2c0652c0d3f9a3e517cc36f70aa38221c80f114a2c2bf30a0cb6a25b6493006b5a96bb76537352bcb93fa32501b95b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922567, "uuid": "e3f6bccc-05a4-4986-b030-cfae25fa5a81", "value": "T10702AF1CE4A2B245C667153511BC9DCEA73CC40BAAC64B4FEF0266EC44810351749EAE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922567, "uuid": "46696374-71ea-4897-aa6e-3e3834f4a4ab", "value": "192:xCPVH9jG6ksx6BDivt+TzPsYvkCFyjTzImRGdrzl7q:xCPVV6BDiEfPzT4Mmszdq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637922567, "uuid": "32c14f44-4d55-4138-b135-a7086f2c2ec1", "value": 8777, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637922567, "uuid": "9877d47f-dad8-451a-88fe-93c8393eabd7", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922567, "uuid": "051c7a94-f87e-4433-8668-059eba8d3444", "value": "INQUIRY.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69db4fb1-4eb5-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637930161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930161, "uuid": "aed8f7fe-dc37-493d-8b3b-eed5550890f7", "comment": "Malware payload (Heodo)", "value": "2bc62d6c06c67bee362fec0fd612b5f2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930161, "uuid": "a215171e-f0d9-4b1a-a3dc-88a084ebd8d6", "comment": "Malware payload (Heodo)", "value": "dab95fc346ff611490598346b9adfa53952367ed9c505602dc8216724a42b315", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930161, "uuid": "1c3b379a-0ee6-40b0-9028-99e6c1fafce0", "comment": "Malware payload (Heodo)", "value": "8414115b18959cbf0496145ad40ccdfd46bfcff8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930161, "uuid": "6b1891d0-836b-4a76-9af2-208a3c066a30", "comment": "Malware payload (Heodo)", "value": "bcfa1ca5884d3b8f69601b37a1bae80aca0585e2110ad5c6e3612b341d0608e0b0f7120488fdbc6efc1570239652d3ba", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930161, "uuid": "8016221b-2cef-4ce4-9a04-02224ae9c702", "value": "T19503BE1EC251F9ECD23AD93A81D849A5521E2E105042B94D2580B58CEF7B2FF6BDF358", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930161, "uuid": "c7ba59fe-7c3f-4fe0-a41d-3fc67ba87502", "value": "768:+/I83GhApRrjevZCwVIYgBZVWpf/wak8y0VItKF:+nKAbIIjkpw78XVIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637930161, "uuid": "c67e376f-3c1e-4387-a116-687e6a4adb72", "value": 37994, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637930161, "uuid": "b4819d29-c1b9-49c0-81b4-51c382edbaeb", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930161, "uuid": "ba905c5b-deef-4543-8626-83e338cd4304", "value": "INF_1004632705836561093682.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "151df3cb-4ebe-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637933884, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933884, "uuid": "032ac12c-f86c-4b38-b888-674e3c6f08b3", "comment": "Malware payload", "value": "d11778eeace7919045230b7d9036ed25", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933884, "uuid": "f3e63c90-ad73-4b3b-9f96-734f11f51046", "comment": "Malware payload", "value": "dad61a731ad2f7c1e58408e0a0d33dc88eb974b226dbd2468b7369bfe097aa71", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933884, "uuid": "9391243a-50f1-4229-871a-c1d9e474da21", "comment": "Malware payload", "value": "eb320f2af620c60a284bb0c90040c39ca60cee2f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933884, "uuid": "2dd87772-63ab-471d-b552-d3ba55b695ba", "comment": "Malware payload", "value": "aaa17731e4638da063cbb3814df17a1d6fe4ec5ae7181aab5a7585484bee16dece2901789e418b81c03177cfbf4118ba", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933884, "uuid": "1baa8554-91d7-43c5-a296-a06b08b7f003", "value": "T17982D0AC87B0E8A5D144B232527F5DD60AB0ACC8077DE453A899C3B1D83A02CCF7BE55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933884, "uuid": "cc5512e3-9ea0-4203-bbc0-af5e5fa2e9a3", "value": "384:MJQ49OtppW1kjlPfs6+ngVVnXjbDAtZQ0QlNkOznUlClClSLv1Rh:eOtppWOP06vVZX/DEZVONkAnU8lCAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637933884, "uuid": "76d1b89e-d5df-4f89-bed2-0997dac22c59", "value": 18240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637933884, "uuid": "00d09816-dddf-402e-820c-f69440908201", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933884, "uuid": "6b103eb8-8105-408b-ab13-d7827264927a", "value": "d11778eeace7919045230b7d9036ed25", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a31940-4ec2-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637935581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935581, "uuid": "b1091c1c-ac2c-4ac2-8418-4f913142a4d2", "comment": "Malware payload (Loki)", "value": "0f9bd94223fe4b380bfc353a86b5ac9c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935581, "uuid": "e2f33cde-c9f6-457b-9d06-e2fd83eff4eb", "comment": "Malware payload (Loki)", "value": "db24fa5284e70cdd29bad1f902a2e6ab5e844b4cf671e9e0b8010aed24bc053d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935581, "uuid": "5dc2a3d5-ddc0-4796-9531-983347c629f7", "comment": "Malware payload (Loki)", "value": "0deb50055996f74c25b9e3b5359501fe6d3fb313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637935581, "uuid": "0ef1e7a6-815a-4f22-b635-6e93434d9ce2", "comment": "Malware payload (Loki)", "value": "9e6f062ae45e19b505025fcd13a0fc90598a2d18797657911c061b36b55e96650af41967fc388d9df772d54eaf6accbc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935581, "uuid": "7e3e210c-7249-406b-acb8-752e1e963627", "value": "T15D94F129326D7F02DABC07FB88905190C3F18DA35622D32B5DD2B1E92E65FF9050E58B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935581, "uuid": "7f81b4f9-7ae8-4760-956b-e8816df308b6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935581, "uuid": "af22d6bb-884c-4e29-a549-0ab192aad81f", "value": "12288:LwwE+bSyoLKixBFmMNZSv9uiKcoSPFDUtCAMxUcFwX:BET32i1Fm9j6E5Ut+acFwX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637935581, "uuid": "f01675ff-4e6b-4213-9627-d5ed9e2a24b5", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637935581, "uuid": "fed27ddb-d32b-4279-935a-b1cfd7ce8a52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637935581, "uuid": "27ad41fa-2f65-4e64-a38c-77026de9a4d0", "value": "Payment Advice Advice GLVA29879055 Priority .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "270d285f-4f0c-11ec-843c-42010a9c0014", "comment": "Malware payload (Pony)", "timestamp": 1637967415, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637967415, "uuid": "c16ebdac-12f7-4cee-a999-00b4cb3be806", "comment": "Malware payload (Pony)", "value": "5c3fce4f9dac1d6b0ff14eae8fa03c7b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637967415, "uuid": "eed20b75-e931-439d-a6e3-51696e25e883", "comment": "Malware payload (Pony)", "value": "db4f561ec42ea2c6f0f2eec13060c8035329625490940006fd21630a079691df", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637967415, "uuid": "91693eaf-11a2-43ce-b971-dbb20598f7bb", "comment": "Malware payload (Pony)", "value": "81792df1a2b8b7b0388df5e3bdab66b5bad80c0b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637967415, "uuid": "33a283d6-c721-444d-862a-59399d69d018", "comment": "Malware payload (Pony)", "value": "09d8bbe1eaea6260f7ac3badb564cd83ff2d464c16993d0e53a644d5eb948d91f8dd07d919b48e67ba009bdf1bab2bfe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637967415, "uuid": "4cb2f261-6e75-4c96-9b8b-2592ed0b2b6d", "value": "T1CFB4AD13F780C872D05B2C7548A5C77F97AABB605C71D32F7B981A3EBEA0690491931B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637967415, "uuid": "4842660c-e1ac-424d-a056-e393703630fd", "value": "657463e309db9e9ff8c2a7c7d5cfb369", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637967415, "uuid": "80a369a7-399a-4bae-9d6e-ae40d077a058", "value": "12288:5Fljj2owZY9gwHOV6djHzSMD0E8QY7nz:PpEW+wH2mHzSMAdQY7z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637967415, "uuid": "a86b9385-bc56-44c5-9d26-1e908b034ce6", "value": 499900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637967415, "uuid": "a13b0bd7-b5b0-4d69-a4d4-04ce77ab448d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637967415, "uuid": "ae7635d3-1650-4959-96f3-29bcda9676c4", "value": "DB4F561EC42EA2C6F0F2EEC13060C8035329625490940.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7c7a577-4e87-11ec-843c-42010a9c0014", "comment": "Malware payload (DanaBot)", "timestamp": 1637910535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910535, "uuid": "48320629-dcc7-460c-a896-d706b0f6f797", "comment": "Malware payload (DanaBot)", "value": "b8455597a458d68bf645b606b837b69c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910535, "uuid": "88da95a1-8a1f-4667-8e0d-43e31ee8f8be", "comment": "Malware payload (DanaBot)", "value": "dc4ba92f484bcdc6da82f4ae45a57b87911907034dd85d8853a74511741311db", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910535, "uuid": "7a3f015e-ab48-46a3-ba64-5dd3f993a8e0", "comment": "Malware payload (DanaBot)", "value": "9e4c883770dddfa9ed64be17b0b3fc4752dad43c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910535, "uuid": "f691f712-4bd7-41fd-ab32-fe6b78338a56", "comment": "Malware payload (DanaBot)", "value": "96078b0933f97df37eb8bea16f6b26a44b1bad3f70b7b7a9b35c2b12567d565c5ce2cdd7249852b8bce687b9e90a4fe5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "DanaBot", "colour": "#B9DC92", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910535, "uuid": "efd92c8a-595f-4c02-a22d-d62f380bf961", "value": "T10B958C51B602E726D6A86CB8FC00C5EF14F0BD49FE44D267F6C17F9FA932241A82519B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910535, "uuid": "b04be49f-82b0-4be9-ad2f-df0318d4768c", "value": "9193125fa02709f428800c1b8d2a818f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910535, "uuid": "877135a0-278a-419b-a021-ba09fb3af646", "value": "49152:uQU1aLhQhG5NUAgoOa8nBc0SmmdWwMLwktw4BPeYqfn8+nFFQCxEsJwKQZ:ufaNQh+NUABO/c0Y9AdAYqf8+gqJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637910535, "uuid": "38bf8abb-f32f-477a-a38f-a3cc0dc5e4ab", "value": 1945600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637910535, "uuid": "720e67f8-3f47-4ee3-a967-ad21513e631e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910535, "uuid": "15f331cb-65f7-40d6-b149-93ef4b724d5d", "value": "b8455597a458d68bf645b606b837b69c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "156a3700-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918852, "uuid": "d4675597-9669-4ca9-b7e6-d882d954bb58", "comment": "Malware payload (Dridex)", "value": "bee8470b921740735b0f08302fdc378f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918852, "uuid": "bf538973-4423-4b11-937e-0e5d48535d8b", "comment": "Malware payload (Dridex)", "value": "dd7c2b5ccd52a609e2ec3dd4d2ff6b83c6f16eb1c5f6fb14a918fdc733b6f76e", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918852, "uuid": "3094b291-1c42-4c0e-9901-01301042d79a", "comment": "Malware payload (Dridex)", "value": "a82e32a58f122d3bca865982febdc8b4e5fda106", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918852, "uuid": "cb99f512-eca0-466d-a1fa-0edf5bef4be0", "comment": "Malware payload (Dridex)", "value": "69e848e94c227c84d00837d74220160cfd5bbbbee96759ef03f9f5e4c2b43ddb616aac10586cffd47018c8782762bb9b", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918852, "uuid": "e9a37967-741d-4232-a5c6-d6fb4e0a37b7", "value": "T15555D162E36871E4C5739A31D07F151F0AB66D2268598205FB723A740D3FBC9BFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918852, "uuid": "57cb446c-8838-421b-ba91-7d2504e30aad", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918852, "uuid": "d12b99a2-55b7-41d9-b09b-631360be6e75", "value": "12288:+GVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:T3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918852, "uuid": "2e4af66f-530d-4cc4-9423-5d5473cb81c6", "value": 1392640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918852, "uuid": "9daa0c36-df76-4419-a384-aad62aac6bdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918852, "uuid": "c58d1c26-0529-48a3-a3b8-4215811bd854", "value": "dd7c2b5ccd52a609e2ec3dd4d2ff6b83c6f16eb1c5f6fb14a918fdc733b6f76e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5dda1a4-4e84-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637909297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909297, "uuid": "53b22f01-c3e4-4631-9520-0f78c1de0147", "comment": "Malware payload", "value": "3e8705370c9d62dd3bd1b4db16163b87", "object_relation": "md5", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909297, "uuid": "cf6525a9-cd0a-4745-9a95-54252f1887da", "comment": "Malware payload", "value": "de1fc9c68764558d6a62d45d6b165f97f912edb095327274d41997e8b10d5541", "object_relation": "sha256", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909297, "uuid": "64fbdd60-4896-446e-9c6b-cb5f5047350b", "comment": "Malware payload", "value": "bc14646285ac9c0964d980c1d0138f0cbd01c00b", "object_relation": "sha1", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637909297, "uuid": "a4dd7009-80bc-4c8e-90e1-c0cee5ef129e", "comment": "Malware payload", "value": "ec9e98829e833f227d5e8d8884dfc4417c241e5dbf6e67209b2102bed1b6d8580b6ad5052e1d0a8d68037b6cd53ad345", "object_relation": "sha3-384", "Tag": [ { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909297, "uuid": "4c7bc903-2784-493e-8905-e5405028f693", "value": "T1C5A42342F1C148B459D9FE1A62E6219B00423D97C9B54848836F370E76E7F9EEBB2CD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909297, "uuid": "921e5da1-9272-49ed-b2bd-e7523559d00c", "value": "12288:U3wWqrGDQZQQ0ptQ+7/zqYkmSkEDQYU73/H6355:U3YZQhu+/wQL+3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637909297, "uuid": "b3394d47-8bbc-44df-a2ee-36551b1aef6c", "value": 461975, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637909297, "uuid": "f4f1ba68-5ba5-4898-a6a0-a871c058048d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637909297, "uuid": "360cae58-086e-431b-ad81-ad58fb8200cb", "value": "Cotizaci\ufffdn RFQ.r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6e3e687-4ecb-11ec-843c-42010a9c0014", "comment": "Malware payload (FluBot)", "timestamp": 1637939846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637939846, "uuid": "01a73797-c659-4004-8b75-f2d2ad2dc2a1", "comment": "Malware payload (FluBot)", "value": "749510b3010a45fea2d2763476e17511", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637939846, "uuid": "74f73ec0-c000-4e49-8caa-6c8bc0c8be7b", "comment": "Malware payload (FluBot)", "value": "df5944f9190614f04a8818a50438dfaf3339fa95289cdc0af54f8f239eb253fd", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637939846, "uuid": "9ea149d6-190d-498d-a3cc-511f0d1b8969", "comment": "Malware payload (FluBot)", "value": "79589fd0ba7c1d0afc8c3d1e22ed60a38585348e", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637939846, "uuid": "5e12d61c-55c1-4c21-b82a-bfff812edb30", "comment": "Malware payload (FluBot)", "value": "58b3a7309bfd894c192e956fd7fdfc76b8c965e04cf8d47614193d765f1da8b407998f56e940eaf7dd054c7cfcfac814", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "FluBot", "colour": "#856CEF", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637939846, "uuid": "67ab8b66-401c-46e6-a45f-b89d95ee8913", "value": "T1DF362369FE9EE4A3D003E4B4C1649987A508005D5A24F55B2A3692CC8EFED449B4FFCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637939846, "uuid": "b9cd6c7b-50e0-4de5-81a9-41a928a36525", "value": "98304:4mamSQUaXwpaqhRikhoWQafbXrXmZg5uQ+1xNGbFF8Djc13W3EAe:9SQUaXPSG9q5P+7NGbr8Ds3v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637939846, "uuid": "7fc570e6-a5fd-4899-a045-b51f721d58f6", "value": 5226532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637939846, "uuid": "cdbe30f0-b658-42b5-b4db-87a7bf46c37b", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637939846, "uuid": "e15a8927-b370-4f39-80dd-bf9d0a9b1356", "value": "Voicemail86.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1749ea59-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload (ServHelper)", "timestamp": 1637921432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921432, "uuid": "a1e99f1a-86f8-498a-938c-3285aeec08c6", "comment": "Malware payload (ServHelper)", "value": "d97a38c3bea371da6d9dfaee99ed039d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921432, "uuid": "05f1aede-b3ca-4bb0-b1b3-bc7c11eef37d", "comment": "Malware payload (ServHelper)", "value": "df9df29f3c0d3af0e23a5f32be956469661f8f4006162442737452f5c5709744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921432, "uuid": "050260d9-03d7-4e56-921f-fed1e227e831", "comment": "Malware payload (ServHelper)", "value": "1fec3033a83b2ceea2f34bf81fc0929d2570fbdd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921432, "uuid": "930a46e7-e177-4732-9659-2c496f7f872e", "comment": "Malware payload (ServHelper)", "value": "2b5bd479d467960772021d2f6b52f030743061a32d02bad2dc8c3f83814f6fb8de491ef03949671f39bc02f4da411797", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ServHelper", "colour": "#A1B0E6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921432, "uuid": "27085e46-9340-4375-b625-fcb73ef634a0", "value": "T17726D007BC9064B9C5E9C2338DB9B29176B1B858173167C72F50A6BA2FB37D40E35398", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921432, "uuid": "dfd29078-eba1-47f0-9a8e-ccaef3629f13", "value": "c7269d59926fa4252270f407e4dab043", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921432, "uuid": "71b0f5bc-8d79-49d1-9fb9-f5913176f471", "value": "49152:M5/OQG3yFeR32rb/TivO90dL3BmAFd4A64nsfJJP1CuuWxN7GfMqmPNVqbmQqr+p:M5ba3gPkk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921432, "uuid": "ef2830bb-03e4-4cbe-ad10-3b95fb13f163", "value": 4525056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921432, "uuid": "ed64a4e3-d3c2-411b-8fc1-6a79c5638c52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921432, "uuid": "14e24dbe-9afb-4201-852a-5f2df8f5f6d4", "value": "d97a38c3bea371da6d9dfaee99ed039d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1f3a2cd-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637921692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921692, "uuid": "b99f7f93-0bf0-46da-9af5-01ff6d5d4e03", "comment": "Malware payload (AgentTesla)", "value": "c5e64149cb35047d302ded1274f63674", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921692, "uuid": "ad85adfb-975a-416a-ae98-f92bfef2ddc8", "comment": "Malware payload (AgentTesla)", "value": "dff47d14f59a6b705060be6a846208bb9fdb25b3d218cd54cab93c478d562591", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921692, "uuid": "ba0db861-d43b-4b56-b8c1-62368e124d57", "comment": "Malware payload (AgentTesla)", "value": "4efa2440bb0ea0b822d0b4d6f44fef3c32256374", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921692, "uuid": "95dbfabd-5080-4dc8-b0b1-51326a8670f8", "comment": "Malware payload (AgentTesla)", "value": "b5033df61190ec6888bd5901a2cceab299de17d877dda849ca505d96a4c39033b3de76297b9212f90591d0db8c6a86b9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921692, "uuid": "f80673ae-3ba0-4ddf-a280-418db2136c25", "value": "T198341224BEB6FA0ADDBBA6BD410F052A00BAFF1508361CE70194B37DA77D435528997C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921692, "uuid": "7c11f9af-7797-4d38-86b4-f2a816e0559e", "value": "6144:wEMW4ffyJmT70FnjeGAaFvf1HqAHeHR3aWk:nMWeyq7gGg31pHex3/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921692, "uuid": "a5cf2118-1c74-4be0-849d-35901a73ac13", "value": 234552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921692, "uuid": "542887a9-2a28-499c-9437-e82107ccdd2f", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921692, "uuid": "f3fa1807-d963-43d1-9dc1-181bf2fd0a1d", "value": "CDCB-PKG04-2573-2021 -TRANSGLOBAL.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428185c4-4ef3-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637956724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956724, "uuid": "e2d17c82-05d5-47cf-a09c-93909cb99533", "comment": "Malware payload (Heodo)", "value": "6a1c045b307d594cc4c8905cc88e4b92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956724, "uuid": "3ef6cd3b-33d0-4c84-a93a-02492de06c45", "comment": "Malware payload (Heodo)", "value": "e091dfed6d7d8d595121b6b00fa3f9ec6d97b8d9ef88a9599b0448721ff645c2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956724, "uuid": "a93959a5-01e9-4081-8cd6-b94fb87f83a5", "comment": "Malware payload (Heodo)", "value": "e215f15a85d1d1e58d77bbcb2d9d54cbf1f5d8a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637956724, "uuid": "2d63fe5d-adf8-4c6f-b569-ca1c6bb9d07c", "comment": "Malware payload (Heodo)", "value": "a3960299c7131ba271a664fd66e69fa8d60d0b6c25570a15dec307957e4e9f53e68c6acd3a998a965a75895125373004", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956724, "uuid": "53d7fa8c-8f68-4c58-bd8e-c5cc9a2a760e", "value": "T191E4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956724, "uuid": "bf8eb9dd-9d00-4136-8135-13cfa2d05174", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956724, "uuid": "1586c071-c097-41cc-b375-0a5d19901b13", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhFico09cDlB4Vx/ID:0uH0GCNeQfi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637956724, "uuid": "2b927fbf-b3cf-4ab4-9b95-575e6c73fdeb", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637956724, "uuid": "7e94637b-d844-4678-95eb-d3564c19bf3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637956724, "uuid": "b67215c6-d4a8-4c0a-b814-c81928bfc32b", "value": "6a1c045b307d594cc4c8905cc88e4b92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e213a53b-4ebe-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637934228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934228, "uuid": "b05fdd02-545c-4c48-ae52-a6ec4bc54a02", "comment": "Malware payload (Heodo)", "value": "a29264e357ac8916011bd12a0f446ced", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934228, "uuid": "8f3b7e4e-6c03-4018-bab6-04073a72d0bd", "comment": "Malware payload (Heodo)", "value": "e1afbfb8f966d44fc795f4a4dea27a5c218f66b8bad5b0247148abbf9aeb272b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934228, "uuid": "9c76f792-7acc-4107-a930-ff5d790c4019", "comment": "Malware payload (Heodo)", "value": "5ee00de9982ff9a1a43a93d3c052da10478a8d68", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934228, "uuid": "d855cb92-5274-43ac-8e3a-5b18b957c9ac", "comment": "Malware payload (Heodo)", "value": "3149aaa69e263773bc2ffc52d210be871973c0d491cea89381087335536658f16440027bc94666147bfb93022478eef7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934228, "uuid": "64e7d3bc-defd-449f-b76a-be2778dec805", "value": "T1BDA4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934228, "uuid": "fc0003f0-6eb8-49b8-b248-2a6573c7b746", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934228, "uuid": "6d428f51-4b6c-4ddf-aed4-1580f1427dc5", "value": "12288:o4xZ0/tI1BD2LETv0FhBO9U6W8XUDaBN7a1vt:oED2LETvM3b6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637934228, "uuid": "fddd8f12-ee9b-40f5-a5c8-3b56667ce682", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637934228, "uuid": "48e8533f-44f3-4325-9bf0-ce6239e65064", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934228, "uuid": "1b90c0b3-c5bb-4d4b-903e-2c495ebf8355", "value": "a29264e357ac8916011bd12a0f446ced", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ace1ef-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637919059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919059, "uuid": "afca185b-b413-4176-b17b-433bea3f24cc", "comment": "Malware payload (Dridex)", "value": "f013bd186a7cc04178679a1b24b7ef64", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919059, "uuid": "7c0adc7e-951a-4fae-9f1d-8352a98687df", "comment": "Malware payload (Dridex)", "value": "e222b35f91a6abd76a3226837ef9eda5ede74ccfaae17ed01a7538fe79a2da4b", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919059, "uuid": "9d10e3e0-337b-42a2-a7fc-dc881e5be681", "comment": "Malware payload (Dridex)", "value": "30dd7d35772cfe50cac035ecb21e3ea8e17551db", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919059, "uuid": "17fb4e44-5258-489d-9cf7-1467b63a09d2", "comment": "Malware payload (Dridex)", "value": "bfcb590e76c6041390fca6264b68fc8d3121b40bc8155160efe2262132478f65a431a3769e0e5e6d366d450b223ffc5e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919059, "uuid": "417d945e-4bf7-4d7d-9103-6c35a44b107c", "value": "T15445D162E36871E4C5739A31D07F551F0AB66C2268598205FB723A700D3FBC9BFE9129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919059, "uuid": "12c0f2c4-9912-49ab-b618-5a23497649cd", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919059, "uuid": "0266fc98-fe88-4015-b4ea-d7b882f1b56b", "value": "12288:GGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7t1:73JAvRl/fKQKCgFfx4P/vat1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919059, "uuid": "885d756d-d73c-468c-92a5-1b415720970e", "value": 1236992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919059, "uuid": "9e3ad4a4-ac72-4a7f-82fb-686fc34926ad", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919059, "uuid": "e56e94e3-f9ac-4285-a813-7268bfb6d06d", "value": "e222b35f91a6abd76a3226837ef9eda5ede74ccfaae17ed01a7538fe79a2da4b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50174a4e-4ef6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637958035, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958035, "uuid": "46606eb0-ba58-40f5-9051-ee5aa8375be7", "comment": "Malware payload", "value": "fe42417618529b505b542a342dedf31e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958035, "uuid": "984d56d7-03bd-4467-a606-7ff30b726945", "comment": "Malware payload", "value": "e26a0cb7ac0770b492782bfaa2ad8f241f846243fbfaad6ec4dfba97df56132f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958035, "uuid": "bafcf44a-c86c-48b5-98fd-de08ade842c0", "comment": "Malware payload", "value": "f6ac05bff8a8fce58d249ab9ef24eded82e3f68f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958035, "uuid": "261a6450-05fa-4fd6-b298-581c142ff93d", "comment": "Malware payload", "value": "de2eabdef2b977a8e902a82ec3826458fc7f98f1750937192f0a46003ab965efe297f31893f1553f4edfb6ac390b526f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958035, "uuid": "a18b5a2c-be0b-475a-aae3-ff02e7272f83", "value": "T1FD055A1162A69152E3641FB0AC782A8B48382DF8C7BCC5E773D0277D06BE5F254E5B63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958035, "uuid": "51dc827f-4a87-4d29-b2ea-0aa29f8376c8", "value": "fec6b51b8b6036276f67493047b0f572", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958035, "uuid": "0718d6b0-f733-49a7-95d3-0cbd3a9c4fe2", "value": "12288:2eycUSKkKBvQ18tNoir755PQVUnurHru4GY9j23oaBIQuSLtkzvw3V4:okevyiNoijPQVcuDj03PBIQMzo3V4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637958035, "uuid": "448b08a4-0c7f-457a-a8a0-d9abcd220dba", "value": 796672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637958035, "uuid": "a78da9e6-7e8d-44ac-8477-5f8e9f5cce00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958035, "uuid": "0423c3b6-abda-4eb7-9d7c-f79faf576239", "value": "Eris.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08aed555-4f03-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637963499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637963499, "uuid": "ba4f86e5-9ec9-45b3-b0e3-72710fb6cdb5", "comment": "Malware payload (RedLineStealer)", "value": "6cfadee91fcd3879c911ee178c2371c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637963499, "uuid": "76c0566e-c7a2-4e71-b6e3-91a204f9608e", "comment": "Malware payload (RedLineStealer)", "value": "e2bc183186790b127ad0435c5d9141a8f6635f2ad0d3f7d1c4c7147305a073ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637963499, "uuid": "0c88a51f-7ff0-4660-9138-fe06059fc140", "comment": "Malware payload (RedLineStealer)", "value": "0774c684969bce62406e4bf416f708bbdc1cebcb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637963499, "uuid": "94642116-9e1f-4095-bbe6-c3818a41b70c", "comment": "Malware payload (RedLineStealer)", "value": "819a99a959a4637a7d21b0cb41299474790ec4e7528c6a764d36fa96da41fa471ce307c0fc271a2cc00a2a02ade1b117", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637963499, "uuid": "11330649-fd63-46ca-bbcf-1ea2fbfe0b78", "value": "T1B59432136DD8FB18A0915D3382CF7E291B922DD28B7245462B59FEF012A42116E7BF7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637963499, "uuid": "3bdd234e-f7a0-4d1f-80dd-b796310983ec", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637963499, "uuid": "3051cf7e-0746-400f-b037-790455791b15", "value": "6144:Jam0pGtq4D7oCG99APV2l/QGiors716t/+XdNBu5vpvW8WW3WWIo/oZsJvaL:5z7oCGk2lMXdNBu5vpvW8WW3WWYKw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637963499, "uuid": "2932f15c-2646-4e86-bc11-423c4774d119", "value": 439704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637963499, "uuid": "7ddf5fba-d269-4746-9569-086fde4516cf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637963499, "uuid": "06640111-20dd-42b3-8e3a-56ef8dd4eb6f", "value": "e2bc183186790b127ad0435c5d9141a8f6635f2ad0d3f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03022f72-4efb-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637960053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960053, "uuid": "da56a820-2178-4503-b10d-38912b40c601", "comment": "Malware payload (Mirai)", "value": "1a1c8e35910c65dbec5543990c327eed", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960053, "uuid": "0da1b4e0-6c5e-4490-9564-636a0157d26b", "comment": "Malware payload (Mirai)", "value": "e30ebfae0238469d88cde6517f68af00bb3bf71bced1c0cce60be9d3c7d8069a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960053, "uuid": "a2a0e4b1-2741-4675-af08-b3ff17be428f", "comment": "Malware payload (Mirai)", "value": "cb54b9275c0a2dfc6e1b17a51a4114ee3161d891", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960053, "uuid": "7971cbdc-d61f-449e-b7ed-85263ba205de", "comment": "Malware payload (Mirai)", "value": "398a54c646e70f2b284d262cf31bf467f1e82d8a87b27d9317767a32091635e9aec69a66c82ed8c9e38f034dba7bdc4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960053, "uuid": "2c885b2b-3945-43e0-ac0e-c58fec4e136b", "value": "T180D2E1026681FEE1C5B00235ED668A9B72293D79D1D134FB9A3C0EF8A6ED50D47F8943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960053, "uuid": "8f27c63c-b487-48d1-9496-dbf52886df22", "value": "768:EusHfRavjynNKnjFcZIhQzhKMXgWo9q3UEL7e:WRwynNIOQQ1KMwWRLC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637960053, "uuid": "e27a7c62-cd5a-4341-a5d0-1f69214812e6", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637960053, "uuid": "1d33db5b-31aa-4609-9575-8aae25bbe41c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960053, "uuid": "91de9c70-657a-4897-a2ed-438cefa7de99", "value": "1a1c8e35910c65dbec5543990c327eed", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d26d1ba-4efa-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637959775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959775, "uuid": "0514c703-56e9-4d0c-86bb-58593c0d59ca", "comment": "Malware payload (RedLineStealer)", "value": "43422d39a91eb25a8ae4b29635525cbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959775, "uuid": "85b6c473-bfa6-4697-b588-766222192a19", "comment": "Malware payload (RedLineStealer)", "value": "e39f3b1df79e83b6391cf5f6825b17567b1ef2111d034a0bdea2f9d48c3d0e4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959775, "uuid": "bf44a18a-2b79-4db9-8a72-9e729f939737", "comment": "Malware payload (RedLineStealer)", "value": "7116cc9208f409702d491c273ed8fc9f757707e3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637959775, "uuid": "a10e246c-a90e-4551-bca7-8ba087bb01ee", "comment": "Malware payload (RedLineStealer)", "value": "53cc7798677d9d6a8e8f733ba0d467e184b1b8d0073c459b19ae540d57c15a5bf886d5ffefe337f49737627ebb2e41bc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959775, "uuid": "1636ef72-04c8-4f04-aeb6-af21c7279605", "value": "T191B4482868BFC05950E3EFA12DDCA8FBDD9A55E3640C743701A4632B8B52B84DE4F479", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959775, "uuid": "ec24c5f0-a2b5-458f-afc1-6a40fe8972d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959775, "uuid": "228bef14-725e-4fc1-9fa1-52e4f2e970e2", "value": "12288:AEFiag8rnySs4UpVaj7q3kLhUPdX4Qp+IEtdl83LfWsUyS+4ZYnX7k:jiXJP6Zy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637959775, "uuid": "d4fdd83a-d8f5-476c-a947-8423fdfb2c2a", "value": 533504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637959775, "uuid": "0addee0a-8feb-4721-8939-2ade127b5478", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637959775, "uuid": "0b5da1b3-fbe6-4726-8d6e-578bba2393a2", "value": "43422d39a91eb25a8ae4b29635525cbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aeff327-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637919076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919076, "uuid": "5b937ca2-357f-4cd4-a90d-93aacd8bcc09", "comment": "Malware payload (Dridex)", "value": "ea1bfbc91324c0cbb97f17775e653dab", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919076, "uuid": "046487f8-73ee-49ba-8823-61667f2dd059", "comment": "Malware payload (Dridex)", "value": "e3a97ee2fa0ea4dc05340e0778674a93e8c95944c519df7ee5f486c08b1df15a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919076, "uuid": "a630536b-6858-4a89-bf07-2d8b0285b32c", "comment": "Malware payload (Dridex)", "value": "61c6d875774c9cd59ae56e351a291c2cf9e79284", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919076, "uuid": "597a79a2-f9f6-47be-b64e-e02e31156632", "comment": "Malware payload (Dridex)", "value": "a469f54738d8462e7fefac9aea81a61591581466fdbcf58ccc51c7a489c258aebed5f1bc30dd4e73d6ba6b3c2e4daab4", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919076, "uuid": "1b63cbe4-c284-4f12-9ecb-a6bbf21dd97d", "value": "T12545D162E36871E4C5739A31D07F151F0AB66D2268598205FB723A740D3FBC9BFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919076, "uuid": "cae5bef6-ab65-4b90-b964-e37462f49f7a", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919076, "uuid": "9053c939-79f3-4df8-9969-14fd160064bf", "value": "12288:hGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:k3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919076, "uuid": "8434f577-ecd2-451b-a57a-c0590b791a92", "value": 1232896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919076, "uuid": "2879135f-d1e1-4c64-901b-7580c917a683", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919076, "uuid": "44487c6c-828d-4c35-9822-b36c25bdb8c4", "value": "e3a97ee2fa0ea4dc05340e0778674a93e8c95944c519df7ee5f486c08b1df15a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd4b700-4ea1-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637921683, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921683, "uuid": "e72f3603-b007-4878-b276-5db1f9023d21", "comment": "Malware payload (Formbook)", "value": "2f129eb2f2bfc0ff414336b5af0baf40", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921683, "uuid": "3dfb5e62-b0e4-4516-b3e6-cb1153875363", "comment": "Malware payload (Formbook)", "value": "e48d0e655547d46fc8f882becc199a8b47f7391fa76786150a21f5168c87e7d5", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921683, "uuid": "5cdf92f2-4644-4592-89cd-ff78a0968958", "comment": "Malware payload (Formbook)", "value": "63fd63ea69faaaae0b829224a425d35effe843c9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637921683, "uuid": "eb45fd5f-1599-4cbd-94d0-50dfd6148abb", "comment": "Malware payload (Formbook)", "value": "40007129b1de51bdf473711b5db0423b4242f7659a688e6b47f502bdf8d1657ea62d1256d1197aa8dbb0baed1d142fce", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921683, "uuid": "99596a14-e761-4b7c-ae40-9c8b3b9a64eb", "value": "T1743412663AA402EAD9E95F313538A374C1BFEC536817824B50037A5B2BF904A5196BF3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921683, "uuid": "c94c734d-e3ec-4888-b0f0-59c893f8e1c3", "value": "6144:AFiisdf2Xr649y45WkF7Ec1j/Ig+h+M4a0foyGlQ:Gsd2764Y45WqpjfA1a5IQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637921683, "uuid": "4e64e531-e289-433a-a435-f2291f75a2d9", "value": 234376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637921683, "uuid": "7e669440-a0bf-4ddf-b40b-ba197429ca24", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637921683, "uuid": "8baa0f7a-4939-48a5-8cc9-7afb67b04960", "value": "STYLE 1110850800.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0756464b-4efb-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637960060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960060, "uuid": "17bf0c59-4b56-43c5-98ac-95132852bad3", "comment": "Malware payload (Mirai)", "value": "0fc04b73af3d8e2c6d9e9e25e4d68203", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960060, "uuid": "ff244d79-0715-43e2-bf35-b42ce63a0934", "comment": "Malware payload (Mirai)", "value": "e4ff7618e412b8d7d655b28d9ad6dd36b93b2a9e621dc5d97f4b417ddfaa762a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960060, "uuid": "956f2a89-87f6-4b1f-bf90-9a29ffc49cb3", "comment": "Malware payload (Mirai)", "value": "59304af56b8ffd126aa2bf4b82143dce58dc20b0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637960060, "uuid": "36c9086a-3da8-49cd-8492-f5f40def8ac9", "comment": "Malware payload (Mirai)", "value": "e14b54a79cd0504fb33e6a250a93baae871ba8a16cccc0e03a98833baa825b16635f24a1fbd8063ffcbf59e9737a3808", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960060, "uuid": "8824bdd5-587b-4e1e-a598-7ec3bae707d4", "value": "T137B2D11AC0AE2E74FEDB7D355941E2C17FA19BDF3A61CDC01AC15A110622D381F88AD8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960060, "uuid": "06aafdc9-8608-4c88-a3eb-386465f47fae", "value": "384:2OA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo4slrM4uVcqgw05s:2AApCdvwJr69VJoA8FZtxCo8hslY4uV3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637960060, "uuid": "35dde5e2-9b07-4718-b74b-3667beb3d58d", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637960060, "uuid": "b46dda22-fd3b-40c3-9a44-0adb7bc7418d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637960060, "uuid": "e2b65242-f259-48b5-a879-1f7fa854bf4d", "value": "0fc04b73af3d8e2c6d9e9e25e4d68203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bec07e83-4ebf-11ec-843c-42010a9c0014", "comment": "Malware payload (GCleaner)", "timestamp": 1637934598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934598, "uuid": "a0da1065-b575-43eb-8a77-7a4b79108cfc", "comment": "Malware payload (GCleaner)", "value": "9df64048442f3e2359167b4557bef2c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934598, "uuid": "206353f7-ed55-4dbb-b8fb-fe34d710dcc4", "comment": "Malware payload (GCleaner)", "value": "e57501a7f031ba3ac01f8d4d322b5b26cb6d7d25e9ad148054b16aa644f2d31e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934598, "uuid": "203ae044-4bcb-4ded-ba62-b5e8a4db09a1", "comment": "Malware payload (GCleaner)", "value": "619693bf13e6915e1a7f6fa81f171f386916fa99", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934598, "uuid": "5b8e1867-ab3c-426a-b098-282b361596df", "comment": "Malware payload (GCleaner)", "value": "a83d6a1e124369aa37b21e76af459878269afb3e845e37769397db86db999ba36d65f35aaa719680a74ae219a13d085a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gcleaner", "colour": "#6323B2", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934598, "uuid": "71fbf146-4795-446d-9953-041176d4328a", "value": "T1BEF633AC61BBD680D325727342B727DACDB6EF0A49D4022CF36C633125D657A632D3A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934598, "uuid": "0d8d6deb-ad82-4821-8ea0-179fc6d8f1fc", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934598, "uuid": "0e81276e-2dc8-4350-bcb6-b9b6d7481f7b", "value": "393216:JrMkcU6DT16fFiSeE4mHIK7gBx+4EJl8aII407:JrMkIAtiSgul4EJl8u7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637934598, "uuid": "b5911008-08dc-415f-9ff1-83ffc4371b87", "value": 16190668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637934598, "uuid": "9738cb14-879e-4cc3-a414-bf47be5518c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934598, "uuid": "59a9bae6-0caf-4ee3-86e3-98eaf8ca6b8b", "value": "setup_x86_x64_install.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1beb0d4-4eaf-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637927678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927678, "uuid": "445f924b-823f-42c0-9459-494662a84edf", "comment": "Malware payload (Heodo)", "value": "43e4382046bb58082dd6ad2cb9eb02e7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927678, "uuid": "5dec817e-bba6-4ee7-9a91-840c859fe840", "comment": "Malware payload (Heodo)", "value": "e5958241f7b455b05a0e59d8602fb51a2148aefe2fbe13641af920eb98ac6045", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927678, "uuid": "1171251d-a2af-4137-a922-a3c3454a2cfc", "comment": "Malware payload (Heodo)", "value": "d6a2a1a45865aaabbd2cf3922f64f689374e46ea", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927678, "uuid": "227e5eea-e07d-45c5-87b1-ecb615bf4205", "comment": "Malware payload (Heodo)", "value": "f4347c1fe330086b20c59721d49ad4ec924fc3975b64b4c95514c5f0c7b0eea8551fabd39fd943b82eea8771cd1cae2a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927678, "uuid": "dc3b6262-94eb-4257-8d93-9ef5d2dfb2b8", "value": "T11203AE1EC251B9A8D235D93A819845E9611D2E016082FA4D24C0B58CEF7B2FF9BDF35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927678, "uuid": "6e0bacec-213e-4d04-8d13-59ffbd396e1e", "value": "768:pbII+/I83pLGrpRrjevZCwVI+6gBZVWpf/wak8y0VIyR:pMnpLSbII+Bkpw78XVIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637927678, "uuid": "b44ec3b2-fbf9-47d0-98b8-a76d09d3ae74", "value": 38032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637927678, "uuid": "7c8a6a06-5af9-4c35-b8cc-bcfeb078d128", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927678, "uuid": "24af795d-88d1-425a-ad82-7723b94bef55", "value": "DY-3983 report.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d868e7b-4e5c-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637891861, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891861, "uuid": "15edbbe7-8f44-4ea1-a9ee-e625ed1bb142", "comment": "Malware payload (Heodo)", "value": "d2566b97f39db7e03e2254e31f4381e8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891861, "uuid": "0f469a80-fbad-4087-90bd-d9468f499131", "comment": "Malware payload (Heodo)", "value": "e5cf4a2b2892c1cef6d5c8868a8c9c8761e2a7177a87c6f63565877603918408", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891861, "uuid": "6282e057-076a-47c6-98e7-14b14f72286c", "comment": "Malware payload (Heodo)", "value": "3f7b55afe7773b9e64f34ee1240cb37385e4c2b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637891861, "uuid": "1c34cebc-6811-444d-a2ab-9ed00f1b87a4", "comment": "Malware payload (Heodo)", "value": "afa816297a98359c11dadc40744798787a2119d128c80ba4f24b954d1cf8f92487b8fea3fda2d37ef05706ef8d378eb8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891861, "uuid": "4d501bc7-0cb9-4ca8-b7a6-4cd46c13e9b6", "value": "T19FB4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891861, "uuid": "83bf48cc-65ef-423c-a602-277459e07148", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891861, "uuid": "7021f5d2-6d31-4332-8065-84f5f943809e", "value": "12288:smVdIG2GDNBtIlD987snJrkZW+mw3ffEPy:sm4GDNBtIl6w6ZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637891861, "uuid": "aab50b10-892a-4b85-a616-42be93f9de68", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637891861, "uuid": "22e2eb99-d80c-414f-8aec-58f6982acc70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637891861, "uuid": "e61f5efc-d86b-4e11-a7f4-a3b6a37a8523", "value": "d2566b97f39db7e03e2254e31f4381e8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18920521-4e84-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637908979, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908979, "uuid": "ea0d7d73-f8db-4f47-bcbb-77993b6e27e1", "comment": "Malware payload (Formbook)", "value": "be0f492d15478f27be7e79f07a901a2b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908979, "uuid": "0a105fff-1eea-4454-8c4c-dbeb8761c5f6", "comment": "Malware payload (Formbook)", "value": "e624803aab79b18716fc0ba9b78e37b8a340cc129dfc47a3eaad2b17d091dae4", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908979, "uuid": "92675687-1fca-4013-91a7-c14e777a16cd", "comment": "Malware payload (Formbook)", "value": "2c5649ad3ed628e82abe57aae267c500cca8671e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908979, "uuid": "67057fa0-06b2-4392-9f9a-5ed9e66ad6ce", "comment": "Malware payload (Formbook)", "value": "8b432f68ae96c6dfbc6b841f15075966875f27dec43583962d30af53ad5cf955e943523400b654282b780a21e8c5ca10", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908979, "uuid": "2a17f9a4-5c9c-4b7f-9112-28dfbc57d8b9", "value": "T1B495330E53A63825C9C6227DA6A18E7FDF71183D4DE1E6070F525B1CE9EB28907E0736", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908979, "uuid": "a841e154-8ab3-4d7a-9660-0ddeba275e23", "value": "49152:Ievrs7aymgBZ+rtV5iHyLVAPiRi8/447CsKWTWeh:IevwtZ+rT5iSxAa0Pgh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637908979, "uuid": "3c92654e-3bce-4310-9417-e6435edb2dbf", "value": 1995683, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637908979, "uuid": "65e9148a-e7a2-4146-80c5-165908413915", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908979, "uuid": "d5ac8dc5-8330-480b-be49-2d71474e0680", "value": "RFQ- PO 180030876.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "896c4704-4e9e-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637920335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920335, "uuid": "7306973e-c35e-484f-80c6-afe794254d79", "comment": "Malware payload (Heodo)", "value": "63945dd6c4769b486ce859bd390a4440", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920335, "uuid": "851482b3-8ac1-47fe-953c-d8d898da868d", "comment": "Malware payload (Heodo)", "value": "e6f9c015d50f9249252adcf3c5142cdfb1b971f3fe94ce3a505e44d0534c6137", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920335, "uuid": "122fa110-357e-4d92-95d9-6a8c0835788f", "comment": "Malware payload (Heodo)", "value": "191be86a7f6712305543bd4e23fbac3a6507333a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637920335, "uuid": "da7133b8-b011-485a-ae78-ecc8c8317c6e", "comment": "Malware payload (Heodo)", "value": "948015ccc3b558940e4c29827495801b028504a6c6c83cd707dd1e0c49cec5c9736977cd8c5111b633cbd80a9066f904", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920335, "uuid": "b0bbfa79-dff9-4298-867c-73adc7bb4e02", "value": "T14903BE1EC251F9ACD236D93A81D845A5651D2E11A082BA4930C0B58CEF772FF6BDF35C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920335, "uuid": "1baaaeb2-29ea-4332-86c2-7d31379094ad", "value": "768:VL/I83RvxEpRrjevZCwVI8gBZVWpf/wak8y0VIedb:tnRvKbII/kpw78XVIIb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637920335, "uuid": "a4522f21-c9ee-42e7-b030-c2843eaf94ff", "value": 38049, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637920335, "uuid": "d1206bf1-87a8-4366-99d2-648a5041b726", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637920335, "uuid": "71a38650-cb2f-4f4d-a3a7-a9e4fb5dc069", "value": "Invoice.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "176213f4-4e7f-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637906830, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637906830, "uuid": "748769e9-8dbc-4835-985f-46b0e4355868", "comment": "Malware payload", "value": "6616e6e1cfe2c026348a31683bf26f4b", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637906830, "uuid": "7588483e-d1d5-4e04-8915-c0999e6310ad", "comment": "Malware payload", "value": "e7fd765a1789a116bc735092a38cbfa17fa2eb36de821721a0559b5fd1e0aed0", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637906830, "uuid": "6cf63bc7-5af3-4715-82d5-4f44520686ca", "comment": "Malware payload", "value": "a8ae11211f4d315b43c5ea6262311b4fde13e876", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637906830, "uuid": "ea880316-4e24-4fc0-a2ab-96b810cd8310", "comment": "Malware payload", "value": "62ec91df23a984947c6659d457f9d1e1b30a25de9b9aa8f73438a1f793694bca52bd0b08f8b1af53996d65a19e8b0813", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637906830, "uuid": "3918d13f-4491-48ef-8981-addb30a8ae63", "value": "T109B012A06CD4DC6007CD0E94003DD73DE931D6302CE5E48224F55790D20C6C1BE20EB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637906830, "uuid": "6e6070f0-f2c4-4713-9a81-cb0331b5b42d", "value": "3:gJc2fu1q90qYGRXPKKRcLM3mQRGfwr/TWp7b:Uc2fu1q5YcPKIcLM31GfwrbWVb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637906830, "uuid": "fdd23316-2a06-4a30-84e4-e6eae1bb285e", "value": 112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637906830, "uuid": "805798ac-59c4-4899-8f89-30f8695fab12", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637906830, "uuid": "72ad8a93-1674-48c9-96dc-befd81276bfb", "value": "4ix.Hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf52a2bf-4ecf-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637941471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "94ca7edf-ce11-491b-a2a7-11dc1012b11d", "comment": "Malware payload (Heodo)", "value": "e3a28bdd91ac16775990ea636e0398b3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "368a7471-420a-46f3-b934-d873d6e106dd", "comment": "Malware payload (Heodo)", "value": "e9395d08f8a42d10e0bbf3b8c9a42912b715ad704ba8e511cd566d7cc917771c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "d79c1d6d-f94a-4a9b-8417-333878c6770c", "comment": "Malware payload (Heodo)", "value": "19a963a334a57ffcd8c6879734ec4bddb1c4c0d4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "e7c87da7-35c5-4a4b-ac73-feac1f6a77a2", "comment": "Malware payload (Heodo)", "value": "f88e9d6d218092d5bfff3ee54aa9bef776dbf0e1de50056e14603d366b0cf3eeac50c4f7990e1c97173d346586975703", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "06f3d97e-1a06-438d-a0d8-ded4d3020973", "value": "T1FEE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "e009a3f9-8701-476c-b5dc-9cbbd24c698d", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "e6ff353d-2ad2-424c-aa54-9bc789649c84", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhxico09cDlB4Vx/ID:0uH0GCNeQ/i7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637941471, "uuid": "b9015db1-ae8a-4e7c-a9dc-88a94cecfa43", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637941471, "uuid": "a4cd547e-2cdd-49fb-8ba4-fba2d218ad73", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "51883770-e06b-4e1d-83c2-17a442afb880", "value": "emotet_exe_e4_e9395d08f8a42d10e0bbf3b8c9a42912b715ad704ba8e511cd566d7cc917771c_2021-11-26__154426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19a7a3ac-4e52-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637887506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887506, "uuid": "2f1e1ba1-88cb-42cc-9818-60aa644be5b8", "comment": "Malware payload (Heodo)", "value": "09a2601c2c5bfd55671d2a1c9689e77b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887506, "uuid": "be13dc4e-52aa-451b-895a-dd407634f756", "comment": "Malware payload (Heodo)", "value": "e9b3fe6b797a79043b0b9e346f1681c7298051e5442db4bede31dcaae7754952", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887506, "uuid": "945cf104-6eb9-4d6d-962b-377f14c0a650", "comment": "Malware payload (Heodo)", "value": "116c1a516cd9967a77d4e5317962a66a5a4bc9c0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887506, "uuid": "d55caf4b-538c-4a11-bb1e-9222a016242c", "comment": "Malware payload (Heodo)", "value": "a4bd2bc34c34d1168154889049482317d31935d0f1c0cc95f341ba103d7641e63f45979cdf5949ae472fe93c4677703c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887506, "uuid": "fa4ccbb1-1b6a-4971-bbf6-a10d3446dc1a", "value": "T198C4BE11F3D2C436D0AF01357616DB9927B9BE61AE758293FBE47B4E1F314C28A38642", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887506, "uuid": "30b518d6-3dec-4cc6-b3c1-eedf16e356d1", "value": "43031315f82b6fa0235c2c3dae2afd94", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887506, "uuid": "82c05435-5f58-4ab8-b16f-57e0adcb2c66", "value": "6144:fJ4kSRXCb0GNf0QNR+hbspY72fZ84iP/MaDO3HhXqD/hN4+XWrS4raGIKRCBKh:aC1R+6PfZ8l/Mz3HhvTO4p8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637887506, "uuid": "22ee51af-1dce-4abd-ad7c-b3c4865c0e82", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637887506, "uuid": "2224914c-7733-4878-85fd-e155283ec0c8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887506, "uuid": "59b15db1-b32e-4ca0-bea0-9a9a0e2bbd60", "value": "09a2601c2c5bfd55671d2a1c9689e77b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b28bb6dd-4e61-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637894205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894205, "uuid": "85ac7f70-f11b-47a4-9b77-c44dd1b1fc94", "comment": "Malware payload", "value": "db0e3a5196487db895982febc37e9777", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894205, "uuid": "17534158-bbb3-4fb9-9780-ee63b1fbb51a", "comment": "Malware payload", "value": "eafb8b10d4cf9d73403317cb0589635bdf368c9b82296584d8d7540932dcbbce", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894205, "uuid": "743da73b-5fbf-4506-998c-32a25313e26f", "comment": "Malware payload", "value": "aec5c3cb12e77ba0eefbfcb208a2116ca51c13fa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637894205, "uuid": "d595df05-d576-4ebc-92ee-39f1c3ec082e", "comment": "Malware payload", "value": "de9587702bdd29dc881487ea7944b88932d5e4896c974698f12b277fb729d6c15c519f5340392690c34b3247f3c00585", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894205, "uuid": "745d901b-4652-4e94-b815-7c4c56100c62", "value": "T1BA23F22D9513E6FFD47C28B9626D13152C731AD7FA4FEA876410BA63BE0281834573B4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894205, "uuid": "cae9ec3b-d2f9-4753-9c0c-78e70dc8c0fd", "value": "768:gSZ1Lqm7M+thM0Aotin5vmtK0R7AZd8qLE3rMkSRlM0l8VjJgGlzDpxYsd+Cjfay:TD7MChtALdmR9AZd8PgkSRlkVZVrYM+O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637894205, "uuid": "1fd4de1f-556b-4093-86a7-821665e228d4", "value": 46932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637894205, "uuid": "3f2f4269-91c6-4b7d-80c4-1fbc43aa69b4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637894205, "uuid": "6e122534-6cab-45cf-a8ac-eb9930db65ce", "value": "db0e3a5196487db895982febc37e9777", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf3ba669-4ecf-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637941471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "4b4a3a9f-dcff-445c-b7d3-9657b54001a5", "comment": "Malware payload (Heodo)", "value": "b042e9ba0e173bfb55aeadecc5ce6720", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "efd0e13e-a979-4392-89ba-974c782ae2c1", "comment": "Malware payload (Heodo)", "value": "eb2fc4321968fbba8aa2fc7f381f1fde43eaacfde6d95e40f9d7e0191c01b175", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "812e9f2e-8c89-4962-bb88-88042723f967", "comment": "Malware payload (Heodo)", "value": "7cd8b52b75210ce4e94a5cf166fff811104bfdf5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "12ecbf72-69a9-4baf-a20b-7d74d2c98525", "comment": "Malware payload (Heodo)", "value": "a9ec341d465efeaeca017ce1db5b34f5f1538bdda0ae7a359c07b7f48526fc1588b3c151b2f4bd80b8af3f70fcce9562", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "3de26352-1466-4769-8246-659e28047cd6", "value": "T14AE4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "bb3c0bbe-3eea-41aa-9e72-c7fa4b971e77", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "8f1fca19-98cf-466b-a49c-d0d2323022ec", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhyico09cDlB4Vx/ID:0uH0GCNeQUi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637941471, "uuid": "3217e024-8cf1-4b63-b182-c286a99fbcae", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637941471, "uuid": "441e753d-411c-4bc9-a506-66420bf48021", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "cf7e218c-f615-4363-8543-023e47fce821", "value": "emotet_exe_e4_eb2fc4321968fbba8aa2fc7f381f1fde43eaacfde6d95e40f9d7e0191c01b175_2021-11-26__154426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b279a293-4e87-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637910526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910526, "uuid": "b0067023-af57-42bc-9f29-87b489a1428c", "comment": "Malware payload (AgentTesla)", "value": "953bb3f3e78ad51aa164849fdabf8cc6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910526, "uuid": "bb2e9e98-3f78-4968-b542-2f5fdf4da4e2", "comment": "Malware payload (AgentTesla)", "value": "eb317d5ea6169fd6359fd184a91c7948cce6a662a92405df636592952f1f20c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910526, "uuid": "becf3222-f74f-46e8-97dd-2340f6cdbdc8", "comment": "Malware payload (AgentTesla)", "value": "ab7f178497cd07563244336169a2a438cf1df199", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637910526, "uuid": "35f797f5-2242-47d7-a21f-933ba5b8489d", "comment": "Malware payload (AgentTesla)", "value": "fb4bc9fc992c7dc0d7dbbf247251d54ad5b6949a8c00047061af8e686522b4555e84390f8fe6bf0a688c729eecdae07d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910526, "uuid": "faf76b4d-a7c9-49d9-8923-9a3ba9d97e98", "value": "T16A84235FCEC99DC64A8F10F635E38BA88886884512154ED81B71FEC61DA6CDC8FAF435", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910526, "uuid": "7d4c31de-fdcc-4674-8c9a-464500d8b059", "value": "6144:VidYrt8eNvKjx/mXEnJMu/GeqxFPxsDxTxBrUIT5uqChy7QkHKlIwj+:V9B8+Kjl1Cxr5sDZxBrTChy7Rzwj+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637910526, "uuid": "25058992-ac3b-4acf-b118-a6641281d902", "value": 401391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637910526, "uuid": "461a7052-d852-47a6-a192-40b787368502", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637910526, "uuid": "6b998ab2-6337-4406-a1e0-0e9a124fa693", "value": "TRANSFER SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9053f7-4ea4-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637922787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922787, "uuid": "90faece1-f678-4f7e-bf92-ba386a73e4d4", "comment": "Malware payload (Loki)", "value": "52d50085e36b7323f6f9f31f19ef1ac9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922787, "uuid": "ca180553-882c-4bad-9b2f-c844701240d6", "comment": "Malware payload (Loki)", "value": "eb73f45abe366a147b234405441598554f11281088e3ed0909711d2988429739", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922787, "uuid": "8bef715f-2af6-4289-8c68-15f37ac82e2f", "comment": "Malware payload (Loki)", "value": "8d4ae19783fb6c72be8040401da080b3e728de17", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637922787, "uuid": "201036b8-9829-4a45-aa37-3a8f22c5c1a0", "comment": "Malware payload (Loki)", "value": "d1dee315462b1715b2e0be7018a15796046410d5eb9db9c3183228541fa455577a0d3d0be4e756d7cf832ca280bbe5e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922787, "uuid": "26a9cc90-b41b-47b4-939f-d65e6a22b9c3", "value": "T1D964122F51D264FBE696C93541F3A3B6D2BA0387127B1F0B0F801E532F662D19B88719", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922787, "uuid": "b4c79496-ac8c-4982-8f67-7c642868dba5", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922787, "uuid": "5bc07159-1f9d-49b7-91e2-af7b9aa0d744", "value": "6144:rGi62orLo0W+FE/cAGuXlDk/rQI7rA4OONaDN7m2W6ngY5MGYoc:e22Mf+FEkKiDQsrG7rWgJYoc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637922787, "uuid": "6d9690a4-8c51-409f-96a4-a09c51547c4b", "value": 335116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637922787, "uuid": "0ffda43e-40cd-445f-8644-1e4e400cf5f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637922787, "uuid": "b447fceb-16f1-4e87-8ecf-ebdb29a6a7d3", "value": "52d50085e36b7323f6f9f31f19ef1ac9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a3157c-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918876, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918876, "uuid": "0c509c01-3996-4bd5-9b31-d0da9ef42d2d", "comment": "Malware payload (Dridex)", "value": "fb0979bd562c4f18393ec92c8de9989f", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918876, "uuid": "6e94b080-1433-4555-8166-3c8002e4263b", "comment": "Malware payload (Dridex)", "value": "ec8dbc3e4d86b25d943dfbb2eff71a10b09ac5acc5a9648ed6e4537da666cf9a", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918876, "uuid": "5419b4c4-2929-48e8-b27e-28aee4c99ec4", "comment": "Malware payload (Dridex)", "value": "e5f1e762d8f0a522806e77cf6930ef6f05299993", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918876, "uuid": "31ed9551-0401-4b4b-b81c-f86a9c7fafca", "comment": "Malware payload (Dridex)", "value": "e6689cda51c7a974b306858ab04836fcd75205affa009bfe1d2da7feef86e857b4f0176ea1dbe8c5b50a5566e18c06af", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918876, "uuid": "f61832b0-7496-4584-9b78-f6329e2acc76", "value": "T1E155D162D36871E8C5639A31D07F551F0AB66C2268598215FB723A700D3FBC9FFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918876, "uuid": "9da3037d-128d-4480-a822-f26b0d8f2b1c", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918876, "uuid": "05af2d73-1e7b-4a64-8cc0-0e479c09b0f2", "value": "12288:BGVNJAvuPFUl/faxmVlBLXKCgFfEK7JRLeHlX//ve7:E3JAvRl/fKQKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918876, "uuid": "4b865502-0b59-4594-ade4-92f79a4bb6fe", "value": 1368064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918876, "uuid": "36561f23-f6ec-475d-ba45-969bc9c64d53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918876, "uuid": "c367245e-d4d0-4331-8644-2f50410b0d0b", "value": "ec8dbc3e4d86b25d943dfbb2eff71a10b09ac5acc5a9648ed6e4537da666cf9a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "062daf6e-4e84-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637908948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908948, "uuid": "fb4d51cc-0412-4746-8286-e9d40d7920b0", "comment": "Malware payload", "value": "a8a00d83c5f3e11044176691a42fb780", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908948, "uuid": "5bd6a048-4150-404e-85d7-50e1510e2577", "comment": "Malware payload", "value": "ed888c5440254e0626c897c2add0df6444821a1000f209f577e6f9e835130d61", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908948, "uuid": "cb8f5bd3-0221-48e8-a545-dcaceadcfe76", "comment": "Malware payload", "value": "04c22904a3337f2f2cb0fd6d386b274bfda71a5f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637908948, "uuid": "9978502f-4aac-49ea-ad52-7da8936ebece", "comment": "Malware payload", "value": "61ea0c26c32247bbd7428dcfd3edfa49c9ad0180aec83deb2abf199f57f57e693457ba401597c5bcb46a44d2d227cccf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908948, "uuid": "be50689a-46c6-4302-ab99-21b8466eefb3", "value": "T1AFF3D00326404742F46E4274ED63938C2F25AC5CE99271AF226B3F0AF7B57764A2C739", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908948, "uuid": "0e2536b5-ce2b-4bda-b4ae-a0d63b8989ae", "value": "3072:YqVFVUTsBft6QBnT5RZzO3iyXn47STz70eAPLA9j64lY2v6fQTO:5VFVUTsBft6QBnT52353DpkAA4lPioT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637908948, "uuid": "9ee2a2d1-9e73-4f91-9ca3-6d28cc54b6c7", "value": 162304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637908948, "uuid": "5e50e884-ceb3-481f-bbda-2a99f62c6c70", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637908948, "uuid": "802d4266-4590-4434-86fb-dc7163e12841", "value": "FCB Payment Approval Letter..doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf6b8ed4-4ecf-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637941471, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "c2c4d7d8-6c79-481b-bfe5-2977684193dc", "comment": "Malware payload (Heodo)", "value": "21c70c9ac6820f91d3633eb429ec9e41", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "53192173-4992-4116-849b-80cc1c6a8c46", "comment": "Malware payload (Heodo)", "value": "ee3905a30acae3df4878f8ffb4ed1d23be75364987650d09bb5ea313d48184fc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "ba4ae5ab-003f-440b-bc5e-0caf9394c938", "comment": "Malware payload (Heodo)", "value": "c6aa03e5ea4bb2a25994bcb9c9e8d09a599f5fcf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637941471, "uuid": "e38ed6ef-568c-4b88-96a3-f3e0ee47fcec", "comment": "Malware payload (Heodo)", "value": "02661332abec4e7747bf8e0e84e366f944db7d7e2fbb1199e70956e0ee34b2b7a73e2231af8e8ee5e4dbaa5382a2bf92", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "9d3a4ac5-5634-40b9-b76e-5e12e1bf063b", "value": "T192E4AE1173C1C076D5AF02314916931C72F6BD908FBA868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "f71e584f-e8c0-47c4-8d1b-b61929597a1d", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "f68bd8d0-54c7-4bc5-917e-89232e8479a7", "value": "12288:FqQlvIOH0GCTBHmPt4eBQhHico09cDlB4Vx/ID:0uH0GCNeQxi7H0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637941471, "uuid": "c6dbac66-aa42-4e43-82e0-d590e0af46f5", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637941471, "uuid": "cee4acd0-173b-40ab-aa43-60106cb538f6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637941471, "uuid": "1d25a6ef-373e-4b48-9233-c13ab0afa2c7", "value": "emotet_exe_e4_ee3905a30acae3df4878f8ffb4ed1d23be75364987650d09bb5ea313d48184fc_2021-11-26__154426.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d630d53-4eb0-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637928073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928073, "uuid": "a77bfe98-89bc-48e0-8bbb-e09ad7807f87", "comment": "Malware payload (Mirai)", "value": "117761a4605028e18b02343b8f54eefd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928073, "uuid": "d95831ce-c5bd-402a-8d59-a9ecb8f56095", "comment": "Malware payload (Mirai)", "value": "ee601320a4dffda2c5963cace248799d9d85dfcd79e69cf366ad32095f3ab70a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928073, "uuid": "2ae729b9-124d-48d6-99e2-285899fb316f", "comment": "Malware payload (Mirai)", "value": "e112a9f60ffe6d4a20336cc9e8428d0be0392796", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637928073, "uuid": "d4c6b28f-f7b9-4641-a77e-c2f9fdd0c261", "comment": "Malware payload (Mirai)", "value": "21a0336cb7b715629ad1cbd789e60843ed840e52ea9688e99a85d604da87f1c5b352dc155dfa96f897e7b554188af747", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928073, "uuid": "7ec709e9-a265-46c5-9091-a43287a997df", "value": "T1023319A52A81F2BCD6E100B8F04B62E51A630A1C269CF1E370D3557AEF79F08357DE59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928073, "uuid": "e49422d6-c0fc-4cf7-a268-836fa9d50acd", "value": "768:PpJSspeBZygCiONU6OzZbEj4L6EJMvlDknczU9:/SssBZki8Otbc4uEFczU9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637928073, "uuid": "294aa14f-44c6-419d-a028-439ff49a8e1e", "value": 50560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637928073, "uuid": "b018e5fb-d975-46f5-879a-15234dfa4e48", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637928073, "uuid": "17e2ec27-caf2-4106-8e3e-0a916629cb49", "value": "117761a4605028e18b02343b8f54eefd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7dbf1fa6-4edb-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637946515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946515, "uuid": "f713da90-5325-4db5-bc1b-0369417b9f44", "comment": "Malware payload (AgentTesla)", "value": "b1a66b6b613e01ab3397af13bb090167", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946515, "uuid": "f2370d4d-4c69-4dc4-bdf1-1d58328093e9", "comment": "Malware payload (AgentTesla)", "value": "ef399849449ea137a53b0769960c4fdd204fea9153d89b96fdd5a7ead13927d8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946515, "uuid": "f98615f0-e30d-4574-bfb0-4da6db2bdde2", "comment": "Malware payload (AgentTesla)", "value": "e1101b2e10c3226c235fdd7e87b02c336f233d6c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946515, "uuid": "e7a178e6-9cee-462e-a893-411a413dc156", "comment": "Malware payload (AgentTesla)", "value": "add668c1412faa561e2e8a94a5715fe72894e8c4cae3c973009d529fc53f8812d8bcf89b8fef0c8a46ac59a46c2aefbd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946515, "uuid": "09dbc69b-898c-4e2a-a3d9-2330874aee6d", "value": "T185A41201327C6F17E6748BFAA5A0B05153F9263E51A1F78E1EC2B0EB1FA6F150582E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946515, "uuid": "b74b6e1b-eabd-49b7-abd5-6c4469c5d8a4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946515, "uuid": "abcd3d5b-a335-4cfd-821d-2b16e75d042e", "value": "12288:vaMjoLFVO2L9kWPMOmsKJwDVHfn54l6wUIkUixBFm:vabhVt9kWNPKKF6YwTzi1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637946515, "uuid": "05fb5721-4357-4b86-bd94-213aa8c78d12", "value": 488960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637946515, "uuid": "7b14815d-ba3d-4c0c-a574-dea61baa6b05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946515, "uuid": "f3ba9508-c40e-400c-ba89-54a4b6af02b1", "value": "Orden de compra_CN 443635.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1298d003-4f0c-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637967381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637967381, "uuid": "d01b4dde-a223-4c31-8243-2bc1edcff181", "comment": "Malware payload (RaccoonStealer)", "value": "65e5f0263c181a9597d9fa1ee7e79644", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637967381, "uuid": "3693095b-db3b-46de-966a-eefbdd1515b0", "comment": "Malware payload (RaccoonStealer)", "value": "f1203a90897dcc7df33bf3e50f26e55bc88021898aff502304272bbdff98ac1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637967381, "uuid": "4fcf4031-a8cf-4a20-83d9-705912661c7a", "comment": "Malware payload (RaccoonStealer)", "value": "9229596d2cb33bdc04cb83471e75524df8e2420d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637967381, "uuid": "cb071e5c-8e5a-4e59-b092-f9ec06d993de", "comment": "Malware payload (RaccoonStealer)", "value": "19f8ad347cd0563e528450fca9ac837a3ca9adcbb1ec56732a3699a313c6f483c69fb39d98623b929bf9c46b5310de6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637967381, "uuid": "7ed787c7-6832-46dc-9010-4d01fcd8dc3a", "value": "T1A52502D171B14AD5D9A98771CC22D4802332FE4E666D8A3F1496FD4A7B7231B0E23A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637967381, "uuid": "e512fb39-e2aa-460d-b735-c6cc44abb31c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637967381, "uuid": "446be86a-7dba-431c-a846-abbca116ad63", "value": "24576:+C0OrlQDKDmf2MyPpGIWKX6WaheLEMtumKngP:+C0ou2MepGlK1alMtuFK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637967381, "uuid": "6c81e86e-f1d2-4b85-aeb6-794f921a6a2b", "value": 1036800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637967381, "uuid": "da5a7437-004a-4a7b-a5e3-0c5fd6b11b3e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637967381, "uuid": "e40561a0-c7e0-4b80-a5c3-524bd077f070", "value": "65e5f0263c181a9597d9fa1ee7e79644.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9f40e61-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637918753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918753, "uuid": "ead26188-f0cf-4500-b463-c12d8525804a", "comment": "Malware payload (RedLineStealer)", "value": "e3f1d20143671e98a7a5000d31c7727b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918753, "uuid": "2fa76193-5cbd-4393-bda5-1da21793de53", "comment": "Malware payload (RedLineStealer)", "value": "f154e980cace183b5ce4d68c2236812f135c5af65f10ca3f62a6db81ec3b7c2a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918753, "uuid": "d64127de-3d7f-4140-9937-364f42b766f9", "comment": "Malware payload (RedLineStealer)", "value": "bddf84f4c0ed9df72598ba66c38d78d7c10bc8b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918753, "uuid": "bf64ec47-4d47-4746-8d05-330f15b48d1d", "comment": "Malware payload (RedLineStealer)", "value": "14bfa2334e3e10c56814b6d2dd3f0129d52117c57a14d5bb655d541ca06d59c0adff4ffcd37f08df8d0cec9d08fd161a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918753, "uuid": "fd621c22-ba33-4b69-b25d-9c46bbc82e1f", "value": "T1CDA35D3067AC9F19EAFD1B75B4B2012043F0E08A9091FB4A4DC154E71FA7B866957EF2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918753, "uuid": "a88dad08-b955-483e-a6a2-0837a6b58fe8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918753, "uuid": "4559ae15-44c2-4d2c-9280-efebf42dae47", "value": "1536:5qsCbqDylbG6jejoigIj43Ywzi0Zb78ivombfexv0ujXyyed2j3tmulgS6p8l:XEwiYj+zi0ZbYe1g0ujyzdD8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918753, "uuid": "21130520-d97d-4ac6-8dcb-e3d76ab07e1f", "value": 97792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918753, "uuid": "eff76787-2096-4306-99f0-40bfff1ad139", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918753, "uuid": "acb4cd71-db94-48a4-a33f-8479a1f2331d", "value": "e3f1d20143671e98a7a5000d31c7727b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a499cc-4ec0-11ec-843c-42010a9c0014", "comment": "Malware payload (CoinMiner.XMRig)", "timestamp": 1637934793, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934793, "uuid": "5e66c764-7558-43ec-b8bf-71673563b7f9", "comment": "Malware payload (CoinMiner.XMRig)", "value": "decc8063a0859935b9028e5f8d90cb03", "object_relation": "md5", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934793, "uuid": "d972d673-7b70-4d06-869c-0c3e6432d9be", "comment": "Malware payload (CoinMiner.XMRig)", "value": "f15e77a9002b5ff912240ed81aeb0ab548871d5efdd09972bcdadb153198bc68", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934793, "uuid": "abd00b5f-ad47-4080-9bd9-7203eff6fc81", "comment": "Malware payload (CoinMiner.XMRig)", "value": "1d7d8a61d810a4e1f20a4e1bcea11df98f000fd1", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637934793, "uuid": "884994af-49da-4ba1-ad93-78cf602b3e00", "comment": "Malware payload (CoinMiner.XMRig)", "value": "29f333c37df06bdf830239a255f04379ce6c7ffc03da94931524389b1dbb3e59ffbebf3923434b8d17a8a48fe9f82dbf", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner.XMRig", "colour": "#C10C3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934793, "uuid": "5070821e-5185-4cc8-9798-e1cc0e1c5003", "value": "T1966533ABA2D09F34F3C352F03647D61BA8E197025DB6A0552178E813D508AF6BE8D77C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934793, "uuid": "190e7152-ea0f-4c9a-a1f6-61fd55ff9e4a", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934793, "uuid": "03182d0e-c651-4c86-bf26-950f304ce1a2", "value": "24576:l5EtMxgRmY3VEtPUN2x5ehgJxb15YTnTckheWNl60aCg7V5EakEaHNYK3xqdWOW:YmKmuKPbcgJRYvjeWNbE3NNalX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637934793, "uuid": "3cfd4c71-655d-45a2-85fa-9b370c44f87c", "value": 1515104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637934793, "uuid": "1126d1fe-91c8-4191-9f48-2335cb8eeef4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637934793, "uuid": "512e08be-cbed-47f9-97bf-d4a195dbc7ee", "value": "file2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df884d01-4eec-11ec-843c-42010a9c0014", "comment": "Malware payload (Socelars)", "timestamp": 1637953981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953981, "uuid": "f024ddfa-f0f2-43f9-8d9a-f3bc33ccd753", "comment": "Malware payload (Socelars)", "value": "fdbb6eb1058252d82d5c5436b910c78e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953981, "uuid": "d343aa34-89f0-4e47-826c-156e44be5691", "comment": "Malware payload (Socelars)", "value": "f18ede26c6bf2a14546009d40fec04c92bf9eed9e37a122c05d5702b975fa072", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953981, "uuid": "f36fec89-22c3-44e4-8ffe-46538e0b8ec9", "comment": "Malware payload (Socelars)", "value": "119d9e1e7f83497d8671d1260413fc1667c561c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637953981, "uuid": "afb2da6d-5194-41fe-b707-08d4baa72c2c", "comment": "Malware payload (Socelars)", "value": "15f473be9cdb0c6ad6c227313f2b08385e4f62036c3e65983dfaa2b7f38987e8d7bcfdb44d65c3329494980b29d89777", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953981, "uuid": "27be2b89-4e19-41de-b78c-bb67994b1283", "value": "T11B659F11F682A036ECE3007282FF5AFE9D6CB621030854D7E3C45D695E619E37A37A5B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953981, "uuid": "7b28f583-cbaf-4fdd-907c-249e3df31e51", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953981, "uuid": "a0fdb3f8-cb87-45c8-a608-90753a61adf0", "value": "24576:uCjpXA4U35ozW03XRp/hESVE50U2xbVvBpVdnz4ORZgjCNnR:7pTJxPzlJ/dnz4ORZKCNnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637953981, "uuid": "0c5a4b08-a0c1-44cb-8193-08809ccbec86", "value": 1489920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637953981, "uuid": "2714c100-c4a1-4366-8add-8c51d8192e74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637953981, "uuid": "7e0f22dc-e39a-478f-9f57-4dfac1c48e6b", "value": "fdbb6eb1058252d82d5c5436b910c78e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6f3f390-4ed8-11ec-843c-42010a9c0014", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1637945349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945349, "uuid": "8659f647-003e-45a1-bd43-a1addc7589bf", "comment": "Malware payload (RaccoonStealer)", "value": "34d596186fea8a357e2bd80ec36dcd51", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945349, "uuid": "d000116b-a0fb-4e34-a701-4ce7ba07770c", "comment": "Malware payload (RaccoonStealer)", "value": "f1d98438e664906a234fcffb43ec48b80f2722c28c5462fa04f859bca022187b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945349, "uuid": "ff2c488d-ea46-4c15-a096-fe9452b69edb", "comment": "Malware payload (RaccoonStealer)", "value": "39e1a98d0e3a877b94c8a7c1f6272bc6ddef38f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637945349, "uuid": "093878c0-1d25-4c45-98d2-31996a0f46e9", "comment": "Malware payload (RaccoonStealer)", "value": "90582de99b15df1fe479a945cb4cd8d53036b8ad56326c7439f6c2e90736b6bc8521505baf73f6da6ca7542eb05c5f9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945349, "uuid": "fc7c191e-9200-4490-9088-55a5b89f9af0", "value": "T1AB653331E35F1C9FC0AE8A368E93B76BD9C8041EECD836C35727A4958467CA93E45874", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945349, "uuid": "83b56b0a-8eef-4a74-b0d2-6842a828260c", "value": "22301bd01fecfc0f42cc27a9b8788c3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945349, "uuid": "ea4eb25b-c7bb-43e6-8d5b-2d953d7d9f11", "value": "24576:gITq8k9jZmSVOsGx9u62G1NoHMVOWbBwY9f7IuWggkEaHNYK3sTDLrJ+Yvwr:xq8kySVexca1N9nVJpgNaAD/J+Y+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637945349, "uuid": "db670c14-e261-4447-8c07-e0c7a782208e", "value": 1492192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637945349, "uuid": "53ca0cbc-acb5-40f8-9108-f10e0b7cdbeb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637945349, "uuid": "6369a274-9282-482b-8ff4-8c9f33597ce6", "value": "Sony Vegas Pro.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc4b12e8-4eca-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637939372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637939372, "uuid": "34e88697-5bc1-4431-94f5-b439c090bd56", "comment": "Malware payload (Heodo)", "value": "d3aacba7bb63cf36f84026b00eff90cf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637939372, "uuid": "99d6adbc-4de0-4dab-bcce-67df8266a2ff", "comment": "Malware payload (Heodo)", "value": "f1e29bb4342ed9dde0309dd031c1d90271fbffb329827e42101346f5923bd224", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637939372, "uuid": "c46c159b-2d7b-4e03-84e1-8f80d8209c6b", "comment": "Malware payload (Heodo)", "value": "6a1e65f1c992ac729ef9861cffde7547900f520d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637939372, "uuid": "ed925651-b650-4d53-88fc-ed6ee86daa8a", "comment": "Malware payload (Heodo)", "value": "7c9d559523eec69bc2229a61429175625e30ca1c25433df35797074ff63d77ee22286508b095ae2f9890812efe713cf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637939372, "uuid": "4547db85-2778-4843-b460-d4c20e34b5a5", "value": "T1F8A4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637939372, "uuid": "3c798cf0-8177-4fbb-aa8a-1359028ef34d", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637939372, "uuid": "f4a5413d-0411-47ea-9aa6-9252fd789e2b", "value": "12288:o4xZ0/tI1BD2LETv0Fh+O9U6W8XUDaBN7a1vt:oED2LETvMYb6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637939372, "uuid": "0fad2720-718f-414f-8af4-1b83a10fbc91", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637939372, "uuid": "040f3803-4654-44a7-95fb-9d4c8a81e818", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637939372, "uuid": "d2a7bea9-e7da-44c8-8436-a5702503ccf4", "value": "d3aacba7bb63cf36f84026b00eff90cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "920bb8f8-4e90-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637914337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914337, "uuid": "da2738a3-c2b7-4def-aca0-cb02f9dd9bc1", "comment": "Malware payload (Heodo)", "value": "9ae817dfba15856c04a051996350c540", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914337, "uuid": "c53625df-704f-41e3-9ecf-d16a5793c4a2", "comment": "Malware payload (Heodo)", "value": "f2243fbb56a5ceafdbac83568f997149541d5f5f483d7484f9d5cbdb2f2c8c40", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914337, "uuid": "af1b9af6-2045-4c1f-bb35-2c9678b98da3", "comment": "Malware payload (Heodo)", "value": "b1b425253c46ce323a4a055e5af62fcfea03b0dc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637914337, "uuid": "3666fe5b-4683-40a9-af78-0ec20ae5c790", "comment": "Malware payload (Heodo)", "value": "c5e5dc35f5d222dfdd6323b6b30d167323e4a5017204a9b05d0f0bcc6fc3ebfae27aeb3bb3d1631fdedffaecb75bb085", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914337, "uuid": "11076067-fded-42c2-b3a5-0419e4e6a1df", "value": "T146A4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914337, "uuid": "eec1feea-88bf-4a16-850d-5708fdc06644", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914337, "uuid": "f619d870-15a6-4322-b054-f53784b3b83d", "value": "12288:o4xZ0/tI1BD2LETv0FhFO9U6W8XUDaBN7a1vt:oED2LETvMzb6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637914337, "uuid": "4d095c81-8b8c-4c06-9841-184a88e30d6e", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637914337, "uuid": "4355e5a1-f723-4590-9788-484a6a5fb39d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637914337, "uuid": "ef470643-59ac-459f-a129-74ff78831fe6", "value": "emotet_exe_e4_f2243fbb56a5ceafdbac83568f997149541d5f5f483d7484f9d5cbdb2f2c8c40_2021-11-26__081212.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "227e08b9-4e65-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637895681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895681, "uuid": "db183cea-2a0d-41e7-9008-34ecfb017a26", "comment": "Malware payload (Loki)", "value": "3d20b115d9a2887f15b664b5b193ae37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895681, "uuid": "6675359e-e3df-432f-85dd-0b6080dacc58", "comment": "Malware payload (Loki)", "value": "f37efd92a82f614d8b2c6b8714cc8a19e85ef7e5288dc7357e13efe831b27d6d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895681, "uuid": "004f5252-5e82-41ff-97a7-ef4b4abf5e4f", "comment": "Malware payload (Loki)", "value": "2b6a9f0269ac0f1e321f3f4239cf2510496eac1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637895681, "uuid": "40b73714-751a-4bdf-aa05-d10680948da5", "comment": "Malware payload (Loki)", "value": "7dadd0031d11e302251fe517acdeac40216b8cf73c6c4dbb7fbcb15cb6ddfdba1f2b1db10847fa8877eed0c009443ced", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895681, "uuid": "baef3700-0fee-4a7b-a01d-2fe91af1fd97", "value": "T1C86423276FD001ABF9D2D2701DBAE7A0C3BD1BD58B759A4B1BB81EA22CD61C34538191", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895681, "uuid": "89fc6865-697e-46d5-93bc-249a31704ec9", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895681, "uuid": "f0ed810e-b1b8-4a04-b527-91ebb25f246d", "value": "6144:rGiwFv6cGNWs+oZqExywHycHZchICEglejwrBa6KO9B+Xd/hfMO7WwlVp:qYWs+oZ3ynPELwrBAO9EXRhfT7tlT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637895681, "uuid": "54060ee0-0069-46d8-9417-6297505b8457", "value": 309626, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637895681, "uuid": "e365ae4c-2420-41ab-8d11-7ffc61ade8ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637895681, "uuid": "88c3cba9-d7bc-465a-b1fc-7cd30930c3a5", "value": "3d20b115d9a2887f15b664b5b193ae37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc4e25e-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637919001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919001, "uuid": "432ca6e2-e9e1-45ec-830f-fcd10efedac3", "comment": "Malware payload (NanoCore)", "value": "b273bfba69d7e8fe82fbdf48c41fb887", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919001, "uuid": "e38f9acd-d3e8-456e-b380-5f9523ac4067", "comment": "Malware payload (NanoCore)", "value": "f3bfb9c5eac0d816809f6d264de160d15e530a84806606c8c73d244eb52c0676", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919001, "uuid": "a5909392-dcf5-4c9c-ac53-998de834bf15", "comment": "Malware payload (NanoCore)", "value": "3510d4da03a45f21309065321646298f3085d4dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919001, "uuid": "d19c3b80-4772-4c13-9e31-0a257e5ae592", "comment": "Malware payload (NanoCore)", "value": "a9fa4cb93c79f0c2a77ce462f33502b891e6bb98c1cee8a216f491286222f1f2039515a787e6b9e520ddd6a35a17bd0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919001, "uuid": "6c62035d-35ca-4d7e-8dca-1538a3461a7a", "value": "T1F745BE02B3D5D036FFAB92739B6AF22256BC7D250123852F13982D79BD701B1227D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919001, "uuid": "457e0ef2-b2c7-4bfc-9367-5e41f7c2c451", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919001, "uuid": "0564ca8c-f779-43dd-9ccf-eba4408ae7b6", "value": "24576:9AHnh+eWsN3skA4RV1Hom2KXMmHaFZyrh9QI/C+EZCBqUIYXmf8MuvWzB:ch+ZkldoPK8YaFZyri7QPIYXLM5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919001, "uuid": "7d199087-5818-4c87-b9bf-b401a7518ecb", "value": 1254360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919001, "uuid": "d9441897-cee1-4de9-94f5-0a0060432965", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919001, "uuid": "b7111ce5-c694-4ea0-97e4-397de27461b3", "value": "f3bfb9c5eac0d816809f6d264de160d15e530a84806606c8c73d244eb52c0676", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9158da89-4ec4-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637936670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936670, "uuid": "3f23a6e4-32ed-4af8-9867-c5a28098e62e", "comment": "Malware payload (Heodo)", "value": "b73a896f67f465f81fba46af1b8fcc67", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936670, "uuid": "76bba7d1-085e-4387-9f34-ff225d9cf4a8", "comment": "Malware payload (Heodo)", "value": "f3fc91fd628c56569ae5344646fdc2155234c21c702c152247d86e00e4e51990", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936670, "uuid": "5af6bc41-9fb8-4b4e-9c7d-96b8bc1d8ed9", "comment": "Malware payload (Heodo)", "value": "62dcea5801b6d1b1059fcec1b3820e6b16017a8b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637936670, "uuid": "9b70772c-8caa-4990-85f5-fbad3e5261a7", "comment": "Malware payload (Heodo)", "value": "7844da32772e2041ff1549aa5a7006e1bc911f4019337b7e3a78c7d313f7a950572edd46a933a619dd2250863a5cb4ee", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936670, "uuid": "bbb03249-4caf-48aa-9de6-34044412638e", "value": "T1B4A4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936670, "uuid": "69151515-7eb7-43f0-ba11-2a4b2e3575af", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936670, "uuid": "6e843b56-e0ac-4f51-af85-23439ee18fff", "value": "12288:o4xZ0/tI1BD2LETv0FhIO9U6W8XUDaBN7a1vt:oED2LETvMyb6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637936670, "uuid": "c5f43673-5355-4522-84c4-c9a989ade64f", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637936670, "uuid": "29d28387-8e1f-4f12-986b-ee99ad8f84f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637936670, "uuid": "0f0a3cc4-c005-4813-bdcc-5b7b143cb114", "value": "f3fc91fd628c56569ae5344646fdc2155234c21c702c152247d86e00e4e51990", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb235331-4ee4-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637950564, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950564, "uuid": "5fd2ab71-cb60-4be9-8d57-7244eb0f1451", "comment": "Malware payload (RedLineStealer)", "value": "a43b1555ed04cc100412d57a3bc9178a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950564, "uuid": "ef7779ae-1ede-4f5c-b090-0febfc05c742", "comment": "Malware payload (RedLineStealer)", "value": "f4834b690ae6fd572f23a1d1be7528074c4ab5a2a3bfe758b317064fc4ee19f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950564, "uuid": "b92fa3f9-d9c9-41cd-9727-fbd1d6ac08cf", "comment": "Malware payload (RedLineStealer)", "value": "589fb74395dd059b3f7dbbbee3e8e7fe70d60ec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637950564, "uuid": "6d06c9e6-30e8-4494-b1e2-298c7f3930ec", "comment": "Malware payload (RedLineStealer)", "value": "3269e53a256207329af67f14002d0224ac9504cbb91411fb71bb0a4685620e38a8c0a160c0eb209e3fa43996e1b9a667", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950564, "uuid": "e428a198-91d8-4207-ac57-d3851db0bf4d", "value": "T1C15533EFC92D250DCAAB2BF810C0822796E8CEB40FF5652DF78649919728761C79D05F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950564, "uuid": "030770d4-a7fe-4f32-846e-a58c564c78ec", "value": "d7dd6fa75115d9909f747434e40fff68", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950564, "uuid": "1444f086-f409-4328-a037-9b9da3f09256", "value": "24576:TgGp61hn5ajhtB8sML3GWfplU8nIihWyPtapBkEaHNYK3wnJjBmw7:Tg9N5attXMvRltnpapBNai7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637950564, "uuid": "5cd121fd-28be-4df6-8df9-d562f93205b4", "value": 1328792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637950564, "uuid": "963aa69e-d8df-4f3d-83fe-88149b632083", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637950564, "uuid": "bb799cb5-1c31-49f7-8c07-fe614423a5d8", "value": "f4834b690ae6fd572f23a1d1be7528074c4ab5a2a3bfe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17546a9d-4eb0-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637927875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927875, "uuid": "deba8334-e02d-42b4-a290-6d7afc98273d", "comment": "Malware payload (Heodo)", "value": "1d0e15c0bb627fd335b6735a8078959e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927875, "uuid": "f66d5bc3-1f56-4d2d-855a-8cca18cf607c", "comment": "Malware payload (Heodo)", "value": "f4a6aa75bd85c3487c0cc6d20c70ed917b24a67e19176090fd98f90c5f3679ba", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927875, "uuid": "5ac04dd8-f1a7-4162-99e1-bb1ccb44cbbc", "comment": "Malware payload (Heodo)", "value": "a57c01b0b64bf9175e79b5cd64f18b04675cda67", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927875, "uuid": "e670fd55-1655-48d1-8e07-d1b9ff2bed40", "comment": "Malware payload (Heodo)", "value": "766e6bbe5221d6dd5ea1b2af2d53c4550aa7f6f89ea8ad78b5a40cf27c55d78ca7f47e36eb1eb8245db24c37c1f20f0e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927875, "uuid": "967e455f-0c06-498c-96d2-eeee877861d6", "value": "T143A4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927875, "uuid": "b82687dd-f2d4-413e-8262-a6701df23b43", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927875, "uuid": "b29e97d0-6eca-482b-9bcd-d75bc2208b13", "value": "12288:o4xZ0/tI1BD2LETv0FhSO9U6W8XUDaBN7a1vt:oED2LETvMYb6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637927875, "uuid": "0074b355-381e-4265-9770-23cd21eba62f", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637927875, "uuid": "47b196f2-e4ed-4c0d-86d4-b10968574f35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927875, "uuid": "91b297e2-9aee-452b-b999-d955cc1765ad", "value": "besta.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b76ceb7-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931103, "uuid": "544af269-3de5-4229-89f9-d6e4c8715b73", "comment": "Malware payload (Dridex)", "value": "08c6875bc81611e2ca718c13cb243d65", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931103, "uuid": "be624612-afb0-409e-a2d0-c24e0f299de8", "comment": "Malware payload (Dridex)", "value": "f552b727c2ea726bf41810bb5f5d2121b13f426ec0cb23201d4f8a9ce8f5fd47", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931103, "uuid": "29f0a857-c046-4c63-bda1-6eb384cb8bba", "comment": "Malware payload (Dridex)", "value": "7447b36ebed6fbce8c93ba7f4d7a426e96b8fda0", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931103, "uuid": "1491f50b-b4ac-4e93-b108-ee3f03b72b5f", "comment": "Malware payload (Dridex)", "value": "83f2cdc851e0acb24d885499b4c5b181f0049627adb70bc6d8b8140252543c5adde829c7f9019a20d611c02e1e4dcc2d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931103, "uuid": "900393f7-3b9d-4de4-9da8-4e43fd932bff", "value": "T17E83029DCA5C95BBC666E43B024F297AAD1585F06480E3AF54B8F20C11F2783734DA1F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931103, "uuid": "eb78dc0e-c472-4b01-b2bc-534d4e8b9c3e", "value": "1536:UWFPZZKz/1eCzbqzLkh/OPvTFVuVKqHEA1rdnkjU7AxwYUYVgdV:VXEz/9qGWPvZVuVK6EXo7Ax5USgdV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931103, "uuid": "7512f9aa-c77e-4bb6-a4ae-ee453875177c", "value": 83934, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931103, "uuid": "e066b96a-c421-414e-bd68-f4a4c0414f52", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931103, "uuid": "d8bb4582-8b23-46f9-b3b6-8132957bb596", "value": "payment070388974.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76f7d988-4ebc-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637933189, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933189, "uuid": "8cdad2cc-9731-4893-ab16-004c7dc62073", "comment": "Malware payload (Heodo)", "value": "8617e4fbb93a9a59fe72be231ecad548", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933189, "uuid": "28ffec32-65df-4141-b0f9-2dfb9f9ae4bf", "comment": "Malware payload (Heodo)", "value": "f5a55a987e97f58cb7c73fc093132ce006ac0fb1fddb90482a39db273b76dff9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933189, "uuid": "a2335314-252c-4c4e-b40f-d838ad9f2ad0", "comment": "Malware payload (Heodo)", "value": "1453d3a2719941a13560ef088e180209029edf22", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933189, "uuid": "dc352d8c-bc61-47d2-96b2-3ca985acc41a", "comment": "Malware payload (Heodo)", "value": "9aae82393b6e72a764faf0a493298102076b02d36542255cfd47e2e0d99cf1ecd356cd5888979caa643172da4e43797e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933189, "uuid": "1db63079-7159-4493-ae35-ee522b23564c", "value": "T128B4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933189, "uuid": "74a2a977-a43f-468c-a47c-1e5517021b06", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933189, "uuid": "a3bd8f6e-981d-496d-a75b-f0f3ffb09101", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDaW3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjRXC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637933189, "uuid": "29dd4ac1-369c-4932-8a2f-8d15e9929cd2", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637933189, "uuid": "06612600-5b28-4548-997e-df7c38fcba2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933189, "uuid": "2a4a0941-cedc-42f2-b916-4413885d1cab", "value": "8617e4fbb93a9a59fe72be231ecad548", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4debb6c9-4eb9-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931832, "uuid": "f99ce05a-060c-41b9-b943-af0818666745", "comment": "Malware payload (Dridex)", "value": "fe18dc6edf43ad57865b2661b539c280", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931832, "uuid": "eaf7a9a0-3931-4512-ace6-f7f9fa58478d", "comment": "Malware payload (Dridex)", "value": "f5beeb404593b7d72f2ecabe258f2f9f1078d4205813c4bbf40e5b3d81f7f392", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931832, "uuid": "de192132-b2a3-432c-b89c-8ea26cb0cd73", "comment": "Malware payload (Dridex)", "value": "e7978729137a9ab22870b32173753453c7a361e8", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931832, "uuid": "f4f11f63-ba8b-4957-ab4d-6cfb2b9c0e70", "comment": "Malware payload (Dridex)", "value": "b6e4c42af334aebadee42b8d3aa3dbde1cc6319afb7269de496443f8bb44b2337d37a43b5f9dacde9d6f115864f99d9d", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931832, "uuid": "85d00ce7-1af4-4996-8ade-2a366869930a", "value": "T1B263F1AE9548F00DD791DF7DCFBA48D053014E53AA48A7AB18C6721C7EEA3460FDC099", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931832, "uuid": "51f7a7b0-6e6c-4b62-b21a-d8e45475f7b8", "value": "1536:UWePuALLImemeKHqeK7YncYVMbd6b7JLa5RmgdkR:V980XKUYXeB6b+ggdc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931832, "uuid": "9906f92c-06ed-4a58-b064-6aa01b46d8ec", "value": 69240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931832, "uuid": "b581fb23-945b-42bf-a490-21f62f40d8e8", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931832, "uuid": "1776e89d-386f-4df9-bec3-ab547234fc40", "value": "Netflix coupon 95735.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4375f20-4eaf-11ec-843c-42010a9c0014", "comment": "Malware payload (Mirai)", "timestamp": 1637927682, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927682, "uuid": "251e0481-6a1b-4cdc-8505-5e398252d461", "comment": "Malware payload (Mirai)", "value": "430467aec23e03a5d9861a7230349020", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927682, "uuid": "6a1a7cce-4b77-40a8-8000-7adfe9f643e5", "comment": "Malware payload (Mirai)", "value": "f5e34e7e25d87cff77047bb15423227260e430031deea0bc14bdd4557d6bfa0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927682, "uuid": "c9a9a17f-e4b1-433e-b106-f8071e4ccad7", "comment": "Malware payload (Mirai)", "value": "71381d1bef362b123875dcae221750659d5304ba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927682, "uuid": "3481b160-f9a6-457f-9a49-ec10cc65fd10", "comment": "Malware payload (Mirai)", "value": "136a4a30a4d2e0549c6782e515a58baae00f06af2ac7fb7fb8f0da24b4c0def7681542fe51a31c86d6dd91d89a5cbf67", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927682, "uuid": "10692876-fed2-4eeb-b37f-0f9f3e81245d", "value": "T167C34C1679391917C0C496BB11F78721F2F6234D11B8866D3E760F8EBF28780B2563B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927682, "uuid": "f3c84e3f-821a-443e-86d4-50b1e1524c36", "value": "1536:85OIDrqYbX3tm7/mnFtvVXtiJb2dT5bYtAt/kzidrTMz0RD:UvDliurVXtil2dN51IzID", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637927682, "uuid": "50fac4a2-d26b-46be-a4e6-f0fcf0e7e878", "value": 119252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637927682, "uuid": "cd211ad2-adc5-4da2-8e8f-c9b10ec4f0a7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927682, "uuid": "0bbc86e9-3748-4f13-875a-2c75f43f1271", "value": "430467aec23e03a5d9861a7230349020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f219d955-4e95-11ec-843c-42010a9c0014", "comment": "Malware payload (RedLineStealer)", "timestamp": 1637916646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916646, "uuid": "9036ab04-7fa4-4b11-840c-edf529895b6f", "comment": "Malware payload (RedLineStealer)", "value": "5d3edfc88ece352bc7d4334330d9ee0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916646, "uuid": "8a789ffd-a3d3-4d4c-8e47-8e7815b44373", "comment": "Malware payload (RedLineStealer)", "value": "f5eb64043ef2c64c9c971bd9b6c3d6f43702c5e3dd19639327d20db8fb713c99", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916646, "uuid": "e2ac22fb-f35e-43de-af34-49137ee6842b", "comment": "Malware payload (RedLineStealer)", "value": "917a5d9952ee7146abf4cdd3fe63d52ab9794d30", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637916646, "uuid": "298118fb-85ef-47c8-bd28-d5122412b271", "comment": "Malware payload (RedLineStealer)", "value": "326be027fcebc5f1494cb502260329126c0c939da22c585115b2fa4c426f53dfc418618885ea7627543bfb7106aed783", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916646, "uuid": "044086d3-f6b6-4938-89a3-432e9dcd7b24", "value": "T1CE548D107BA0C439F1B756B899B9D369AA3FBDA16B3890CF52D126EA56346D0DC30307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916646, "uuid": "fc691460-6557-41a4-8cb7-8c2b7d12b8aa", "value": "f33785d6af19c29b6dc8bc3f4b716836", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916646, "uuid": "d196851c-87d7-43c6-b947-5863a666dd19", "value": "6144:NZZY/bxjJ+wziV5nPcgKbSXuZet0yy8VoW6CWVietAu:VmbxjJj8JPcfbSXuZet0yy8VVWV3Au", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637916646, "uuid": "f1898c1c-be79-4f05-a81e-a24d852d585d", "value": 300032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637916646, "uuid": "9fdba986-971b-47d9-ac42-04147afcce5c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637916646, "uuid": "20be72e8-3b85-46db-9a72-19ffdc556218", "value": "5d3edfc88ece352bc7d4334330d9ee0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "473b4224-4ebc-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637933109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933109, "uuid": "56b3e171-ac43-4f74-b4fa-0319a83ff69b", "comment": "Malware payload", "value": "87141122720d2b3af06f2da9806f6894", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "porn", "colour": "#17740F", "exportable": true, "hide_tag": false }, { "name": "sextortion", "colour": "#6B1A4C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933109, "uuid": "9d434396-ecb1-456d-90b7-7d690453cff9", "comment": "Malware payload", "value": "f6312547a2e70e98e0f97bf5f73ac7e8c5f5c30ef197464eec6642ca55206293", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "porn", "colour": "#17740F", "exportable": true, "hide_tag": false }, { "name": "sextortion", "colour": "#6B1A4C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933109, "uuid": "e4a9d813-b1e8-46ba-9c5a-b74d29ee3892", "comment": "Malware payload", "value": "0b0d86dee0bb84ff936ed9ceb91915b382c747cf", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "porn", "colour": "#17740F", "exportable": true, "hide_tag": false }, { "name": "sextortion", "colour": "#6B1A4C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637933109, "uuid": "82579148-bc9c-471e-8999-0747cdcf7413", "comment": "Malware payload", "value": "afd321d379ba3b3825ebad2a7dd448d5b5a6c1cf412d1314ff8f258f1cbd900944a1b15853fd0a6ec7dfc012bd84e2ec", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "porn", "colour": "#17740F", "exportable": true, "hide_tag": false }, { "name": "sextortion", "colour": "#6B1A4C", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933109, "uuid": "5ae64635-78c1-4d3f-82bc-9680279c3a23", "value": "T1BA161297EB0AE967D5F3D6369776435B9A1A0C488643E3431B86B53C0DB3AC047C6F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933109, "uuid": "3621f9ea-70ce-4ba4-930f-03d45e46d64e", "value": "98304:LL9Arjc0Xf2eX85nKfsbgOYQb5XIBcw8rYPcN3InDBu+4ES+iRm:/Gfc0+eMFKfsbgOlb5WcN3Inf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637933109, "uuid": "723741b7-d492-4573-bf81-5bdfcbf693ee", "value": 4275158, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637933109, "uuid": "ae4cfc26-f6c4-4d73-8ae8-36647b515dd4", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637933109, "uuid": "1adc285b-7991-48a0-a1f2-aef3fddbc902", "value": "LUTASNGEOAS.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d746aa8-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (AgentTesla)", "timestamp": 1637931106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931106, "uuid": "6b2d6449-b230-44e4-834e-954078002747", "comment": "Malware payload (AgentTesla)", "value": "19ffa7faef45d960d76f053c451bd020", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931106, "uuid": "8ce7926b-5145-4f34-9c96-bf5c2d17ca02", "comment": "Malware payload (AgentTesla)", "value": "f72cc67f1919f53c69e355ce7e6a48968a94650f9650d06fe158b14b655347ac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931106, "uuid": "199f07a7-3b1c-4dc9-b1f0-fba5f692fadb", "comment": "Malware payload (AgentTesla)", "value": "7743811556d47ae7097c11016e5d445e06c9fede", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931106, "uuid": "0dd75059-959f-4a5d-af2a-6addb4a38479", "comment": "Malware payload (AgentTesla)", "value": "bdeeed7030449cce0c03483c5ec7e541d0f5a47994446034b97d5c28e2de530f3df59da9eeb4308b9addb29ddfb81b2c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931106, "uuid": "40e8700c-7cdb-47f6-8320-cf3af304ee18", "value": "T1F7F4E09AF2441777D8BA0FF8C9A39880137B2FE25510D7096C86BECD3E37B464622657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931106, "uuid": "71d01efe-7c0e-4e0b-96f5-5aa0adba0e81", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931106, "uuid": "4fcd8870-aeb2-47ea-9898-755d3d3d9a0f", "value": "6144:01ltrDn0OHyAr0wnbQMnaEly76/VRN80vHK4UQhTIz2Ng5/avT0O/zXKhO5ajJr8:QtD00PbQoa9aK4UyTfkaARjZqEap5HB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931106, "uuid": "5037dc8c-cbe2-44df-8280-671781a33c05", "value": 743936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931106, "uuid": "06faf19c-23ed-4865-b64a-3010d9de4025", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931106, "uuid": "51d4d0b6-cbf6-4356-baaa-f98b0b3b6b58", "value": "PO-BL00046749.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3fd974-4ec8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637938402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938402, "uuid": "42e485f6-32f4-4c77-bdd4-31792384aa4d", "comment": "Malware payload", "value": "e31bd8797841b06a56e826b78715ea58", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938402, "uuid": "bc8434dc-56bb-4f05-b0e1-063778278a0b", "comment": "Malware payload", "value": "f84e32b431fa71f60e11f900cf1ae2055248bd4abcf090f0439916e5eb06944e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938402, "uuid": "e666952f-a49f-4c9c-8de8-2044fa7f4952", "comment": "Malware payload", "value": "b425ad248466bfa36e11369b16c575d6e2489907", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938402, "uuid": "9702bf3d-4069-47e1-8a9d-654529b0d9f9", "comment": "Malware payload", "value": "cfb6b7150529bb2238af7d74036a7b333733edac4bdd827c2be8e542b5689a95feaf3b01273ae636104d6782cff0d2c6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938402, "uuid": "a7d2804b-53d6-478e-b443-f4cc1a8159e3", "value": "T1EEA2C04EF9D47DCAC85C2938D4AC17D01D94F1C8B7EE5B9DA32A58C43B38925F1680A9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938402, "uuid": "40cb7551-90ad-407d-ab8a-8c38e818b7db", "value": "384:9J7rfmKPecwYgZJqx+tCRk4X3bwbtWMUIyqG3pflsGLMzKNyu4RWGVCz0Nv3d:PrfmKPLLgZJBwq47whY5NdLSJbWw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637938402, "uuid": "69bb80e2-4590-4983-b2db-d76bedd7282a", "value": 21604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637938402, "uuid": "864ae904-cc46-4f0b-8833-1d514328f043", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938402, "uuid": "42c14780-4d8b-4f96-b562-461014b45709", "value": "e31bd8797841b06a56e826b78715ea58", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af0edd1-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (NanoCore)", "timestamp": 1637918996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918996, "uuid": "deecd496-f522-420b-946f-577ae375b682", "comment": "Malware payload (NanoCore)", "value": "23c8c2b5349c07f9ba7c47034cb44a12", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918996, "uuid": "257f94cb-ea4b-49f5-b46d-e72d8e5adff6", "comment": "Malware payload (NanoCore)", "value": "f84f733be4fbb9b1e94e71442ac3805796db7b0d228c6270abc9af4200d5c4bb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918996, "uuid": "49bba431-c7e5-41ee-9ac6-ec5708df9ebf", "comment": "Malware payload (NanoCore)", "value": "d8e9cab91d5fe84cc5d03327365af9ed84c4b6ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918996, "uuid": "5889f7d3-2fa6-4d53-9518-fa4a7a6db17b", "comment": "Malware payload (NanoCore)", "value": "645588ceee964e7e0339b520579b9ebcb8712d1b32082b41c2360ec5ad4571abf29d35bdeb23e5efc9ce5b8efdf9bc35", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918996, "uuid": "be36eafc-d655-44f0-a1c1-f5202cb906f0", "value": "T18845BE02B3D5C036FFAB92739B6AF22256BC7D250123852F13982D79BD701B1227D663", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918996, "uuid": "d2ab394b-03c1-47af-946c-e1fee90c37bf", "value": "afcdf79be1557326c854b6e20cb900a7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918996, "uuid": "9512f5a0-01aa-420c-96ea-757bb2caeff5", "value": "24576:9AHnh+eWsN3skA4RV1Hom2KXMmHaFZyrh9QI/C+EZCBqUIYXmf8MuvWzb:ch+ZkldoPK8YaFZyri7QPIYXLMD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918996, "uuid": "d5b457bc-90f6-4ead-948e-c5d5dd5701a8", "value": 1254376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918996, "uuid": "bccf50a7-ba30-4860-b20a-c41cb0a3c50b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918996, "uuid": "968e920c-e5e0-4e33-99af-7ec94430aea9", "value": "f84f733be4fbb9b1e94e71442ac3805796db7b0d228c6270abc9af4200d5c4bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "392b535c-4eb6-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637930509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930509, "uuid": "ea702421-23f9-4d7c-885c-de8ec3f1f4ac", "comment": "Malware payload (Heodo)", "value": "4ae29f15b773cc32a8a58e2b1a09bce5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930509, "uuid": "80629ae5-a95d-43b3-a816-818e862de438", "comment": "Malware payload (Heodo)", "value": "f87c4159b834be6f1c21dfd320ea7238bb278657352a014dc4092c7a11dd7bec", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930509, "uuid": "add15aea-3f07-4072-9453-e9cf0bd23909", "comment": "Malware payload (Heodo)", "value": "da47fb50eff4d829024fddce614c42cfcc56bde2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637930509, "uuid": "0e2f19bc-2787-4a46-adf3-e64d3c8f56c1", "comment": "Malware payload (Heodo)", "value": "de0962c9e50c3e172707e52adef8c58dd31b49306e970d9ceb3d2a370b84036e5d8b5a2ccdcbf7ae179fc952ab43c9c5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930509, "uuid": "02ae725b-90f0-450a-b9cf-34cf07a55ed6", "value": "T177A4BF11F982D072D1BD15303D35DB968A6DBC604FE4C9EB67E42B2D8E352C14B36E2A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930509, "uuid": "dcfa5400-bd28-455d-81d4-776079f327e7", "value": "a67ad3f2c7f4c937ce61f03a8b5a902f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930509, "uuid": "1c010e95-9d99-4675-9cb0-68ca8804b366", "value": "12288:o4xZ0/tI1BD2LETv0Fh5O9U6W8XUDaBN7a1vt:oED2LETvMjb6WWUDcxwv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637930509, "uuid": "fcccd626-bad5-4ab8-acd5-bb02af80b4f3", "value": 485888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637930509, "uuid": "c9ec35d5-4b67-4de8-89de-916e64f3a782", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637930509, "uuid": "154aa5f2-93f6-42d4-9c51-1ca32cf1b573", "value": "besta.ocx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54504a39-4ef6-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637958042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958042, "uuid": "eb5dbfa8-1e3a-4559-8af1-d6e7a9b3336d", "comment": "Malware payload", "value": "daf966d2eb555728e5477e06b417c0f8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958042, "uuid": "8df1837f-3b17-49a8-b18e-791b9afd03f0", "comment": "Malware payload", "value": "f93fae9c111c736edb5e43dae3e25d500abedc397d8559c4296769c14c4c37a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958042, "uuid": "ec2b7cb6-f60d-4962-8934-afc33f8f0ae2", "comment": "Malware payload", "value": "6f6e95cf8ae7a02f98e5b798a2fc8aa0bdad92a6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637958042, "uuid": "67f31b38-ce50-4dca-b081-268a079a8e9d", "comment": "Malware payload", "value": "294671a209a0aaff8240a8ef9c2b2538959b6bc451a8217c81f71128267506453063011471faf4b70326748537f6e6c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958042, "uuid": "704cb287-4d10-4ac9-9d69-336286c18b57", "value": "T14E46233363654005E4E59C3AD627BDE532F20E929B827C7966F6FCC92131AE0F613A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958042, "uuid": "0bf19d7d-48a1-413f-9906-562e6a662cce", "value": "172750858dcc0719eed08c952858023c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958042, "uuid": "d417b63e-b69c-49af-b5e9-2d65e76124e6", "value": "98304:bW4gd3QVlIwRIaNoUG/IzMyizORl4nPTck7cFgXwnau7pV8zCl/QFRaPWXh:ahWVlCaNpG/IzM7z7P97cFDnX+TFlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637958042, "uuid": "597a6ea4-a8a0-4dfa-ac00-e9409a7463ff", "value": 5709616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637958042, "uuid": "316684b2-8500-41dd-a67d-e0d75043bb4a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637958042, "uuid": "62d89c6e-7a53-4a6f-a23a-f747feb23b4a", "value": "Software.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32bbc9cf-4ed1-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637942094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942094, "uuid": "a3097936-8732-4fa9-ba17-8aa1dc2a3772", "comment": "Malware payload (Heodo)", "value": "fa470c63fdcbd0b116a19c0d3cef9936", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942094, "uuid": "c4c8d2aa-64c6-4f40-9dd1-599f48579fb5", "comment": "Malware payload (Heodo)", "value": "f948a166b20328169beee0271f5dee0af68e09df261d49e9f4760465db66ec37", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942094, "uuid": "2f87b892-709a-47f4-af9f-7c679b170966", "comment": "Malware payload (Heodo)", "value": "3cb1c825c04c39cc74769a2557a52cb80997b7e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637942094, "uuid": "870431a9-fd4d-414c-9503-2b9baba90969", "comment": "Malware payload (Heodo)", "value": "05835a572a480c0c58c6a3dbd260e36c439ff8f14558b128530b53bc3bc9e36ee34b1ff898933647c7c0fb3e8847d4a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942094, "uuid": "864b1240-2dfa-4e08-8816-085bb44dec20", "value": "T1B2B4AE11F7D0C432D1AB30346616E6752AADBD715AF5828B7BD42B7E5F304D28A28B0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942094, "uuid": "5275dac0-588c-40b1-8ee9-d9fac069ae2d", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942094, "uuid": "25392e42-7400-49da-ac70-a46bd484ef21", "value": "6144:8JuLf/WAlRkVQqLyqoGN4BmbvC4zUQtIlHN3nkHDaw3P93XCJdjW4+WxnKYRRn4k:HVqLOGNVDzZtIlHN3nkjHXC/j8un/gB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637942094, "uuid": "64789281-65d1-4ac0-a5cb-b14b5bdd8e6a", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637942094, "uuid": "a9a4bfc4-f52c-47ab-92e3-a7f1fa313e67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637942094, "uuid": "7c1626d7-bb48-4163-97ed-07ca1d759b83", "value": "fa470c63fdcbd0b116a19c0d3cef9936", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f08331d6-4e4b-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637884860, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884860, "uuid": "d70e5de7-7786-4c49-be17-a8b2129b576d", "comment": "Malware payload (Heodo)", "value": "88497f6bc31b67489bd6e4cca45339b7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884860, "uuid": "e797c85b-f9f2-488a-aaf4-5b0bc2a595ee", "comment": "Malware payload (Heodo)", "value": "f95ac8f358845c5d2f4e70e5d8a8be1f675df8cc53ecc05119586cfc45f8fba7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884860, "uuid": "e263a5bc-b0d3-466c-890d-8ba24faef35d", "comment": "Malware payload (Heodo)", "value": "6eb5d7b1fcb5969cf43bafbac3935df765399513", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637884860, "uuid": "f06c22b0-4366-414d-b3e2-9c0998d4ac81", "comment": "Malware payload (Heodo)", "value": "eec65902646fe3c84f70ed734393fa0e965c3348739900497572814b0e6bd961e7540d54e9295fb3da2eb0a2f244948a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884860, "uuid": "060dbf03-e23a-4639-b3e8-cdf64ec07cf3", "value": "T1CAB4BE11F3D0C032D1AB31746666E7752AADBD315AF5828B7BD42B7E5F305D28A2830B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884860, "uuid": "2351e9c0-a9b1-4699-9caa-77de801b93f8", "value": "7786268c05d434623e5cf2d8c7606864", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884860, "uuid": "9a1d18af-e20b-4bb2-b1e2-1251ad4946a7", "value": "12288:smVdIG2GDNBtIlD987snorkZW+mw3ffEPy:sm4GDNBtIl6wzZzmwvfEPy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637884860, "uuid": "4005fc95-6a3d-42d6-9bd0-dfd750e3bbb8", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637884860, "uuid": "c7d3e914-38f0-444b-ad1d-231b7433b1d5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637884860, "uuid": "efa76056-0c0c-44d0-87fe-1e8f7b45e2c8", "value": "emotet_exe_e5_f95ac8f358845c5d2f4e70e5d8a8be1f675df8cc53ecc05119586cfc45f8fba7_2021-11-26__000055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c227990-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637931104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931104, "uuid": "631e64da-c4d5-4e87-8b63-ec6f0c415321", "comment": "Malware payload (Dridex)", "value": "81574ec946727e2b1f6a27344fb331ae", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931104, "uuid": "54dd02d1-c43a-4639-9481-478ce7d71aeb", "comment": "Malware payload (Dridex)", "value": "f99d44c28ed1a1d98c19541455a621e96dbf5fd52395774e7e8d53e2bdd5ed9d", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931104, "uuid": "9c46c025-f5ac-4969-af4a-2205f36779a3", "comment": "Malware payload (Dridex)", "value": "291a97ebcbeb95bdf975e2e8c6de9a5f4ce99d51", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931104, "uuid": "95b11e54-81bf-4cbb-bb5d-174af30b9083", "comment": "Malware payload (Dridex)", "value": "f789d1b872e8d2f8954d961e9184c0b0febc30c2163a73255d975b53f4d29646a9d968f56654486c11588c3b1a255251", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931104, "uuid": "cb0fe486-9691-4d68-8797-8f921db27cdd", "value": "T10373022E85633575CAF1EE3CDB0D08B364163B215D257ACB1898ADE88775583EF4A20B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931104, "uuid": "dfe6c9c6-bac1-4296-b05b-378dfdf6e35d", "value": "1536:UWDPrX6Q3cWViBN3yKqxyeHw3vRMgF3oKy5haKY/8hwmJnf+LoMgdJ:V/qmc3/q0dfaguKyG/6wmJngoMgdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931104, "uuid": "4d28a038-7c6c-4038-9fe6-7883465a1e3f", "value": 80480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931104, "uuid": "a3c35f22-dbdb-4cb0-9dd8-bc4db8fa760e", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931104, "uuid": "6e8fba3e-ff57-4d1f-b6dd-c5b81f0e4a2d", "value": "payment67942.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb23d444-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637954349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954349, "uuid": "fdae8714-9cfa-4e20-ac7b-84187cf6f98b", "comment": "Malware payload (Formbook)", "value": "57cc0ace207027209844af224fb73061", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954349, "uuid": "64b3484d-4878-4669-80fa-e2425a3f05f3", "comment": "Malware payload (Formbook)", "value": "fa5f726e3f04e8773ec7a1bdbc23974e1a009a67b3836d8e5c23f5cf7df18672", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954349, "uuid": "f9c4cd21-17da-4ee5-aedc-d6689600f22d", "comment": "Malware payload (Formbook)", "value": "df4a616885fd3b371d81acec1d8d556acbb2d1eb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954349, "uuid": "5c6fc4bf-d80d-4534-921a-3ae86559a64f", "comment": "Malware payload (Formbook)", "value": "18f72acffb6badfc675e1ef4381733eb8c92da5012f30aba8f6ac1a7c723bf0d1943f990bf16f09abd91290f4cee807a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954349, "uuid": "fd862657-5e1b-4b18-97b0-fb36c13066b3", "value": "T15DB43A656B511F7FF07EC338C12A055887F6A82FC355DADE3EB140EA5A61F84C2A2D12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954349, "uuid": "86d44293-f766-423f-bc18-9ae9bc3ca550", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954349, "uuid": "0ff88937-7850-4030-84cc-5db845027093", "value": "6144:fona9uO2r+VyIIV9pxXB/R7bJgyzAu5TiJreaQIX1NHr:foSuUVyIIV93x/ZbzAuwBeaQIlN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954349, "uuid": "e1b3d967-74ec-4fd9-9d71-2e114bbeefec", "value": 520192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954349, "uuid": "ee877077-ce01-4d53-abde-8174c1907bbd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954349, "uuid": "ee0d1e91-8fdc-468a-8edc-c41d9d21fd03", "value": "57cc0ace207027209844af224fb73061.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa5a4e86-4eb7-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637931128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931128, "uuid": "0173ca95-b68b-4ebc-8e50-9bf1efea3b22", "comment": "Malware payload (Formbook)", "value": "2ad63d9efbd9df1eb3e0a54f8e82045e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931128, "uuid": "9ae45e95-f3e6-4e0c-964f-2852538fd0ce", "comment": "Malware payload (Formbook)", "value": "fa6e94c900dc4d280b9748242d5f06a5030bb15c5e2ea7a4527e6987ab14d67c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931128, "uuid": "6b4190c2-a357-42ca-b292-da1f2a57458b", "comment": "Malware payload (Formbook)", "value": "964f225f12ba1bab2b5b68f8e023e8d0cc2d0a4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931128, "uuid": "d6a77465-bf02-48e4-8b16-935f6da027ea", "comment": "Malware payload (Formbook)", "value": "9528172e9fe85bfea88e0d0409a0ca798f8d1542b4362c681abcc99b7ba48b62a2a82beebdec40166a44f8b73857a81b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931128, "uuid": "e23aa46d-f178-49c0-b143-14e025b16e20", "value": "T1DEA4F1B0379863A7C87A4BF50C6190D9233275067E04DBADACC9628E6D32B165713BF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931128, "uuid": "4ce60707-dc93-4250-8a2a-c96f182def98", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931128, "uuid": "352a43d7-69c0-4dd1-aa12-b4a0ad67403d", "value": "6144:deTxYZUW9FcS+TO9rjZSKspVATFu8iL9OpmTPpx5el8XA89XJoQ+qPNtRLVHPP1G:deTGpAMspuTQz4U1euw8ZRhVX9mtD00", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931128, "uuid": "7631be33-7128-4b05-80b6-fa45f28c4576", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931128, "uuid": "7ffdeb4b-b98e-4a63-a817-f3e81f86643e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931128, "uuid": "81f1e6e9-bc45-40c3-85ab-db70866d4d22", "value": "Urgent Order#.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6d77a44-4edb-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637946638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946638, "uuid": "81b47fcf-c3b9-479b-b5f7-460417837cb9", "comment": "Malware payload", "value": "10e737f93e675c78290be9b33bc9262a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946638, "uuid": "58ba2308-dbcf-47ef-83ec-fe747f38eedd", "comment": "Malware payload", "value": "facd3e847a32c9119c712694a47fb3434966d93cf85f76b612cd8326bd4a682b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946638, "uuid": "c68ccf68-47bd-4db7-9ee2-4d90db311832", "comment": "Malware payload", "value": "da5407603f8cb98ea54337d92369becae70cf5cc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637946638, "uuid": "2e758e26-2639-4667-b74f-38e966d3e95a", "comment": "Malware payload", "value": "3017778c64e71354289201ccce649ddd50675e010731676b1a5410c688a676be386c1dd7c4011eff5201c88bb88f3a15", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946638, "uuid": "fc078def-0b68-47e3-b1a1-28e0a0187225", "value": "T1550633A57D973049CB60A6B0F94C934247D97DBE6848EE9CBD8670E78ABFB2144D1C03", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946638, "uuid": "a9c8b76b-7998-4899-9ed0-b0404b1cd795", "value": "4328f7206db519cd4e82283211d98e83", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946638, "uuid": "269430fc-7d31-48cb-9175-bfff845c00e6", "value": "49152:ItkplAVhXRJ1pj+R/XjqQe9vVkuENmq2UXeedtSRLPpD3dV6RifFjDWBseyKY:7pJ/GQe9v9ENm6rbSRtqRiNjDQH+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637946638, "uuid": "95afb129-335f-4797-bf3a-db283532c109", "value": 3784704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637946638, "uuid": "876576cd-d232-4778-aa5a-8776786fe160", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637946638, "uuid": "75df40c1-76c6-470d-bf1e-0e35f3ae0be2", "value": "aInjector Win64_x32.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06761fbb-4eed-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637954046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954046, "uuid": "664b58c9-8efc-49d9-9437-24c7a25b2562", "comment": "Malware payload (Heodo)", "value": "a5bef41c39f25ecc700b18205dc2824c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954046, "uuid": "b0e44bfd-94a0-463f-a133-51e01ee031e0", "comment": "Malware payload (Heodo)", "value": "fb1f4b8b987d746351fcecc9c5584a14d631125bd41216f566b840134668f90d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954046, "uuid": "7d6750e9-e73f-45e6-87e2-39e48ffbb684", "comment": "Malware payload (Heodo)", "value": "43fea44568fb7e432386a83c20ab4a478ac342b2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637954046, "uuid": "0071d49b-bdf6-4509-9609-6001f831db3f", "comment": "Malware payload (Heodo)", "value": "b8cce00555fd83b90d5b384af9baa59fdb4192a648edcbc7ff869c6d6cfec13bc9d01b4a4d518d7479b5ccedba0a5d0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954046, "uuid": "c25fbaa2-71e4-42df-bea3-bbeae0aa83d6", "value": "T1D6E4AE1277D1C076D4AF02310926931C72F6BD508FB9868BAFD86F6E6E701D29A34727", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954046, "uuid": "74f1b731-ee82-446b-a08f-05d88ccba1cf", "value": "d8c52655a835ecb2c6fea489c7c7674b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954046, "uuid": "617948c6-083a-4334-9f40-ad6fc6e2f0bb", "value": "12288:WKEUkuAOLka1miSmuYr1V7RAobS3qTHPR101D:TEQLka1nBVtAoS3WvR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637954046, "uuid": "74368040-f937-4ee0-a7fc-acdebe84416d", "value": 712704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637954046, "uuid": "10b6616f-bebe-4183-a008-7f85b9409b3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637954046, "uuid": "772a912f-f81c-4836-9c0f-170fa352792b", "value": "a5bef41c39f25ecc700b18205dc2824c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bf55002-4e53-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637887913, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887913, "uuid": "bc759911-4f09-40d6-94be-e5b7d54e8357", "comment": "Malware payload", "value": "6f1df5d4075dc8499a505a20afe7a8b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887913, "uuid": "9993d24d-32b9-47f7-8c2d-808e09359daf", "comment": "Malware payload", "value": "fb2604c4774fabb3c38cdaa40c46cde673cb98ac2bd58c46fc9a447849aaffb7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887913, "uuid": "60ada2e4-0b0b-46bf-a12e-3e2265dfb5c2", "comment": "Malware payload", "value": "e3086fbed24b25a396f757144a6efb2fa1082574", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637887913, "uuid": "afb0ebdf-1699-4c1b-8ea4-1d615a540b6c", "comment": "Malware payload", "value": "ce728a7268182690ab2ae89815414092890e1644fcbeef1182d5f8a90dd670fc73800b5672e042f3a4c6b769ca458fc5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887913, "uuid": "27e29cfd-2d67-4a3f-a654-ae9fe370f59b", "value": "T1B47623A96254339CC01AC4349933E904F3F2961E4BD5E6EEB2DF7B907F6B821DA05B05", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887913, "uuid": "30d1c394-55a6-480c-a429-68ceb3576f2e", "value": "4858383f978348cf32b759c63d8fce8d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887913, "uuid": "b9342e99-184e-425d-ac0e-e0d090e761ba", "value": "196608:mPIX25sQstDqQsLAaB0lXVJJdfRlbVtNI:QCQstuQ4AaqDPx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637887913, "uuid": "8427c140-6c88-4da2-974c-925cc1c7b9ad", "value": 7163904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637887913, "uuid": "1886fd6a-3b25-49a5-9b0f-8d8dea50bb9b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637887913, "uuid": "76d1a4ed-1855-4c87-a563-6846a3f12129", "value": "6f1df5d4075dc8499a505a20afe7a8b4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d65428f-4e9d-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637919698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919698, "uuid": "f0ff3e8a-f66b-4bcd-b21a-e586b0b4c8e4", "comment": "Malware payload (Loki)", "value": "19f7024a18e42134f09150e201732c37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919698, "uuid": "1950bf0f-06c1-4c19-94d5-124466cb0062", "comment": "Malware payload (Loki)", "value": "fc6495bc4cea5446bd3c15ecff52abef10d2dedabdaeeb009ec15d4010e68d63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919698, "uuid": "34388ffe-deed-45b6-bea5-4580c71f2c09", "comment": "Malware payload (Loki)", "value": "20a0191d1168cdcdc8829d1f6f4fd3b8d19dec46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637919698, "uuid": "5be58f1a-77c4-4630-8ffa-f26c1a6b5d5e", "comment": "Malware payload (Loki)", "value": "7e8c5b100ff97e0a274edb0b22fb3bb077bc2afd67b3e469eb919bca7db242f3b132a9d7795f6d07fcd644603b42bea7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919698, "uuid": "b842e455-fca8-46df-934b-7c8c51c2a36e", "value": "T18C6423A53580C9F3ED845F321D737F05EAB25DA827B669AB0F703EB72FB118644081A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919698, "uuid": "b750281e-c837-47c3-b590-c4610f4c9a00", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919698, "uuid": "a6672d51-4c71-452f-aad6-6d44f37a8830", "value": "6144:FGiRb4Bfg6vfR1FcOPWD0UkXARcNuyHVZovh4UZjhoLVTx:L4Bxp7xPWD0UkwSNbPyaUZloLVd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637919698, "uuid": "dd6eb0d0-d30e-4ddc-a5aa-35288c66f7d7", "value": 311169, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637919698, "uuid": "4f51d4ff-ea55-417a-982e-30bdfb44d905", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637919698, "uuid": "e9cca5b4-2af2-4425-8681-045a4c841d0e", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95f9ba63-4ec8-11ec-843c-42010a9c0014", "comment": "Malware payload", "timestamp": 1637938395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938395, "uuid": "ae13fa73-2424-4428-a571-cdcbd1ab3aad", "comment": "Malware payload", "value": "ebc76b1271f99f282417b5c308445dde", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938395, "uuid": "ef770584-1d4c-4eef-b2c6-d097823dddb6", "comment": "Malware payload", "value": "fcc55c662bd266e3a7e784c032abd482fd8ca9a06543c090731d99007f520112", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938395, "uuid": "501682a7-0b37-4f96-b899-7d864cef47ad", "comment": "Malware payload", "value": "e9c27ce1b7258e1e0457d274eee132769011090d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637938395, "uuid": "440f40bc-9efd-41f9-bf8e-58832f1402dd", "comment": "Malware payload", "value": "be0550ccc517b50cbca75f1e4294f066cdb2998df29aaab644e0aaa2b1773020d106a5ea464eb13f29500f64bdfb5fa2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938395, "uuid": "6cb00650-a223-44ac-83c6-0e25a323cea1", "value": "T1CDA2CFAA47489D99ED56C0F8077D1B2458351B77F903C80B349AD98BEEA78443CA3BD0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938395, "uuid": "b7982289-1ef8-4ef4-ae27-a8854857f708", "value": "384:x9ouXTCkpXPViyKzvLd209kwmCnf7jFfJaimCkWICvG2v4BcVJgGlzDpH7uNj1J9:cuXTdXPViyQvL0ukPCnfaimCkkeHmVJ0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637938395, "uuid": "b4ade3b4-dde2-4fa4-81c8-8bd5c8175a76", "value": 21472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637938395, "uuid": "b8e6274b-920e-4a44-92f8-64d2646cef4d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637938395, "uuid": "f7436b7b-9130-4b74-b6b5-3f0ce01653ec", "value": "ebc76b1271f99f282417b5c308445dde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57cf59fc-4e9b-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918964, "uuid": "5fd48d6b-1725-4e6c-9a5c-0d5b0ae275c9", "comment": "Malware payload (Dridex)", "value": "b7cb0b38c91fe5183f257cffed75d9e7", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918964, "uuid": "341055e9-0905-4ac0-ac02-54e23f73e681", "comment": "Malware payload (Dridex)", "value": "fcd217409b7b0f3697ebf5d9f23419b1befde51cb25b202d9a68ef0d450e41d0", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918964, "uuid": "3f4770fe-bd64-4588-af03-80cd93148486", "comment": "Malware payload (Dridex)", "value": "b844563703d0c31daa1e00d29c67730053060b58", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918964, "uuid": "41cd72b3-8675-4dc4-9d91-4caf792a1fe4", "comment": "Malware payload (Dridex)", "value": "7745700a1e78895ddecaadc382558cfcc431f37eff3806338f17cb6a1b1b73013919451939d0d188f736743e12659670", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918964, "uuid": "dab832f6-4a36-4508-8593-ee68e5240f7c", "value": "T12E55D162E36471E8C5739A31D03F551F0AB66D2268598205FB723A740D3FAC9FFE8129", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918964, "uuid": "154b71f2-b31d-4985-ba1e-ccd584b65995", "value": "72906e44c69f979a7a4dfcb492a7b5bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918964, "uuid": "07c2ef8f-6623-4b08-a564-8e49a7163d2b", "value": "12288:4GVNJAvuPFUl/faxuVlBLXKCgFfEK7JRLeHlX//ve7:p3JAvRl/fKIKCgFfx4P/va", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918964, "uuid": "cab79c13-341b-45eb-884f-871e1fb619a7", "value": 1331200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918964, "uuid": "fcfe004e-caf2-43b9-8c8e-a58d4c14e024", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918964, "uuid": "739c1af7-cefd-4809-9e67-dde9435c1c77", "value": "fcd217409b7b0f3697ebf5d9f23419b1befde51cb25b202d9a68ef0d450e41d0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc24f37f-4ed6-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637944580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944580, "uuid": "e107070d-cdd8-456d-97a5-20ccaa2c3e34", "comment": "Malware payload (Dridex)", "value": "a92052a64d7bc3d0a3b9db6c27120998", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944580, "uuid": "7e7e6944-c498-4dae-9f60-fc7727c850d9", "comment": "Malware payload (Dridex)", "value": "fe1b7296de9d25a7cc1c1c8a98b488e2c65ca5c0431bef190297b621184e9634", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944580, "uuid": "457167cc-e846-4402-b5d2-c52b0ef5cd03", "comment": "Malware payload (Dridex)", "value": "54ea2f8d44438e0d49c8b0bbef55197991322e42", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637944580, "uuid": "c0694c16-960c-4543-bef4-f95abc3250f0", "comment": "Malware payload (Dridex)", "value": "37d98ae0f2754a70dcae019c55bee6936d399e6bd535ecc81ca4a124948eb86cb9d375afa3eb075d1118d03561c1d63e", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944580, "uuid": "8549871e-15e0-4308-9b74-06e4101b0431", "value": "T1EC93025AA0D6B868C1EA64FED24F29F6E0310A4C5645FD1F7CAD427817A418FDB8D42C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944580, "uuid": "354b7448-613b-4284-b9d7-ea75c4a1a944", "value": "1536:UWQPFFxgFzx5YVqHS2YzayhpSW4vHR05Q4r5UZKUb2vNTRwQ++gdX:VrFzIsj8aipSW4vHREQ4iZKUbeCQgdX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637944580, "uuid": "6e914123-b4de-4f6c-9129-361842059246", "value": 92669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637944580, "uuid": "ddef5afb-f3d5-4b6b-90b5-54819a823229", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637944580, "uuid": "f7235ba2-6857-4711-89d3-5d78248fa890", "value": "gift-coupon-06633.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511d8755-4eb9-11ec-843c-42010a9c0014", "comment": "Malware payload (Formbook)", "timestamp": 1637931837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931837, "uuid": "cea69ea2-0b19-40eb-9717-b1abe6925ba9", "comment": "Malware payload (Formbook)", "value": "c0de473c3065a05fe9c0582005bbff37", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931837, "uuid": "ce20c5f9-e147-4b6f-951d-1cff6ab2d34e", "comment": "Malware payload (Formbook)", "value": "fe367e5f3b5894117d3b699784bc5da3cb4083608c94879895b279b2bc2f32a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931837, "uuid": "01e37142-f480-4965-a9e5-f77990f48eda", "comment": "Malware payload (Formbook)", "value": "def0fd8f7d18fd2f6141b020b2f858c5e6297378", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931837, "uuid": "967fb180-3eb8-4838-902b-7150938d0070", "comment": "Malware payload (Formbook)", "value": "e1d114ddaba0dbdf5f3000974cc84662866b470a6510be7a6893ada96c23314d560dd0502d311e092c7439f9fcd69938", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931837, "uuid": "5af943ce-d121-4d55-a734-7b0097fa4c62", "value": "T159F46D41E6E24873C1372B758D999DE8A9257E252D24D48B67E33F088F7C3D0A724B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931837, "uuid": "d130d383-e5d0-4cfb-8118-76b03c558bc8", "value": "eb3e9d8cf19100c077e1fdd127bcd369", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931837, "uuid": "25b8d100-5e04-4d58-93ed-0a83e9f33b56", "value": "12288:g6Hvy5le1KrvnEWkPpgiVymUqmCRb3seJ1B8fDfwUCm0gRS+:g6PWleMvnEW0pgiJUUx3zJ1Ba7cH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931837, "uuid": "bdf0da04-ea47-4f1d-84b9-2dfce7c92ded", "value": 727552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931837, "uuid": "98af5ab8-a97d-4226-9af6-aa701b77b7ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931837, "uuid": "e2532497-456e-4bed-8857-2d31bef4da21", "value": "Se adjunta la factura proforma..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4787c5b9-4eb9-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637931821, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931821, "uuid": "598a3abc-a7ef-43c0-9c60-5cb8a89bb778", "comment": "Malware payload (Loki)", "value": "db3bda84190794f6649bc78b918b20b2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931821, "uuid": "b0ada62f-7a54-4137-9168-f5ac983d3d9d", "comment": "Malware payload (Loki)", "value": "fe3932c1a7b75a2e1baa83a218ef4f8c05e143dbe9d9c5834c2c7500aed50670", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931821, "uuid": "0cd0dd7c-7817-4a6d-b126-ad3e9baf5869", "comment": "Malware payload (Loki)", "value": "6adadae01e705a5788bef53aa210b5962f4909b8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637931821, "uuid": "65b1bc93-5f85-4e8b-8faf-0bc2911bc28f", "comment": "Malware payload (Loki)", "value": "c1dcd3707b46283af64647376422e1a8b66f39283323653fd6284bf7df3ca78527b562966d4edf426a8bb8db3bd9b197", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931821, "uuid": "c58ab0d9-c691-4a16-af00-cfb5dc059bd1", "value": "T19A64232548D01ABBF4D112380C769FDDE7BBCA0A967D53A58B642FA35C22052DB202DB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931821, "uuid": "b335ca6d-a92a-4f46-8e29-8a848bde0238", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931821, "uuid": "bd6d1af4-0315-4641-81c6-f9dd1347f516", "value": "6144:rGinpUbzxN87a3H4oNrkyh1QATaj1ZqnIQ99xscclqdD/x5kPSq+orxXF7BhJU:tOzxNQyNI1wIQ99qccaDx+PSGvBh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637931821, "uuid": "bca63e75-7be5-498f-ad96-7acfbf6a9b66", "value": 337018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637931821, "uuid": "89001a5e-9bad-4fea-899f-ef117dfd5d9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637931821, "uuid": "21a3f2aa-52ac-4660-9ad7-369259dad06e", "value": "db3bda84190794f6649bc78b918b20b2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5cea65b-4e9a-11ec-843c-42010a9c0014", "comment": "Malware payload (Dridex)", "timestamp": 1637918799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918799, "uuid": "6b3837ac-741a-4a91-b9f6-e1b703939336", "comment": "Malware payload (Dridex)", "value": "b833af54974479f3f905c09600bad9bb", "object_relation": "md5", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918799, "uuid": "d21e6de8-8386-4a92-997e-60485fd7cba5", "comment": "Malware payload (Dridex)", "value": "ff25e9f36e8267df94a51f3252cab735e329dd5d2d2a5a4a2a7cfb1c4f7858db", "object_relation": "sha256", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918799, "uuid": "4227b1c5-5c0b-485b-952e-4ad60964f67f", "comment": "Malware payload (Dridex)", "value": "c8b57a99795b1cd22a7f51ce398e5d2bddbf2d4c", "object_relation": "sha1", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637918799, "uuid": "95b9a40c-afdc-4bf1-80d2-66250e1648cb", "comment": "Malware payload (Dridex)", "value": "649ca1ef1d4a405d24bb11d3f69b779141ad1ec278cf3a6b28221fe560c46d1ccd5275b9cd45ea11c906bc2f2a5b73cc", "object_relation": "sha3-384", "Tag": [ { "name": "Dridex", "colour": "#68D4B6", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918799, "uuid": "cac1b576-cbde-463d-9f4d-9abcb246b8d0", "value": "T1BC65E102FF9963E6D9502DF696F0F2A3C9B0F6854C680239DB65405F9CA0ACEBD150ED", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918799, "uuid": "708e8528-832b-4e94-8056-fc0fb445561e", "value": "4a2e61e1749a0183eccaadb9c4ef6ec2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918799, "uuid": "be8e255b-a9f1-487b-9c7e-d9abcd9fae79", "value": "12288:rZgJtlQepQn+NDo7nIgegQCLDF/B9wvj/cLvVZFuw:rZK6F7nVeRmDFJivohZFV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637918799, "uuid": "5a5a28ac-f076-40ab-97c1-7f8080899a99", "value": 1421312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637918799, "uuid": "a2526bf5-8869-4b78-af62-19bd490f3941", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637918799, "uuid": "65a7e6cd-6875-4079-b078-4c9a274498b5", "value": "ff25e9f36e8267df94a51f3252cab735e329dd5d2d2a5a4a2a7cfb1c4f7858db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dbf0f4f-4e92-11ec-843c-42010a9c0014", "comment": "Malware payload (Loki)", "timestamp": 1637915108, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637915108, "uuid": "9bf423f5-2fcc-4b2f-ba5b-5a7217f8e090", "comment": "Malware payload (Loki)", "value": "301b7a55537525f807ddb79c81ec2ca6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637915108, "uuid": "b1a2f654-86ea-4120-a720-ec531d537c3c", "comment": "Malware payload (Loki)", "value": "ff265d82a5185b0c0d4bb6cfd6b13859553faf45bf72d479860ddbc885ba683f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637915108, "uuid": "e78a5c0d-862e-4322-91be-a881dc1ab186", "comment": "Malware payload (Loki)", "value": "37dbbf625f36096e590e8842ac373c2db9488c17", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637915108, "uuid": "1c00df4a-40f7-4e0c-85ff-21fb9a41a3a8", "comment": "Malware payload (Loki)", "value": "cbce255d70a08802ba8558a90014f3bcd27e75b2ed218f6e721319932924db102213e5adc8d0779bb23734b9c0ace79e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637915108, "uuid": "d375936a-632f-43d8-a397-f8a3b40bd4e1", "value": "T1A264238BB4C2A9B3E5C2C6F076F69375E376416103A10693BF585F7B4E9128202673B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1637915108, "uuid": "0bf58555-d622-48d1-bafc-b036304769f2", "value": "7fa974366048f9c551ef45714595665e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637915108, "uuid": "c369d866-f769-4464-ba29-db6ffa541a29", "value": "6144:rGiFZEkgVuNmOHDinGVJg7eAjOuHyxzIr8YNGppHoNqtad+786M7zQ8:PMGpnoy6IppH8Ke+QB7zn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637915108, "uuid": "8404830a-dc37-4966-8e4d-1bf7dbc1fea3", "value": 337184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637915108, "uuid": "59d3af6d-4c5e-451e-a37e-2e7aea48f0e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637915108, "uuid": "3c6ef371-9228-46a3-bbd3-c8bdb1862a52", "value": "301b7a55537525f807ddb79c81ec2ca6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a981b7b8-4eaf-11ec-843c-42010a9c0014", "comment": "Malware payload (Heodo)", "timestamp": 1637927691, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927691, "uuid": "e74f01e1-1a51-431e-a1fe-a59be5d75f3c", "comment": "Malware payload (Heodo)", "value": "c5e4773f428d7132c9ce61497c666b13", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927691, "uuid": "79f30ac6-bcaa-4375-9937-7603e7fc16ca", "comment": "Malware payload (Heodo)", "value": "ff4ba141ea9e2775939dffd258d3a1fcd0e65960f40fa8babb90d86bb4dc9ea8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927691, "uuid": "0ae684e5-4c73-4ceb-b4bc-7bf190366748", "comment": "Malware payload (Heodo)", "value": "68ca2c2c34044fc44a7aaf34f0658635d753d6a7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1637927691, "uuid": "159f6a78-dfbd-440b-88dd-21434258627a", "comment": "Malware payload (Heodo)", "value": "4d75f7a024bc5662073272d07d3ff69a7046b55799c68a7e897786b24f507f1c9236773537b5f3610797e27cc7f6e643", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927691, "uuid": "0e195c28-8382-450c-96de-3cd5bf29d13c", "value": "T16003AE1EC251B9A8D235D93A819845E9611D2E016082FA4D24C0B58CEF7B2FF9BDF35D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927691, "uuid": "29186e09-5531-4a69-bd53-1397c08842f2", "value": "768:ZbII+/I83pLGrpRrjevZCwVI+6gBZVWpf/wak8y0VIyR:ZMnpLSbII+Bkpw78XVIY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1637927691, "uuid": "7b810b6e-866d-480c-bb47-7c576843fb05", "value": 38032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1637927691, "uuid": "6e619c3c-aed3-4512-b466-b4b94e39a854", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1637927691, "uuid": "2e838a67-6c05-4a68-ae32-bc4834a21dea", "value": "XI-2574 report.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }