{ "Event": { "published": true, "date": "2022-01-20", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-01-20", "timestamp": 1642723381, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "efce3174-8695-4772-b808-79e0ae4c4368", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "747a6c8c-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666239, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666239, "uuid": "f08f5564-b774-48ce-b997-9b2e542d9ade", "comment": "Malware payload", "value": "941e7dd0526d0f466605da7a50775342", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666239, "uuid": "7a8e98dd-adc2-4aa5-9cb0-a8befb69ff47", "comment": "Malware payload", "value": "003aca917252b019223a74074ba2f8093274ddf08449c9003b943d9efe635a4c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666239, "uuid": "0dd5cf16-d475-40b3-81bd-82e6e2ab3f00", "comment": "Malware payload", "value": "80c89d3bd40f81c730909f877a8c148bd0fea349", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666239, "uuid": "ba7251d1-029b-414f-befb-3f0accdd893a", "comment": "Malware payload", "value": "85edd965d5f36bc3a6ba1393c615c4fe81b6564c9540aad9dae5de686f263c80568bf696e8bf865d2b3d393461c222dd", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666239, "uuid": "ffd21113-124a-4876-be37-33cbda465e0c", "value": "T13CF4E3DCA900E0EED829E27576BA2CDA93E4620FD14163CC794D73115BB6B90C3DDA78", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666239, "uuid": "5d68fedc-d6e2-48f4-b10c-1fa9906815f4", "value": "3072:EfZa9fIYbWsAtz63YDIhHTO3Hhx6R6bMcjMBAgXiHl3s:EfZaoXgPXwlc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666239, "uuid": "784f95d5-00d7-4a0a-9316-8c89a9099d5f", "value": 731983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666239, "uuid": "57f034c5-0b9d-4513-9db8-f95dec2d9873", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666239, "uuid": "b02b22a4-632e-4267-8403-95522ec3d3ff", "value": "Order #2273.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e216ba-7a0f-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642696680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696680, "uuid": "527e0fe4-03bc-4632-a22b-001ebf3138e4", "comment": "Malware payload (Formbook)", "value": "5797d89148151bfa38e0ba8ede50f434", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696680, "uuid": "1f7c45c4-14e1-47b2-b354-125b8f4037dd", "comment": "Malware payload (Formbook)", "value": "0070dab47a3777b272b7a6471d4cec59bc3cc8c0d456999de9d16e991c7fbcd9", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696680, "uuid": "faf95b9b-e008-475d-917a-1f14b2315bdf", "comment": "Malware payload (Formbook)", "value": "9b6c564fc1b4e272fcfb11fa030ed1889e5b22cb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696680, "uuid": "78e7032e-5a62-45cd-81c3-de148696673c", "comment": "Malware payload (Formbook)", "value": "d030f5b85cda99e84863ec9da49c2c8cdae917baf8b4c1f606e186b6ffb1ea174c01951855e918775718840eb607a841", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696680, "uuid": "b325c337-b566-411b-93f4-7071148f1ec4", "value": "T170D2D007D70E8859D749913C400D2960B06A37BD73AB3F5BB673F90A5DA98C337A1809", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696680, "uuid": "c0955ec3-5537-40dd-9c5e-851d787c1897", "value": "768:H/8RO7ck5yDbZvUWwCtpA6OgXLPx+XbrjafMCRYBOKrd:EZDbZIWpAiXDQD1qYBP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642696680, "uuid": "bc22149d-50ba-40e5-a907-509f4ad76f37", "value": 28444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642696680, "uuid": "50a9748f-6fbb-441f-8f20-8940e531c733", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696680, "uuid": "d8f217e9-7743-449e-aad1-3bafc52072d5", "value": "5797d89148151bfa38e0ba8ede50f434.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ccace53-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660616, "uuid": "a2f2692d-3309-477f-9c6f-2239a0e2ba01", "comment": "Malware payload (RedLineStealer)", "value": "832c2e7384f4332a3dbe91ce0f0a8da0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660616, "uuid": "4dd79c1b-fbb2-4fb2-aedf-bc803a422022", "comment": "Malware payload (RedLineStealer)", "value": "014d9e246efaad3a91e21a36303842275f2b767245e3989143a75995babb653e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660616, "uuid": "8cd1ba2f-5315-4ed8-b1d1-6cff6b7ddf78", "comment": "Malware payload (RedLineStealer)", "value": "f8fbc01d3a8203d4623609011ed0ccd2ce5133dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660616, "uuid": "df325093-bd3e-43c6-a0ca-2a2e5df83a8d", "comment": "Malware payload (RedLineStealer)", "value": "a72048b0292f9f9c774a17ce9bbe2bcb6d1fe5f190240250aeb3f884aa9b8a9cc6cd5328aba99be068884dc55732d477", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660616, "uuid": "b16f8600-334b-4788-aae5-1aa43c114d8e", "value": "T1CB84E0F07580E931C4865A32C41ACFA11EBEFC710866964377A43B6EBE726C1636725F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660616, "uuid": "9b7686ad-0304-422c-9b4b-372598b976e0", "value": "125adc129c50285a2cd4524417d3fdd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660616, "uuid": "c55068f4-e544-4497-8fd5-52b0dbdac761", "value": "6144:jwDbLbV2YtYleLndyQ40oaOZZANNx5pJoPqlOn/2H0wMpHs:jw3l2Yt8eLnkq9OZaNnpJIe0wn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660616, "uuid": "ac2928be-52df-489f-bdc5-1ed93348d457", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660616, "uuid": "64e1dff5-bb8d-49ec-80d4-425f8d377e3c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660616, "uuid": "87f9064a-cd24-45c9-b7b5-c789f64dffc1", "value": "832c2e7384f4332a3dbe91ce0f0a8da0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fe3d298-79d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642672674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672674, "uuid": "708ded59-386f-4b1a-bbde-9806812206c3", "comment": "Malware payload (Gafgyt)", "value": "1b8f6b67161e1ad796a54acd5d512772", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672674, "uuid": "b3dc2be6-515d-4917-943a-b878598f41c6", "comment": "Malware payload (Gafgyt)", "value": "01612325732fbd47f98cf844638da7d02a8e3c594abef857d144be199e644f3a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672674, "uuid": "26bebb7b-7057-44f9-bf06-4d9268673ef2", "comment": "Malware payload (Gafgyt)", "value": "3f9a77746445b75775485701ce4bcf3d4b579fa8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672674, "uuid": "76483b8f-4859-4758-9c8c-17ffea471791", "comment": "Malware payload (Gafgyt)", "value": "0229fb54b6f7d4d29fe4c09bb88a15ba87705af7bc4e53578689f3354e1a8f766ea89f07c10329fe1953071fc2152820", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672674, "uuid": "54335d0e-fb97-4d87-a6ba-cc5ecc4aca6e", "value": "T14F63E807BB51DEB7CC5FCE7307EA4601208EE45A06A46B1F7274E96CA74B98E48E3D44", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672674, "uuid": "a9effaa1-c2ac-4776-baaf-edd6b044545b", "value": "768:SIteT2gHwH8XemTdyfwReYK9bPZsc7XiIYKe0edHn2K+qmfIZnjVnHlmGNSL9Z:S8eTHQAHn9+Zsc7YKRuHna4nJHkGMhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672674, "uuid": "59f39a5d-a988-42fe-9243-3282cc50fad0", "value": 73379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672674, "uuid": "7c3abf7a-ffe4-4b5b-8355-161f9a3f9ca2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672674, "uuid": "ff5ba646-8b51-414b-b653-25dd852e431a", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57fe0630-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660608, "uuid": "69b15a86-5815-4162-9842-3ab51d395764", "comment": "Malware payload (RedLineStealer)", "value": "7c3bec1f5e1ba84dd19e8d3e38be15af", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660608, "uuid": "b773f157-81c6-4e40-b282-ecafb0cfde24", "comment": "Malware payload (RedLineStealer)", "value": "02a1be5f6bac2f03f8dc06a3b94f346ab67f18b70703b80d91ca47478f6d8c5f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660608, "uuid": "c2c44c88-c202-4dd2-bd41-0beccbdbc8b1", "comment": "Malware payload (RedLineStealer)", "value": "f72b164f7d49d9bde1aaf3a749a003b6f8465d7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660608, "uuid": "0dc8a503-0567-47d9-8d1c-bc756001f6ea", "comment": "Malware payload (RedLineStealer)", "value": "8592262924e43dd21d19474719015ba6e0ee155af93e58e645c41cc3c57bb913c90527242bd3f7de4db702c4affe14d4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660608, "uuid": "78f053dd-ea7c-4988-b735-38a78a95ddea", "value": "T19A84E0317680D431C8D65730882ACFB45ABFBC7158A4454B73A43B6EBF36292A56F21F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660608, "uuid": "8fa02172-dc14-4939-9951-2b14f6afd9b4", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660608, "uuid": "86225c63-b96c-4c64-b966-60ade6256139", "value": "6144:FQRLpc2YPeFw/tMtyz0Cwkvv5Xf0x5xdZoRhyAha2TY:mu2YPL/wyz0CwkntfsdKrLTY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660608, "uuid": "2f112428-2cf7-44be-9a74-2ac33512b899", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660608, "uuid": "e4bf39af-c681-4d76-b832-b7f92ad566ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660608, "uuid": "86c1b4d3-30cb-4fe1-b68f-e16f2a4c513a", "value": "7c3bec1f5e1ba84dd19e8d3e38be15af.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "496dc480-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660583, "uuid": "814fd26b-e90b-4925-99ed-d84301bbe1da", "comment": "Malware payload (RedLineStealer)", "value": "427d21f69f75541d0f013ece070ace0b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660583, "uuid": "331d0f68-39d2-425e-bc6f-0b30f3db41d4", "comment": "Malware payload (RedLineStealer)", "value": "0317255bad96140a5cae78a6f10dc78fb4360fe1d848304261b8de361b64f61e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660583, "uuid": "a8f62f6d-592a-44e9-90b9-1cbdc6947585", "comment": "Malware payload (RedLineStealer)", "value": "2b997c070cdbec7942a10bba300e5275268d6126", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660583, "uuid": "e20d94da-7218-4725-b0cd-5572b16b0851", "comment": "Malware payload (RedLineStealer)", "value": "1a923f64e61cb6e33648b0a7da5ae88086a95c230eb3ad081f31f8c0504e1e4f252d1056bebb55968e117bfa77cb6270", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660583, "uuid": "988b39df-9ea8-460b-bbaf-fb3218772860", "value": "T1D984E03175E0D433D48206300929FFB06AADBC32296589473F9566AEAF323D156763AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660583, "uuid": "7def5195-f7d0-498b-ac27-48870222b8e9", "value": "b7a0d2a66e86e27ee741e32de65d65f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660583, "uuid": "f1f0c9bb-2c84-4e76-950f-f131003b3ab0", "value": "6144:kqnslLfJ/roWh0PZvPiNZfQo9wXE4TD8OieBSp9+iU6:fArJ/rQBvPeZoW8E4TDi20+m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660583, "uuid": "5125ed96-ea5e-40a0-921d-f88783f655a0", "value": 399872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660583, "uuid": "17b5e1fa-e2b6-4f7c-9d17-a50e2f94e749", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660583, "uuid": "8979f786-d9b2-4891-8540-c68bd57085fb", "value": "427d21f69f75541d0f013ece070ace0b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8b43792-7a22-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642704981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704981, "uuid": "ba12a1a9-8298-4dc7-94bc-34b38b6311f2", "comment": "Malware payload (Heodo)", "value": "bfc78ce361ad80f26738ce76e9b55f97", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704981, "uuid": "3b078815-2ae8-4188-a2c5-282c30c44079", "comment": "Malware payload (Heodo)", "value": "039adcca4d205850117d5b2348ceec561c57868668ab822350ef94a9b9467842", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704981, "uuid": "8326c57d-f396-4a48-ab48-0c2dadb4842a", "comment": "Malware payload (Heodo)", "value": "88371813c7e54d036c5583ed46e546dc32c99b8a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704981, "uuid": "685f6fe0-df42-438c-9b40-371dfd6e0b15", "comment": "Malware payload (Heodo)", "value": "56ccf0454ff2a93891338291c03549e47c1776e651e06b7c67a5d1f0593b9e46257c714e61a4feeb65a98299e7a5e2d0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704981, "uuid": "0780eaff-6e9b-48e8-8956-461442702ccf", "value": "T164E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704981, "uuid": "3b45ca36-1bb4-4bb2-8fad-727d533cf3b1", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642704981, "uuid": "11296bcc-3d4a-41a5-a6fb-0226192e675e", "value": 145170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642704981, "uuid": "b051d2c6-182e-4b43-a290-ada0b8a37fec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704981, "uuid": "4bb615d1-a044-4a8b-821c-93e6428b70d0", "value": "bfc78ce361ad80f26738ce76e9b55f97", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd78ddb-7a0e-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642696398, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696398, "uuid": "3c044e3f-c480-450a-9647-ab657084b105", "comment": "Malware payload (Formbook)", "value": "0957f6996d7e25e6f62253bf34005c6e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696398, "uuid": "8d263fb9-d488-4d4f-a5e2-fdeca8105c9d", "comment": "Malware payload (Formbook)", "value": "0430209b01853dc25a306ad951a4fbcb44ca60ef5df437184b1784ff79c53864", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696398, "uuid": "370edfe6-c5e6-446c-a189-967afad6d6ce", "comment": "Malware payload (Formbook)", "value": "657aeb373e21a1166e2bc91c7f6d3435c0fc1da8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696398, "uuid": "3fab5f66-f826-4464-82e5-0188a701eab1", "comment": "Malware payload (Formbook)", "value": "c57a024ab7e090c392f2cbecac877bee9d56a8ef12dcf8d90ea22cb5a68cb0e07fa19728533fd5890167e016bf41c0e3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696398, "uuid": "a2613c20-b6e1-4d14-b9de-893762e2ec1d", "value": "T15854220672D2CBBBC67325371873BB20D27E57350E922507A3E06BA3A8722525D167F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696398, "uuid": "9e4be665-41b5-4944-8b95-443bb6ed4be1", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696398, "uuid": "ce3605a8-6fc2-44f2-8997-156ec3f121ee", "value": "6144:owm6ZE2RAqJ/dU0WZdp8XVyX2Y8LOhHKJZGSGSHnaVa/z9Jv:y2aAFUfzIxG0saRJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642696398, "uuid": "8f75ddc2-7669-4ead-aa4f-218e12eded76", "value": 282192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642696398, "uuid": "2b6c378f-8e4c-4f59-a8d1-7e3c024cecec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696398, "uuid": "9a66b1a4-86ed-4850-a75b-b6d285abe620", "value": "Nouvelle_docx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afc40996-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642666339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666339, "uuid": "592d3568-1714-4066-919f-fa306fcebd7b", "comment": "Malware payload (Formbook)", "value": "126ae728ada77b821a6c92c47fbfdb5a", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666339, "uuid": "eb11f5ef-f31d-4b35-bfe0-7c956e814d27", "comment": "Malware payload (Formbook)", "value": "0450f9017a4e7556c6bbfa5e69363ed935e11fa47efff5755b172103b3b59892", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666339, "uuid": "f94f1c32-a816-478e-956c-a714afd17295", "comment": "Malware payload (Formbook)", "value": "ab6c53b97d055e52bfbbd99e80947adc1ef00853", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666339, "uuid": "ee328b0b-b54d-467e-b4f8-d8e7b8adcb98", "comment": "Malware payload (Formbook)", "value": "69f52bbd32ea900ebe2a9cd1752b7f9d326d2aa17efa3d50a084b295061f72558f54af8393bce6509b3ca518b2d6ee2c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666339, "uuid": "54b982df-fc9f-430e-b467-89d85c1b0bfa", "value": "T1B78401007FF917AEEAFB87F4A975520013B9792A3562D35D0D9E31CD29B6B828101B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666339, "uuid": "b3ae97c5-3228-49e3-ba34-d09a66451b05", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666339, "uuid": "10eb9512-acb9-45b1-be71-5c571e3efa1a", "value": "6144:MkndpLF3Y+SLB/YaJLhzROcBGb3qZQAnizLiyMM0xb0MY97oJ9AstFGyWAD:FnX++SLBwqzFNZLwG+0g90gWFGYD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666339, "uuid": "623bbc41-5057-4836-8c4d-8f2b8102e3ff", "value": 383488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666339, "uuid": "0e1d4c53-788b-4f78-832c-5df7034d98de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666339, "uuid": "c4bbbbf5-5709-4d6f-a522-864a22f2dacc", "value": "DHL AWB AND INV.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b00bda00-7a4b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642722603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722603, "uuid": "a27611a3-cf09-4941-976b-7d47241c5252", "comment": "Malware payload", "value": "9fe11a4ce9570525378f46d8cfb6cd98", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722603, "uuid": "8bdfbbe0-ad8a-4e1f-8afd-17d1cbf00655", "comment": "Malware payload", "value": "0468412f4be479303b317c4edcaa372990fe8f3dc4b968cae5d3881479f42832", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722603, "uuid": "782fde9a-c852-47ff-b7b9-ad217a39f63f", "comment": "Malware payload", "value": "cb445e44907791851868591ea771e5eb2a995898", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722603, "uuid": "8d196508-345f-4a8b-aab6-71fc34eafb9c", "comment": "Malware payload", "value": "e3339753b8aaa91428d0c7e0da3446a19e1a4b0ca8d7e899866d25ed039afb1b5b7e63f0977fdb5ded5f152adf362027", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722603, "uuid": "b62a36bb-bc64-40e4-8640-dad82ef1e0b5", "value": "T17E14837E7E21AB7EE268873207F76FB0C39521D326A19352E16CD7185E7524C184FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722603, "uuid": "f6eddc3e-71a5-4117-bb1c-923b508b5312", "value": "6144:VKv3mNGR3Xz/9tmzn3DT3y+aZWlWcWyWOW5WeTg8jF5hUXOzDWmKz6FhdzHWlwq:2gAF5hUX4DWmKz6FhdzHWlwq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642722603, "uuid": "0366cf9b-5601-4f59-a9b3-01ca7a534ae0", "value": 201424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642722603, "uuid": "b100f0b5-16ab-4bb9-94f6-d83caa75c95b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722603, "uuid": "2f980b2f-b6b4-49e3-92c5-2c9dfa98bd3a", "value": "daddyl33t.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60b77c1d-7a27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642707008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707008, "uuid": "ed8a2147-ff6f-4823-aeac-564f269ccffa", "comment": "Malware payload", "value": "4efbde6e887e5b120a7df4ec08ee03c2", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707008, "uuid": "17c706b6-5ab2-4c9f-a2f1-fe7326f1c432", "comment": "Malware payload", "value": "0469e6ef5293fa730138df4c55b057afe61ea347f9c36bf969b839b2fe0acf5a", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707008, "uuid": "67319e68-c027-44ed-a0ce-93ea2c8ce171", "comment": "Malware payload", "value": "b1e95fe6b7c678d7c5cbcc102243c38eec8e206d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707008, "uuid": "9e40ba38-c5a3-496c-8f89-322240bf9f91", "comment": "Malware payload", "value": "ceb9e6a2c0f3c13e7ddc8a5e81c38e93227711ae02b0269441c2173a58675a79d236c709c92b8099b06a3403e9d182d1", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707008, "uuid": "0f5d649d-08b9-4c6a-929c-d2f9f29ca1ba", "value": "T1D793F196325C0FE3F112D67EA5F930802E21DDD50D947BCA921EF3685077AA249712FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707008, "uuid": "08e1b1ee-f2c1-4582-bb31-a290d133619a", "value": "1536:cujV9+vltgoDW2fkJZGQ1z32i76LftT7DWTU3yvlMPt450Qe0RqGAEGbPb:cuhuy2r0ZJd2i7iFfDH3qlMm50bnT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642707008, "uuid": "20bfd962-996d-4723-8bd0-6b940d764635", "value": 97304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642707008, "uuid": "5e49880a-8ff6-427d-b84a-1af994f3ba46", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707008, "uuid": "907861ef-f5e6-4dc9-a9a8-c3a11c137783", "value": "Offer-January 20222 New Orders.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44892aac-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642668736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668736, "uuid": "fbe1a4bc-a275-4802-ba61-b8e41c840151", "comment": "Malware payload (AgentTesla)", "value": "294d0cb0fffe81ae00bc0f7ecbb2850a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668736, "uuid": "817affb0-4e75-479c-bbad-3d0ef78a8951", "comment": "Malware payload (AgentTesla)", "value": "04f7f10685ea5273a430a93c65a43ed64742cbbd56632c4d20330e8726893c3a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668736, "uuid": "828964f3-c107-4a32-9ae2-09bdf36c1e15", "comment": "Malware payload (AgentTesla)", "value": "c34bceb52f43a27f3c3592cd274cc5726cdae574", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668736, "uuid": "a4c1f9c6-3321-450c-bb27-92a952175e10", "comment": "Malware payload (AgentTesla)", "value": "6a01522a717c400138dc39e29ac7f144117cbb6326d16efc9ed11bb17797efe6966e22652c19e3eccc18adfd0c3bdd5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668736, "uuid": "acfc33df-693d-4f66-b5fd-5ff12aabc802", "value": "T1869402103BFA776AEAEA87F42A74521063B4794A2535D31D0CCA30DE1976F82DB11B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668736, "uuid": "9bfa38d5-c0b1-4ad8-99ab-c30fb228ce10", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668736, "uuid": "d5dcca23-8d85-4698-af7c-54b72d897d7d", "value": "12288:5x16Kp/0kDO2u+c98R9qNO03X1GQECPTYPA3MyD:VZbO2QBAYGQPYPqZD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668736, "uuid": "868481dc-9ade-4438-a8ef-7c0e250cda2a", "value": 437248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668736, "uuid": "09b7b211-40c3-40dd-be13-6fc19e88f1e0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668736, "uuid": "0900b045-0ef0-4055-abe6-2e7168682c31", "value": "9ZaCRWIp6tBXeU3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c743e72-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1642666065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666065, "uuid": "c9037bbd-46a5-44f0-bd79-57f397678fbb", "comment": "Malware payload (STRRAT)", "value": "ce78d7595ff47d40be541be7ea67abca", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666065, "uuid": "52304fd2-c423-4619-abac-02ea96e30589", "comment": "Malware payload (STRRAT)", "value": "05e8a158081eeaf61480bc366266b9da128ced63ab253eba0f1a4c1278b9676f", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666065, "uuid": "7e83a385-1c7c-4f02-8395-f302b1d81a61", "comment": "Malware payload (STRRAT)", "value": "9df02d4e402d211326c047dafebc3a7932fb9356", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666065, "uuid": "b28dc4e5-7b65-494a-b259-721a9f475a7f", "comment": "Malware payload (STRRAT)", "value": "87695e62e8cb8a9ec72d3831f7af4f33ed24762c6b263518b0633ab617dcc9bdfd70a7eae16989d8547e59e0b4d12ed0", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666065, "uuid": "a2c1ed60-bdcf-4592-b02b-6ab8bdd4aeb7", "value": "T1BB04BF19CAB02F55CA0F4E17783B25C92E90FA7EF4D976CBBD2A691E7B91100503F168", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666065, "uuid": "f67dab75-e79c-4db9-aba8-e4254e4197fb", "value": "3072:qbw137JjUw0h88AwBewaoqp3ayKzHrguy+FeKw+IidjobVwlEpLFSlVJ:qGqIwBeDNp3aJbrl3I+WSEOTJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666065, "uuid": "e06c70d9-e346-46ac-a81c-86243d86e028", "value": 186693, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666065, "uuid": "f6e16d59-edd2-498a-8fb2-b59de665bb17", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666065, "uuid": "1a4df6af-2878-4e55-a1a9-ab1b00d9067c", "value": "RFQ _JTCEngineering_110355500342450_PDF.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b133cc7a-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642660758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660758, "uuid": "93fa3fd4-7df2-465a-842b-320ee602e060", "comment": "Malware payload (SilentBuilder)", "value": "79a90c8bc6fd6179cb91d2ea2666124b", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660758, "uuid": "120054bd-0e77-4fdd-afd4-9832206d1876", "comment": "Malware payload (SilentBuilder)", "value": "06be4ce3aeae146a062b983ce21dd42b08cba908a69958729e758bc41836735c", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660758, "uuid": "40a4fe51-2601-4831-b1be-3fcde219a38b", "comment": "Malware payload (SilentBuilder)", "value": "eee7c801be1c21fa4791bbe9958ee68c66165b53", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660758, "uuid": "a874a699-3e5b-4ce9-921b-81223bd125e4", "comment": "Malware payload (SilentBuilder)", "value": "20c06d1358657f3f3285512a6690edaba50765e5fbc22fb67c20a12449a288b02abacbaf879653594591c8364fd77191", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660758, "uuid": "9719eeff-f7a5-41b7-9c20-f2a75b65d217", "value": "T132E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660758, "uuid": "b3881a25-62f2-4266-a597-cf52904530ed", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660758, "uuid": "26c2698c-26e2-48f3-970a-ef0c49e04555", "value": 145466, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660758, "uuid": "6e17e069-0a44-4006-b257-17e85a4619b8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660758, "uuid": "9c917b3f-e8d3-4574-9ff6-6ce3cd75643c", "value": "79a90c8bc6fd6179cb91d2ea2666124b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "490a48e9-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642665737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665737, "uuid": "20453e66-3881-44b8-95af-92082ea22ba5", "comment": "Malware payload (AgentTesla)", "value": "620b0df0114713ca65f6255c2cf62dd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665737, "uuid": "bec8acd9-0b8a-46c5-af5f-32ca53f9526e", "comment": "Malware payload (AgentTesla)", "value": "0729cd1d836c9f9b7b9f356c32cda718338ecf6d2c7918f3bd063065390ccd4b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665737, "uuid": "a00c3a77-c72b-4e35-82fd-2014c0bab8a5", "comment": "Malware payload (AgentTesla)", "value": "ebf6e5d012a7c4365142485e0996e0e8af46626f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665737, "uuid": "f30c3d36-4af6-4340-a73d-89319e863b6f", "comment": "Malware payload (AgentTesla)", "value": "47c9685e2171a3f1be97956e2c9b86e076b4fceddc1569feb96148ce0a945b88e6337b07660a653fdaacf27ae8a77b7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665737, "uuid": "64de520e-29f3-43ad-aa6e-f84434042cb0", "value": "T18994011577FA2369EABA8BF07526105007F67D6A6052D31C0D89B0DD18B2FD28B92F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665737, "uuid": "89c8d3d1-523e-48a7-9963-6e784d56009b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665737, "uuid": "861ce6eb-158f-4da8-8791-291cc1efaeb1", "value": "12288:uQks53oB/zmRw+hX03gTep2qJt9GiosCtqPwx:lFloBCRlSUUlJksC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665737, "uuid": "9c5bdb58-1bb7-402e-8358-ad9f881de7d3", "value": 448512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665737, "uuid": "2b5f53fe-4c67-4efa-b9bd-8214307b33ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665737, "uuid": "f9cf209a-ade8-4fee-b2a6-7a5c2470b23e", "value": "620b0df0114713ca65f6255c2cf62dd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "980c4798-79d5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642671882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671882, "uuid": "c5dfa1c0-9b2e-4d77-b714-fd6e7f2ae340", "comment": "Malware payload (Heodo)", "value": "555c0d187a1f24607c7d825fe261721a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671882, "uuid": "426f17cf-ade6-4bf5-a551-4aefd0ab2dc6", "comment": "Malware payload (Heodo)", "value": "072e3636ec5c47623b41cf15c107c508b73117e461c7eeb69ddc8c9a777a6dc3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671882, "uuid": "e6057804-65e6-4eee-8e74-9def67d90b2a", "comment": "Malware payload (Heodo)", "value": "bc0336e35feff09085a4479f2a366172ed67dca0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671882, "uuid": "8a74e8ff-df14-4601-bf73-20c9779ffbbe", "comment": "Malware payload (Heodo)", "value": "6bc503c0cd5bc01850b0c5b783fcc21d7cefecbefec7f747a3cb6650b1fa7a175ce9a7d88934034e7ae9708310b4d66c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671882, "uuid": "392078d6-7e41-423f-ad8b-889b98e0a32b", "value": "T190E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671882, "uuid": "2366b132-8c38-4b72-88e4-35ce747fbd50", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642671882, "uuid": "69ac4984-98d9-4106-84d0-9b165bed1d13", "value": 146050, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642671882, "uuid": "cf461743-4546-4b32-a218-73ff5722eb1f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671882, "uuid": "3d582855-bf94-4f50-9475-7e87660c72e4", "value": "555c0d187a1f24607c7d825fe261721a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8ac7d1da-79be-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642661982, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661982, "uuid": "f5c58f03-cb6b-4497-a9de-139d6d4de7fb", "comment": "Malware payload (AgentTesla)", "value": "f50f3514d79977b2a1509663d7b79a92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661982, "uuid": "91347ebe-a4c1-4a7b-866c-fe4410b18715", "comment": "Malware payload (AgentTesla)", "value": "0766516039a826cec36788ca878d04b6a7a9234da17660a74f565aabfc482885", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661982, "uuid": "a4e9016a-d383-4e93-bcb6-14e5b35222c8", "comment": "Malware payload (AgentTesla)", "value": "5ccff592b074314a99e5c89444b30bd55ef0ff18", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661982, "uuid": "e2e185fd-9dd2-4685-9960-07994ab767e2", "comment": "Malware payload (AgentTesla)", "value": "9ddaeb75ed0415d2d9f0b22d72275d6748f21142327a03dd816944ad653ebe751c87924159f6b5385317d4a2258b1f47", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661982, "uuid": "8451f00c-f49d-43d2-8c15-f6bcd8aa204a", "value": "T11C9423D705AB466BB9C15AE77EDC1571EBFD25E25431A18B9C01E6233F43EC00EA8D0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661982, "uuid": "dea68fa7-a45d-48b8-85af-9473d8f4e8c8", "value": "12288:Or0HxyysxqaDRm6wcGPngnpiF0DUYuUB3rYLZGiUZ2:+TLtmLcsYUKB7GOU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661982, "uuid": "1b5f1b44-b97c-4fa8-b141-427265d29744", "value": 424071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661982, "uuid": "c8e29779-edf4-47c2-9b7c-8b4e0e073ab2", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661982, "uuid": "8d26f3ae-b040-4686-b174-8cae55480806", "value": "MV AMIS WEALTH CTM USD 40,000.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4a949e-7a24-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642705932, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705932, "uuid": "6c2c99c1-acda-4dcc-ab67-a7edf889ac8c", "comment": "Malware payload", "value": "4f1e8fdae1d70383c185b619b7c5d90b", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705932, "uuid": "f67c76ac-3278-4ddd-ae4f-8d0ee1e5ef92", "comment": "Malware payload", "value": "079ba651e3ae0034cddea23337dde9cacbb3c6dbd813045d21ee92859bdb7594", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705932, "uuid": "68f20567-829d-4381-89b7-1bfbad56b9b4", "comment": "Malware payload", "value": "342bd12b61cf1aff10624dd4b0b783b7519546c9", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705932, "uuid": "c8b3fe17-52c3-4919-91b7-609c4c4f18f5", "comment": "Malware payload", "value": "83b520c9ede03730962a7416fec91513902860a1631460844dfa8794d9b4a8468e7f42290dd05ec8e10125f3b12e7570", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642705932, "uuid": "e384cec1-f0b5-48ec-b50c-5540c0cc9122", "value": "T19E51A809FC47D15C9B792327ED978566FF1B411B5DA2104C71DCC2491F2080996ACF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642705932, "uuid": "a29d94b3-055b-4f86-bb72-b52c30f831a9", "value": "48:AxMtZ48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBor:j7GhrffvIypvK0elkEYZ85zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642705932, "uuid": "2336bb64-4f45-46e0-8ecf-112d043b4941", "value": 3143, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642705932, "uuid": "98933d10-de24-47d7-b136-ed8f79b435f5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642705932, "uuid": "3ef85faa-6c15-4e72-b8cd-19c46d845279", "value": "6bWFxex9.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd534bcf-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642666388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666388, "uuid": "b208fc9c-dc28-448f-8a4f-a255ee14a6eb", "comment": "Malware payload (AgentTesla)", "value": "f2a1d3bd67549dbfc473afcc39e8b9be", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666388, "uuid": "d72b3e10-5f31-4f57-a3ca-8791b92ba49e", "comment": "Malware payload (AgentTesla)", "value": "07b4533a0a0e9ef4da895439ca064c144c0346e305a01c4808e053765855af17", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666388, "uuid": "5339ad42-d2be-41d4-8959-b6b4595e09ff", "comment": "Malware payload (AgentTesla)", "value": "ec6b058445da9ec296d016c171d43dce67a61b5a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666388, "uuid": "18b16fb4-38d3-49cc-b498-7d268110adbe", "comment": "Malware payload (AgentTesla)", "value": "065f667bdb9d8807a62f25fa1b30a12318e58f61c7607d42bf689e154d45966033924d025aedbf93d37432d97a7b6e0a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666388, "uuid": "ec35f1c5-f8a6-4424-a71c-f74d95e68fe6", "value": "T1E69412FB273D672AE6B91BF13A5171049BB2A4DEF932D60A148930CDA310F214752F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666388, "uuid": "d47fca9f-43a8-4735-8521-ce317d54cf03", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666388, "uuid": "7d4acfc1-cc83-44f0-a7b2-9e0babc7213b", "value": "12288:2qPwrYdAbc0CSBRFG/MBwsGjCGgjVmBs5O5h8nzk:GYdAbc0CSLFGmwtgjVA6ODx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666388, "uuid": "9e52341d-9e34-4015-814f-8adcd3f15777", "value": 414208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666388, "uuid": "1bf7b84a-ec03-40dc-b65c-a4768cd239bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666388, "uuid": "a52b8cbd-4c09-40c1-972f-ca5eab017bb7", "value": "NOTIFICACI\u00d3N DE ENV\u00cdO DE DHL XXX 0.01330500 1518443702.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "080c5ecc-79bf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642662192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662192, "uuid": "d58f0faf-51a4-40d2-92b3-36942bc3c82c", "comment": "Malware payload", "value": "97ff29d3d8fc1831b3b04e8c6fe5a756", "object_relation": "md5", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662192, "uuid": "872becd9-8456-41b0-93f4-7937b1b773cc", "comment": "Malware payload", "value": "0840dcd518df593cd0d5d7bb475f11200932f2ce00e06fd3ba0d1d70eea2ec51", "object_relation": "sha256", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662192, "uuid": "3d19e616-d17b-4b2d-b192-80fbd172b8f8", "comment": "Malware payload", "value": "96c0b5cedb2f5aa5b888148556e35a0dc0a2cb12", "object_relation": "sha1", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662192, "uuid": "de5f207b-ac09-4ccf-af8d-0176eaf71117", "comment": "Malware payload", "value": "8f1b708233871824340f3a46f75d9bebf85505c420ec1b591dee472181806116535514b46c918c24a0be14a518427d7c", "object_relation": "sha3-384", "Tag": [ { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662192, "uuid": "909c8cc1-0246-44a2-b20e-5a504297daff", "value": "T102D423B88A38360D1D71C7B5BC8D5D6D1BC658CC7FBEE8121E9492C1468B23E2D25F29", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662192, "uuid": "aeb94975-52fe-47d5-a5ef-7dc1acf1fc72", "value": "12288:80VGmVy8sFpQ1n/j9epEKNHvisqzzortA2zW7TBGt0BnYH0QGD2:8AGmVUFpy/JepE6gQrtFW7dGShYPG6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642662192, "uuid": "8a91e1df-d2d2-4ab8-9da4-48ccb5f4ce8d", "value": 605150, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642662192, "uuid": "6482c894-a6d0-4c43-b8e1-80e1f8fc9b08", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662192, "uuid": "1ccb3380-4409-42ff-86b1-abe54df46dc6", "value": "Invoice & Packing list.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef102e75-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642676753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676753, "uuid": "3359a0ab-17d5-4327-8e4f-3569ab79bf3d", "comment": "Malware payload (AgentTesla)", "value": "ea034189d58117d1230cbb81a465d60d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676753, "uuid": "3534de19-cc0a-4d37-8f64-7c47ef352a47", "comment": "Malware payload (AgentTesla)", "value": "0883932effebc38003004a83a80fbdbf2caab3a8467d59237791087872920468", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676753, "uuid": "e7892664-6319-43c5-bba1-3eebbc0d74b3", "comment": "Malware payload (AgentTesla)", "value": "fce915cc37b4a71f3ce870811183d354e18e6e4c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676753, "uuid": "9a7eb984-e189-42aa-bb80-71f1f9bc70ff", "comment": "Malware payload (AgentTesla)", "value": "4895a985f89b25e0964d6cfd6c3686789cfbf6458d6759d46c9c1a2424cb7e041d8d1a4507d2e61d74350f7478f8fc6e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676753, "uuid": "e93afa7d-32a1-4114-a6c3-e463e05679e8", "value": "T1EFE44A90E2448CA5FC1A8B75987BCD395217BE3EECB4100E366DF7255BB32C2246AD17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676753, "uuid": "77897457-5742-4271-830b-377551bbff6f", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676753, "uuid": "6dc9dcab-91fc-4dde-8500-9e2d0f59064e", "value": "6144:lwXAqPsPsJtAQBDvWPH4/jouSonMFgNw18cAWl7Er2NCmX65U/opZkKC:spAWvWPY/jNSonMFgdcNlFCz5H2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676753, "uuid": "9be70980-eaa2-453b-a981-cac09b679b44", "value": 698389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676753, "uuid": "7587df29-a6d8-43f0-81ff-d675a5fa1b0c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676753, "uuid": "bc38d9ab-fbda-41a0-b17d-8ca6ac5b883a", "value": "FACTURAS_pdf______________________________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0280b3c-7a0b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695223, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695223, "uuid": "6ef4bfb5-10b5-4f05-a767-fe9f1f64fecf", "comment": "Malware payload", "value": "bc03c18127731e2557d8f14520d93c6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695223, "uuid": "a0865611-d839-4536-904e-cd550561b32b", "comment": "Malware payload", "value": "097d954875899e9d0e17e31c7ffecfc4073fe417f51a57483ae01628bb733702", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695223, "uuid": "4c1694a5-46eb-48a1-b06d-9a2cd21e9bb7", "comment": "Malware payload", "value": "c8ea50d646fd588a8c482ea6347467b90a4d08b9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695223, "uuid": "3fadf84d-4c95-4bb2-86cf-b88467743c86", "comment": "Malware payload", "value": "afb9981626dc1cf8a6ba9a8c26750e7e109513d57a21a0a0bce4a7ae24953bad36834848da82e8b2ff20af2d073b644d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695223, "uuid": "c3e6e926-b4d7-42bb-a040-bbae566ed49c", "value": "T15AA3D717AB118EB7E85FDD7706EA4601208EF4C712A56B2B7274DA7CB74A48F08E3C54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695223, "uuid": "25e6925e-cc72-43e0-a13d-7d6537e0ed18", "value": "1536:kf2beTtLr7E7eqMMUaZ0rkcQ3xQXKrlUqAXgwhEHwF5higrVcr:SLr7ELBUafua3AQwhEHwF5hfrVcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695223, "uuid": "84f210ba-dfdf-4ac6-a800-897e6586e90b", "value": 99020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695223, "uuid": "deecdc44-5410-4915-8a58-4d126111fdc3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695223, "uuid": "30816da1-cd4b-4f0d-be61-b8e89a45ae15", "value": "bc03c18127731e2557d8f14520d93c6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0f1f7ba-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642666394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666394, "uuid": "fabd6b4f-64f0-4a2e-bc75-35c198c860c8", "comment": "Malware payload (Formbook)", "value": "0074e3ea80dbccc795e03ac9e5ffb8b3", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666394, "uuid": "f4b315b6-16bb-4f5c-aac5-1d6ee9a832e3", "comment": "Malware payload (Formbook)", "value": "098e2e5d1fa98d106c36ed3e7e1e632afd7ae0e10442fa0dabf2f6ed8c9c18b5", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666394, "uuid": "6d7898ab-845b-4492-862c-8974ef62bc9e", "comment": "Malware payload (Formbook)", "value": "0d11d85a0cf13637a7f56a3b6b4417f5b4d23f3b", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666394, "uuid": "f06854ad-24c2-41d8-9d83-fe16ebb8680d", "comment": "Malware payload (Formbook)", "value": "1e2240f8740bee6f0db83f7c2b3431d792885c90391c7c855c010d7346ae6ac67f981683f1ff06b49a5a8023566d3b5c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666394, "uuid": "a9195514-f23d-4eed-b80a-151878b5ff52", "value": "T160A4CF077BDEC622C269673384EF800447B8EE916A53DB0E3DD873BC192275B9A4535E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666394, "uuid": "bed2cf54-bf74-4138-a169-97a0cfcf2e48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666394, "uuid": "f04b62b6-571a-439c-a9ba-f7b3fdfe3618", "value": "12288:KdxWx9RkYiLThz/SE1uctNmYQq7nYfcJ:KbWx9A7SKuSmYQq8U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666394, "uuid": "0d3238ba-9a46-4227-a71c-18fd62249c1f", "value": 475136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666394, "uuid": "e7386dfb-4398-4bb5-a9eb-f5ae2fa45bec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666394, "uuid": "abf68fa8-44bc-432b-a846-5fbdaea935c5", "value": "DHL INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb3b60ae-79fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642689202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689202, "uuid": "316c0c8d-5646-4fad-9e9e-0f11c515aa91", "comment": "Malware payload (Heodo)", "value": "997fff8a89a129cc0622cc2891d1ccea", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689202, "uuid": "7f6c1941-2b5c-4a7c-817a-7df4e6a9b999", "comment": "Malware payload (Heodo)", "value": "0a20a1b82fd605aaca4441f2be6c35ce6d486d0a55de5efda00150db78b3e6d4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689202, "uuid": "2350f34e-9e4d-4b23-ad0c-83539d418b6d", "comment": "Malware payload (Heodo)", "value": "ef7fad068081c863d8bf6a5231385d9acc85ab90", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689202, "uuid": "d86c3b8e-aee9-403a-b3ef-7dbc3d07824c", "comment": "Malware payload (Heodo)", "value": "1defcced69069d092bc366bf12b16aade8ed290cabc27c9baa10ea1adaef517591dbf34923dd0d7167e0002e6282db1a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689202, "uuid": "5600dcab-1093-4019-babb-311bd4252a21", "value": "T151E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689202, "uuid": "c27bce1f-445a-4135-a779-0ff3a833f0cb", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689202, "uuid": "0a3c6f64-6046-470f-9bdd-4493932535e5", "value": 144635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689202, "uuid": "a69bd94a-685f-490c-82a4-5e7d05ee1c33", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689202, "uuid": "c3482c1f-62e7-4773-abad-6dfd6a43e354", "value": "997fff8a89a129cc0622cc2891d1ccea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0f4174e-7a24-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642705854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705854, "uuid": "703d96bf-4646-4045-8841-e5d4794c90c9", "comment": "Malware payload", "value": "4140815d5604ff565740160073a8bbfa", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705854, "uuid": "908cbe1a-574d-4500-a987-71b619056e7d", "comment": "Malware payload", "value": "0a85e3a643207751f2805e0f1f78b3cb7ebe740dfb9a845cac26add17fad8aee", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705854, "uuid": "08a54d75-e579-4a63-b0df-d541deac6748", "comment": "Malware payload", "value": "f58a91390570a7cf397e454bae2ad2b9e6dda6cd", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705854, "uuid": "5858e55d-f77b-4799-a627-57baf8053dcf", "comment": "Malware payload", "value": "1600e6d07827def8c81d43442534bc4dbb071634930c07cb8385289f4dff970f46aae184be5be9e5abf7683b024995b2", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642705854, "uuid": "8539f056-f8ac-468b-889b-9808dde87c4b", "value": "T12551970AF847D15C9FB9236BEC978962FF1B811B9DA2104C71DCC2495F3080996ACF9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642705854, "uuid": "8b60b54c-1df4-43f6-b054-61aa525852a3", "value": "48:AxfZ48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBoze:+GhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642705854, "uuid": "1ae241a1-c4ac-4fae-9419-4618a9bb6c09", "value": 3131, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642705854, "uuid": "a8511774-056a-4e63-8b49-48cb13c1af6d", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642705854, "uuid": "78704d94-cc1f-4b55-99ae-26919d2b7d1b", "value": "2wG0dnL1.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50fe683f-7a15-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642699251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699251, "uuid": "3cc23628-2bab-4068-84bc-51c2ceb5a045", "comment": "Malware payload (Heodo)", "value": "c7f0fcd06b6757af2bbb33cc2cfb81c3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699251, "uuid": "516de5db-7496-4e89-b050-2ddbceee069a", "comment": "Malware payload (Heodo)", "value": "0a8cebd3dbaaaec6da67ecc981207a79a0f386290bf9e5495b03ef4e5aad68d7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699251, "uuid": "2b965628-0973-4c08-ae74-3a7f4a91cfeb", "comment": "Malware payload (Heodo)", "value": "231300463ad19358fc71ef8c1a4a358967887594", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699251, "uuid": "23ef8830-fb03-4d75-b8f4-be91bd2afff9", "comment": "Malware payload (Heodo)", "value": "00b48ad2fd2e353071598263ae99fe54ff8a2477f87eb6548103d9b4e8bda36505899751e00358412b7004bc28fc5e7f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699251, "uuid": "902cee73-57ba-4efd-9754-69a97fdec0f5", "value": "T122C4AE12F7D1C07AD1AF12356A2A9B9C63B5BD619DF1C20BEFD53A4D5E306428F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699251, "uuid": "40a542f3-a53c-4273-8703-0d543735e6bf", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699251, "uuid": "802af2fe-0f11-4044-ab3e-e0d8d8407601", "value": "6144:5Ig427JC2jW8j6bzhO5vDynHoIoxoJ0CopGEfrBBHEUXZXbej1BC3OBtNCkiFPs7:5D42+8jM8WIIU8GrwIXbeDCxBPs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642699251, "uuid": "9f001f1c-c438-4b84-a307-5250908cbedd", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642699251, "uuid": "33156ec9-3588-4470-a27e-2966aba121d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699251, "uuid": "bd8fabe6-5441-46ef-afaf-c4c69abc8619", "value": "mw5go9sX5gzFc06t.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69d13e2d-7a40-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642717761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642717761, "uuid": "cb9fff72-6959-4fc5-b539-704d260dfc3b", "comment": "Malware payload", "value": "941b5004b86c75a7fb30c6aee64fe350", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642717761, "uuid": "b5b5ad14-a9f5-419b-9760-8d2c1d00620d", "comment": "Malware payload", "value": "0aa692cc9abe6360ac72502a9f27fb0e3d401153dfe067524c82c56b7e5f8625", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642717761, "uuid": "83b1e36b-cde9-43e5-aef7-a80f1e34a71d", "comment": "Malware payload", "value": "b16f1e822476e8ba006f64618075e2368349c359", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642717761, "uuid": "43888694-e605-4cc8-b16b-eeafda16b800", "comment": "Malware payload", "value": "e8f651020eff97ed7c3987fa5b6759ec11a307605bcf7c8b53df74f0d84172d708dd3cb3fb2ae8746404d2eadfd20bd9", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642717761, "uuid": "7bb8810b-2e2a-48ff-8432-55e87f25e2d1", "value": "T19F636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642717761, "uuid": "a5ca6828-76ad-4177-82a2-b8eb6dd23ceb", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642717761, "uuid": "9f96f28e-1b1e-49a2-a1d2-bf6e47c6eb19", "value": 71511, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642717761, "uuid": "ac0a52d0-8ac2-4cb6-b0ad-2ed8fef00926", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642717761, "uuid": "b2120325-9c48-43b8-a7b9-66e0a90583d6", "value": "941b5004b86c75a7fb30c6aee64fe350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3478c4c-79f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642685726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685726, "uuid": "536ca8da-9e36-4170-9377-db18532c9be7", "comment": "Malware payload (Formbook)", "value": "087a1a6ca1519efe7bb0e31092a148f1", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685726, "uuid": "fdc4e5a6-c487-4587-a354-9e6cf9d153c7", "comment": "Malware payload (Formbook)", "value": "0aac2e9b322ee36de9cd43e311a1f729f0cab79a5704a4d849cf0ad22fd357a5", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685726, "uuid": "3b49d2ec-ccc6-42f2-807d-6a32c79cc163", "comment": "Malware payload (Formbook)", "value": "6e29a610837bcd1d304f558d9597fc395c87cde6", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685726, "uuid": "090ca254-4a40-4272-a08f-ff275f9355e4", "comment": "Malware payload (Formbook)", "value": "5797cf0c9c468c872d812a6be5511bba620c148ea6c283f126afb84c4ee023ac30398224b1d840c1b8db613f72bfa951", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685726, "uuid": "30bb2cb5-4aa7-4432-87e1-1ab36cb7ee30", "value": "T17FA302CEB17D86162E1F72C09FED008A027D485AD13C57561B998A2F6B32C297611DFE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685726, "uuid": "a51af0e9-c608-4f71-907b-2e76ece40aa3", "value": "1536:O35PBIER4w1x0dfTDok8Ah8x7Ozx8CZQKcT3Z+rZj9/Fnza2c0Mlsk/i0KlPSl:O3ZBIk4e2dfHb8Ah8x7ZCZNcgrL9za59", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642685726, "uuid": "92b0ccc1-514b-42bf-89ff-16d6dbcc74d8", "value": 97811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642685726, "uuid": "b9eec511-e797-4ad8-927f-0547c9dbde96", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685726, "uuid": "16f7bf0b-54a7-4f33-af3f-aafffba57b83", "value": "Bank Payment Report.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e60b3bf-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660619, "uuid": "a91809b6-c25d-44f6-9ac9-368c3906cb3c", "comment": "Malware payload (RedLineStealer)", "value": "815b6c913c17dc6a7c1b16f12d611c52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660619, "uuid": "ed9313bf-d4ba-4ac3-9821-a634eb77084c", "comment": "Malware payload (RedLineStealer)", "value": "0abb7a8a9e8ae8584f07303c705ae630899b394028e092b72594b3158b4cdc56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660619, "uuid": "ac5c0613-8473-4229-931a-07c181f39ca1", "comment": "Malware payload (RedLineStealer)", "value": "5398dcbbc5df960616b62c1ea1dc4946524189c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660619, "uuid": "92075bac-e2e0-4e4e-802d-b88f0b93825c", "comment": "Malware payload (RedLineStealer)", "value": "73a12bb5a2c29a7b443eac2a4f38c6a049eba4a760495ce8688fe9b72bbcae8c41423ae2bce5bd6f697f70fddaceae44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660619, "uuid": "488a6bca-c7d4-46f6-a1b3-e313db424b88", "value": "T1AF84E0347A90D433C7815970443ECFA04ABEBC712964864777A43BAEAE35291216F37F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660619, "uuid": "53226c0d-9d6e-40e0-88b6-e2dfd5d61048", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660619, "uuid": "6215d0a6-1a56-49b1-936a-f0b94a59cfea", "value": "6144:56SLtz2Y01Wd8ZJByIJkoxFn18a8lJAJfisF6m4mES:nV2Y01U8ZvyujuJAJqsA/mES", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660619, "uuid": "c263cdf2-b616-498e-a8ce-770f02f54077", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660619, "uuid": "b39e2059-130d-4a27-8327-3734a57e223c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660619, "uuid": "9336262c-2f87-4283-b5c0-34d7839639db", "value": "815b6c913c17dc6a7c1b16f12d611c52.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc813fb5-7a04-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642692237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692237, "uuid": "80d87fbb-75a8-44fb-86c1-8fe2151255b4", "comment": "Malware payload (Heodo)", "value": "4d1f5f4ab19ac3ece287f74398084c63", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692237, "uuid": "919383b1-8074-4fb9-9eb6-b9764121e380", "comment": "Malware payload (Heodo)", "value": "0bcfb5ec55307b202d34f0fcdd61f1308ca007dad6288902b63fda00ba363d8c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692237, "uuid": "9aded824-c3fb-492f-9bac-7bedb1ba8669", "comment": "Malware payload (Heodo)", "value": "68db839c7de850a813f943035b15227787af8eb2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692237, "uuid": "0143a8b7-fd89-4877-86a9-a1769b60f0d8", "comment": "Malware payload (Heodo)", "value": "4634d367df860e774611790e8d170143a0a7b6da1a82c48410627998ef13ddcf1bf1f37e1985e831152112f6f115d8f4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692237, "uuid": "8e63ab3a-f375-477d-9b5a-f79f64b7a319", "value": "T1FAE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692237, "uuid": "332d0170-a7d7-4cca-98c6-ad228479ddb2", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642692237, "uuid": "640b3ce8-7049-4b43-9dde-99185de829a6", "value": 144391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642692237, "uuid": "9f4a2864-7da2-4146-9b20-abe8149bccff", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692237, "uuid": "2c057498-ba86-4347-a944-0eff964d9a87", "value": "4d1f5f4ab19ac3ece287f74398084c63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db24a7a4-79d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642672424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672424, "uuid": "47193e6f-338c-4779-bfee-6314d72a4d38", "comment": "Malware payload (Mirai)", "value": "a1d8d681875c54c5205b64b53519a636", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672424, "uuid": "0bb204fc-3328-403b-a05f-197c4ec4a1aa", "comment": "Malware payload (Mirai)", "value": "0beb0268e1eccc7707426ffa00f6ac9e7b4c91f26366c05362ec77b33b99eb8b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672424, "uuid": "27aa2aa9-5d76-4b91-9fca-5da89723c7a6", "comment": "Malware payload (Mirai)", "value": "6db77762a36ed5707d20483f5fc99e68a0835bed", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672424, "uuid": "6b220c8d-246c-446d-a721-9197d7d29290", "comment": "Malware payload (Mirai)", "value": "8d35c76d82d576f5a0df4da07cd85b9c5fa3105b2ce37fe3a0e815d8af7e7b7557af6116b06bf3f134b111b944c6446c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672424, "uuid": "40c04b68-6ef1-49c4-b4c2-1831299cf22e", "value": "T170546236E61189B2E11C4CF1346676946EC6437B5D2A1AC3E56E49B4FF3381B01FAEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672424, "uuid": "2e54922d-9093-400d-8f66-732bc8a07b3a", "value": "6144:Wjhluva28i2/TMXdZCSpn0UpQKqUgAZ08kjUd3Elv4YmH1cuEgvniuN/:WjhS8x/xjO38wYmH1cuEgvniuN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672424, "uuid": "29ff07c4-dd8e-4002-8077-6896c1fb2bae", "value": 293756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672424, "uuid": "1f40cb88-cdda-4397-8c94-f2b1d477220b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672424, "uuid": "43e28adb-bfdd-42d3-975d-53309ef9af2c", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc49211e-7a2c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642709363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709363, "uuid": "748e2895-a6a8-47de-a6f0-2ebeadf4d744", "comment": "Malware payload", "value": "62e510878678ccdac6a6c7ea8c1575a6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709363, "uuid": "57ec411a-2f58-41cf-b910-d9de80ec6a81", "comment": "Malware payload", "value": "0c4e77b57d8e9a24987e2327bce6a0c3f5c274379fc319497838ff7b0cd8ed23", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709363, "uuid": "0586c539-8cb5-48d9-be9d-54c19f6c76e2", "comment": "Malware payload", "value": "de21aa30d20566e4fdff1228740c637bee0f0425", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709363, "uuid": "403fd7a1-98b5-46fd-a45d-d775c519b32f", "comment": "Malware payload", "value": "965096baa04c5d43fcc68e02c767614ed8e9de52ed5a768b17014bc3c3026f66bbe4ee2aad8ae9709174b8604700714d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709363, "uuid": "8855a2da-f606-4569-82c4-e4a658ded725", "value": "T179267D88F793E0F1F25388B0515AEA77A63005296063F1F7EB8B6724B077341AB592DD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709363, "uuid": "52fd6bfd-ceac-49a2-9482-4406665fc854", "value": "98304:qE9pjjeLTH4ddOo1ycYr7BTdSo76WXKnsIdg62hbET/ClaS:qE9JjATHedOo1ycYJToo76WXadg6XTS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642709363, "uuid": "31da4faa-2ac5-4911-80fb-d8405851e1a0", "value": 4622552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642709363, "uuid": "216c5352-1995-41cf-8572-5d57cf04beab", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709363, "uuid": "83d889e0-878a-4c40-a191-649d38176159", "value": "i686unpacked", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac3fb56-79ff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642689738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689738, "uuid": "17360ff1-8350-4ca1-aa23-c57b6e74ff22", "comment": "Malware payload", "value": "ee1666df78ae700e9056e58a01180e56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689738, "uuid": "398524e9-ef82-4c60-8b86-1d5f9866db0d", "comment": "Malware payload", "value": "0c850189152813ace3063af65fad784dace09ebd9778423c04aa0881b0d0cc09", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689738, "uuid": "5456d48f-7135-4bb4-b747-8c04358218ea", "comment": "Malware payload", "value": "c8addca093c9e753fc817e8e2887b20aef88ef8d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689738, "uuid": "400773d0-1927-492e-a075-db861bd23f45", "comment": "Malware payload", "value": "5a31c55db674aeaa3eda53aa743ed40707dd4d4016633d3e430411ab9b4c190a49e3cd823a53df0dd80cefeae4af8600", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689738, "uuid": "07fb9e3d-57a1-438b-94fd-9e15ab2e4cc2", "value": "T1F30502367F816315C74E8BB48D7DAC1063B8F98A3C18CA5E89462DE55338BC2976473B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689738, "uuid": "a90bd0f3-403d-4a2e-b450-e770d2b5b6ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689738, "uuid": "a28e9d09-9d01-4996-bbac-4a7992d11d3e", "value": "12288:P10T519WfXGI9WfXGI9WfXGiiiiE9WfXGd333:PgefXkfXkfXMfXk333", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689738, "uuid": "87d7db49-952a-4524-9965-815b479d5fd0", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689738, "uuid": "f0bf75f6-b60e-438f-b4d2-ce6da52e80f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689738, "uuid": "287284ba-6698-4702-b7d4-1f2d4e24d3e1", "value": "me.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad490c6e-7a0b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695111, "uuid": "79e15843-cbbf-4111-a16c-15747920455a", "comment": "Malware payload", "value": "00072fbc1c490f3023c3baba0e9331a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695111, "uuid": "94f9e0c0-463d-4ce1-bec4-bbc5e5405222", "comment": "Malware payload", "value": "0d36d48561ddffd1c239b4624d5023082966777ffe00f717dd7d7458fccaa00e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695111, "uuid": "09556161-1096-4d3f-b7ce-728602fcd83d", "comment": "Malware payload", "value": "a0d3eb01b62c36025620c2e5c0591e6ffbc27f77", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695111, "uuid": "2c70e2ac-f138-43f8-b602-bc5fa1a5bbc4", "comment": "Malware payload", "value": "544a851ed789e27183d6d07850585c7e34359845a857a446db3bd758820ae8afb2a310ff17adf58b4908f98ab41ba8e4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695111, "uuid": "d3ed160c-afcd-4ac0-9deb-339794d2d891", "value": "T1EFA3290192508A53D1C2277EB7DB56193323AFA9939B73155A24FFFC2F8279D0E3A121", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695111, "uuid": "c7d52a1a-52a2-4b8a-b366-b2bfd324f710", "value": "3072:7eh2VaNz1TWimTtqSXz0MCgvHgumyGQitVpn8s:7ehmaRGTtqSXAKgumyGQitzn8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695111, "uuid": "c160ff93-0e2a-4da6-982f-4830e0ac0bff", "value": 101192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695111, "uuid": "e17ee7a9-c61c-4696-9a41-ff43de786336", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695111, "uuid": "44123598-ccaf-4179-b1c7-bad8eaf36e22", "value": "00072fbc1c490f3023c3baba0e9331a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "547c2a48-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642666615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666615, "uuid": "837d724b-e3cf-486d-98e6-9e67d5b75a36", "comment": "Malware payload (AveMariaRAT)", "value": "82a4d3168c075cfce19a565d510ae3fb", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666615, "uuid": "a3ac0557-1157-4c66-ab02-b727ae7ec8fa", "comment": "Malware payload (AveMariaRAT)", "value": "0d9facf6b7073de4e3db19eb64e80589d98cfe35b66942191390a891bb8b241c", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666615, "uuid": "971b3db7-3bcf-4b74-acf1-6938114886fc", "comment": "Malware payload (AveMariaRAT)", "value": "c35bcac3c67badcaffd60f813363b6fbcef2baf7", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666615, "uuid": "9e20aada-6ad0-4a20-877f-dd70a68b1f55", "comment": "Malware payload (AveMariaRAT)", "value": "1a089b594d817d28e575ea123d34057ee3facd2fb6d0d3f9265f2b133364361b3dc8488a94a2abd328d9e266ce97de04", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666615, "uuid": "98c141a9-9f4f-4f97-b195-1f10ae133456", "value": "T16D156B63F2918436D4331A384C67EBB9552A7E017E2D7A477BD47E0C5F3A2813929E83", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666615, "uuid": "ed16ed5c-14f1-43be-9f2f-2e224f878bec", "value": "d571f528db93ab4c8d72c51955dc7b93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666615, "uuid": "a424bb40-6980-47c4-9661-8e28a0ea55e9", "value": "12288:wHFymIc+xnYsoAFlK/st03JMAIliAhojhZBYf2WZsOvVyW7T3bnvwc2:wHeaAFlKYevUBb2yyKT7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666615, "uuid": "140ac9c6-8ccd-421d-be48-d3b3a3699aaf", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666615, "uuid": "96dde9ff-cb1c-45b7-94bf-8da73f066a30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666615, "uuid": "a2ad58bf-1108-46a8-af39-5a57545af791", "value": "IMG-P-O #0517839208392_20-01-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597dbed7-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660610, "uuid": "7d05ab69-491e-492b-9733-0a6e01746acb", "comment": "Malware payload (RedLineStealer)", "value": "870fd630c9dfc4a078760a7b425464ff", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660610, "uuid": "2f3d24f0-7c28-459b-bea2-4ed68006a373", "comment": "Malware payload (RedLineStealer)", "value": "0e08cc4751863c2150282dae704864e2b80feb930314ee9b3db331ec8fc4043b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660610, "uuid": "64714eea-f93e-4abf-9ea4-96b2f704034a", "comment": "Malware payload (RedLineStealer)", "value": "ed5a067b3fa8c989734806eaa5f204303ed724c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660610, "uuid": "cdee2213-4e10-4e78-bc0b-2119820f7fe3", "comment": "Malware payload (RedLineStealer)", "value": "a95e587f27ea27441f71f1285c6a8282d3daf8a3361ca5a0ee4ad83d8a65268d2f0a5d46104543212de21d7127220734", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660610, "uuid": "1c15d30c-5cc8-437e-a99d-c466419e4fad", "value": "T1BE84E02035C0E431F0A699308429CFA19ABDBC771964568773A43B9EBF712C2667727F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660610, "uuid": "a6311075-33ac-4d51-a547-6d669a9bf604", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660610, "uuid": "ff52b7fd-36dc-43c9-b7c4-499827254bf1", "value": "6144:ojjLYG2YWjPlkyZr13O0ZO7S4Gjz7qtIlgRgUV4Mb+FMY:252YWeg1+0Zt4Gjz7qtWgRgalY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660610, "uuid": "27f985a9-c58b-4dc7-bf36-b784fe38609a", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660610, "uuid": "4468b32f-7141-4f5c-8a5d-1116bb62d943", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660610, "uuid": "69bd78c4-523c-42ef-91e6-5d58a14a7b65", "value": "870fd630c9dfc4a078760a7b425464ff.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60608181-7a19-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642700995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700995, "uuid": "01ddc261-f6d3-469c-bc1e-93408f93ad53", "comment": "Malware payload (Heodo)", "value": "88208824f3da1ad74ee7ef6d7b7add5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700995, "uuid": "3ef84fa4-ec45-462e-b95a-4e2e378fd2fe", "comment": "Malware payload (Heodo)", "value": "0e16e8ae77dfea5297e5fd7aa08c5d95142f02b2d3fbbbd1db3e0f393d87a1c1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700995, "uuid": "2d8e9118-1cf6-4333-926a-efb3afeb00d1", "comment": "Malware payload (Heodo)", "value": "b3188660c284ece1a1451203e6cf28c104ac6440", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700995, "uuid": "57480f2c-b705-4cb0-b800-e1529ed41e32", "comment": "Malware payload (Heodo)", "value": "90c1307045bb1f4984e25a17634e18050480a1ebdee7b7b625f4d481b40c4b1418fb974dd5a548aa18e9791d90b1a398", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700995, "uuid": "298a7be8-f70f-42a6-95cd-2fa2a9bd124d", "value": "T1BFC4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700995, "uuid": "d2c62d35-c7ef-47df-acc7-e82b421b4a24", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700995, "uuid": "d056a5b1-7cda-42df-9cf5-804505350cd3", "value": "12288:P78OGF+L8/4UUNyrmdMhTq/n4vAzdkPs7:D8Ody4amdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642700995, "uuid": "efb6d81d-ccb6-4ac3-b2f9-08e4702bf311", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642700995, "uuid": "51302410-40ac-45da-9f67-38a66811c3b2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700995, "uuid": "5c62ba29-a0e5-48e6-a71a-3ed23576feef", "value": "88208824f3da1ad74ee7ef6d7b7add5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132933c2-79dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642675095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675095, "uuid": "c3984577-dfc0-4a48-87a1-c62d30400419", "comment": "Malware payload (Mirai)", "value": "1fcd5f119a027ab8bc0046ee2a4589a4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675095, "uuid": "29f9d0b5-6a7d-4ef1-89cd-c0ebceb73b0d", "comment": "Malware payload (Mirai)", "value": "0e8bcfdc6b55dc510034085087d641e99e809a24350ed6027f6b77f8aa09fb36", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675095, "uuid": "1b47a11e-0c8f-450f-8dd4-19ce92cd5e70", "comment": "Malware payload (Mirai)", "value": "894962eda14c4c4c19f398408e29820159b89e16", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675095, "uuid": "4d46a2b4-3917-4e95-ac41-9a258d29bf8c", "comment": "Malware payload (Mirai)", "value": "51f91c0a9b50949a705b7596e28bc4cfa1b65913d03fa28f5c6d470253cd2bc00655400104f419679967651fa9a3578f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675095, "uuid": "14b75674-4aed-441e-99eb-653010e282b6", "value": "T116D2E0C4902BD451F288133A7DFC92FD18D70C46E6BA8761F754CC56B7A782A6A327E0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675095, "uuid": "5275f5a3-9433-455d-bd75-28a67f71b029", "value": "384:MVMBQR6uojSpHk6GyTa0z7ZidWmRtZ8Rwqxr/t0RLWnPzHQKtuHynb8u0ZVUir7S:UM4lFxmmZidb7ZgUWpsI0PUg7CPE+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675095, "uuid": "c45e9bd0-9fb5-465d-82fe-34b922928166", "value": 28904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675095, "uuid": "216d9b6a-affb-43e1-9d80-b3a35e22555c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675095, "uuid": "d6e64b3f-16a4-43bb-8071-ff0ee25fd693", "value": "Tsunami.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70bd8a06-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660649, "uuid": "8c9744fa-5f5c-445d-b33f-387ceb71a79e", "comment": "Malware payload (RedLineStealer)", "value": "a0d5ec8f534f374dceca7f9318a35073", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660649, "uuid": "d64abead-6f23-41a8-844f-9d9ee9261140", "comment": "Malware payload (RedLineStealer)", "value": "0e988e5af62ae1e0f16d79d8345b9c3923c011c4b3d50020e60ceec507c65b61", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660649, "uuid": "97a37fdf-178c-43bc-829c-a93522a819e9", "comment": "Malware payload (RedLineStealer)", "value": "200add7008482531b1e393f3e09a39ff46b89c9d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660649, "uuid": "c4fda61b-cba3-45bd-9e3b-f77d4bd8d04f", "comment": "Malware payload (RedLineStealer)", "value": "788b645dd0eda6bbb117603d2554af261ea716cf49fdb35cfc9fbaed06729fbd366f4fae058163ee2d37c7b65c809c0e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660649, "uuid": "87b37fe0-1bf3-436c-9daa-86b398e7fa08", "value": "T1F15550DD56C51A08CFAF07F14DFBE72E88B296C553136BE9229E50F1272219FB02D4A4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660649, "uuid": "6ba12a5e-9fcb-45f4-91a8-10df54f3ee22", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660649, "uuid": "902a7caf-3983-4445-9716-14f219048f3b", "value": "12288:r8z3fdK+bYxyOB1T1QybjBz09OxXLY2SpQj8/WVNQxR72dvi/IKZ9+T8:uPcdOYLYvZ+/QnbIKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660649, "uuid": "8148b583-c99a-4a6f-a9f3-682d450f3423", "value": 1324544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660649, "uuid": "5fde8c00-105c-45c7-9279-432bacda2b17", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660649, "uuid": "d59f6451-803f-49b2-89b3-fef3cf1f1f76", "value": "a0d5ec8f534f374dceca7f9318a35073.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2800bfdf-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642665681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665681, "uuid": "6d66f7ea-71f0-4050-a3fc-36f0c62f17da", "comment": "Malware payload (Loki)", "value": "f0af5cefb0e56c004537b16edc01d26c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665681, "uuid": "408e581e-da30-4d12-afaa-edb5761257ea", "comment": "Malware payload (Loki)", "value": "0f0dd9f3bca44d911fc90196fbcc8add85a2630138a8d521f641dd0a25233ff6", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665681, "uuid": "bc88e708-6a0a-4511-b0e1-82f5e94083e5", "comment": "Malware payload (Loki)", "value": "5ff7e0bfbba2fda3a070f364aa0d7e3b98c02ec4", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665681, "uuid": "437c76b2-1864-4a00-a92d-b29987d9eef8", "comment": "Malware payload (Loki)", "value": "a7fb5ec73c65d120584c45cc14e4a0cbe7b58623082ca0967521422244051fa361035bc7296c45b786b4afcd68422a47", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665681, "uuid": "a2dc67bf-415d-4086-8596-e00b5ac78fcf", "value": "T10F0412D6E7684B27E0325479F19E15B3C3099EF7804B431232977CAE0AB9D543ABB163", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665681, "uuid": "e38e66dc-8f89-40c7-8e46-b1d0e4c1a138", "value": "3072:DDiERYlI39G1a7Hl6g//iy7s6qPuXDlV4Wd4KPsi/wEhrvtoHJHajZaM+oiU3:7RYlI39Gs7H4g/qy7JqPuXT7vki/wEhN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665681, "uuid": "b30dd5ed-4ebb-4a28-98af-739f4becd0e7", "value": 187272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665681, "uuid": "b818b494-8e5e-497c-9430-fcaa56f3c2e3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665681, "uuid": "3ef688d6-fdd5-4a17-a039-64476857bc31", "value": "Doc_B002281F_263466912.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17e2253d-7a3e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642716764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716764, "uuid": "eccb730b-1b0e-4e0b-abe6-bc666d92404b", "comment": "Malware payload", "value": "7e3dc40ab5a5a824a157f894d0b46768", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716764, "uuid": "674a5be5-76d1-4edb-be4d-fb41a567b9f1", "comment": "Malware payload", "value": "0f42b20f799c9d1956f810952da2492e135ddaf0c1eb3afeb975a49ae8c784ef", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716764, "uuid": "0c275fdd-8982-4544-b9c3-95259c57b296", "comment": "Malware payload", "value": "8bec0cec1e5b64d7e6dced82bcc0b9b62fa88b0d", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716764, "uuid": "9bc64097-7ee8-456e-acf9-cf166ec24f18", "comment": "Malware payload", "value": "f31e8ab54020735418cd3e0e29278c040ddbebf4d5cbe11b5d9fa78206e4d385aa156c6c0807b828977c6ef13c7f9330", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716764, "uuid": "a81b34ce-518d-4d8b-a7b1-1611502bd097", "value": "T1C0636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716764, "uuid": "f64954a0-f167-42d7-9ecb-ca1b1e0c9fd0", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642716764, "uuid": "e65e3ea3-cc17-4f9a-8f13-493f9f2a5d73", "value": 71267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642716764, "uuid": "b2bf4c3d-801e-4b0b-9892-c779ecaa73c2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716764, "uuid": "8d22e1aa-2906-4ce8-a0ec-f773f5ecaff3", "value": "7e3dc40ab5a5a824a157f894d0b46768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "300026d5-7a2d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642709503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709503, "uuid": "e6c5321b-b341-499f-b9c2-25f421013aa3", "comment": "Malware payload", "value": "ec34268e83ff9d28a9f02863657335c9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709503, "uuid": "546be53c-ac10-4eba-b45e-74b90a18f573", "comment": "Malware payload", "value": "10adf6726c61d0bfb4cc674a2f2787f68f73c3ea3abf509cfb206d53335dccd7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709503, "uuid": "94cc4a36-18cb-4b53-a6a4-aa00f447a236", "comment": "Malware payload", "value": "cd315b903b23b4a6422fe99078bde8e88a0dd053", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709503, "uuid": "b836f5f0-7687-4d4c-8587-ddd59eb8237c", "comment": "Malware payload", "value": "af12843336f3ac5706f0654262a59349fe9ab2a580a77d2ee9120225186814a80b05fe585e6cbbf4fdb0e627308daf42", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709503, "uuid": "ea85010b-5440-427e-a051-bb50c84f8c31", "value": "T18BA42889FB2CD8ABC2110B728DDA437C2331D29517025A2BAF7C617C9A257ECFE43556", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709503, "uuid": "56083a60-e9cc-4a33-a1b2-b2819a76ace8", "value": "6144:jQEBVg1IKfmbmAyFfVI9OSUIqS/FVmcSQS9nH7DmtWVc9T:UI4IYmbmtVI9OqqS/FQcM/mtCc9T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642709503, "uuid": "1ae9dfae-280b-47cd-9200-7f0f183c8f4a", "value": 482504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642709503, "uuid": "9d653c7a-5d01-4c9c-a95a-8da77ab2f0e2", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709503, "uuid": "51b170d5-058f-4338-be45-fa209bcf1540", "value": "bashirc.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec105acd-7a0b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695216, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695216, "uuid": "26e98291-c0a0-4c2f-8bd1-809823a79d54", "comment": "Malware payload", "value": "a5ff7d048f12f805a7eea1afff651acc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695216, "uuid": "18c73322-2d52-4bee-bddb-87f94906ca61", "comment": "Malware payload", "value": "10fdbaec7cbd9cccf8ed85420ce4cd649d5dcbfb19f29a77c8412cf6d01ad432", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695216, "uuid": "2d7f3b27-fa44-46fa-b1cc-9780d2a6c957", "comment": "Malware payload", "value": "ad67340ed690dab59965f0481134f057f40ce594", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695216, "uuid": "398d8554-fd62-4e4e-8af7-abe09e98ad00", "comment": "Malware payload", "value": "79857d91bb8c297c9e3208353eb858fe01e54ad4fcbca397dbc4a2bfd1555d460133f448a77cbb08382988b4e2751be3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695216, "uuid": "c7b653d1-83b7-4241-8b69-1faed7bc5c88", "value": "T13A731813371D0E43E05B69F82AF72BF083A6FDE61662A544A119FFE853726F02411B99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695216, "uuid": "2dfefc43-8669-4bda-bb94-61f4deeec172", "value": "1536:6cWLV1u8ZpUdJ6DDdniqRQsyeGUlo6VAgH0MnK/r:6hTSJ6DDgsGUlo6VAgUMnK/r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695216, "uuid": "56d3367a-6328-4921-a0f4-7df6f3d863fb", "value": 75229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695216, "uuid": "c963c18c-61ce-4aa1-9e1e-d2271d9c7b76", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695216, "uuid": "7c28e37e-bedf-424c-99ad-a702ef2a2a0c", "value": "a5ff7d048f12f805a7eea1afff651acc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b6fc5e1b-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674941, "uuid": "c0e78965-5175-4523-8c3a-811e001ce76b", "comment": "Malware payload (Mirai)", "value": "fe3e7d0595404ee9f364c9f11c043eed", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674941, "uuid": "3de0db8a-5049-4dfc-b1ca-348bc97a65b3", "comment": "Malware payload (Mirai)", "value": "11fe516417666e858b1b55067783444ee83a511d69cc17fe0f683a56861c4b12", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674941, "uuid": "af20f784-0964-4046-986f-104c875a1a6d", "comment": "Malware payload (Mirai)", "value": "c0716897b5a2a94abbf03094defbe1b82e8d9667", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674941, "uuid": "cf8cdfd7-dc3b-4167-96df-8516a8b32286", "comment": "Malware payload (Mirai)", "value": "715fba9e5dea55edfe6b5d245ad18778b4d59cf8155747c432372e05c1422dfec09da47d8ef4975e3b564a1812273d93", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674941, "uuid": "4f844df3-ad20-4d64-86b5-d1d7305e9871", "value": "T1F8A30897F801DFB7F40AE67604D34B24B670BBE54F531622722739A6AE722D42823F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674941, "uuid": "a037801d-3b7a-48fd-8e95-f854c1a67c77", "value": "3072:BdKLGdUvuXwyKQlU8fz86mumuxVqDr78fz1e:BdKLGdUfyKl8w6mumuxVqDr78fz1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674941, "uuid": "c76606b5-0b69-4341-8d5f-c28372f3b1a4", "value": 98923, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674941, "uuid": "756971d2-d64a-4264-80e9-275f711b3151", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674941, "uuid": "95f24495-fd33-4cd6-bfbd-2f7f84bd1647", "value": "i-5.8-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713a1cd5-79db-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674394, "uuid": "eb9bf0bd-c205-425d-996b-a89a8d97b22e", "comment": "Malware payload (Mirai)", "value": "5a67404487538e34c13925c445d00a60", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674394, "uuid": "763e05e1-2af2-4488-b85c-c8f8910f0953", "comment": "Malware payload (Mirai)", "value": "1227752a9329b296aac8ef57ac7d7ef5947b227d623c5bfcc3d8e0dab936a642", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674394, "uuid": "cac3187f-b54e-4ee3-8525-db8737188489", "comment": "Malware payload (Mirai)", "value": "8863f9cfdb01c672ab3b56ee119ebd2599150cb6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674394, "uuid": "695f1e09-8506-4ca0-b97b-1f6bdd7da934", "comment": "Malware payload (Mirai)", "value": "6df2f9b41139278714e4e2ed6ccd662303b8d48e4a522ed165517430953bf3790f98c1519083d4b56a0e2882a76ae22e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674394, "uuid": "c20232f2-354e-4c3b-a360-48bc5c91bef3", "value": "T1EFB39DABF2071591C8A346F007CB4FDE6E1722C29F57C4E36C6E253E58750DB1A0AB86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674394, "uuid": "601df033-ef69-4dc3-940a-953b894aeff8", "value": "1536:Rt4uLcytbI96ifY2aye7tcOiyRLqlqOgb3a10S/LWmoo:34uLcytU96UY2JatcwRLqlqOgbWTqmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674394, "uuid": "3f920140-9956-4b4c-99fc-f3b06794593b", "value": 117288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674394, "uuid": "26d7ee9b-1c98-4d60-ac09-9609707363e8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674394, "uuid": "a75bd248-85d3-4e8c-a12a-af11e0f7885d", "value": "uYtea.arc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6932ce7-7a2d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642709702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709702, "uuid": "514cf718-3b57-4f37-b8e1-e37abb3afbcd", "comment": "Malware payload (Heodo)", "value": "203f07c7c9b2c411366db87862173b0c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709702, "uuid": "775abd88-defa-43f0-88b0-4eda6ebebfbe", "comment": "Malware payload (Heodo)", "value": "1260ff0a2fff2aa76478b723fc979c02f5b051d7edcb19cb4428cbb157bd1a7b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709702, "uuid": "0e527233-1fd0-4405-be49-2c0e1c20ca18", "comment": "Malware payload (Heodo)", "value": "aa69467249e555900011774563b5d982e312eae6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709702, "uuid": "1de0d825-59d1-497c-a7e6-1fc9f2baaa8f", "comment": "Malware payload (Heodo)", "value": "e58b8854a6e5c9a752b7b5bbdd478cf21d8937b7c812ff6d166530933c0af7b420ea31cecd3cdb90d5fa1582145ec6ba", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709702, "uuid": "b73c2215-f604-40c3-8128-d0a0364b09a6", "value": "T13AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709702, "uuid": "0f8829bc-1a39-4c24-93ed-0e6d28ebfdc1", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642709702, "uuid": "c68df328-ccdc-4318-baf0-dd7b9b694a32", "value": 144979, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642709702, "uuid": "47c6fc14-0e73-4007-b62f-ded40cef4918", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709702, "uuid": "4b1e4b3e-2214-484a-8b0c-dc40146c299a", "value": "203f07c7c9b2c411366db87862173b0c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a1a02a4-79d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642672664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672664, "uuid": "07b27d46-29d9-438a-8ab8-37f94d67d065", "comment": "Malware payload (Gafgyt)", "value": "29789a272583e67ad9754c7663eb7398", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672664, "uuid": "f54b865a-0f56-4e9b-8c63-f49a6dfcf5b8", "comment": "Malware payload (Gafgyt)", "value": "1265eb2686a6d7401b8b8d657d95e9a94b5b358b2facbed73b7f23a84980cb60", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672664, "uuid": "9c17d6ab-7ce0-4aa9-9ccd-92db93834654", "comment": "Malware payload (Gafgyt)", "value": "5cb6c3af674c4293205470e3e1c284115e02a1b6", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672664, "uuid": "fcccc50b-9317-4d21-a1f9-2629c4799d0e", "comment": "Malware payload (Gafgyt)", "value": "fc9bbe1ed12f7aeb1253ab7ccabe08e6bd02fb5a3d38ede7248ef5c9e3d5a782263ad86c387762f8b50a64d6497abd0c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672664, "uuid": "41a65e83-933c-419e-833a-e9eb12798232", "value": "T1BD4318A2B801EFB7F40EE77644D34725B270FA664A63163173177D6AAA362C43827F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672664, "uuid": "a1d5b49b-2125-4ea4-9e48-5e02f0d8f34e", "value": "768:8bM70ogb5AWLYgam8h7/kbXyQ0zoBoThscMomyOTAHoIn8V78RbayU6:8Uw5AhY89KXyQooBoTicMomyOcIMQQS6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672664, "uuid": "adc67e7c-121a-44e0-aecb-c3625e9618bc", "value": 58885, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672664, "uuid": "bd5b9a31-613e-4e58-b25d-37921b9eda57", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672664, "uuid": "f393d320-b3ef-4ae8-8d37-171860ae6d40", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95a7747d-79d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642669731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669731, "uuid": "1bf863e6-86ee-4607-b89b-82916c6312da", "comment": "Malware payload (Mirai)", "value": "3c76097381d355f42f5db907ce429fb9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669731, "uuid": "a9bd584b-175b-46f2-aea0-1aae3d29e756", "comment": "Malware payload (Mirai)", "value": "12f9074dd906cf60d149067e47b5bd73a27a198fee1bc3e906437e65ce589936", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669731, "uuid": "5445075a-97d0-4c04-a690-4ec1cb701f86", "comment": "Malware payload (Mirai)", "value": "a60d962614ce447c1e137e57540ee90604d969a2", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669731, "uuid": "f779411a-9733-4b4a-8012-2dce15ea1e58", "comment": "Malware payload (Mirai)", "value": "578dc916106f8d82ea2d1e3f4e7f6b2bef83b2c07be448eafaa0c40e0db3457718b8bd8705a8c93b3cc5a34c49ffef3d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669731, "uuid": "7704a381-682d-41eb-b122-1eced8d45ea3", "value": "T177330861B8936A1BC6D0237ABAAE558D332063E8D2CF3217CD601B147BCA51F0D67F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669731, "uuid": "b2493d8a-56c8-4292-a5b1-2a4617b45871", "value": "1536:VvmyehDi86b9vUwmkaqXDBnww6Ioh+kWIi:VvmyehmYVw6hhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669731, "uuid": "4f721301-f2a4-4067-805f-6d27441affb6", "value": 54648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669731, "uuid": "467518dd-e5c8-48ec-9fb5-285ac0545cb2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669731, "uuid": "6916b8d2-c6de-4e53-9720-cad1077a21e5", "value": "gang123isgodloluaintgettingthesebinslikedammwtf.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda83333-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642675059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675059, "uuid": "6932ab8c-7f58-4d5a-b79f-963d1a322541", "comment": "Malware payload (Mirai)", "value": "fe3a81e95999771a01b9ef122f349852", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675059, "uuid": "4c174847-5645-478f-8587-df6855a69ea7", "comment": "Malware payload (Mirai)", "value": "138911f349d1af24600cb924fe6b0378ee8b835c89ea3291221f18d8b936b96c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675059, "uuid": "d05d5dbe-0b71-4624-a575-2b6a6e8f1267", "comment": "Malware payload (Mirai)", "value": "09b84f4ab208c4203582f8dc4df9914a31c7b81f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675059, "uuid": "cd9418e8-8ede-4d15-a03d-663c485dbb62", "comment": "Malware payload (Mirai)", "value": "1cd521447cac89f14e1f43b2164fe74fd2d0ddb6db18cb6946b45766830d652d0f34da5f75fb062a3800d63f4a5c8331", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675059, "uuid": "fcf17f9b-9161-4a1e-9b98-81dced7c7258", "value": "T1A8B2D0B1D6187BB3F6700975AA58C44B570B12F8837A7675326C07AA87C2E0277B49CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675059, "uuid": "ce420b3a-c6c8-4cf9-bf2f-9bf6e3cb20e0", "value": "384:bjPxebXYkx/cx5rxB9eQrHLycsTCIvEZutlsjRlgOWhymdGUop5h8U:HxeUs/2xerEZuMOs3Uoz+U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675059, "uuid": "6ef71afa-28dc-4822-968a-b02321283e87", "value": 24760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675059, "uuid": "9ca52c3a-727a-422a-9655-6e4bf5323d54", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675059, "uuid": "9c682ca1-da39-4173-b9be-3f9b34b0ed97", "value": "Tsunami.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e918c8b-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665639, "uuid": "5702b522-f9b5-4649-984c-5ba9e8071c45", "comment": "Malware payload", "value": "82f156483b3c453e6163c2a1c1d1ad8a", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665639, "uuid": "9566e7c6-4c85-4167-bdf3-01a8fb22d237", "comment": "Malware payload", "value": "1476931ff1a1384f02d3d8182d8769d3ffb9761e8d6cde9264cd16a089b1a760", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665639, "uuid": "414d2528-58db-453d-b88c-cdac3cacccc5", "comment": "Malware payload", "value": "fba052d9740975bfe0964a1ebe1c464fc62959b0", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665639, "uuid": "12a54002-f785-4c87-9fc6-b00a8a55a7c9", "comment": "Malware payload", "value": "f30cd85501509668810329fc5a15688b0cec7253976c0bece8ba21629f42dfa9689fad2e5fc64ee7792cafabb7321437", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665639, "uuid": "2fed8e7b-0a21-486d-b4df-642139cbe4bb", "value": "T1D3B57C22F2C1C537D0732E38CD5BA3A89529BD501E28954B7BE41E4C5F397817E2A2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665639, "uuid": "cadc9787-038d-43c9-8172-18f039f5a7c7", "value": "49152:DR59LqOvotV7tngltehm/Tf9yTPU3Z3OYLEA:79LqOvi7tgjehur6KOYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665639, "uuid": "c2a59ee2-80b9-45fd-852d-82dd73ef7964", "value": 2346496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665639, "uuid": "70e00e74-303e-45cc-9aa6-f73aaa512ced", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665639, "uuid": "92f1bfdf-feb9-4dae-bfa0-25b60ad0abe1", "value": "inadimplencia_vvfj1673380.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d44849e-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666603, "uuid": "5b97258f-7290-4f8c-8a4e-72ec9f31a1de", "comment": "Malware payload", "value": "b2eb3785e26c5f064b7d0c58bdd3abe0", "object_relation": "md5", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666603, "uuid": "e8989980-d6bd-4315-beb1-255e616ca92c", "comment": "Malware payload", "value": "14e3c13e7455e571bd4bc010d174a6a0f7d416216b77c1e0d27f0f3be59e3bf2", "object_relation": "sha256", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666603, "uuid": "e0a7a34e-6923-4d53-b8dd-d8a6610a700f", "comment": "Malware payload", "value": "4fe811c74b66460f6dc74f0c910ded417920dcbc", "object_relation": "sha1", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666603, "uuid": "86158353-876b-4bdf-ad00-03b60478301b", "comment": "Malware payload", "value": "68f03f77725f719c691d8b05c23bf160cc01e702cd0fe60fe5022c164b91cc8b85172f024862ab5cb3f17ce43db23295", "object_relation": "sha3-384", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666603, "uuid": "993e7633-99a4-46fb-b559-64e478db7f02", "value": "T10B05339BB42B693BD30E5B70FE0BF068C99DC3BFA4A4B524FF552494CA102B58E46017", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666603, "uuid": "29fad2aa-561a-45ae-bf7e-5fd775e61237", "value": "24576:qGZBscrlbdvm21QzAgSrx6q/xE08YH9vXKwpq:qGTBRbd+VzAL/SgXHpq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666603, "uuid": "3b86bd0a-7ff4-4e75-907c-bafd46eb022e", "value": 803725, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666603, "uuid": "7b69b9d9-e6aa-48bd-88c9-ed9b4241159f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666603, "uuid": "3163ee61-80d1-4bcc-a1a3-83f84094a715", "value": "List Product.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55ad14d2-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642665758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665758, "uuid": "fba063e0-a999-493e-9026-bcb2f46fd04c", "comment": "Malware payload (AgentTesla)", "value": "421bdaf2711cd0a281df363b65a977e4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665758, "uuid": "98b519f7-e387-49f9-aacc-c7864b022229", "comment": "Malware payload (AgentTesla)", "value": "162bdf15d0bcb20725bb3cb8f06fcd34b6086905cb6389fa2f24bfc7314a28e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665758, "uuid": "051d5a37-13c9-4de2-9d3e-742ff2d05aca", "comment": "Malware payload (AgentTesla)", "value": "8ac74fab463fb85ba1fd9490326ac84ae880f0cd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665758, "uuid": "89c7132b-fb54-4c4a-b1a5-531b019f9059", "comment": "Malware payload (AgentTesla)", "value": "23b193802753a8c3989dd8702f60a79953ca5277dc6c7218a921cc5b47072dae0a15e9ddc16a6f2f76d53645cf1cf51d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665758, "uuid": "a2614f48-e9cc-41fe-90cf-214172814a2b", "value": "T18864125F25C0CABFD9435E732D738377CFF8EA16463228AB271E0F29956B0C21619166", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665758, "uuid": "78ba218b-5161-4427-a22f-c9f485c7e93b", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665758, "uuid": "5f122451-6ddf-4da2-95f7-a4576a7171f6", "value": "6144:owWyX0eDdmYffggvfp4OQo9F+DHOVnpISqzKUKsY302T:iykemQf3fKOQHuVnbKYk2T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665758, "uuid": "8c20ec7f-d433-4ff9-be1c-3331d74c5dec", "value": 316345, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665758, "uuid": "814ed16c-a213-449b-b0d8-9c76ad9427ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665758, "uuid": "5e0add66-5805-47a2-8a99-9e83b5ef3bad", "value": "Halkbank,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f70a6bf-79c2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642663627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663627, "uuid": "4c7f6d3a-aecf-49a8-9fea-3d9b671b47cf", "comment": "Malware payload (AgentTesla)", "value": "a3baca31775862fbc79729b869491412", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663627, "uuid": "6f3780c1-596d-40d4-b357-25e3c6e92d38", "comment": "Malware payload (AgentTesla)", "value": "17157684680738db38e2185960af962dfaf7ab6e071fce7643eec989e2d15248", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663627, "uuid": "f7dff0e4-f369-4900-9708-5df34af87782", "comment": "Malware payload (AgentTesla)", "value": "206cb3f113538c86f8c9f666eaabe18257a69125", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663627, "uuid": "e83c19c3-f7fc-434f-9a32-b4ab8f4156d1", "comment": "Malware payload (AgentTesla)", "value": "87ef4dd9b5215ed4f91389139e86bff6e77210a9a17df40cc9546a65a4301bc8a36f4031f8f68be1681cd7b81f283321", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663627, "uuid": "80d89fe9-d283-4217-80d1-8b509f377fa1", "value": "T17CB4BFAC755072DFC86BCC769EA81C64EA5178BB830BD243A01315DCAA4DA9BCF151F3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663627, "uuid": "ca05fc9e-8341-4430-af0e-beb5fa5c030e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663627, "uuid": "a1937a21-49ad-41a4-87ab-6221d1d4a679", "value": "12288:lho+NFwXZzevLY9ud8HsgOVS0VX4Y7OCtNY32mPub0dAc:jo+QXBb9umMgOVNSub0dAc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663627, "uuid": "f517f576-55cd-4bb9-9565-4f2318c1590c", "value": 500224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663627, "uuid": "14964603-d342-4858-906c-c3d4318296c5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663627, "uuid": "a1a0147d-62b0-4437-a66d-f2b5d63b2d88", "value": "PO-Accessoriesequipment.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "750d58f2-7a2a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642708331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708331, "uuid": "cd0545f1-2ddd-4200-8630-37df67f77392", "comment": "Malware payload (RedLineStealer)", "value": "c1b2cef0032b0032743287094d3d4a6b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708331, "uuid": "eba000f7-3348-4c59-9bd0-88b269999c3b", "comment": "Malware payload (RedLineStealer)", "value": "172c3197b51f2568ccc5769d6cb0f069f1eeb3ccbd5ba924aaac80110d9472c1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708331, "uuid": "81b1070b-056d-4c26-98ef-9a652e045b97", "comment": "Malware payload (RedLineStealer)", "value": "a9d2e377332a3edcfa371d91e8e2e434bfe1665e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708331, "uuid": "a404f289-e854-4a02-9c8e-f1189373e9e1", "comment": "Malware payload (RedLineStealer)", "value": "dbe77f7bf06964eabb6791863d062d5529795bbbab7acb2234639263c9cc6c444a318f9da6a08bd53fc336f21ab7b342", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708331, "uuid": "0f5e4731-c7f6-4c3b-8444-8f08ead2e1e3", "value": "T1C9C4226070874096C9B84F3A1875A7F74A2FAC0F5C503A026EE47B7EEFB25B95A1158C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708331, "uuid": "312070e6-475f-4429-8bae-66288a72577a", "value": "18600288044736f8f82d4bea3ba0b2a9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708331, "uuid": "5cb38c05-9996-45e2-86e4-c2f9b9bfff18", "value": "12288:sv6OaJHhvt64u/lHz/Q5x6R6PXVbOWkBu:eaJHhE4u/Gr6R69bLko", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708331, "uuid": "54392797-cdd9-4129-ae28-3a0bd17e922c", "value": 582480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708331, "uuid": "6e1f370a-2832-421b-8c46-91953d4dd3c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708331, "uuid": "89a2e72a-f2f0-44f5-bafe-22c24f28d03b", "value": "c1b2cef0032b0032743287094d3d4a6b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74963ca7-79f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642686426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686426, "uuid": "456624ae-7872-47e0-8c34-8975b65cf6ac", "comment": "Malware payload (Heodo)", "value": "2db09b4bc3d17a6911e91686d307934f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686426, "uuid": "8a7a871a-ac3f-458d-a018-7e0970302413", "comment": "Malware payload (Heodo)", "value": "17581147f8499f2af73d7e6c3e66e18acaf2d4acdbec0aafa790384231cc9f8a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686426, "uuid": "f1b513b8-ca61-463d-a145-7aa42dcfa725", "comment": "Malware payload (Heodo)", "value": "f19c92d9afdacfe8e19401c36228b37cc933f5d6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686426, "uuid": "3ec65169-90f0-4543-a4fd-bddcfe67956b", "comment": "Malware payload (Heodo)", "value": "9d7c6a2d2d77bd0880459fec2fe3fbd586361ec5233455ce01a083738a6e1b418b789ebd07c0480e09cff63420a047b3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686426, "uuid": "804d7eb9-1f08-4399-ae8b-ca2f99c49854", "value": "T13BE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686426, "uuid": "7efb0240-9e4f-4c51-b000-8b2b3738cfe4", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642686426, "uuid": "b8b87e39-d48a-489c-9fb5-7d14fd966cf8", "value": 144539, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642686426, "uuid": "ab2cee0f-d423-4132-ac6f-0a425701ce7f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686426, "uuid": "0c086ee9-6069-4125-939b-650a3ca0a721", "value": "2db09b4bc3d17a6911e91686d307934f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1959c87-7a26-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642706687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706687, "uuid": "66c143e2-3142-4928-9d0c-48d7d3d82589", "comment": "Malware payload (AgentTesla)", "value": "30181e3587c815a5f0f3e5978881da8c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706687, "uuid": "95072150-36c0-4ebc-b0bd-344a2f1a9b2f", "comment": "Malware payload (AgentTesla)", "value": "1761708807cc80699956bf603fa86f92f24410656df3abe71cca5d1803967130", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706687, "uuid": "f97996c5-c79b-4574-94eb-a2cb46c2db5a", "comment": "Malware payload (AgentTesla)", "value": "fb88d5251cea0f55ea669d751f5082618d5396bc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706687, "uuid": "4995499b-578c-49c9-a50a-0a4a671eea82", "comment": "Malware payload (AgentTesla)", "value": "75600b3e2e955f229b7635010a569fd0b2b327d629ce980bbcfd1743122e7acfbe94dbb2d75e7f868730a98fa6ba183d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706687, "uuid": "1d68da51-bf00-48bc-b9ff-05211c6ff92a", "value": "T147C292BCD0A701988F41ABBC5B2BAF45558C3A2DF7889133327CA7316BD5E7A511293C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706687, "uuid": "06587da5-d39d-4c13-bc0f-9aa19860f717", "value": "384:TR69T44G0w5g3sXOM/DI1nUSHuZQTqigOXocTI1J8WhrTAoJAZE:TRk4VbS3sTk1nhxWhrFAZE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642706687, "uuid": "395297be-69d2-4585-8c46-17976e5099ba", "value": 25792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642706687, "uuid": "e5506766-16b4-4aa6-8287-d6d42c770531", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706687, "uuid": "617f02bf-6980-4037-8ecb-05b61135edd3", "value": "print_01.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfbc2a1a-79da-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642674150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674150, "uuid": "8feb7541-da7d-4d26-a900-521798b37037", "comment": "Malware payload", "value": "956942f47beb98223579f48c1db3a009", "object_relation": "md5", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674150, "uuid": "fd47a8df-053e-47b4-b107-176f9908594b", "comment": "Malware payload", "value": "17ba16c864fab3e21b71529be9351e28a41c441b1300153f0eeaaaea9033ca2f", "object_relation": "sha256", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674150, "uuid": "a7571064-d4b8-4139-a381-51df63ea2367", "comment": "Malware payload", "value": "5347f54de62df30b9ac4a27a4b68536bf5d8fc00", "object_relation": "sha1", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674150, "uuid": "6b9afbdb-46eb-4ba3-bf27-45425f2a3bbb", "comment": "Malware payload", "value": "21d4a4a89f789e030521e95355d4c991e9d9ee0cceed28840c33126694aeb79bfeeca4b2b25c7d8f8eb18574581971fd", "object_relation": "sha3-384", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674150, "uuid": "fa217205-be9f-4d30-b2d7-47937d31a5d1", "value": "T1DB946B0277ED4128FAF7AB705974C0155D7ABCA9D8B6E02E1660814E1CB5E80CFB2B77", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674150, "uuid": "136f6df1-4ffd-4afc-afb0-a12a5b9948ae", "value": "6144:lI8CoGED5ecfN+J+HkIPjUk1OJ/3wmgtOp3+jA3QayKqHbHlTcpA+HSA:a8Cop51fN+Cb6Vw3OZNyVAAi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674150, "uuid": "62c01c14-8ee0-4cfc-bc7a-28521081edf9", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674150, "uuid": "6f07adbe-7d83-4f93-8929-bac3a1322479", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674150, "uuid": "1d221a1d-d94a-46c2-8378-08d442b96247", "value": "test3.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a988bec8-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642666328, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666328, "uuid": "34d80e26-e29e-4abe-8b4e-e09386bd1738", "comment": "Malware payload (AgentTesla)", "value": "edebb03a1fc0184c9f6bfe8271225fcb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666328, "uuid": "edec9f8a-c712-432e-b368-f32609589056", "comment": "Malware payload (AgentTesla)", "value": "180a5d8c28bc4b365d42351b37869f1ab329a6e9c3c442aea122080c9e932dda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666328, "uuid": "fa6e4906-d8c9-4e3d-8802-12927713bb3b", "comment": "Malware payload (AgentTesla)", "value": "5b73099ff2d2903b79c824e3f09df993ce23e275", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666328, "uuid": "704a4075-eed4-43b2-91d9-d4c6d5639e02", "comment": "Malware payload (AgentTesla)", "value": "c0758cd03f9dcf895f5e1f7ae45e0fad403c36cc52e2c05b8290920ffdd15eaab2f204ffb7d19552599bae2c2f496b1a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666328, "uuid": "1726a36f-6ec3-4fce-8fff-db3e561fcb3f", "value": "T1FA84EDF9E7E34693F8315A36CB91433461327EC9A4E45DF645C8BA2C4E302DE921E96C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666328, "uuid": "194b2f7f-f200-4b3a-9155-f8601b6748cd", "value": "1536:L7PvzvDyfSNbzhU47FEdSGVS9ZID9khfC3+bLrubADuByVAB3Zfcpn+1MVoyJPkX:L7PvzWuXFEdSAeSD9jIXDuB/5GfqPGQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666328, "uuid": "31ccdeee-bc20-4948-b667-e8cd16c4666d", "value": 379080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666328, "uuid": "97649425-70c7-45c9-b878-171ca0c9237f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666328, "uuid": "2df7da77-54c6-454b-a638-cd9ac7e27eae", "value": "DHL_Jan 2022 at 1.10_80BZ290_JPG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c3ba154-79c6-11ec-9275-42010a9c0029", "comment": "Malware payload (OnlyLogger)", "timestamp": 1642665366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665366, "uuid": "f3459753-e2d1-47f7-ae48-3248faa4ae94", "comment": "Malware payload (OnlyLogger)", "value": "bd3f3318a85ad39f2d7eca6e3a666514", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665366, "uuid": "297f7e00-7f24-4d6a-9aae-f2059ed2f1ff", "comment": "Malware payload (OnlyLogger)", "value": "18a2e53028f323ca5465d6acd67da7859370cd4f132f6d1a39dc08e89f88de78", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665366, "uuid": "d9069fc3-2ff5-4e41-a8ea-1485791ad58b", "comment": "Malware payload (OnlyLogger)", "value": "74226cece4809c1e4de4018dd0ab491f90a3aae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665366, "uuid": "b4342a80-7515-4c14-a7a4-c00e78d84797", "comment": "Malware payload (OnlyLogger)", "value": "4d39f225594859fc111313815f4200ebb89052e15ed0f3123415d50d383dabe8731eaf02add0c79d42ca8a3dfc4c70f8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "OnlyLogger", "colour": "#4D83D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665366, "uuid": "af58d0e3-f6a1-40fb-8799-8962c9e1bbf9", "value": "T1D384C010BBA0D034F5B712F45A7A93ACB93E7EB1572451CB62D12AEE1A356E0EC30357", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665366, "uuid": "1e0d0f82-dba4-4e3e-8031-7cb0d5286f4a", "value": "bed56fcc334b35bbcbc5c3e5d6f4e894", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665366, "uuid": "e1f08642-ee13-4f10-911f-74807bf771b5", "value": "6144:WCMqRjFhKy2aw50LAxhLEIMqR0Y6oBx/dx7YNopl+97YK2AaWpYT+mhCZVLLsXpl:WlsFoy2HSkxhLbMqRp9x/dx7YNopk9Gz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665366, "uuid": "ce20a0f8-bb98-4957-b98b-5082393f7e0e", "value": 392704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665366, "uuid": "ef4271bb-8eed-4500-872e-80ae1370b9ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665366, "uuid": "9b4d2bc0-338a-45b0-a7c0-1d8053e00b54", "value": "bd3f3318a85ad39f2d7eca6e3a666514.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4e7cb6a-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1642660737, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660737, "uuid": "c9796cef-979d-40cb-95da-9897b7e4b534", "comment": "Malware payload (BazaLoader)", "value": "a7b5773f21c69c8e2706df0b3807de47", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660737, "uuid": "c0382b53-3c11-4df4-8532-4484817f1ad8", "comment": "Malware payload (BazaLoader)", "value": "18f5ade40bc5441aa11d03672f5a08e0b05e3fdeca5f2903a565ca7632d9e537", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660737, "uuid": "5bdaabca-9ee8-4b49-a899-a1366ea461df", "comment": "Malware payload (BazaLoader)", "value": "efa02e80c7b3899b1c3092d1a164239e8870a848", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660737, "uuid": "10c6680a-6d58-4ba3-9af3-67c45e9c97fe", "comment": "Malware payload (BazaLoader)", "value": "210c2bfefbd5d3e6444219a7bbc8048e067292f43c930ef3c0fd2311222ea2250ae54348c6dca7da858d562786cf142d", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660737, "uuid": "d4ba9ab4-ec1e-4a52-8951-ff5db06210b8", "value": "T18E85FE43180C819F9867D77421671D97EEB87E47F2C84E1ED1E428B84AEBDA674CA04F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660737, "uuid": "4c7c0f20-600c-46bf-a421-c740cdc94b57", "value": "f30f2b5b65c947eccbf132b668fe3257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660737, "uuid": "396aacee-2301-457a-a357-9178ee5bc8fa", "value": "24576:la1QHwgJMrQqj/wAc6QORNx2nAjwkaDm0GV9igWwlnwXQBwfalj21X4GtZ+FdnZ8:gH5qloBMd8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660737, "uuid": "e187dfb5-5847-4a93-a3b7-8c7e615564b1", "value": 1816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660737, "uuid": "54f06fc4-902a-43ac-adb0-d6a1db15ab6f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660737, "uuid": "a69cc42c-1d99-4b45-b2d9-fc75e6a60fae", "value": "a7b5773f21c69c8e2706df0b3807de47", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe3976b2-79c6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642665611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665611, "uuid": "7ef599b7-3e80-4371-ac38-bd650b345fd6", "comment": "Malware payload (SnakeKeylogger)", "value": "5cf9438d0cce7f1a7d70b73dcce5f210", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665611, "uuid": "1d53635a-f8a5-494a-9e16-cb7c0f3272a1", "comment": "Malware payload (SnakeKeylogger)", "value": "19bd3df06f35497ddc090fc8b39b26769614d1ee1efc0833197b87e020cc1a80", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665611, "uuid": "33081369-c816-44ce-8477-d6ec6fc1ff4e", "comment": "Malware payload (SnakeKeylogger)", "value": "513aa59f966126edfd9140ea30b3126784310c82", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665611, "uuid": "658176c2-2cdd-4c3b-b686-80959bee04fa", "comment": "Malware payload (SnakeKeylogger)", "value": "400cdfc1b98d3fbca9f6dfbb6987741632b86388ba329065eee67de71d24af5c0abbe652cc49c98d74d63c3ab71aa2ce", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665611, "uuid": "2f47fb83-2221-4fca-8a2e-5b75f3a2fd03", "value": "T1D8A2936CD4A706A88F456BB8272B6F45118DBA6DF3899533327C57301BE2E7A0423D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665611, "uuid": "ea2bbc51-8840-4045-9629-56b5ed157a84", "value": "384:WJEVF3J3pxr1cC3o3kesgoYZxtOyVp6zQXYPH:g+J3ZcVkessOyYPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665611, "uuid": "50056f6b-ebea-47ac-a7b0-2f14262ac09b", "value": 21636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665611, "uuid": "354fa6ff-2f3b-4eba-a3a5-9ca299f13d4d", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665611, "uuid": "84f40c4b-951f-49ed-aa02-5ac80ec6066f", "value": "LIST FOR QUOTE.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f69ec778-79be-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642662162, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662162, "uuid": "058b2c07-49db-41c2-92ef-2f226cee4fa7", "comment": "Malware payload (RedLineStealer)", "value": "d9a4ddffc0170e5fbca0218f8244ea93", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662162, "uuid": "c227d92d-068e-4810-9f56-8aacfb9d8233", "comment": "Malware payload (RedLineStealer)", "value": "1a19f686e340a2e7a98406adb717d55fa76c2d12e0740565a90ae7eeb8997a16", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662162, "uuid": "00f91416-2f24-41b4-a942-d94e6a04ff43", "comment": "Malware payload (RedLineStealer)", "value": "d2bf763e6ca2ff82a2e48e424b014e142a31e19f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662162, "uuid": "1987959e-56d3-4d1c-9c5e-0d5ea66d5de6", "comment": "Malware payload (RedLineStealer)", "value": "40f30aa56ed0c4b630186dac63a8814d824d55a1aa641778f6daa435dc8d4c7785511ab33602377c6b34ac6ef80263a5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662162, "uuid": "21b4bacf-84ce-4442-8f55-7e8bbb1009c6", "value": "T1C784E075BA80D032F886D631863ACFA359BDBC711954474773A83B2A6F3129132A735F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662162, "uuid": "868fee09-cfda-4e63-b598-2126c7332674", "value": "125adc129c50285a2cd4524417d3fdd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662162, "uuid": "df41120b-2e68-46b7-b757-412dd363784c", "value": "6144:nw4fLRV2YtDcJGD3musmwmXGweTwebBOYkIyHgIW:nwSP2YtDcJHEXGVj5khW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642662162, "uuid": "22ff039d-af51-426a-a00b-5cd7d8c25f77", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642662162, "uuid": "e0b9df19-0738-4e48-8fdb-c10a7608fb1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662162, "uuid": "b1c6b6bc-369e-43c5-87a2-9f558698f96d", "value": "d9a4ddffc0170e5fbca0218f8244ea93.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ef8680b-79d5-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1642671894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671894, "uuid": "e93b724d-20c7-4fd2-be2f-c4affdc64143", "comment": "Malware payload (RemcosRAT)", "value": "8cc25df069ec48ae8187e12018cedff8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671894, "uuid": "d4dcde68-6c5a-45a1-a205-227537841641", "comment": "Malware payload (RemcosRAT)", "value": "1a46084bd4ac24c54d3462786cc1f9d3ff67735740680f26ca1c24864b684b8a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671894, "uuid": "40d93e32-c2b7-497b-ae82-083a998858a7", "comment": "Malware payload (RemcosRAT)", "value": "16dc9e7aab5b2ec6ad0eefa8725cc45151034145", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671894, "uuid": "773f458b-1b7e-4a32-ad3a-869a8b59dc9a", "comment": "Malware payload (RemcosRAT)", "value": "784752c05e6ff589690dbe810e1f6320e013cfbfbca8b402dd1027c01211a7762933f6203ab0256c579b5e7676ef093e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671894, "uuid": "133e9edf-a966-4086-94b0-5c0f1e7417f3", "value": "T158740110BBF9172EE6FD87F4A532101053BA7A5A2263D21C0C9A70CE19BBFC65651B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671894, "uuid": "84d06b27-540c-4795-8cf8-1102164d2da6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671894, "uuid": "f49f4f36-1b82-4219-86ea-ff619b02c400", "value": "6144:33CLLF3dJHISqDjHug7AZ5VDGJXhfvzH1R8mZaU5TH0In9Nt2LhMAmk:H+0DLugcZ5VSdNvzV+U53nTteH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642671894, "uuid": "e89bfaf2-42d0-4f67-8039-c303a0edb356", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642671894, "uuid": "6fea8548-12bb-47cb-91c5-f00da8a6f4bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671894, "uuid": "ee760ce0-2eb6-4130-897f-77475c0a41ff", "value": "8cc25df069ec48ae8187e12018cedff8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "518d0c15-7a45-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642719868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642719868, "uuid": "29622dcb-6e12-489e-8ceb-55324ae108be", "comment": "Malware payload", "value": "1a59b73480501ddead0d4fcff73dca23", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642719868, "uuid": "d69ebffb-d367-4846-8976-6adb500ddb56", "comment": "Malware payload", "value": "1aa1e797bd106f28bc73e4a09bd4d3eb7a13943ef42f06bda76c41fbca54d0be", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642719868, "uuid": "de33d247-1bd9-4059-9368-1a3134dab1ba", "comment": "Malware payload", "value": "c5e0aac4105036450c2f42e73d239528de2a6569", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642719868, "uuid": "0d487b6a-9b70-4950-b810-39e1f312fef4", "comment": "Malware payload", "value": "ec607a270d5194d61da9663f0a88f9b576e43a3e1ea221bf564a4e0a31375bf0fd51d03947ccfdeabe2dd722c9da2108", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642719868, "uuid": "7aaba0f5-12f2-4910-87cf-6dc09815609e", "value": "T115636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642719868, "uuid": "9466bfa9-4abb-4789-b886-d5d4d1ef7a56", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642719868, "uuid": "8adceefa-fd21-433c-8a18-5e61d665ff53", "value": 73111, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642719868, "uuid": "22af1c4e-1e7f-475c-91e9-241aabd60701", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642719868, "uuid": "a9140120-af3b-4b32-a2db-e43fc09cb00a", "value": "1a59b73480501ddead0d4fcff73dca23", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca0a1337-79c0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642662947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662947, "uuid": "75c53f58-10eb-41ab-a6e7-0ff48d2b82d0", "comment": "Malware payload", "value": "e2802ec63f08a98c16710f047ed71cb2", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662947, "uuid": "94ea68a9-0d9a-4621-9478-fa52b2a813de", "comment": "Malware payload", "value": "1b60ef6900dc790f2565e4fd27b14742ed6bec53252e3b142f0af6a246d94837", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662947, "uuid": "2a1024d9-98b0-4dda-9ad1-03b7bdc7b860", "comment": "Malware payload", "value": "5c6009e1e0dbebd832d458a6c5d28b9f6fc12382", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662947, "uuid": "6ea25fdc-0e28-44f6-a5dc-21738aeec134", "comment": "Malware payload", "value": "387f599bfcb2c10310250f5ff2f144a9db19bbf6b0a87a84ba3349956159e19fea4e536764d00b98c1e77831a61869c2", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662947, "uuid": "d29f54ae-b94f-4ea0-970c-cb35318c7b49", "value": "T120221A3163404F10D11442396FD3B6A5B6392C81BA698193E247A3FF3E7190DAB308BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662947, "uuid": "afbba209-a349-4dfd-8bef-47891f44fcc0", "value": "96:SaaJQL8rvfcRQv5ZZAaa9UoNrUarICIcB:Sawa8rc65wL7NrjrIg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642662947, "uuid": "0bcb4191-10d8-43fe-b22d-7043817e521a", "value": 10874, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642662947, "uuid": "f73719f9-1cf4-4dab-a49f-64b1ebf6e263", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662947, "uuid": "0bca2284-f686-4a71-840e-d58795f555e8", "value": "Status Report.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b61491a9-7a0b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695125, "uuid": "34124eef-555d-4221-9b87-cbfa74a08ce9", "comment": "Malware payload", "value": "366c80200fd35830f64d572e4bc49aa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695125, "uuid": "e7e59ec0-6913-4ed5-888d-0160e24d31f4", "comment": "Malware payload", "value": "1bbf372498ecbb05be3d2ebfe1919c1c786fdaf2ca28054f3c5057bc27a27e87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695125, "uuid": "54af410e-c19b-4915-b5cf-e4529edd2e5b", "comment": "Malware payload", "value": "b080826a7f7f46114af8d38098453b9510b18d84", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695125, "uuid": "70542872-8fa3-4237-8db1-e3b4ff3395f3", "comment": "Malware payload", "value": "4a7d53cb211de3490c33303b8e9db6125f315a37f586b73bde645ee1c08899da3126053da496f478dbed95152b426a15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695125, "uuid": "0e26bfa5-ff67-4fa5-9434-a5f60b11c9e0", "value": "T16F8308323B270E27D0CA14B511E34731B7B2D68B286E9657B9A0EEBC3F15AC435167D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695125, "uuid": "192435b6-0b4b-4aeb-8abf-98f8b4d6dbd6", "value": "1536:7qN4Qs5Bx0t5aAj5utVhYhk02YcZ4ko6VAsH9+nekr:JQsCjaAdYhYhk0/cZ4ko6VAsd+nekr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695125, "uuid": "cc212558-6a4f-46e8-bd76-5643cbdc9e45", "value": 84417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695125, "uuid": "2f0a193d-3611-4ce1-9966-a2a3ecd8d97b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695125, "uuid": "522ee848-0c00-4954-aac8-0d841ce8d29e", "value": "366c80200fd35830f64d572e4bc49aa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbedf8bc-7a3b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642715751, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642715751, "uuid": "346d1829-6f1a-46b0-8e85-502565ec6699", "comment": "Malware payload", "value": "c293fede037cb7ef8648b3ea795f7a4f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642715751, "uuid": "3e9bf2e8-d844-4931-aa45-c5ddd16e701c", "comment": "Malware payload", "value": "1cd33223f2bcf4e48f8673d10848ad384b08dbae29261df07e469406960ccda9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642715751, "uuid": "e94a1241-c7de-4bcb-8cc6-d877a7c5be6e", "comment": "Malware payload", "value": "12f2582035f04a3468f7ebb193feebd8f829bea5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642715751, "uuid": "d8a89aa0-319b-492f-a090-65f51e9e1e38", "comment": "Malware payload", "value": "6969bfd9e24664a22828271dfa86f88386eabef4b03b542968006e52fa12292fe6ca80c34edcffb90a9b2ff7f8515858", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642715751, "uuid": "b90591c6-dca0-4bd6-b168-37f621cb8d1e", "value": "T1CB842297E01C1740CEC60F3A9D27852A94729EEE4F025DE34545BDAAFEF472A2F4885C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642715751, "uuid": "62c3c0d5-45f8-4fe3-a923-5757346e22a7", "value": "f197229d03f2fb47bd50b959b5bc269c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642715751, "uuid": "38d43c6f-1e18-4fa9-ab90-636029e3df07", "value": "6144:xv5zQJVb5p72cHF1ybDFwekh212KhvwIb759QOaBjpaVRPu23E2rJmWjFc94:x4VOiF1WD7kE1dTYOi8V5u23zmWFy4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642715751, "uuid": "54200496-f3e2-44f9-8024-14d60d53aec7", "value": 384432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642715751, "uuid": "21406440-e054-47bf-b809-10e4565c2548", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642715751, "uuid": "2c9e7606-f57c-4016-bc78-319f759d33e0", "value": "c293fede037cb7ef8648b3ea795f7a4f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4b79e8-7a39-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642714701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714701, "uuid": "777df858-4efb-44dc-ad29-b1ecfebed17f", "comment": "Malware payload (Heodo)", "value": "03bbceb242abaf4c7710bffdb38a05c1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714701, "uuid": "3cdf6aa5-5186-4a77-9b68-afc33581ad83", "comment": "Malware payload (Heodo)", "value": "1d51a274899e8d9f5f0d731c91c8308a7437c80c22a0d67f92aa4ed958175e85", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714701, "uuid": "be675d8b-03fb-4dad-a3c8-b0260473117c", "comment": "Malware payload (Heodo)", "value": "32029d337e56f1ec657e50318b9d05c10e1f33b4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714701, "uuid": "0ec9dcaa-6e0f-444b-af49-3c14484224d0", "comment": "Malware payload (Heodo)", "value": "3bdb8b00b2d14fccd493af8511459383c583410daddbe4ee9c27d978b550fdfbe7b8cd0959fe86da8ed91ac92f01291e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714701, "uuid": "2084640f-690a-4a58-86a6-64c7c612fc50", "value": "T184636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714701, "uuid": "55f843fa-d60e-4978-9f46-882c3d8c2cd1", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642714701, "uuid": "4c549170-a18f-4bef-829b-6ef6e1b4602a", "value": 71347, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642714701, "uuid": "2705f80f-b078-436d-b36d-bbd4bc5381c1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714701, "uuid": "dc87bb32-bfeb-4510-bede-8afcfc16cb59", "value": "03bbceb242abaf4c7710bffdb38a05c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cbec6fbc-7a00-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642690438, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690438, "uuid": "7161d28c-d81f-4195-87f1-12b2fb3ee0be", "comment": "Malware payload (Heodo)", "value": "80ccde20c7a21428011dd36a12620586", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690438, "uuid": "e4159244-a358-4e3a-a0d1-21176534d7f8", "comment": "Malware payload (Heodo)", "value": "1db2ec499c11b096c4a468a878a9e6bb791183ca2156eb2e8c233fd7b172b607", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690438, "uuid": "4c1484ec-bb87-4d2d-8711-a257b09b9cb8", "comment": "Malware payload (Heodo)", "value": "e9e5c35418b72bfff3c1e05fbc94a26ededf2774", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690438, "uuid": "6808ce9f-4885-4cee-b3a0-db30aed77e92", "comment": "Malware payload (Heodo)", "value": "0bcc6302161fb83664c522fc3ccae2d6071dfda226732fbcdcfd088e12a55b8bdda5b4a0f5793749c307e075fc638ea8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690438, "uuid": "9cab89ce-8929-4885-b711-1a02093f8661", "value": "T1B9E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690438, "uuid": "c04bbbb4-fb40-4e54-b6f6-a827b799b8e3", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642690438, "uuid": "08f250d8-4412-4cc1-8657-6244eb767def", "value": 146170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642690438, "uuid": "fa2488fb-f8c6-41a2-b7e1-1dd905888136", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690438, "uuid": "3ada97d2-35f5-492a-a2da-7d5af28a9918", "value": "80ccde20c7a21428011dd36a12620586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8e4d847-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666810, "uuid": "4f613f4f-fed3-4de9-91f2-4cdf49dde5bd", "comment": "Malware payload", "value": "204cb61fce8fc4ac912dcb3bcef910ad", "object_relation": "md5", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666810, "uuid": "ccdd5b73-5c45-47bc-93b5-a62b857d127a", "comment": "Malware payload", "value": "1eb5421cae14cc706efdb9e911608c2c4759ccc446f6e1a62ecf5ba20e5b3482", "object_relation": "sha256", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666810, "uuid": "043c6767-ab7f-4d6f-b691-b3b51cbddf27", "comment": "Malware payload", "value": "e72798ceeb62f6c1f5ccc7b6455d04c51ef15bc9", "object_relation": "sha1", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666810, "uuid": "8fa7e8dc-e608-4080-b365-84e7af2cf190", "comment": "Malware payload", "value": "bb99b53def36e13316305318b99074e900d872121e5d8c2113f190108343b38a568af8d48dc4646f84d4e09bd82f74ca", "object_relation": "sha3-384", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666810, "uuid": "28921972-8ffc-4d80-b92a-d032fd84cacd", "value": "T1FCF423395AC190AACC978EB30B8993C427F5AE65674EFC893E9C2DF5F214042581D3ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666810, "uuid": "050356ff-e2a8-415a-b44b-267484b74108", "value": "12288:YAH3S0LnvIsBsN9ep5i8ElGzlHH/V6sY8xm1hsuBz3kwktPK5pqfh370pDYlNZH3:YAH/LnZtpLDlHNOAm1zBz38tqY970Ym6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666810, "uuid": "f334ade0-eca9-4934-878f-05a0bb425123", "value": 758369, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666810, "uuid": "35751607-caf8-4ac9-b037-9f503e2fd2ca", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666810, "uuid": "6e49ea19-f478-458f-83c4-2db88555b178", "value": "TL-3525.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a52f62b-7a1c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642702273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642702273, "uuid": "d129d0db-a415-4653-9285-d5a88196ae76", "comment": "Malware payload (Heodo)", "value": "b90e4ccbc4a778ce124631483793e357", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642702273, "uuid": "e39eaa16-6109-4f4f-8b25-6a8aa219495e", "comment": "Malware payload (Heodo)", "value": "1f01ec0b5b4994cf520472586290d49c00653df2e80922613541046d7ee04367", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642702273, "uuid": "0ed57d66-fb5b-4aeb-851f-42db3de8a2b6", "comment": "Malware payload (Heodo)", "value": "b1ecf1489dbd82427f4fae181a451117e4aa6e93", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642702273, "uuid": "fd3c2557-ed74-4fdc-b1b0-e5e31cbc2811", "comment": "Malware payload (Heodo)", "value": "d2af999387c5adf86a38176c9aaae281b8b4933dcf95b13480e1cbf4107876e9920b53a565bb541592b4b1fa17115b4d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642702273, "uuid": "1cca4200-5b7a-4ae2-aa73-6e30d9e0acfe", "value": "T1CCE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642702273, "uuid": "b3d32074-06ca-4385-821c-17d874dc0b90", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642702273, "uuid": "ab065179-747e-4c80-ac7c-1963613d5068", "value": 145686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642702273, "uuid": "705ccabc-650c-477c-b64c-f924156d5534", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642702273, "uuid": "f445977e-1c71-46ef-8fc0-743feaceee8c", "value": "b90e4ccbc4a778ce124631483793e357", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0664cee-79cc-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642668138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668138, "uuid": "0d11ce6e-e78d-4c03-9bcc-726edefba0bb", "comment": "Malware payload (Loki)", "value": "940454579182f8aa9bae3ffe1b761ac6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668138, "uuid": "f14d6571-a670-4f3c-849a-e2e7fbca0446", "comment": "Malware payload (Loki)", "value": "1fe92b0962f5725a3a8fafd00d85d636f46dfd84582a1f21e2286610a7feb3a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668138, "uuid": "c234a8a9-35e3-468d-b6b4-ba4fe1106233", "comment": "Malware payload (Loki)", "value": "e0b85933dcd7d60f564ebce57297eb4a5b7935f2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668138, "uuid": "f46d72fd-02bc-4477-aa03-8e92a3579821", "comment": "Malware payload (Loki)", "value": "570f7e18bc9bdb3ab466312cc537100006b7e586db2d98a2f111f066e7d30caf51e18ab88d93d0f8026db0afc56b1766", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668138, "uuid": "0359df69-00f9-4a2b-8709-6c87fac51fff", "value": "T13354BFF13690D871C44B26748425EFA04ABDFC3118A5864733A837AEAF762D2567B31F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668138, "uuid": "f8c10ba3-af70-432c-8872-88f15abe4615", "value": "b7a0d2a66e86e27ee741e32de65d65f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668138, "uuid": "1b6318c9-a7a9-4224-ac06-6534a30c7ce2", "value": "3072:KDGchLHrQQ3D9bXp7rm8+L2nkhv+Qk56YYr8gA5YJVMgm91cM/h3:KDGchLLp3DZNi8+Sz0YC8Cv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668138, "uuid": "9982679c-7c6f-4c9c-91fa-ca036ecd8b56", "value": 284160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668138, "uuid": "66868d7b-e97b-4e27-9341-beb13c6a9738", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668138, "uuid": "057c167c-f1a5-436d-b192-378b53d69ba7", "value": "940454579182f8aa9bae3ffe1b761ac6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39240583-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1642665710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665710, "uuid": "7ec2fc67-2f05-46aa-afa3-af1f42cc9b2a", "comment": "Malware payload (BazaLoader)", "value": "f3bf04bfa6c87ee6e8f66fce0b5fac59", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665710, "uuid": "dd3a378a-ec14-4f12-b7c1-c79ad58cb012", "comment": "Malware payload (BazaLoader)", "value": "2045ecc425209bfc5e090d868856afe74cf0cb13dc63f8a00b656aac3fe438ea", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665710, "uuid": "7bd07ca4-3650-467f-b620-e3762f104499", "comment": "Malware payload (BazaLoader)", "value": "ccd946fa6eed9551ac8f7f0139d8587bb878007e", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665710, "uuid": "1612e502-8cd0-447e-86f6-b2571abf52e8", "comment": "Malware payload (BazaLoader)", "value": "05fcab82d8128b73abd1291729e5cea982ad6850df6a917d034b47ce31759a8b46f64968933c7d3bfc99aaf27aee5126", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665710, "uuid": "ca6c7f43-bb02-4997-b172-232fae618332", "value": "T14785FE43180C819F9867D77421671D97EEB87E47F2C84E1ED1E428B84AEBDA674CA04F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665710, "uuid": "df9a764d-d129-4867-9a45-6a203293d264", "value": "f30f2b5b65c947eccbf132b668fe3257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665710, "uuid": "df54f468-c93a-410f-91a2-48cd86ef03bd", "value": "24576:Aa1QHwgJMrQqj/wAc6QORNx2nAjwka7m0GV9igWQlnwXwBwfaljN1X4GtZ+FdnZs:FnEKFIhMd8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665710, "uuid": "ea2f8e5a-8faa-4d9a-ad73-d7e347b48379", "value": 1816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665710, "uuid": "5eaeb76b-c498-4ced-a22c-eb13c0c0baf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665710, "uuid": "4b4400d1-94f0-4138-b3cd-e0863103b002", "value": "f3bf04bfa6c87ee6e8f66fce0b5fac59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f0fdc5a-79be-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642661828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661828, "uuid": "310d5b6c-6cee-4caf-895e-e10161b6bcdc", "comment": "Malware payload (AgentTesla)", "value": "a96418b82f6184e6ed717414124e78d3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661828, "uuid": "96b706a3-dc5f-44b6-a01c-934c69b41b90", "comment": "Malware payload (AgentTesla)", "value": "20a11d98d3555517a734c848dadd5d9199e1bafe6cd5b779d085aab7203c6466", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661828, "uuid": "6149f070-f4c8-4982-9da6-875f759d41ed", "comment": "Malware payload (AgentTesla)", "value": "857ffadbe172bab0c1ebfcfd28ea17d1e2f97c0c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661828, "uuid": "6f16adcb-55c5-4a77-aaf4-7396a72c9d2a", "comment": "Malware payload (AgentTesla)", "value": "b2cef68ad4d9700108f85cbff9ed646e7525f939e605e3638afb74ffce2b887bcfe72e61b0adee7289b7edbcaca26fe8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661828, "uuid": "87699043-fb42-42ec-9a68-331e4451050d", "value": "T1D694239F57C8F8A4F014DD5FA6975F09C6A004F0EC9A36D12F0EFE65A3966FA3905880", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661828, "uuid": "89846589-139f-4d0d-93e4-884d2212f3c1", "value": "12288:heVUCFtqQ/XFc/Mf1Eeh+kf6FxCAVBdm+:GFtRXFc/Mf/hheLVHX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661828, "uuid": "4d60f07e-b25b-4f6e-8b6b-b443857606e6", "value": 415600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661828, "uuid": "df4bbad2-c7b9-4ad0-a044-483e85782feb", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661828, "uuid": "5b8dceef-68b8-458a-a69f-3e2bc79d556c", "value": "COMMERCIAL INVOICE, BILL OF LADING, ETC DOC.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20af5296-79e2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642677265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642677265, "uuid": "103dadaa-5cba-4422-b70d-3c33cca821db", "comment": "Malware payload (Mirai)", "value": "983507324744171bd0ba1f422a399786", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642677265, "uuid": "824e58dc-eb24-45e0-9775-71489c6a17dd", "comment": "Malware payload (Mirai)", "value": "20d2d4f78cf6b405032378f86eb37b97ff5f29c1c212ad0d87eacb2d60c0e5b2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642677265, "uuid": "ffdbf096-1692-44bc-87ba-9fff8ee19a67", "comment": "Malware payload (Mirai)", "value": "0079792673b923d993ee7ef111ea90ecc76cbbe4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642677265, "uuid": "2a3b3170-e5cf-4bdc-b1b6-8728710e2eea", "comment": "Malware payload (Mirai)", "value": "607fcf4fd1a4b82c88e9be0a56b58a0b9fc9982fa3c5b30b036d3d33a98d4783adafb01724a3fe004a1dd5eed6204a5d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642677265, "uuid": "92a17a29-c970-4b20-92c3-e4cd9dfad61d", "value": "T13FD2E13C57533CB284B52C39F429C603B75783B9C2E475513A825EBCB3C5295DAEE291", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642677265, "uuid": "f0366530-6797-4d80-9229-4b468a2bde65", "value": "768:NEtZRjTviljUxl7nn4f+6eD/GQ4Vo1IE7s3Uoz7:qZTvq0lzv6Y/sWMz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642677265, "uuid": "617bfed0-2f62-43c7-aef6-b316dac6504d", "value": 28604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642677265, "uuid": "693cca8c-5916-4f76-979b-2fdffd62f3df", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642677265, "uuid": "a697bc84-4851-4f9d-9344-ecbbd020a10c", "value": "983507324744171bd0ba1f422a399786", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2a36e11-79e8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642680168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680168, "uuid": "f1946355-5956-499d-985a-5a7eb878ae3c", "comment": "Malware payload", "value": "2372a232275b2342414f4b26c7aa33df", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680168, "uuid": "e8fe3a38-d726-4f8d-994d-29e9b5e6facd", "comment": "Malware payload", "value": "2127d87ceadf6348883b490d982b4a8ba11a5a658813c2ac74905d4bba23fa23", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680168, "uuid": "6c1bfb42-c6e1-4255-8ca5-e712eb947b2d", "comment": "Malware payload", "value": "eb0f9307a45ad590ef4330d74c95d1a8d123270f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680168, "uuid": "19f8896b-ab39-46c3-ac63-316f48524462", "comment": "Malware payload", "value": "f2d11b1518610986a43d75f7ee270719690aec50b73a3ec8b05bf0b8577723f7e442ba5493a7445cdb2dc9d5ffec7ba9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680168, "uuid": "22bbae70-98ef-4ee3-bbe9-63091a0570d2", "value": "T189737381B2C3EE35C56A8CB594BAA3582770BD15DF56972B38C63A273DB06D02F04F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680168, "uuid": "fb1d351e-fd70-43d2-8edf-66544517ed1d", "value": "1536:so69VWIo91APopDifloRKLLOuAYZtFDikDDM3:9gVWl1A4DifloRo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642680168, "uuid": "9f5bcf23-8442-4cc3-89f0-1847adbd31ff", "value": 80384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642680168, "uuid": "75b02470-88f3-4520-b081-3b34085bbea3", "value": "application/msword", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680168, "uuid": "e403c5d9-54ef-41ef-b198-7e3d67449a1d", "value": "After hearing letter to Sr Cui on Timing of JR (Fangyuan Case) \u5883\u5916\u503a\u6743\u4eba\u534f\u8c03\u59d4\u5458\u4f1a\u81f4\u5d14\u5fd7\u7965\u5173\u4e8e\u65b9\u5706\u516c\u53f8\u8fdb\u5165\u7834\u4ea7\u91cd\u6574\u7a0b\u5e8f\u7684\u610f\u89c1\uff08\u65b9\u5706\u6848\uff09.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ccebfbe-7a4b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642722490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722490, "uuid": "e3225d81-717a-432e-a20c-98c70accac7b", "comment": "Malware payload", "value": "540a7f58458e28c33c8bd3cdec7d5ba4", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722490, "uuid": "18ed3521-f9a2-494e-b7d2-10991382c6f5", "comment": "Malware payload", "value": "2181997083632b17484474d7152e18c8a65175b823c871b164d15d2e20a8ae16", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722490, "uuid": "764bbe0c-52d9-4b32-a515-a5814024af27", "comment": "Malware payload", "value": "c8137fcfa2510aa02a2558bb316113c28cae7ec0", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722490, "uuid": "26b28577-6699-4dc9-880d-63f1fd37fffb", "comment": "Malware payload", "value": "f013214b13e46e3284a20cccb9a469a57ed928fa4bff6fb5164fcbad770ac1ad182814ce1f1f240bcbd4c6b9823f310d", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722490, "uuid": "a460e9a8-8e04-4435-8f75-4cc02becea51", "value": "T19E636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722490, "uuid": "94048f39-062c-41c2-8eab-53976623ee83", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642722490, "uuid": "a3c82750-167b-4b2a-80fe-fe332ab9b60a", "value": 71490, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642722490, "uuid": "80316c0d-257b-4100-b344-4584788ebd60", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722490, "uuid": "4f461350-bdc6-4bec-aaca-70a966d09ddf", "value": "540a7f58458e28c33c8bd3cdec7d5ba4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a2cfa93-7a21-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642704474, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704474, "uuid": "1bd43d3e-a533-46f6-af97-e6f461e24966", "comment": "Malware payload (Heodo)", "value": "f0799f764f34241f8aa3cd6099b5270e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704474, "uuid": "0c4cc9d5-c951-441e-855d-a96acbb0068c", "comment": "Malware payload (Heodo)", "value": "21d232623741921731cfb7ae0e877134962916c9cc81cad7553accf2784f73dd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704474, "uuid": "1a90b896-c749-4231-884c-457cea0bbd1b", "comment": "Malware payload (Heodo)", "value": "f65a48d6bbcb7a656f07e467705fe955fcf67ad7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704474, "uuid": "6d09c6d8-46c6-49db-bc43-dd1ac9f25ade", "comment": "Malware payload (Heodo)", "value": "5b1f80234392cf1fbf61a7cb10028a50e0734391dcdae7ae1cbcb6ffa4559fcf823840dbffee54545e60c1182c3fa700", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704474, "uuid": "27ce0a51-f328-4667-9333-76a215604202", "value": "T1D5C4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704474, "uuid": "bb4297ab-edd3-428d-b17d-bb587a34c07c", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704474, "uuid": "b2aad854-3c4c-421d-9147-fefe78a31b82", "value": "12288:P78OGF+L8/4UUNyradMhTq/n4vAzdkPs7:D8Ody4aadbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642704474, "uuid": "4ef4d53a-a678-440f-920a-e36a43858bfa", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642704474, "uuid": "87dee79a-9fec-4658-ae1d-36bd0995e947", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704474, "uuid": "a73275e3-36b0-4170-9811-f6db28cbca55", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f79d759-79ec-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642681532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681532, "uuid": "848547ea-2328-478b-aad2-bcf830b5b7c8", "comment": "Malware payload (Heodo)", "value": "321380dc019516dfff7c977712f3c4cc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681532, "uuid": "5b57afa4-56ca-4779-980a-be07daa94ef2", "comment": "Malware payload (Heodo)", "value": "2200463c1d38d5aab53073663fb65625a6c6df671ac9c26ff35e6567cbc588a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681532, "uuid": "4cff5364-9350-4a18-9f6d-e90cf60af1d1", "comment": "Malware payload (Heodo)", "value": "88a64b3ff6a5cc01696672a3c880a4753acaf330", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681532, "uuid": "e2afb7fc-8a54-4483-afbe-cac9a9848b97", "comment": "Malware payload (Heodo)", "value": "5fd4e0db0ddc5e1c1b771edf87379d7d8c5980d31b05bfcbf750d244fee99b42dafeb020baab3972894485f42863d6da", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681532, "uuid": "5692ee02-1e8d-4618-9e50-1f52521de2e0", "value": "T184C4AE12F7D1C07AD1AF12356A2A9B9C63B5BD619DF1C20BEFD53A4D5E306428F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681532, "uuid": "d4e03c99-e74b-4ce5-a70d-347c700f6f0c", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681532, "uuid": "ec9680a8-d033-40b0-876a-1ebcda4f1953", "value": "6144:5Ig427JC2jW8j6bzhO5vDynHoIoxoJ0CopGEfrzBHEUXZXbej1BC3OBtNCkiFPs7:5D42+8jM8WIIU8GraIXbeDCxBPs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642681532, "uuid": "1b587d5b-cfba-4fa6-bea0-8653bbf2eecf", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642681532, "uuid": "21c35692-1928-4789-9489-c15b43c8607c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681532, "uuid": "37e2eb93-6de8-4731-84c4-ffc225089e01", "value": "cZzLrCufohLBE9UU9.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10b820f6-79f0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642683252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683252, "uuid": "d177279c-c505-4876-8516-c1acee21ad42", "comment": "Malware payload (Heodo)", "value": "30059262ec13cc306a468e21cdcb9d00", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683252, "uuid": "b84c3f43-19aa-4279-be5f-b11d9567df20", "comment": "Malware payload (Heodo)", "value": "22948141e8f020d01dbd92abd0eeacb3eb1d69fcf145fee4b65cdc395d309a57", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683252, "uuid": "cfa74107-b965-42c1-ba76-a7c968bc18af", "comment": "Malware payload (Heodo)", "value": "e4b2abc7e64e125254715adc0bac71a82e663798", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683252, "uuid": "5435024d-0691-43ef-9cae-5839dc7d423d", "comment": "Malware payload (Heodo)", "value": "d897b7c1faeee65a75072529976477f2468751a7c7477d2a0f9dc26a0e3549901d710692aa827ad03b426ed7953b6fc4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683252, "uuid": "ff480878-8c10-4085-ad0e-7e8aa20a4bad", "value": "T10AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683252, "uuid": "d971b184-d1ff-4d60-994a-44b378328753", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642683252, "uuid": "815c6bd1-dd4b-4ebd-ad6a-bd45be5c842f", "value": 145326, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642683252, "uuid": "c336cf47-852f-40cc-916b-26ee42017b45", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683252, "uuid": "e54759a4-0858-4a29-b5c2-9e25f648a15d", "value": "30059262ec13cc306a468e21cdcb9d00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b4c7222-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660613, "uuid": "a8dd7dc4-98b5-4e4a-9d38-0407fe0f62b0", "comment": "Malware payload (RedLineStealer)", "value": "7faa48481e048fe66ea85d9343a394e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660613, "uuid": "f6816911-4c8c-4a8b-9472-67f49d2c6664", "comment": "Malware payload (RedLineStealer)", "value": "22a58e79e643f6f422a1394de4fe4e78d2638370815eb23ecae037b99693926a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660613, "uuid": "589c9790-ea9c-41c9-bf62-5c923b29b3ee", "comment": "Malware payload (RedLineStealer)", "value": "616f4aecf818966f8d313d5bfe0040183da9b071", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660613, "uuid": "2a9f3613-26bd-4405-91fb-b95e63d38ffe", "comment": "Malware payload (RedLineStealer)", "value": "7a3c06a8f62405493eec7aab4e43a41a4788137f1a03189b80268613c7a3f62364cc9e1fcec76ebee661e9ae48e68610", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660613, "uuid": "43377f7f-05bf-45ce-a617-46cd76e4cf28", "value": "T17684F13D79D0D031C4826930486ADFA05A7DEC7518692B8373A83B6EBF36781663635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660613, "uuid": "722c83a9-dffd-4b86-bf01-a6687df68882", "value": "125adc129c50285a2cd4524417d3fdd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660613, "uuid": "6ac97e12-891e-4573-89aa-6e58ff694f0b", "value": "12288:JEqV2YbyqMPX6ZxQ35mKsSOZfVjOghpiG:JEvYbjLBhiG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660613, "uuid": "fb2c0eb3-978f-4002-92f5-bcc55f4b8a21", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660613, "uuid": "76726550-7aea-48a3-8ef5-702f65f23654", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660613, "uuid": "58e55f6e-3b5f-47fc-9210-d2449a24c02f", "value": "7faa48481e048fe66ea85d9343a394e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68cb2bcf-7a0e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642696284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696284, "uuid": "ed60982b-d223-47f8-8820-ec525a42befe", "comment": "Malware payload", "value": "684af2bafcd7204db9b72bdbefde506a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696284, "uuid": "0068f0c6-cc58-442e-9988-51cce69c172d", "comment": "Malware payload", "value": "22c4eed50b30a567dc9f1a066e4d30ff4291d9718b391067f83e53e2b307d677", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696284, "uuid": "22324e97-0cca-4700-908a-4f99fd025249", "comment": "Malware payload", "value": "0e6420aba819499b4d5ad44c8c1b668e60af7a7d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696284, "uuid": "4100007f-e264-479d-be25-71e31de33bcc", "comment": "Malware payload", "value": "2a0c373cb0dce617b686ef37eb9e83f8817ed8f56de8dba7f2a934c7955684d800f665a959f0e27dad62b77aa97d0484", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696284, "uuid": "15bd559e-631a-4a67-910a-cd6b540fe5ba", "value": "T1D80501367F52253BC74F4870899ABC60A3B8DD4A2968CBCE894F1CE59354BC69730367", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696284, "uuid": "feaaccfa-1d4f-4bb8-a24e-33ccd9aabd87", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696284, "uuid": "e76dc0d3-05e5-40ec-9cc1-989b49695c01", "value": "12288:Dhl19WfXGI9WfXGI9WfXGiiiiE9WfXGd333TQ:refXkfXkfXMfXk333k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642696284, "uuid": "c571904b-7469-4804-a03a-cfa6ef7130ac", "value": 834560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642696284, "uuid": "a4b0cdd2-3857-4e88-be01-1eac843dd8e9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696284, "uuid": "d2aa359c-a960-4b71-a86e-cd83ab9458c7", "value": "ASEAN HBL-MBL INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "239b8ee1-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642674693, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674693, "uuid": "4eaf49e5-d4c9-49fb-b8e3-8bbd99adf1da", "comment": "Malware payload (Formbook)", "value": "7692a9ecc1b4d092387cffe6faa8d762", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674693, "uuid": "b91cc256-24dd-4b6b-ac3c-20136f40a103", "comment": "Malware payload (Formbook)", "value": "22c8527c55a52f56653e38bf1f2dbc8ccc06ab0f0ab16879138f30037b710b0a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674693, "uuid": "f99ae6e3-0526-4f32-92dc-32cf8200606b", "comment": "Malware payload (Formbook)", "value": "37e70527d40c881115036ae2de66e3685d3a8f10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674693, "uuid": "7d64f300-8f21-4f05-a1c3-143aa951f828", "comment": "Malware payload (Formbook)", "value": "827b5ce0d816afa50048ac8fc55dd3c8ca96d60d29d782965d2cdecf87d112e9c98fcf8f1a1656d1c1c773dda98f0010", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674693, "uuid": "9abb69ef-d70d-43d1-818e-4d2d57c654ec", "value": "T1CF841211B7FA271AE6BA87F0A535504413BA7E6B1132E31C4E9630DE19B3B82D751B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674693, "uuid": "b1326b55-8827-4d26-9cb1-a1f2fb4ff35a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674693, "uuid": "c74fc92e-59f4-4ab7-a688-8e50de806600", "value": "6144:NwQDqLF3nNxWcZd/GD2LqkIpIwExxDYAFaaC8jd20SgEV0UtLXoRGlBgWIYxSd:9ctzWCd/CWiIwE7nRJM0ShdD/Be", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674693, "uuid": "b5f478d4-c55e-4354-9f91-a8777855a4a6", "value": 382464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674693, "uuid": "5146c21e-8c82-4e96-acaa-13b355bbff36", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674693, "uuid": "56a2ddd1-122d-4c0a-8358-ad85f80fc0b8", "value": "SNO22 PriceLetter595406_RACX-159814.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7866300f-7a11-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642697599, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697599, "uuid": "c5b20276-ac89-445f-af9e-c4bea848c3e9", "comment": "Malware payload (Heodo)", "value": "e4ab43a5a359a7ca9d6b692af52313eb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697599, "uuid": "039af759-a9da-4366-ae47-63b2b2b121d7", "comment": "Malware payload (Heodo)", "value": "2307899d29ea25d1c7dfcda009141119f8247bf367616d522944a4f1c81f3138", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697599, "uuid": "865a52fc-52f3-4849-b4f1-f6dc7eaad39d", "comment": "Malware payload (Heodo)", "value": "3c2a888384a2aec55540aa86e7702afd81354283", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697599, "uuid": "b1fb18d8-9c35-4227-8162-e382988a8965", "comment": "Malware payload (Heodo)", "value": "8155297df660e5162622cdaa2d06dfce7557da1ed1eaf49f5a2713f72c516cb957a62ad6304326bd2ba10260e5fc2970", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697599, "uuid": "8641c63f-48e9-4b31-b2ac-e0f2a93ecde6", "value": "T1DEE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697599, "uuid": "fe99ed72-d4c4-4f44-8dfd-7c4146c23cbe", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642697599, "uuid": "fcf67543-542b-45db-9754-bb7f2a4c6efa", "value": 145007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642697599, "uuid": "65eaf5b6-2a4f-458a-a0a4-7374f1cab73b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697599, "uuid": "d8b9b422-6492-42ed-9c1e-389c1fb75c04", "value": "e4ab43a5a359a7ca9d6b692af52313eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cce1aec-79c0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642662817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662817, "uuid": "dad4b8e8-9897-4c6e-b1cf-60deb2e9b944", "comment": "Malware payload", "value": "65b7ca6dbadd3b5c144c375e775f4b14", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662817, "uuid": "7ae83a61-ecba-4a92-96df-a721524a1531", "comment": "Malware payload", "value": "239337cd609fa428d47c13f6b8f2e1f9e85c5a87b537385371ad8893b3a164f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662817, "uuid": "81ef7f75-b894-4c95-95a6-32c545fb6a02", "comment": "Malware payload", "value": "7dbe7f68be7431d8598a33f368366464a85dbd74", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662817, "uuid": "edf99a13-85fa-46cf-9b49-8f301a82e57c", "comment": "Malware payload", "value": "ce7e079caeeef7e1509c8c04736c5b4a0308dd020552b1c3214d0f4d36e98ff2f4e82c9060ddcac19aafa7a14a16869b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662817, "uuid": "026a295b-157f-4797-aa34-ed3c9d42460c", "value": "T1E895236127E05338DCA387B1A6651200E7B6FD6E2A76E30D0EC571DA2472F4B2152F7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662817, "uuid": "f044e437-7600-4fb5-80d4-cc5e7f23dd2c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662817, "uuid": "1d4b3496-e76d-41f2-b6bc-8e089db8d2ce", "value": "49152:ONq+gZhFuWEYW9oSjWWzkBMADE3ayorMt931B7E:OUHP9W9WWwiADYcu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642662817, "uuid": "9f0a310d-ee7f-4e88-87e0-76fb7968221d", "value": 1963520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642662817, "uuid": "837bfc6d-ca81-4aa7-8029-2a4df2ba0f07", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662817, "uuid": "0dc3c25e-66d6-4816-8050-a6c87cc6ff76", "value": "PO #222001-174383.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ead5d42-79d7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642672645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672645, "uuid": "be5a24e1-32f6-4c04-be64-b652fefb7d09", "comment": "Malware payload", "value": "f2cd80a304ed8a6fd2fc1b03af5b28e8", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672645, "uuid": "b733a681-e5f9-417a-b54f-351270c35451", "comment": "Malware payload", "value": "241faa47f2d88e2f589b71e1f6ebec7802e16a5a3d109c1e7d6c24091e7e931f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672645, "uuid": "a4da07a8-4cb0-4691-b0f6-c788caf4c333", "comment": "Malware payload", "value": "05561d34a87827ce2ae485312af792e29e1b99c9", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672645, "uuid": "147949ee-fd5d-4a6d-8dab-e68ed1def1d2", "comment": "Malware payload", "value": "3e4be3a68eb36a8ca5f1dd48e7fc76464826323ea9501dd6cd4687cd32f0b3eaf167e614989ec907125b6a048e1ce810", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672645, "uuid": "7491817b-1a13-4e87-9b63-ee0b50e748d5", "value": "T1EF833A06D6518B53C1C2177ABBDF422D37236F68979B331156287FB81B827DD0B2E622", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672645, "uuid": "97aa510b-b9d3-4350-a488-9296bc511892", "value": "1536:eQnqrhEUaRaY+0DjizebvxU1XMgmt5xY7s67o1ZHs2fHypX3+E23kOe2:FRavCbvxU1Xatnos632fHypHl2Ur2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672645, "uuid": "695ca65e-76b9-469e-84ea-3549a80e4393", "value": 85780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672645, "uuid": "a18c1488-f734-4be3-89e4-d11e0481c2eb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672645, "uuid": "9816b591-3927-4a22-a219-c0450ee37835", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74e27c78-7a27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642707042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707042, "uuid": "66a19c4e-2066-4872-b32b-fcdc1f1cebc5", "comment": "Malware payload", "value": "ae754a0a093725e01297ee0dc240f435", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707042, "uuid": "bc43d038-c145-4af6-881f-088c8640003b", "comment": "Malware payload", "value": "24ef4a5a4e0f2b7f8ac9356b85f06d15651e8274e3029b0f3af4cb8b9248361f", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707042, "uuid": "413bb7ca-3b0e-49c6-b153-8306b66ecb94", "comment": "Malware payload", "value": "240157a403ed62b1bca187d8fa2cd69b06e6cbdb", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707042, "uuid": "f2734803-27fe-4222-9900-a2ce44e364e5", "comment": "Malware payload", "value": "cc913d005c8d9dcaf799f23bddb2cc06e202906744de179b9fbdcf3301d935fccaf063d509a0f6f9e8e027744a3eb39d", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707042, "uuid": "44983ed2-b833-474a-913e-b59ddf5848cf", "value": "T14004128E7D4E1219FBA0FF70769606947D368FF59A17D121749E3F6C0A369230822726", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707042, "uuid": "444317e0-eae4-485c-a965-b2a77d702f10", "value": "3072:EqJBF/K0uAPfLvedgfBDLc2xloe9o9vk6/LNFYm7Z/VotuTLld4s3K:hFTPaqlc6g8a9Zto8LR6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642707042, "uuid": "0006b64b-d37b-4765-a064-7f9c7564ed99", "value": 186968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642707042, "uuid": "539403a4-fe5f-45df-8dde-fb626b5d25e1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707042, "uuid": "82677d6d-79db-4cf2-9011-aaca3f31a2fb", "value": "INDA_SKGGCPL75787657 .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d632d82d-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642666403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666403, "uuid": "c109351d-f306-4fe7-9e37-f83c3412c209", "comment": "Malware payload (AgentTesla)", "value": "cac270de1102cbf0ef70162f29a36ba9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666403, "uuid": "8c4f0b2d-ea34-4e13-b7b5-b1a10c1d3a8e", "comment": "Malware payload (AgentTesla)", "value": "25988c011befa5e0ec69297336dc84aa0ba6a2ebb3e3a9ab14449ffc00fc1ff1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666403, "uuid": "a8bca071-8454-4a79-bda8-33e5f02a3841", "comment": "Malware payload (AgentTesla)", "value": "1f04e41012a629c2e69004570ddad01c5d6c38a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666403, "uuid": "5936f6a8-e698-44b3-9c31-5382534d93c2", "comment": "Malware payload (AgentTesla)", "value": "09ac0c849acb44725ada28f1ddd2a90c1f1f265c5f51fe6d8fd0570d299cd39256779a245ae099512aaff084374e0bbb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666403, "uuid": "3327b9f0-101f-4671-b590-8575576da877", "value": "T10CB4DF1777DFCA25C169667688EF800083F4AE81A653D70E3DCD73BC1A22B4B5A4539E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666403, "uuid": "03c90e30-8f5e-4dcd-bb4f-53e4a4fed167", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666403, "uuid": "77a33eab-287a-4be0-b8d1-1a74aa836958", "value": "12288:GRjKmPsWA1/tl1/HrtPnaHWWC4ORuXCK1hzc/:0jKh1/HRPaHWWhmuXTM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666403, "uuid": "af3c8409-867b-40dd-a2b7-ada59a45f01c", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666403, "uuid": "6e70b10d-102c-43b3-b3b9-62808c19065a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666403, "uuid": "f3527817-2274-447f-b402-827e99b74b61", "value": "DHL SHIPMENT NOTIFICATION 284748395.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b53170ec-79c2-11ec-9275-42010a9c0029", "comment": "Malware payload (XpertRAT)", "timestamp": 1642663771, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663771, "uuid": "65d1cc9c-9a19-4912-a543-3c34f28e029f", "comment": "Malware payload (XpertRAT)", "value": "1402bc75caa465e3c69c302a7390a8e7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663771, "uuid": "395666d7-c383-4438-8a7c-df28fc3e596e", "comment": "Malware payload (XpertRAT)", "value": "25a80f4addf74c82d8ae815164c44dcd530fd59fc278f306552d35d5140b880b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663771, "uuid": "8c7dd3ec-7158-488b-bae7-8a864215fbf5", "comment": "Malware payload (XpertRAT)", "value": "df94f132f82c48cdda43a1121266320a1520ffdc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663771, "uuid": "81725425-3041-4a8d-8d8f-f6f30b9d90c3", "comment": "Malware payload (XpertRAT)", "value": "ec349137ddbcbd31caed3494aed29810434c4ae98ebb7628d91178ed9b9b950d10fef14a4fec323ea138c770faaf0cc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663771, "uuid": "18e4a2db-ab84-4bc4-8b7e-b7afd3af48db", "value": "T13E841200BBFE6B08EAEF47F8A07541605BB9BA172155D32D0DC9B1DE1866F868701B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663771, "uuid": "08574969-29b9-4377-8ad5-e45621e11cc4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663771, "uuid": "8c433cd3-bc5f-46b9-8e23-ce9ff22996d7", "value": "6144:9CtrrLF3ko20BGq/MxhaQi7hzrbZW6l5oKxwiVAf4/riqXbVT8jHl:MtbPtGd3CzrBlOWriqXZ8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663771, "uuid": "5e61e783-e170-417b-b6e9-77d069e2c428", "value": 389632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663771, "uuid": "32cf3bb4-1aa2-4a25-9f3a-3b8a91c8dbd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663771, "uuid": "269390d6-f35a-4a9e-8a66-ef129d03ab16", "value": "CS-SUPPLIER QUOTATION SPECIFICATION 2022-0120 45PCS.PDF(97KB).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "580c8a7d-79ff-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642689814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689814, "uuid": "e3aae396-0b4d-4db6-a690-5418043e0271", "comment": "Malware payload (AgentTesla)", "value": "ae468410a5e32ec21ec1fb75f479f57e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689814, "uuid": "48f8692e-da1b-42db-ad01-398da58f8bd1", "comment": "Malware payload (AgentTesla)", "value": "25aff0f8124c74abe09d3c1e6afa57859341720bf7b9d53f97ea0e496e8464ad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689814, "uuid": "2cced56a-df8b-4a13-9905-ca7db12d50e3", "comment": "Malware payload (AgentTesla)", "value": "57dadc0a2a9c470be5acd454ffd6b7ac83e1ecc8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689814, "uuid": "8662e0ab-2cf8-40b4-a956-d56d0e29d5fb", "comment": "Malware payload (AgentTesla)", "value": "d877724ed35caa2859ccc2c29cf42f05c2accfadd1a2cc16edda34f7c48215bc4f4c4eff97872c8f91e3bbe60fc8f036", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689814, "uuid": "5e269f56-1e0f-44ba-b9d4-f634a00a81af", "value": "T134A4021077FE6729EAEA87F57921525513B93D6B3127E32C0E4A20CD29B7B81C701B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689814, "uuid": "1972c062-f62c-4def-999b-bf6efcff99a3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689814, "uuid": "89c9edb3-2b63-4a21-a6f5-b7623bc8f298", "value": "12288:uoJ0YyLoMy2xv3RRYkVypSzOWsqEUyRp9:uO0YTAv/pVypo3rEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689814, "uuid": "1e1898e4-2b3f-4af9-8601-a4218e5da66d", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689814, "uuid": "9a76947f-a03c-45e4-b197-07ca9be4c7ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689814, "uuid": "a24e444a-b1e7-4490-9327-e05086a09f67", "value": "DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bceaa96-79d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642672640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672640, "uuid": "75689124-c590-4603-bb4d-b96740cd86e7", "comment": "Malware payload (Gafgyt)", "value": "8efa0f477e4b9195b9f2c5e354d1d1e5", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672640, "uuid": "a692b4cf-7f52-4921-ac81-04df7ceb6ea9", "comment": "Malware payload (Gafgyt)", "value": "2648dda5ed741fb77609840f0d62a24d2be1b7d9df269ec7590d33a0a7ec4a06", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672640, "uuid": "da901ecd-303b-4800-a91f-cb9bb784aeab", "comment": "Malware payload (Gafgyt)", "value": "f35ee90d463a571d7c657b6434d2988113daa227", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672640, "uuid": "739c0245-73da-47fd-a725-86fad6702b82", "comment": "Malware payload (Gafgyt)", "value": "318323d790c00d9440e075c2c908966a0cedf92b529404c97365e18615e920afa0fdedabe338197562ecab3511cc791a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672640, "uuid": "237a3a81-b88b-4fff-b078-e65331ca164e", "value": "T1E2430B45FD418B17C1C327BAB7DF876D7B36691497DB330166287EB427827DC2A2A220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672640, "uuid": "b1301fb8-c580-43d1-98d9-29a65d15622f", "value": "768:2HV2D+hl5MEvgdMNLiu0+Mveo3+uUbYb1OlZtI1LK+MIgpT9G9YwQI7Omb:UEDwl5MnpvHTU0bmDiLFzgpsH15", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672640, "uuid": "2bf9c17b-a89a-4d34-a2cd-22b4d4e029b2", "value": 60014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672640, "uuid": "ffc36b0e-c723-4955-849e-9f3daba524da", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672640, "uuid": "b3c5cdb7-18f9-46d5-9044-455ae56d09ab", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b224a00a-7a0b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642695119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695119, "uuid": "2cb8923b-6a9f-44c9-bee4-00eabbb61266", "comment": "Malware payload (Heodo)", "value": "d400b196c75455b70ecb83b65d03e15a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695119, "uuid": "e406975f-6025-4ea5-aa5c-72a99f6e500f", "comment": "Malware payload (Heodo)", "value": "272964689382f82969853fc649eb2e2605c2ed6922ef36baf0551f7c01f6a6e7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695119, "uuid": "7de4fb32-a521-40da-ae6c-90d69af03eb0", "comment": "Malware payload (Heodo)", "value": "f594b94e242668b54fd7cb1f217afc4e8a776ce5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695119, "uuid": "2bc5cfb8-a0a4-4ad7-aa6e-84c29e33ef19", "comment": "Malware payload (Heodo)", "value": "be5fb606880dd1c71cb9abf4b156fec269ed1669fec64942898dbbfc9b04da0f49cc025272fc52c930eb53a5b75f9adb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695119, "uuid": "91626af0-ade6-46a3-8fb5-b12f75ad2a80", "value": "T178E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695119, "uuid": "2c50b681-eab4-4398-933c-d548773f8c77", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695119, "uuid": "c83354ea-b52b-46ce-8031-b6d852b63953", "value": 144663, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695119, "uuid": "7c0b3515-6c4c-4187-8e3e-2192fbd031ff", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695119, "uuid": "26532e4e-8248-4e34-9fe4-4d0069261626", "value": "d400b196c75455b70ecb83b65d03e15a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74961409-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660656, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660656, "uuid": "de169957-98d0-42f4-8d7a-015981fce654", "comment": "Malware payload (RedLineStealer)", "value": "a7859e380614970e688306a9d9762f3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660656, "uuid": "6c9f05bc-28dc-4b87-b072-c883f8d89264", "comment": "Malware payload (RedLineStealer)", "value": "2806b3e2aeb583cdd693ca9a024ea63222ee2c4582d66d95126635965ba919b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660656, "uuid": "4999fd16-7dbc-4754-94db-e878f37c3835", "comment": "Malware payload (RedLineStealer)", "value": "3b9c529978e5b9293d9953bfc0766a2feecbc63b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660656, "uuid": "9722acc2-86b9-4fc4-9792-23970ba3d6c7", "comment": "Malware payload (RedLineStealer)", "value": "0c048e0d5d3b342b6636ec68c6f84c06ba73f6e595589ccd8aee36695e1029c5b158fd677d5d830bddddc9e3858537f3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660656, "uuid": "4f6351e1-e90e-486a-906d-90f6bef61554", "value": "T12DF533B2458B7257FE8BE6F43A663F239F643EFCD29210091375DA4BB3821871B44529", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660656, "uuid": "e90f3d10-77e8-4025-b201-fb9ca41a6080", "value": "41304e4befbbd8a63ad6ec59f252160b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660656, "uuid": "1f90ce5f-6ac4-4962-a951-6a992d500992", "value": "98304:X2CckkNV/t36fakgZtC2CdfwoOTD4qT3rHZzzIvE:mRNVV36fakgZtCojTD4Q3zZAM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660656, "uuid": "784d129e-56bf-4972-a1ff-3287e587dfa9", "value": 3594032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660656, "uuid": "d5a50abf-38fb-4ac8-9b7d-aeb810c40e47", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660656, "uuid": "53135717-a470-4a45-a697-9ca22a4fe5a4", "value": "a7859e380614970e688306a9d9762f3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74adf1e4-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642668816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668816, "uuid": "e3429988-02ff-44d6-8a65-ee47c5d586ab", "comment": "Malware payload (AgentTesla)", "value": "cad4efe9754642ce8d7608c196916fbc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668816, "uuid": "7c369647-2cbe-471d-b70b-a4fa660e8378", "comment": "Malware payload (AgentTesla)", "value": "2942c97fad624d64c7d3c0bb6aa7ddb691287d6ac6920b4a5bbf4439062476e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668816, "uuid": "3bc7fcdc-1dac-4704-9177-2213ca00899d", "comment": "Malware payload (AgentTesla)", "value": "548dba7ba24482d08f52ad8cdad29f93443273a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668816, "uuid": "6f08cc2d-3462-438e-b1fa-d0686075f9a7", "comment": "Malware payload (AgentTesla)", "value": "efaaafc12168bc95db225c841051da7efadd18ba3c6bb5e18d8f27a3aaaa5a4526834d73d01f5708a687112b06fd14c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668816, "uuid": "f40f1492-9543-4c44-b565-7d7f7fc0a7a5", "value": "T1799413113A787762E9BD17F01AA16260D3FC01579432C70EAEC494DE7A62F509E92F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668816, "uuid": "99ee291a-704c-4a24-a5ad-9dd24eb0f7b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668816, "uuid": "c99e1e89-6301-4939-a3bb-adf809de6e0d", "value": "12288:cqPwMYdAbc0CYQSfu6jPz4OTDCoz2/zit83+GW:JYdAbc0CYq0bDVz2/ze8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668816, "uuid": "9c4410a0-b8a4-4180-9754-6e794fbc934e", "value": 413184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668816, "uuid": "f56d12cb-a679-4fa7-85ef-11ca4dd0f148", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668816, "uuid": "b2f81c84-7165-47f2-9d39-a000e3315f3c", "value": "cad4efe9754642ce8d7608c196916fbc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7938b701-7a27-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642707049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707049, "uuid": "07b6ba94-d44d-46da-b273-5f927019fe55", "comment": "Malware payload (Formbook)", "value": "8af0ed3f6275b441d3f3efe02a6bed7d", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707049, "uuid": "2fb51f7c-f0ea-4905-b699-8a7933866e99", "comment": "Malware payload (Formbook)", "value": "2951583c119c33813cfe8666debebedc6f89352cea29ab6a69fac851b48faf39", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707049, "uuid": "f0582acf-a6dd-4c0d-8112-796520b1f2f5", "comment": "Malware payload (Formbook)", "value": "7c1a86d4a6090af88e6a687ce2307333c8d551c8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707049, "uuid": "838594ef-9e4c-48c4-875d-9f34fe7aeb63", "comment": "Malware payload (Formbook)", "value": "671dde9793a58ad85513dfc96d5f74c3dc79ca397d38ca743348e18257fae854c697abc94471fbbc648e6e286a52745e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707049, "uuid": "493d502f-d3dd-47d8-99d3-5882e7d33350", "value": "T11A04026BBF90F512E2D0967FD4E6E90A15FD6D746F00A501318F7D5EA632600CA80BAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707049, "uuid": "2028ebd3-f47b-408c-8ab3-d767177a4a11", "value": "3072:0DJNd66CVEyLuwb5yWvX45mA5BiyLTqpR8mSo5On9m9cF0TwUqH9KBO+DU1dmVMj:MJL66CKyLP0WvnA+yLOkmSmO9wwUqH93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642707049, "uuid": "74ef4acc-4263-466f-aeab-89e58dae3dfb", "value": 187032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642707049, "uuid": "d0da6575-c059-4b9b-a54e-d46f8d1ac840", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707049, "uuid": "4cf07c40-9309-430d-a01e-ba23d9f7d149", "value": "SHIPPPING-DOC.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3de4b4e4-79ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642689770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689770, "uuid": "2512f87b-7682-4e46-a025-4c199d8b4157", "comment": "Malware payload (Heodo)", "value": "ab7fe725f889ed937d23d56ad819176b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689770, "uuid": "9ea203e7-d7a5-4aed-82de-e362acb871f4", "comment": "Malware payload (Heodo)", "value": "29a765d282e097a0ddcba25fb078bb0b81fbf9a3e5939f0be8bf41c72c770f83", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689770, "uuid": "369cb2b2-4fa6-44aa-a72e-ceb5fb1b0557", "comment": "Malware payload (Heodo)", "value": "1b5dffb07b9b224834a758d1c2510dcef5ee2ce4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689770, "uuid": "3eb309f5-8d79-492b-9269-c9476d59ce93", "comment": "Malware payload (Heodo)", "value": "3c242af4b892bb53b96aa5daf27243c42d15b6103768f29346f6bd31a4f8d24b576f96af7ba8f7fa9f34b3b1c4c1d907", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689770, "uuid": "2c5af5a3-ddca-4bfb-9e07-a6ad78934daa", "value": "T19AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689770, "uuid": "3cdd9e76-e40c-4f0a-ac7f-fb9867bb3c7a", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689770, "uuid": "3fecd327-12ea-4af0-a73e-85b1e53c4394", "value": 146382, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689770, "uuid": "acf91a3c-63e7-48ca-a5b8-64d6faef65ca", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689770, "uuid": "30d87f27-1a74-436a-8932-c3e5ff5ee055", "value": "ab7fe725f889ed937d23d56ad819176b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8d3961-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674928, "uuid": "3a5b05f9-f478-4daf-bf4b-83daf2ea3a27", "comment": "Malware payload (Mirai)", "value": "df1f625492eaa286cb76ecd0cfef871c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674928, "uuid": "33a35dd0-5b91-4117-abb9-254b37e820da", "comment": "Malware payload (Mirai)", "value": "29de44f01cd03debb047993a4b27d1c5f917e58d2eb5254112a3248fca848671", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674928, "uuid": "b62e3bcc-1ea9-4aed-afd1-620c40377303", "comment": "Malware payload (Mirai)", "value": "96c35830e403d76ac8453ab2862fefc6b1aa4688", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674928, "uuid": "d2787aa7-86b2-48c7-a727-0756fe6e9dc3", "comment": "Malware payload (Mirai)", "value": "29b9decf32afae2f4342e41ec377aced5ee6217a2e55b2a75a9e4ce3f3bcb9ed2a1e892af5569025269ce2025ff1827b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674928, "uuid": "c80c6cbb-5498-4760-bdc4-26bc6bcee38e", "value": "T123C32805D5508727C2D3237AE79F865D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674928, "uuid": "a732d1be-be7c-4dfa-91a6-bdd939c85dd0", "value": "3072:WkYPgPggnAb0JWaY/Vf+EDx0dn+mTQOY5NX3cn:lYPgPggI4Wa8+EDW+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674928, "uuid": "7c93180f-4955-44a6-9be1-5debcbd6c030", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674928, "uuid": "a8296a5b-331c-49a4-8499-0b258cc8522d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674928, "uuid": "a3837b82-f88b-40a0-a6d4-e20c9e36669e", "value": "a-r.m-6.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07ce9fc4-79e1-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642676794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676794, "uuid": "2137f207-32b2-46ce-8302-ad760d2aa333", "comment": "Malware payload (AgentTesla)", "value": "3fbdbe9a64bdd13bffd3f57551fa5094", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676794, "uuid": "2f5ed3ea-c3ab-4515-9be3-bc8ebb1975c9", "comment": "Malware payload (AgentTesla)", "value": "2a0bdf408cb4f42e7a3b5252c83f5de43c1d28e21846928fc53e438d14470fc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676794, "uuid": "1299c9c3-c87b-418e-83c7-b35d56c262a4", "comment": "Malware payload (AgentTesla)", "value": "b3faad6ba82792ca1823f2bdc2efc782c5b3e94f", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676794, "uuid": "9c1980aa-a690-44df-9f77-d6c31c4426d9", "comment": "Malware payload (AgentTesla)", "value": "56e76dcf8498bd09548283adc6175dce24f234242b08bf08887375bca9181462757926c54fee1f5ca2e8c502b5c57d86", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676794, "uuid": "8941fcf3-3a73-4108-99bf-4fe7dd8118cf", "value": "T10225B02F27846237E3CD827711EA60E1A357AAFF564982562071FE7F72B39801B4C587", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676794, "uuid": "2c41d81e-dd1c-4c74-a165-a7ee20b083f6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676794, "uuid": "f54637b5-0722-4c8d-9ea1-1b8c17141b66", "value": "24576:nK777777777777lb0oXUmtOSLuunrJnnnX:K777777777777GDd6r5n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676794, "uuid": "0ab29460-1354-465a-a9fe-3be223c9b296", "value": 969728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676794, "uuid": "758ea953-b8cc-4baf-a771-6a514f5e3cb9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676794, "uuid": "2d3540a8-a178-4fa9-b8c0-201404e0f7f4", "value": "\u59d4\u5916\u8ba2\u5355-\u542f\u7ee9\u7269\u6599612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a2b7bf1-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666490, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666490, "uuid": "14c51108-145c-4355-9923-4e8e1f46e98d", "comment": "Malware payload", "value": "6d0ab5f4586166ac3600863bc9ac493e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666490, "uuid": "f4fdfa6c-65b4-4d0b-bff7-d78b4aa4ad50", "comment": "Malware payload", "value": "2a6b0d55193224f6393e36c728cc15ef4f6b66ea59728214773b35fda25a596e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666490, "uuid": "d5d5033e-79af-4e7d-bb75-fcb3590750f2", "comment": "Malware payload", "value": "af7522e9f870bb9a88c13ab1ea396dfa6f8cd843", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666490, "uuid": "697349f8-2dcd-43d7-9150-decb1d3ebb11", "comment": "Malware payload", "value": "55660b9273afd3df64ed0f9569d2c7ca414ff84ac5ac4205da4e27374193c448e47813085eb834ddd3c85ef765fd8d5f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666490, "uuid": "3b8bc39e-bb03-446f-b0a0-0a859a516bfb", "value": "T17F15E077725180E1C12E0A711D6DB37EC07E7B620A11F7EBB3C85F6D5A748A1A606B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666490, "uuid": "ecfa26a1-62c2-42cb-af82-0ebdbf7d78eb", "value": "35197522762a2e9fc8661fedce3e9e4a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666490, "uuid": "9ca49d06-175c-4d65-bc9b-2d66cd4fa198", "value": "12288:Ru9aqdDhzu6dW/rPt6jgdOacngLdGrkTB/hMvzBrl0eqbt8S1qJt3ui+:QdetMgkaDRX5hMbZueqSS1GU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666490, "uuid": "c0355eee-0d88-4e26-98fd-f119af12e134", "value": 876544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666490, "uuid": "f834b358-0294-4bbf-b6ea-0d4aa5b6576b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666490, "uuid": "f14f31c5-0740-4445-80bd-ddb81831a217", "value": "2zofrncu.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "400f2a5b-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642668728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668728, "uuid": "ade780fb-e54c-48ed-887b-2a62d3117c00", "comment": "Malware payload", "value": "838875c7c992c01a090e22b215f2d7f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668728, "uuid": "a85f209b-941c-4c6c-8811-3390e56631d0", "comment": "Malware payload", "value": "2b44bcd4e351a8778edc7f9a65a95b6c9d224992f883ae33e24bfd325c34ffbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668728, "uuid": "9d607d1b-0685-4a02-92ce-efa8bd426b55", "comment": "Malware payload", "value": "b528b3f0fb241a7b6f31c6eda0f7f4bd5d12dd63", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668728, "uuid": "d753ad7e-05c2-4ab4-9133-cbb4909a9988", "comment": "Malware payload", "value": "6e484efb7400eb94e32716950ccf0e781bfca64999b910ad3953a2415e24bd2faab02e2177e03ce9d8b2263b63bb4fa8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668728, "uuid": "177b6e2d-7251-4a96-b320-b2ad5c9cc8bd", "value": "T17636330AA95F10F1FB92F2777ABE14DACA632556A3FA5117034935DEC3C62913C8F10A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668728, "uuid": "29d83011-5d31-431d-b290-a4bad71d8ef4", "value": "b8ba55866bfe7b49b97c43084c1885db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668728, "uuid": "2e63529c-c930-471c-b364-c5ce53b10119", "value": "98304:MOZ6wq/DHyRc/UJ/Kq9X1MwKlLsNQ93rm5sebiotdsa1:MOZ6f/j419f6LlZdCLT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668728, "uuid": "5b552c9f-7703-42cc-9ce4-08db0389946b", "value": 5181623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668728, "uuid": "136d8bf7-cfae-489c-93b3-322965a5f538", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668728, "uuid": "049c5abe-0c96-4cb8-be5b-78f59606fdd0", "value": "838875c7c992c01a090e22b215f2d7f2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ed1a7f20-7a04-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642692211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692211, "uuid": "74fac932-5ec3-4926-bb4d-2ae8700cc9bc", "comment": "Malware payload (Heodo)", "value": "29715e87b5c27e3c1cccb17a3090b311", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692211, "uuid": "e6e2d04a-d996-4528-9c70-8f1c810191b5", "comment": "Malware payload (Heodo)", "value": "2bc45370dd6eed0f3059fe82bd82d8aeca954819c9ad8ea823d36a8e01c7e92c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692211, "uuid": "044a30af-de11-4529-8c97-515a049ed5bb", "comment": "Malware payload (Heodo)", "value": "5dd1463850abe29a2ae7d92b9e3f360e24006e5c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692211, "uuid": "9472aa57-87a0-4f75-96ed-a73d1b3bcafa", "comment": "Malware payload (Heodo)", "value": "e4e343eeb83cc9fc99f445b84bf2a5d5a794c3b74a91c038281e4888cfb1830ba344d0a3d63f72f743304c6d60aad46b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692211, "uuid": "d4b1643d-ae9e-4103-9b0e-ea43f84bdde2", "value": "T10AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692211, "uuid": "18ec8af8-7464-43f4-beb9-b37246f2a9a6", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642692211, "uuid": "e4096571-127f-4206-b021-1c2862715710", "value": 145562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642692211, "uuid": "65abfbed-1016-47a0-aa10-130ff4333482", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692211, "uuid": "5c69fc1e-bff9-4cf0-b05d-a0f69fb83c1a", "value": "29715e87b5c27e3c1cccb17a3090b311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8fb0130-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708901, "uuid": "6e7432c9-55b7-4df3-85fc-6571c088bddf", "comment": "Malware payload", "value": "eb2f5e1b8f818cf6a7dafe78aea62c93", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708901, "uuid": "88928633-1f47-41d3-8251-a4db51b8bded", "comment": "Malware payload", "value": "2bd102ddc0e618d91a7adc3f3fb92fcfb258680f11b904bb129f5f2f918dcc5f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708901, "uuid": "c0b9a327-bea0-45c9-9959-c2568623919e", "comment": "Malware payload", "value": "3eea91298e19f0a4c33d7b52e2b06e477235aa6f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708901, "uuid": "df4a0538-3bee-4789-9875-988af9ddc46c", "comment": "Malware payload", "value": "5e887809c9df34c919c09fad3369b29ba3d3aa51d77236dfcc2ac1cb717f9ae8226d2298abaf062d7f33736a6d63c95d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708901, "uuid": "572e50a4-6169-4e4c-9af6-386cba1f7678", "value": "T1C5B533CA079B5B5AE3429E3F5B5173B2BBCCD5105DD528435267A869E03AEF83A0E031", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708901, "uuid": "c69c2d1f-bf71-4e2a-82ed-059e94d5026c", "value": "49152:PYprFGudeOr5G5WvRNLinGPOZby+XzvBTlC95L0ATpo7QGXN0Zy:PdudeVEvRNWGPYby+LBQAATOQvZy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708901, "uuid": "a5765840-4591-4ecb-82b4-a99e7c15a9a2", "value": 2365680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708901, "uuid": "46095ee1-d86a-408f-8daa-97bd500d556a", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708901, "uuid": "58efa25b-2357-4661-87d5-1ba4bcf24bca", "value": "x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09650b1a-7a25-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642706003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706003, "uuid": "6be5c7de-216c-4f58-a4b6-48ba1f582ebb", "comment": "Malware payload", "value": "d4250ac03ade455c406e4523a8640fe4", "object_relation": "md5", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706003, "uuid": "644755a6-ffe4-4869-92f3-6cefaac8d182", "comment": "Malware payload", "value": "2c4d76dd1ca68b5ab34c9705a0f7469d5987c11a888b61faf6fc8a6332db6eb3", "object_relation": "sha256", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706003, "uuid": "0cddf1f1-0de4-4ad0-abd9-517107879da7", "comment": "Malware payload", "value": "2a36b218f456b69a48cee33a0b2bbffd5b9da5b1", "object_relation": "sha1", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706003, "uuid": "1df1cbd3-8cea-4317-8cff-6a047cb496ce", "comment": "Malware payload", "value": "e0792eafb1eb0e70023552edbcef0085959b2ee5e8154dc197389385aeec6f81f02cd99b8446d061f625f751daf8152b", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellNPlusMiner", "colour": "#0BE6A3", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706003, "uuid": "cf504ee1-b03a-488e-a96b-056b3edb822c", "value": "T172820707FD0C10932FA8F56ED0749D553F08C3315149093EB2AEAA9A12ECF2A611FADD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706003, "uuid": "1c87e9fe-c510-4b18-9615-85c071623d86", "value": "384:FMofWik3/4dKKQ74JvvW5K/4dKKQ74Jvva:eoNkMQOvu5LQOvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642706003, "uuid": "325cbfb1-b3a1-4b7b-9e6f-852adfc76b68", "value": 17957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642706003, "uuid": "20696ba5-dc9b-4758-b076-42c6fa4e455f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706003, "uuid": "4797fc1d-d2b6-4048-b3b3-f3f6175d0973", "value": "9Y1zcEdU.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85583da9-7a32-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642711794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711794, "uuid": "01a90a33-83b5-48f9-bc2a-0ad142de0e90", "comment": "Malware payload", "value": "b54c3a905e72c5257ec37532f33eaec9", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711794, "uuid": "285527b4-8e22-4fe4-a62c-c404dc97d470", "comment": "Malware payload", "value": "2dc878cbd56aa3817a893c118a8257f705517f72326c6d5424d2b498fcb0c54b", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711794, "uuid": "5f8a5704-16a2-4a6e-a712-fc83cae94d6a", "comment": "Malware payload", "value": "c951e393769a2afc4aafa6020fd965f809b7134f", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711794, "uuid": "92c469a8-a9d3-4e4e-882b-b1bbdfc1dbf0", "comment": "Malware payload", "value": "970ce01a72adbcb09ff57403438314dad80630d72c9f98ce8422dba0f357b36aea4e55874197c64fa61f52e5f6d8952c", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711794, "uuid": "9ebdc708-444c-4110-b33f-d18a2fe1a4c1", "value": "T183636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711794, "uuid": "ca7eb4f4-8d14-47d6-b74c-320588e674be", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642711794, "uuid": "c978aa33-5b93-4340-9b67-d430913af193", "value": 71962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642711794, "uuid": "defe8bd8-5f61-47fa-85eb-2991575719a8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711794, "uuid": "f3eae64f-d7d0-465b-a577-8a1ede0c07ef", "value": "b54c3a905e72c5257ec37532f33eaec9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbc5952e-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642676774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676774, "uuid": "574b1cdd-9637-4ff6-ac04-03fc52bf165f", "comment": "Malware payload (AgentTesla)", "value": "9119ebef5af103cb6cf47523f1ab7235", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676774, "uuid": "b0ed5cba-0de0-4fac-8dc8-c856c29ff46e", "comment": "Malware payload (AgentTesla)", "value": "2deefa28e7329643fff89df8a5715a557796b2fb0ffcee93803c286878e87bf0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676774, "uuid": "bb23001d-b210-4298-a4cc-2ec2293bbd3e", "comment": "Malware payload (AgentTesla)", "value": "fd34f9e39257a25a68ec6bf02a9c098a4b904a2e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676774, "uuid": "389e0adf-26f3-40b3-b66f-547dee8c3815", "comment": "Malware payload (AgentTesla)", "value": "caefb2a2304b7bd999ad788c63392aaea2592bcd14764f476bcf825efdffae600e2bafe19253230f707bb22415d32c99", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676774, "uuid": "bdfc04e7-4ccd-44e6-876f-edd062c03c85", "value": "T11DB40279354069C3E2E9E9319F77D2365B243CBEA186459393F4BF2F31BC62B8805582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676774, "uuid": "bf2d4972-28a4-4491-b520-b7c08a96e425", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676774, "uuid": "06d8e65f-24e7-4c12-8cee-545122b59d65", "value": "12288:OYQ/8j1a/XXXXXXXzPIcO5SS8McYs2uc+rBtKNP:CXXXXXXXrIdIS8MTz+1ts", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676774, "uuid": "f95b6c77-c668-469a-9128-1d1f55e3f1a3", "value": 527023, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676774, "uuid": "4c21b4f9-7a95-4d16-a990-a4b4338c8b18", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676774, "uuid": "cb5c0d35-0ee4-4706-9902-972fcb20147a", "value": "PO & Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79a35163-79db-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674408, "uuid": "0e5973d3-d077-4264-bb6d-cecfa3f39793", "comment": "Malware payload (Mirai)", "value": "be6e3c402d2003aea7884d77e798a663", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674408, "uuid": "cdb46d6e-fafa-48cb-9a65-b03f3840e737", "comment": "Malware payload (Mirai)", "value": "2e5d2159b8a118f7a6a37ab28d1105b56021e46318193c1ef7cb41c5f4555896", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674408, "uuid": "1c49fd0f-c3f6-4389-b26c-3f7e395902a3", "comment": "Malware payload (Mirai)", "value": "2f2ef9684355abbd9be3cb7432ea5dba172093d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674408, "uuid": "82853682-81ee-4e40-a540-2ff1e6d61ffa", "comment": "Malware payload (Mirai)", "value": "972dfbbf3ecc905224b765bb9e30fd1d426e545a9115d1ad428240f55fb5f3542c4b057d58a5678be9b6bc4fec2753ed", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674408, "uuid": "7ea7495a-c751-4d40-b501-02b1aa5abc6b", "value": "T129632B95B8818B21C5D5137DF92D168D372227F8E3DE72139E205F603B8A96B0E3BD46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674408, "uuid": "c7d2d5ae-4bb8-4fa3-81e5-fa5f971d305e", "value": "1536:hgnAjIP7B9stYVenVQmOct8URqOSQHMgimu2aa7LLJa10ftu:uP19st6en6mOcEku2aa7LL4D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674408, "uuid": "58e86976-76bc-4103-a419-0718333e4660", "value": 71540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674408, "uuid": "d83b53fe-ef5c-4388-8096-7e2d4dfb9017", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674408, "uuid": "c6822980-82ab-4323-b0b7-109c1e9a8182", "value": "uYtea.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61b3b289-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660624, "uuid": "b7261120-215e-4159-840f-f60cea971c59", "comment": "Malware payload (RedLineStealer)", "value": "ab49798f2a95054d8f565a6ea6833095", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660624, "uuid": "380b6fe8-5903-4ef8-8388-0f2470c005d8", "comment": "Malware payload (RedLineStealer)", "value": "2e6a515f6f0f4c6afeee0504513de753828975c0a0ee4630ccd4474f0ca8e002", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660624, "uuid": "82ead494-c559-4a41-9b72-dfe206846c8a", "comment": "Malware payload (RedLineStealer)", "value": "31103ad407e4b148660d27b572838a1a5d296f2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660624, "uuid": "19495d1f-e812-4866-b395-136b542409cc", "comment": "Malware payload (RedLineStealer)", "value": "483a93df843a2c9bb00ed9d15c1ade43d220dae5cb7921b30419bdd5f529c9570d0c987053fbb49c771fa06ed34127a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660624, "uuid": "05947397-48fd-4f76-aacd-5483cbc01137", "value": "T16284E07A7AD8D831C0865A708836CFEC597DBC3118654A4377A83B6EAF313C1666630F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660624, "uuid": "d32bcda1-6e7a-438b-b83a-1a1344e08a48", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660624, "uuid": "d70776d1-5a83-42ea-aa03-989ee7e4278e", "value": "6144:74aL9c2YYNGGGEq4IXFkMMBbzDuSLFIfRN4K3KvRB:LS2YYNGGGEpI1SBXDPZIfL4KwRB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660624, "uuid": "7dfb7553-e025-44d5-b1c5-c113f04da74f", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660624, "uuid": "d7df7e46-e526-4a79-8b9f-d1438329e0bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660624, "uuid": "1c508c41-1f20-4b38-b8ad-3be1352f2431", "value": "ab49798f2a95054d8f565a6ea6833095.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22bfcb0a-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642665673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665673, "uuid": "fbde63a3-b1ce-4f42-b42b-f488abe28876", "comment": "Malware payload (Loki)", "value": "cc9ca18d0333039a9260fd621c128238", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665673, "uuid": "6b1a2b1d-3f02-4830-b8e5-7baca765d5b7", "comment": "Malware payload (Loki)", "value": "2f07a186d77fb34b61df2ddc3faec947e98bd1493aec225586ffb99cb98c9401", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665673, "uuid": "afeccc8d-7e8c-42d2-8e7d-639dee134fec", "comment": "Malware payload (Loki)", "value": "767e934bc86f8a859ccfefc56a75028d04f04e82", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665673, "uuid": "d628db30-2dfa-4609-a6d3-03af0ba0f797", "comment": "Malware payload (Loki)", "value": "c926242982e5b4c00ab824884aa3dd59043e013f1acc6738d0ed83da868c7dfbbdfd8a6f6aca531f0a833f7dc012e6bd", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665673, "uuid": "c64a8520-630a-4adb-8f08-7c6e9c41cb84", "value": "T1D1040208757DA8CFCF399F38E406A26346F58E444EC22A41935D73A462FA41E29CEF57", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665673, "uuid": "863a0674-6e1c-4b81-a0b3-7dc4ddb71ad6", "value": "3072:0jf98NtDeP+To7UIL574i4az+lyosbEqMgnlNdi8IXyh:SiNtDiMo7Ua574i4dmE1gnlQY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665673, "uuid": "fd212eac-aa56-4cf1-9cab-3f129f8bd0d1", "value": 187032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665673, "uuid": "c80bc1eb-ee69-4407-a78f-058e817f5169", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665673, "uuid": "e230e866-cfaf-430f-bdda-346ca8f3bff7", "value": "mslog.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e34de81e-79da-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642674156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674156, "uuid": "5b68ff66-1b6f-4793-9374-6562a616d8cd", "comment": "Malware payload", "value": "a1218402bbd1ed4bcf3072b6266a5dce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674156, "uuid": "ed00bff4-e7c3-4c50-904a-31f6245e1e1c", "comment": "Malware payload", "value": "2f5c768479cb3ec1f99f11e6feef8b300c458e5febc11de0dd40754614cd87a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674156, "uuid": "2c646cb6-d212-4bdd-b8b2-76c95817e0c3", "comment": "Malware payload", "value": "045d63f3789042318abe91fd2e95f7a3613a6f78", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674156, "uuid": "9407d461-e3b7-425d-8c2f-13cb61feaeb4", "comment": "Malware payload", "value": "29a61c7f0adf6750bc09c12bf56b0fb9cca7667929b9d495f6d5a507fdc0658a4264215a271942c9b2bd681acd7cd62d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674156, "uuid": "9da25dcd-442a-4454-9ef0-e1658b352a28", "value": "T18A944C41FF4A81B6EFC721B0543E6B1FD92A824923182EE3D3586D6B59D12D2383B15F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674156, "uuid": "2a1a17f2-e985-4b2b-b4af-10cf63fea4c4", "value": "6144:5s4r3lBb7leLEA0CN9YGxSj8vaUw+4J+X3hHb1AoKcu3ETkts+0WnP:u4r3lBMLpWGxYzUw4R71ZKba+0gP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674156, "uuid": "fa9471aa-60b9-4601-8d2b-094398fc144f", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674156, "uuid": "a6b3b83f-b97a-4395-90f8-438153108c85", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674156, "uuid": "eef7e8fa-2900-4f0c-b31e-ca5c0de1546b", "value": "test1.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9e5b61f-79cc-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642668127, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668127, "uuid": "ab16b903-07e0-43b4-b1b8-a782baf13624", "comment": "Malware payload (Loki)", "value": "8b26fb89939450977499942dea617ca0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668127, "uuid": "a46aa333-1da8-40fd-adf8-195774a15eb5", "comment": "Malware payload (Loki)", "value": "3010d94f97e473177fa40a61cc5cb21b5022988d29b7de24bf2ab2cc91dfd44a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668127, "uuid": "066d431c-dd69-4340-9068-a9196e28fe57", "comment": "Malware payload (Loki)", "value": "cebc569752e8c29b2b3ba83cf92d6ead99756849", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668127, "uuid": "907f1198-2b38-4311-9c6e-1aecc9070f62", "comment": "Malware payload (Loki)", "value": "0ec70c4871307988a65bc269d0d2ec39edf22f9d9df4637c74fcd981111100e3a461f6df85afee01f53869d94ee7d313", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668127, "uuid": "bc4a9a47-3a9c-41e2-b2b5-efe76faa505e", "value": "T1BC5423AD26C0D16EF9925D300EB586A6CAFAB11917701D8B6B6A0FBF7FB53D10D11082", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668127, "uuid": "fc0478fd-e9dd-4b89-b1e7-b9954d9681d6", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668127, "uuid": "75651b81-7c88-45b5-a8d1-70890ad2aa01", "value": "6144:owS7zHQk892mVhd75DNu4jpalVUu/uTZt7NPPP1Pi5GDnXiuv8NWfH:tk892au4jpC+TZtJPPuCXiuv8kfH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668127, "uuid": "05161467-656e-48fa-a423-d4f8bd9ff7ba", "value": 280503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668127, "uuid": "cbfa93fb-5861-4f61-86ab-70f64f87c6ac", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668127, "uuid": "9d87458f-6a86-448b-a6ae-0a7b871f295a", "value": "8b26fb89939450977499942dea617ca0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df9abf53-7a37-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642714093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "dff14094-d7b9-4965-8a2c-2a69ccf75b1a", "comment": "Malware payload", "value": "306996c9e96bc21cc31edbbba54a6ee7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "feb2e48e-9d1d-4a72-8112-c3149d371c14", "comment": "Malware payload", "value": "30acbae9e62419cc4a5779a285b779bfe6c2dd30214ec65f712c242063c76ec8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "dbeb1484-5b7a-4809-baf2-eb4261a805e1", "comment": "Malware payload", "value": "239554b8f85941fc2d2b14a87c0855fb284d6f7a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "7cb356e5-e266-4b30-a7fb-5ec6287d5b18", "comment": "Malware payload", "value": "06558a25cf2fb32828f11c33c4ae5854c2bf4a1409947adc88725ddb840cf92f942f56060bef075f76d6ea47af1679a4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "255ab13b-e7d3-4ebe-9c81-bc0c37320011", "value": "T171D4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "24119f2d-c468-4d20-be37-8261006f386f", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "4e404a6e-bee9-4cae-9f6b-028e7723629a", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NyG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYD8Vnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642714093, "uuid": "b9412428-4cc0-4c3c-b105-929455c95ace", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642714093, "uuid": "8e1780a5-be12-48b2-ba30-707ed53d18ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "40ea5772-f4ab-4219-900a-77a58d112ceb", "value": "emotet_exe_e4_30acbae9e62419cc4a5779a285b779bfe6c2dd30214ec65f712c242063c76ec8_2022-01-20__212806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ac5a254-79fc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642688396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688396, "uuid": "c2f8526f-fdfb-4663-aeca-7e9c6c979ea4", "comment": "Malware payload (AgentTesla)", "value": "0eac9fbea9539a38b1eb1f36d883f5de", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688396, "uuid": "69863330-b48d-447b-91c8-96aed32e3df4", "comment": "Malware payload (AgentTesla)", "value": "3149b8e70d67dd88acb5baf26522e4b68a8a3f054934fc3cdcd4d75ea6340eac", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688396, "uuid": "91a3b3b3-6687-4358-9661-19209e883180", "comment": "Malware payload (AgentTesla)", "value": "72617062c5c5914df4200628ad2e9b1f57a47a54", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688396, "uuid": "1d53e36d-eebe-4732-ae90-47ebc4a88106", "comment": "Malware payload (AgentTesla)", "value": "eed05664b392bb7b5e3100dac6180892ea2e8096a3ee5055344cbb4bce323971f5f6af73ec5fc5d1ea46d8157cf7c688", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688396, "uuid": "ad0c89fc-1e8c-44c7-8ef4-2bc0cd31b4ad", "value": "T1C894011477F627BEEAF987F9617100A053767A2B2122D32C0CD670DE1876B86C752B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688396, "uuid": "7ad9088b-3f32-486d-84d9-77aa5433a845", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688396, "uuid": "267be706-09b2-46bb-9c04-079bc6124dfa", "value": "12288:zDQif8xfJ5fZYuQu2q5xZU3MxFo/YgtzpW3txU+th:fQs8j5RYRM5xGcxFowgppWc+th", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642688396, "uuid": "1755d6be-ecdb-42e5-a58d-88f52ca25463", "value": 445952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642688396, "uuid": "08859c11-50a0-44dd-827a-676665a29d96", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688396, "uuid": "fd1b7d42-37cb-442e-9b2f-aa363b6f97c9", "value": "PO_021TECAN.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56daddb1-79be-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642661894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661894, "uuid": "b4200648-2a3b-4d22-8831-a98da7c3948a", "comment": "Malware payload (AgentTesla)", "value": "2be6ad391469258a7c41d9f788ceb59f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661894, "uuid": "2feafc0d-43c1-4771-b590-3cb4554dcd04", "comment": "Malware payload (AgentTesla)", "value": "31e8a8d60f9b9f519864009a48ae1cb815dc419f3f8655e8d771d74c5becc697", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661894, "uuid": "0c0c1ad5-cd8b-4eda-a374-ca165e1efad2", "comment": "Malware payload (AgentTesla)", "value": "335b4e3cc48b072d1aa1a88b1543e522bda83fb9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661894, "uuid": "1ed1376d-c629-447d-8a58-bc767d3a6c2a", "comment": "Malware payload (AgentTesla)", "value": "fbd4f00f8cc0873c474b518db700eecc1e96efaa96c5acce7e92cf94ff00c2e13f92fb184e0c38ba94d5f69909b82781", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661894, "uuid": "e92cdd40-d4a1-4c39-ac0e-2d73c9c07160", "value": "T1E1942313BD214376478F6ACDA49F8059B246C0FC86706957500BEC8B49AB3D3AF1B3B2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661894, "uuid": "5666cafe-b4db-4f5f-b739-6f2ed8dec085", "value": "12288:JBLzt9O+6sKGYwI1xcJ6NMnKUBvjcRFVJREcGI:JVh9O+hYVGecK0rcRfnEU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661894, "uuid": "12addd8b-2eca-4283-8bf7-6a4fcc3a9c03", "value": 423041, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661894, "uuid": "9552f212-c974-4e45-8cb7-f2c53a8d804b", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661894, "uuid": "657d705c-d142-4d2f-8de7-ce18764ec57c", "value": "invoice.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45894d31-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660577, "uuid": "0a6f99da-cf41-4f6e-9500-534090915d78", "comment": "Malware payload (RedLineStealer)", "value": "2d9b9fbfb71051ea45ffba86a2254be2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660577, "uuid": "49ed7546-3f22-4a21-95cf-3946235a0458", "comment": "Malware payload (RedLineStealer)", "value": "31efdf0a4453bd19ecb92e8dc1b16cdc9552ebbae70dbb2444fa4721c2236994", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660577, "uuid": "79f0207e-d585-4877-8e4d-89034846a597", "comment": "Malware payload (RedLineStealer)", "value": "12c19295ab6ff626f7b126645e87dbe3c68a6be3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660577, "uuid": "f8973e53-2c5f-4cfe-8280-80738c42207f", "comment": "Malware payload (RedLineStealer)", "value": "379e9fcd12ce181281091b7155f0c9797c8f010ad85dd50c8038a1e76187e36549611ebf8baacadd2c129126399a8135", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660577, "uuid": "41475be3-dbc3-4c1e-87e5-8f522a1b1b1a", "value": "T19784D02275C0D432C4C259304429DFAC9ABDBC352911864777A4FBABAF713C2E66A74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660577, "uuid": "7abd1af7-4f99-4725-aeec-1811248f8a31", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660577, "uuid": "a98409ca-3bc9-41e4-945b-051cac0b7263", "value": "6144:uFhL/92YYsreE/KVd/wZI6NUOmy71h6t0I3Vy+crstENMG6:YJ2YY6ewKsI6nmue3VVcrstt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660577, "uuid": "5c269fc4-3e71-4474-922c-eacb0f5f126e", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660577, "uuid": "c1f4f860-9159-4aa7-9a47-833f79e0c5f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660577, "uuid": "392d15d7-e83a-4f72-99aa-f388d31effef", "value": "2d9b9fbfb71051ea45ffba86a2254be2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f96f34ad-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642676770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676770, "uuid": "d6f2d533-14fc-44c3-9893-674799f46e39", "comment": "Malware payload (Formbook)", "value": "7dc82eb8ad4d78c1fb2534eef4fb10fd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676770, "uuid": "97ddcf0f-9912-411c-b32a-8ed0a01a98b6", "comment": "Malware payload (Formbook)", "value": "32202111654172f16eab4a33849af61e651680218d44e657b719b56789976561", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676770, "uuid": "de1a778a-2297-404f-aed0-9de233932065", "comment": "Malware payload (Formbook)", "value": "a6f61ab9754a38151026dd6e94a97459723c8add", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676770, "uuid": "f4fa589a-f040-4f13-a0e5-a217c28736d3", "comment": "Malware payload (Formbook)", "value": "815f2ea5628a47a00f1e49e9d7398886e87e2b7e3e26961ec130d85d8dbe7c2d501022272056fd858b8ecf7802da655d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676770, "uuid": "730f31d3-77ea-40e6-a8c3-8117d2515ad6", "value": "T1FC5423AE7BC540ABD80117341D6B479BF3B6E9001262525F57C4CFBE0EE4BF129463AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676770, "uuid": "8ce7a96a-cec0-405a-b928-e084c062a27b", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676770, "uuid": "7b7321a8-fd01-4b28-b299-ebdb007435e9", "value": "6144:owUCpcA46xoWkby7GSZsCdFid4QRsy47am0EwtKXcuTCuafc4Jj:TpM+XiSaCdFiSQRsy4+LtUcG87j", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676770, "uuid": "ba20ab92-7507-4272-8270-aa175f08c75b", "value": 303177, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676770, "uuid": "ec48f379-5880-45f5-966c-3d260cb93dca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676770, "uuid": "88520c6e-b4ad-4e09-bdbf-28ecb73a531c", "value": "Order-711493-pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a99c02d-79d8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642673068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673068, "uuid": "b109ad74-aa21-46d8-bf88-fe0c4dead4f1", "comment": "Malware payload", "value": "03acf8b4c6eecca9f1a66edafee7a166", "object_relation": "md5", "Tag": [ { "name": "PEM", "colour": "#94C7E0", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673068, "uuid": "494b4a98-06ee-499f-a2a7-4b7056902512", "comment": "Malware payload", "value": "327caeab555bb4af404311ed4219bea563326d7435a51c6d02a0e0a61f26b8e8", "object_relation": "sha256", "Tag": [ { "name": "PEM", "colour": "#94C7E0", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673068, "uuid": "43f09ca6-6adc-44fe-aa2b-6dceab387a5d", "comment": "Malware payload", "value": "591f74edfdecfb1fc4c83408eb0416c2063fb026", "object_relation": "sha1", "Tag": [ { "name": "PEM", "colour": "#94C7E0", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673068, "uuid": "7435236b-3311-4263-8185-26077549e2d0", "comment": "Malware payload", "value": "2b48dac7b1c8d0ce6792d595388a69f5058b736a8fdc06af9fe53467fae1c4d2b561ada675d793b7f02713570c899691", "object_relation": "sha3-384", "Tag": [ { "name": "PEM", "colour": "#94C7E0", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673068, "uuid": "1734bcee-d6d1-4992-9af1-418af35caff3", "value": "T19F229E35FF94A0EA4FD5E36B6C4B2EB47B49510FC12F2A589737A2D592F1041E105287", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673068, "uuid": "78eaf1ff-8ef7-4c97-9c55-5d8b78a10bf9", "value": "192:Hm6AfDI3VW/pqzEoTWKdL1Lvuazy0+dpDdN4OSkr9LDzW7YmQdvQbHJ:HmU3V4puTWKLuazy1DdN42r9LDU9ovQV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642673068, "uuid": "c5e03b4c-1f72-4f01-a016-eda89ca141b2", "value": 10366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642673068, "uuid": "2d6f9204-f369-4637-bb1b-6af0a4bc96cd", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673068, "uuid": "0263def9-b7e9-4b55-8712-b6476890c562", "value": "sysmanager.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2288db4e-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708622, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708622, "uuid": "067f747b-8d38-4d7d-a220-5126ae582c85", "comment": "Malware payload", "value": "f7d20815bbea0abc9ff627f501620048", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708622, "uuid": "c4592288-73c4-450d-9d41-cc6d420dba77", "comment": "Malware payload", "value": "328a8b05fbe3718e41a3e3ec07593e68de43cfb1ca77fb8f29e1d3d79ea87f05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708622, "uuid": "612d52bd-1f5c-41da-9360-1a51aa2fa025", "comment": "Malware payload", "value": "5b6bc54abc45667f1baf12eb43230322af1df22c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708622, "uuid": "82834237-221b-4a16-a700-692717238717", "comment": "Malware payload", "value": "665e87593176931de34860115d7774aeeabda5c19f5e998bea3ae21f41b443a99b10c2a4738ee400085aaf6c7bd6cb38", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708622, "uuid": "51e0c18b-cbb6-4f8b-86d9-01c4288bfd2e", "value": "T16534AE35FE90C032D447153C482ACFA15E7EBC355E65D643779A279EEE32381662A20F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708622, "uuid": "4312d7cc-36bb-48d4-b36c-92db01a64032", "value": "29340e6ca7cc3b9eb89af4981d5214eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708622, "uuid": "c26648ae-3d79-49f0-9349-9800b026e593", "value": "3072:aw4Gz9qLgQVJGt0nZMUIt/kf5m25G5yTD62M/h3:aw/MLgIVnZg/kf5E5gDz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708622, "uuid": "d4877f9c-93a9-46f8-910d-d68a55c5b58b", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708622, "uuid": "a578c57d-9a11-4607-a582-263304df2157", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708622, "uuid": "9ff24dd3-4ec3-4307-a2f7-cbd5d759ecf9", "value": "f7d20815bbea0abc9ff627f501620048.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bee072f0-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642660780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660780, "uuid": "607fade5-f2b5-4a92-84e6-0916f1a43481", "comment": "Malware payload (SilentBuilder)", "value": "951698624e4adee587a2858aa05deb16", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660780, "uuid": "010e4917-b5bf-4e49-b735-2f1794273862", "comment": "Malware payload (SilentBuilder)", "value": "32efd3dc59a0008dfe321d99b4d86a446a06af1e3b128295b387c235b4751a0b", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660780, "uuid": "eb452699-0c0e-4212-b764-cca14310dd72", "comment": "Malware payload (SilentBuilder)", "value": "aeecf0ce18d3e14b5d8a0c951e443c10b82a0524", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660780, "uuid": "434bf3c9-5d53-4551-88a3-987ed2b3a6d1", "comment": "Malware payload (SilentBuilder)", "value": "cf331207b046563932b57fa00971c8ec98360b864144bc0302f15ed83dd01b6746bebc8de143809878f3d67f3f18c2d0", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660780, "uuid": "2eed5c00-e875-451e-9aff-fcb3df8a1094", "value": "T1FEE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660780, "uuid": "dd061a99-7138-436f-b1b9-b2c16da4f980", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660780, "uuid": "2accc543-c366-4688-a1f8-9ea90b4e71b0", "value": 146202, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660780, "uuid": "c3c693e6-fb2a-4071-a5ec-6783181db738", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660780, "uuid": "f3911e71-9031-4dde-a45b-3e8e5299f291", "value": "951698624e4adee587a2858aa05deb16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c105b830-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642708888, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708888, "uuid": "7daa6355-7f33-49c2-aafa-19698d4ca7be", "comment": "Malware payload (Heodo)", "value": "b7191203f1139408fdf49507850566d2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708888, "uuid": "1b7fa820-9bbe-4212-a0be-77c96976bb17", "comment": "Malware payload (Heodo)", "value": "32f3361f02ae4615ff51402361d271dfb7aa3984755728c5aa6c854979f0e551", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708888, "uuid": "cf136d0a-f7d9-41a3-b436-e0fb9de549f1", "comment": "Malware payload (Heodo)", "value": "e24cae24aad456f1fa60504ae7bcd81279fa73a4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708888, "uuid": "8bf1b9c7-7074-48bf-b0b0-c55d87ff2592", "comment": "Malware payload (Heodo)", "value": "3f11e2711734d056cca13aac0b13b925aa3803a2c4452f5879bd3c4103607cd39c6e331a0e037e0c3b88c4e0eacbcbbb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708888, "uuid": "1b7d471b-f8d3-485d-951a-dabf4725b999", "value": "T146E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708888, "uuid": "8a87a0ea-5d8c-46de-b808-2c51b244cb70", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708888, "uuid": "1a5a7ef7-933c-4575-8c1e-cc5f9e4ce308", "value": 144943, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708888, "uuid": "43bfc2c4-b421-4563-9455-5ec894eb6667", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708888, "uuid": "c3f6bb62-51bf-45d1-bbd1-747cbaf86879", "value": "b7191203f1139408fdf49507850566d2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c7c4f22-79f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642686412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686412, "uuid": "0388131e-a0f9-4eb6-9018-0fa51fb7ec0f", "comment": "Malware payload (Heodo)", "value": "04683e687c8e78c4797ae1a19ad7de31", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686412, "uuid": "9247605f-3502-4a3d-af1a-cfaab1539dda", "comment": "Malware payload (Heodo)", "value": "33093f1ef1d4b69b111e19172abc6a93e8c1e362905278e648819acace07e42b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686412, "uuid": "65e46e43-4312-4474-8815-4c72ce0624d3", "comment": "Malware payload (Heodo)", "value": "8fcf4018685547e941f96ddcab43c43e3f650ce2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686412, "uuid": "1f148e43-9e30-4df3-a51f-c78c6b12b494", "comment": "Malware payload (Heodo)", "value": "68a2f4d30c71fcaf443caab8eae61eff45ca4705f66d5a19cda4c21eedcb4ebc91d1530217137067fd9bac2266b593a7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686412, "uuid": "b208584f-1dc1-4503-8385-223b01193ecd", "value": "T18FE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686412, "uuid": "68825ae0-477f-4776-9fa9-b5d2f1ec1c62", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642686412, "uuid": "a1404ea6-30c4-4186-bf8c-65d5c1771ac3", "value": 146235, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642686412, "uuid": "b4136425-c71d-47dc-894a-f9b8bc3835ab", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686412, "uuid": "2ab82e82-3f9b-4302-8ed3-63553e27ced7", "value": "04683e687c8e78c4797ae1a19ad7de31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43e289c2-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660574, "uuid": "0336c944-e3d0-4caa-ae0b-bb8d0791ba00", "comment": "Malware payload (RedLineStealer)", "value": "2f9e116cfb0502ea17ec715e4fd25ea3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660574, "uuid": "66304dce-e580-4e25-9c52-8aba3f316cb9", "comment": "Malware payload (RedLineStealer)", "value": "335d317b5167a34fac833e99834735f2be480f1156cc5fc623146c470f24eeea", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660574, "uuid": "091b2d50-cd52-4603-9fcb-66708f9f799e", "comment": "Malware payload (RedLineStealer)", "value": "833be5225da862c859aba26a65c033ebb30376b7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660574, "uuid": "58e9e1fc-3197-47fa-a8ea-bde14b62e287", "comment": "Malware payload (RedLineStealer)", "value": "ce8cf873ec2566f2e65dd8786e229597d6cb8133deff9c4f109d2d55897d141ba9ca0db37e4a7b301f3e547cef2c88ca", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660574, "uuid": "f1ec2270-f744-417e-a38f-4e3de41a56f2", "value": "T16684E070B590C431C08125308626CFA49ABEFC3554644B87B7A9FB6E6F712E2762B35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660574, "uuid": "a43f199a-fd9f-4334-a03f-4a41a20a9666", "value": "125adc129c50285a2cd4524417d3fdd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660574, "uuid": "ab73076c-6a83-446e-9e0b-0c7f9dbf62f6", "value": "6144:ujHiLqf2YnIAQd6hOLkT1IxeSgjpXsEOz0gkFgxkMMIHxpQR:ujC+2YnL8oT1CeSgjp8dQgkFFnQpW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660574, "uuid": "7000a59b-bc0a-4d3a-80e3-9947f89d89d5", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660574, "uuid": "6753b562-29bf-4c9b-9894-1e9c67aa2974", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660574, "uuid": "8972ed9e-c2df-4de2-9704-115f7656bed3", "value": "2f9e116cfb0502ea17ec715e4fd25ea3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75d68557-79d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642672684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672684, "uuid": "fb5e8ea0-7da1-4e8e-b0a6-e8565deaa99d", "comment": "Malware payload (Gafgyt)", "value": "23b10bf6be8637d4cd0f55eb7bf34b66", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672684, "uuid": "88633633-0c33-4a4a-93d9-7c33d85fd248", "comment": "Malware payload (Gafgyt)", "value": "33bf475b95a51e7ae812274cb67620ae89b95768ccaee948c33cba79a65b90c6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672684, "uuid": "614eb784-b4a8-4f9e-af59-9638f6ea4380", "comment": "Malware payload (Gafgyt)", "value": "cb7e4690027bc1628dd18d5fcd6f84e1607b1849", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672684, "uuid": "736b292b-e6a7-4b61-8817-04dc8d2bde85", "comment": "Malware payload (Gafgyt)", "value": "effdfcf78a33c9fd882b1bd351c54d017511b0456556b9cec69f77446698d8a0baed602e9d3725920ba09aa0620c7af7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672684, "uuid": "e94e92a9-429f-420e-8437-25eb7e41b306", "value": "T1F233FA43A9A69F77C086AEB526B30A740753F8154F1B0B8A712DBDF4474B9CCBD1A360", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672684, "uuid": "b67238e0-4256-4661-9e1a-d27189d7c7e2", "value": "768:T8CfHJIxKeKz7ztaXoU0GQR86SZdf+G2KCUI2ZhF/EkghEj:TNvJI3Kz7zAYU0n8uGfCUjZvRbj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672684, "uuid": "1286ba81-a345-44ee-8ac7-712fbf49b0f5", "value": 50986, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672684, "uuid": "6fb1786e-a80d-445f-b97c-ba7917f632f6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672684, "uuid": "ab4a45ca-e3f6-4734-9476-923f8789910a", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2f064cb-7a04-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642692221, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692221, "uuid": "ee6fce9c-12ce-4d7d-a90f-56fedfa24ac3", "comment": "Malware payload (Heodo)", "value": "51c5ef7c8a552340045b9d216f22a234", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692221, "uuid": "9f7c3cde-968e-4aec-afab-3e859a7b8f63", "comment": "Malware payload (Heodo)", "value": "34315a97decc512b1ee8e3f26e5f2ff6ea20bf03d6e8524b970df14e18ecfcb7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692221, "uuid": "9c738f6b-4f0f-4f93-b656-203930d18f76", "comment": "Malware payload (Heodo)", "value": "2a2d330022ae6c376cd7af1c7f0ed8ff7755e630", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692221, "uuid": "ae9b1bf6-3da9-46b9-927a-f59e34cf0130", "comment": "Malware payload (Heodo)", "value": "73f95e1437e4381084eb38ec88d9aedb5f2bfc2973d3bb80f5319245c1dacbcef65d1307ef71198822c759e0050cfd79", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692221, "uuid": "d2fccdb2-ce2e-4939-990a-9594b586b425", "value": "T151E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692221, "uuid": "3557afda-fa2d-43a8-be69-de3480a28dd0", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642692221, "uuid": "9120554b-7ed1-42e8-a42e-b7ec9718f1ae", "value": 146051, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642692221, "uuid": "b20e2fab-0968-461a-b64c-5b151b0df136", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692221, "uuid": "55292539-f4af-4f20-a51d-c34376f343bd", "value": "51c5ef7c8a552340045b9d216f22a234", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba71017-7a27-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642707161, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707161, "uuid": "eb175800-1d19-4dd9-9b45-419890c9f45b", "comment": "Malware payload (AgentTesla)", "value": "c542fcbf1b9a541a0822eac47df01990", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707161, "uuid": "cbaf7af5-3646-47bc-be59-2a9aa5f5d6e2", "comment": "Malware payload (AgentTesla)", "value": "3464aeb37533874adbaa551d7850473649eab0394170c824091ab4978df0294e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707161, "uuid": "539c4f56-69a0-4700-927c-54cad5c0e776", "comment": "Malware payload (AgentTesla)", "value": "2dfc4753040832b926413a24d29fbb7f025d3405", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707161, "uuid": "f6d905ce-e40b-47dc-8120-0d18b36c2e9c", "comment": "Malware payload (AgentTesla)", "value": "d281c6d03edb111ba69562abc63e14a1f8cc977d17ccada3ea389fef80e5ebe012e5fdf1895955e39cfe3a8b0350c594", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707161, "uuid": "3df3d41c-918b-4d00-aa0f-803835cdedbf", "value": "T1EF0502207FD15715C68F87B89D7C7D2083B8B8963958CA6E494E7DEA4238BD09720B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707161, "uuid": "a893b2e0-8556-4813-b4f9-5fe85fc273f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707161, "uuid": "06c764ca-0f1e-4eb5-8b8a-68ac39376f46", "value": "12288:gYMiiiE9WfXGd333FD1kbduVxPL4JRWig4LSjPO8SnOoWJs8i/p:VfXk333h1XvL4w5W8OOoWJIh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642707161, "uuid": "c6e2d228-4647-4b6a-8d31-79d2f6164397", "value": 830464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642707161, "uuid": "c1bcc6fb-fc5b-4f3d-9830-c5d5eb409910", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707161, "uuid": "98596314-eec4-4ca6-8637-f8aefd75f651", "value": "c542fcbf1b9a541a0822eac47df01990.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81d72bea-79ec-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642681723, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681723, "uuid": "512a3564-ecb5-4e8e-b42b-65963640dbda", "comment": "Malware payload", "value": "f18c1527d5a353da2202493c1ec8f6b6", "object_relation": "md5", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681723, "uuid": "ddd55d26-a4d3-45f4-a035-376a233316e1", "comment": "Malware payload", "value": "35380c831ccd7ac5e68b1ceaca0c37f6dc65768edf409f8e1b1a46b59e31aa7d", "object_relation": "sha256", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681723, "uuid": "c1c09d0a-4036-4a9a-a32f-fff7bf6bb7b6", "comment": "Malware payload", "value": "52fb13e6f63c17756f3ac0feec71ba4434bd59ee", "object_relation": "sha1", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681723, "uuid": "4adfff7a-fabc-4696-9d9b-49710085541a", "comment": "Malware payload", "value": "f19fe6ce29c74c8768e245fca612c5ce91f5e168acd847c9f950a00cfa62e329caf2cec80c020cf984846d00dd47a540", "object_relation": "sha3-384", "Tag": [ { "name": "apk", "colour": "#344CAB", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681723, "uuid": "38ede336-4d7e-4113-8be8-0fa8c71ea483", "value": "T10E8423917EA6AB54E50725F93630AFEDA3C121C399B31D0FAF010C92ACD8DB009F56D9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681723, "uuid": "bfa51a5a-f7db-423e-bcf2-cd8eb1f98d07", "value": "6144:KSY3HRyK3mBXTn/ddxSuS28zR/EM5vm5fn8NVer+nGYSckcHOIcm50hOP:GPmBDx5JoR/E4cGer+PluIgq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642681723, "uuid": "57f8a9f2-b7d6-4136-aab0-0ce5ad18278a", "value": 371247, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642681723, "uuid": "b8a12180-2222-4f0e-8bd8-96eab28ddcbd", "value": "application/java-archive", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681723, "uuid": "dded7c87-eac3-47d3-be2d-7aa01a9092cc", "value": "dgpykawdca.apk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29d48581-7a0d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695749, "uuid": "1edfbc55-1e11-4d08-9aa6-6c8002ffa5f3", "comment": "Malware payload", "value": "88e8ec9df9c358753ad40d40458ec32b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695749, "uuid": "a6bc43c5-51e1-4395-84ec-73549dc00fc9", "comment": "Malware payload", "value": "37fd738c1337d4e40cda3d353337ace0775eca4b597f6678681e0e0018332ddb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695749, "uuid": "83d34964-4529-4960-90d4-2723b501e2e7", "comment": "Malware payload", "value": "db1ebc4283f71c945c6c5bf9aef9835d75251002", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695749, "uuid": "e0330a8b-605d-4932-94f5-7d03b4d020a5", "comment": "Malware payload", "value": "48e2b847e56fb3fd9bc2c98e8df1b1dc0013c8fab8a979e9a5b2013b1e259f868c3ab6dae63f7f61ab527ea0454a9cc1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695749, "uuid": "bd4b9910-0561-4436-ac65-d2553e4e559e", "value": "T13F731B41F9018B17D1C327BEB7DF47483B36EA99979B73056624FEB82B867CC1A26110", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695749, "uuid": "d70f1c90-c72a-4de0-a4a2-ed238d2e67bb", "value": "1536:wEHmceEY4+RbRxCAxaB27O1HpE2X4Dei6bPEC/tfqQSMTGrfAer:UceBxCdDpE2U6YC/tfqQSMqrfAer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695749, "uuid": "4ced642a-8d2e-44f2-97e7-85168d722bb4", "value": 80193, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695749, "uuid": "800a5f82-752d-4e69-9434-9acd350a6ebc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695749, "uuid": "f6b7c28d-4464-4279-8f06-397c0e68d5f4", "value": "88e8ec9df9c358753ad40d40458ec32b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "006acaf4-79e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642676782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676782, "uuid": "dafbd753-1cae-4f37-b90b-f90d1677fe89", "comment": "Malware payload (Formbook)", "value": "69ee93123716e7d21e0e527be980c22b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676782, "uuid": "d137d35b-3526-480b-b126-c1ac8a67ab08", "comment": "Malware payload (Formbook)", "value": "3866d4f2f3fa6a3cdedd0b3e4704b438881b0a147e75eeddacaeea85e52c669a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676782, "uuid": "976b29d9-0fc6-4a68-b902-9f027341e911", "comment": "Malware payload (Formbook)", "value": "bb4b074dda0d143d36a6c4c572bd669be67fe0e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676782, "uuid": "4ec16841-0948-4a68-9fa4-6696c69efdef", "comment": "Malware payload (Formbook)", "value": "be305bfe45a736db0eb4a5ff84f98df60a617027c96bc2031364a65d0ee9568cca96dd73220cd93fb14edced6e0bfab2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676782, "uuid": "7789dd59-23e3-4f16-834d-712759511407", "value": "T1C654139674C4ADD7E9072938047FFA9EF27F92225EA02D1B1B302F5DB4921C39564F81", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676782, "uuid": "3f72f740-722c-4416-a15c-ca62c24674b3", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676782, "uuid": "4a232e71-93fa-48c6-842e-1bad8e843184", "value": "6144:owRVo+pqz1u4j8aPhZUQGy4rMvPecaHuPfCgWAMg915s+2MKXh:ty1uiZjQy4YXeaPfA385MMKXh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676782, "uuid": "bdc1d5df-8478-478d-8c02-96ddb3c91368", "value": 291895, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676782, "uuid": "44735659-cdd6-4900-9dc0-1b1a9d99e29c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676782, "uuid": "20237208-5b75-43ac-bbaf-8f8648e8781f", "value": "scan doc_o1022111234.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e534fd2-79d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642669745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669745, "uuid": "f084a270-f4b0-407e-8ff6-c56d918cd22e", "comment": "Malware payload (Mirai)", "value": "f3605bd96bf2d4f7706e3847ab9a4e7a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669745, "uuid": "f6eef488-70fd-4dae-b814-19d0a9572e57", "comment": "Malware payload (Mirai)", "value": "394ddff578548009a7642d65db42d3d55abf80efcb6b3225400c3a9113cfe8a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669745, "uuid": "414d5033-7064-4bad-927f-6972024d1f97", "comment": "Malware payload (Mirai)", "value": "e7310d135e57c79ad39e806fc468205caedf40c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669745, "uuid": "18c029f2-2478-4389-8594-391b861439cc", "comment": "Malware payload (Mirai)", "value": "ef4f459cf82d0b30d3c19200b608eef07f6110e2891b93f19e5a8c3ebef4b6cabd2b1d7a162e5bb27b35af58386b5022", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669745, "uuid": "fb5fb6f8-4d1b-44f7-97dd-6f43590eb143", "value": "T184632995F4029F3CF88BD6BA94170E05B921638547C30F2BA6A6FDA37DB3054BE25D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669745, "uuid": "e1494d21-61fe-4fbd-a304-b1a7d5edf408", "value": "1536:yKYDydkSp116PU4I58Ok/Tgp+nTuRbygNU:yKYD/S/1QUNM/xTwyx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669745, "uuid": "a11d2f9a-9bef-4e35-9242-ee279a9e635d", "value": 72332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669745, "uuid": "73b0680c-80b1-4a71-9170-860f3e6cda7d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669745, "uuid": "58f966a1-f981-4e7f-9929-7fce1f849e5d", "value": "gang123isgodloluaintgettingthesebinslikedammwtf.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b617f6b-79bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642661419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "ba3a40bf-b00a-4e2b-830d-428978d9bbba", "comment": "Malware payload (Heodo)", "value": "a11c09221c3e965d0a21c605ab1aec30", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "96a57610-653a-4acf-88d3-ceeca18baac7", "comment": "Malware payload (Heodo)", "value": "39ca9e52881d6d420be78136792aaa0be741cbf3c3e0042f18246bbc8c19471d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "c620eb7c-2745-458c-9965-d27d4bf48173", "comment": "Malware payload (Heodo)", "value": "755cba2b53136e558219ff9dfb13aa99dfdaaaf6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "6b15dcb4-2dc3-4290-87c2-2b7e56a1b7e3", "comment": "Malware payload (Heodo)", "value": "042cdf690cca2cd8265606108bf716693c848d1eda317be0726ca6afcc3c39e00e6122087c7446d64690daea48cfbd83", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "88f3f5a4-f251-4f5a-9336-0e8b3101c45a", "value": "T119C4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "59359d51-cacd-44cf-abde-7476ba539534", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "64d33896-7e72-4316-b285-5315ec25cd85", "value": "12288:P78OGF+L8/4UUNyrJdMhTq/n4vAzdkPs7:D8Ody4aJdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661419, "uuid": "c0aaca78-935c-4fe9-96fa-870b11642fe8", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661419, "uuid": "848eba3f-9fd2-4c26-8c23-8e78b2855008", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "aa2d476a-3fc3-4f9e-9b0d-5c50b4845ed8", "value": "emotet_exe_e5_39ca9e52881d6d420be78136792aaa0be741cbf3c3e0042f18246bbc8c19471d_2022-01-20__065013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e2a88e9-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660591, "uuid": "4b34d440-a4f0-4ec5-ac09-72a702a94baa", "comment": "Malware payload (RedLineStealer)", "value": "3d3acebbbe17c226e22913780cff2fcc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660591, "uuid": "81f8505b-72a4-4bd3-8813-85d010e22ba1", "comment": "Malware payload (RedLineStealer)", "value": "3a164837338491b3a7285f8f8beb5aedb15b42d2ad7359af19076d06c988af23", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660591, "uuid": "6147b096-8b02-4a38-ad17-93d919431fd7", "comment": "Malware payload (RedLineStealer)", "value": "6d1ae00e93048b2e5c1056fc0db64be62082e2e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660591, "uuid": "d823431b-df1c-4dd1-ae8a-ca1b0cbfbac2", "comment": "Malware payload (RedLineStealer)", "value": "53fc050a71760bfc4842454e15679aa649b2ef2ea560f33f9c620d409e9482575047b395470759c60e3455be6286b43a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660591, "uuid": "451c1d59-1cf2-4816-8758-9c519115db7e", "value": "T1E984E0717580C431C4832A324829CFA45ABEBE3959E5420773A43BEFAE363D1766671F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660591, "uuid": "fcb4456d-f05b-47a8-a86c-7edcbb9e02f4", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660591, "uuid": "d8142d0c-8920-4bfd-950d-7bf3efae4d15", "value": "6144:IQiL3t2YPZBDQRFeMnmsIb9HR2RIoeenDq6PFOx4gu6Tn:WR2YP8Rgnvwgi2PYGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660591, "uuid": "d5fef51a-3078-403b-8c68-6f2603d95ca7", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660591, "uuid": "bdcd42d2-7cf6-4a6c-8931-fd44bc84e47b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660591, "uuid": "4ee4b918-90dc-4cd1-b91b-6a58f7ff6163", "value": "3d3acebbbe17c226e22913780cff2fcc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0910e654-7a2a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708150, "uuid": "cb68a1c1-886f-487a-8691-9c59cc45d94c", "comment": "Malware payload", "value": "6b73040840cf675d89f95e643476ce10", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708150, "uuid": "12c5479c-7ac2-45ca-a669-ba6b0d5faea1", "comment": "Malware payload", "value": "3a650900dde9c97d1c23110b2b04ba2c5d861e48f05d894d1022e8875361869b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708150, "uuid": "9298c301-6d7e-4d7b-a061-96ba159ca14d", "comment": "Malware payload", "value": "04b5c30cdb12d2f271e7111bb1e3b7f25927642b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708150, "uuid": "73a55d87-0c39-4eb8-84eb-ecf7675aabca", "comment": "Malware payload", "value": "6cc10c9fe8b6cb95497eaf20bfed4494cb55ecf4809b90175d214fe08fc3b0aadc1ebe14e73908ae248e29e054318c91", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708150, "uuid": "0c4dd6b5-364e-4b7c-b723-f9b52a7385c0", "value": "T1E4F533902AC517EFDE096F39CE98F40E59840F7023486D34281772BF5B151AEFA5AAF1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708150, "uuid": "5d9bab92-9498-42e9-9970-792dcdae43a5", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708150, "uuid": "1e262c0d-a02e-4540-8cfc-817e5dbcc189", "value": "98304:pi9oOj1jq5AaIITkdRut3aWeck4H3C9YUtaBnfI:pKg5AKUEUa5fI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708150, "uuid": "425c1561-d28f-4114-9e38-ccacc6a3e2c6", "value": 3527680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708150, "uuid": "70dbf4f7-9d18-4695-bb64-efc6bc409362", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708150, "uuid": "81cfa05b-147d-4096-b100-b8c82e3ef7e2", "value": "6b73040840cf675d89f95e643476ce10.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "633b4ff7-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642668787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668787, "uuid": "a5f13c40-3a49-4926-9133-28f4fb51fb2c", "comment": "Malware payload (Formbook)", "value": "b7530ec9f1d5e9c8175a84b0b80c05a7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668787, "uuid": "8f544082-c4b9-4778-894a-b4508326e4bc", "comment": "Malware payload (Formbook)", "value": "3add41c98717984fa6f6d1bff7b1506024e2d91932b60a43810498c44daaef86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668787, "uuid": "7afec8a9-9ad6-46b4-ba64-4f93be91e6e2", "comment": "Malware payload (Formbook)", "value": "9428e3a0bcb6b26fd420e51ebba7c0cd434aa666", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668787, "uuid": "8a3d82c0-0339-49ea-8c60-0f4467ce0158", "comment": "Malware payload (Formbook)", "value": "e0e497bd5a7f91357813857473ecc007b6ec63f604860033452851ab617d0c9341d379066c787eee4d954501d0961ae0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668787, "uuid": "b2e5c405-bb90-4a98-93bc-add3f7c59a83", "value": "T110157B22F2918836D4271B394C67E7A955297E017E29FA477BE43E0C4F7A2C13919EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668787, "uuid": "eade5a4e-89f6-4671-b0d1-6a6eaa55f99d", "value": "d571f528db93ab4c8d72c51955dc7b93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668787, "uuid": "349356dd-b7e5-4a0c-99f1-fda5d3fd0aed", "value": "12288:wHFymIc+xnYsoAFlK/st03JMAIliAhojhZBYf2WZsOvVyW7T3bnvwM2:wHeaAFlKYevUBb2yyKT7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668787, "uuid": "83891e66-33fa-4fc8-9af1-c402a77aca64", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668787, "uuid": "6197e084-702b-427b-881e-9fe482a54e61", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668787, "uuid": "081c02b6-d35c-499f-84d1-f33391cfa068", "value": "b7530ec9f1d5e9c8175a84b0b80c05a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7dd1ae-79f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642685746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685746, "uuid": "8655803b-4ae1-43c5-a96a-1b574321c54f", "comment": "Malware payload (Formbook)", "value": "81f7488cffb8c7c5e99704ab86599e35", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685746, "uuid": "2ed7d45c-31b0-4a57-9263-38607a26763c", "comment": "Malware payload (Formbook)", "value": "3b0cb81251298bb9f51e79d9aec8212cba5cfd8f61b24ab9239ad130065c412f", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685746, "uuid": "66696606-db3e-441c-bd7b-0fb94acdbdfb", "comment": "Malware payload (Formbook)", "value": "41fad69fa007a44729c644da26871bd6d24f2ab5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685746, "uuid": "907938c6-99b6-47b1-8936-a64bcf68694d", "comment": "Malware payload (Formbook)", "value": "aaf708a6d52ffb6d59cf6b3e202507bf6f638019f51e3c5ccf5645e271842f9fd47177d04e14c19bdf23d83cf1a0b038", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685746, "uuid": "72994780-5db7-4315-b4c5-c833998cbf31", "value": "T19304125B72113332D57B91B21EEBDB088E54DF3CAF65828A05A03FA949F51499C332F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685746, "uuid": "177aa7a6-1f22-4b6d-ab39-425cf69304be", "value": "3072:E9x6iVc66NPUyqu4IQmPn4oDFIegg7Snht1ju/tgVgr:hiOnFUhm/BFIfgMjDKr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642685746, "uuid": "7aa7f292-0c89-4df0-ad7f-567047396d57", "value": 187032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642685746, "uuid": "dd21820f-f1a3-4cd4-a9d2-d8675c21126d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685746, "uuid": "42c6aeb2-2dc9-435d-a89f-7cd585bc03de", "value": "BOSFA Pty -Project File - PRICE REQUEST Ref#93801994 Australia.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b78af7-7a3e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642716759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716759, "uuid": "bc7b72ce-6d2c-4752-b550-71d262971439", "comment": "Malware payload", "value": "a94bd49bc8d8efb16fa2ba6ac7c9e6b6", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716759, "uuid": "acac9b19-3da5-44c6-b84f-02521379d762", "comment": "Malware payload", "value": "3b63534dcaf71bdf8293d2a3ce3310a02d2eda37deac68d5ccbdc89cfbc8f408", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716759, "uuid": "10fca8b7-ac8e-4efc-b28d-0d64b6ec3f50", "comment": "Malware payload", "value": "95940104c33b39598210b2e4da193101f0f2944a", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716759, "uuid": "e2a2d896-5103-46e3-a7ba-9f99cf7c172e", "comment": "Malware payload", "value": "2d475dbed688a3047179374fdc8a326ac10ea621e551f9bd996afe00cf2822b9e9535f99f229d63126ad9a86bbb28c7f", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716759, "uuid": "9e3a1906-8606-4ed1-a46a-58ef2612efca", "value": "T1C0636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716759, "uuid": "838e1979-f2f2-45c8-9713-ed6a5ea273a2", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642716759, "uuid": "49d995d3-1454-4473-bbe7-762b67be1c78", "value": 72227, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642716759, "uuid": "410c56d1-a3ed-4415-8bb1-907e34071bae", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716759, "uuid": "62f035cb-494c-41d1-90a2-5deb6af6fdb8", "value": "a94bd49bc8d8efb16fa2ba6ac7c9e6b6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a5ea713-7a2a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642708259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708259, "uuid": "148a8ab4-9d8f-4971-a48b-f6f71c5e693f", "comment": "Malware payload (Heodo)", "value": "cc6a5eca7b9c5260fe8f8342db014443", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708259, "uuid": "f0b3da20-218b-4a09-a7b1-92c1fe5f8bf8", "comment": "Malware payload (Heodo)", "value": "3ce617ed4d5a78ba123d6463b4c0c6b8e7ea29f0800761e9559c8bf182f21afe", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708259, "uuid": "74201d79-e52c-40f6-aae4-230f23b8de34", "comment": "Malware payload (Heodo)", "value": "6d227eb212e4066cb913848b2a4b05752dfc7332", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708259, "uuid": "0bf5bf4d-6998-49b1-bedb-470f1dfa2a69", "comment": "Malware payload (Heodo)", "value": "44ace30839d7a68021729e1b4bfe460169478f704438f624293d4338ed173f9364d22e147244194fee71f5ae182b72ac", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708259, "uuid": "70d6078c-be68-424f-9167-1c5fd10a8b24", "value": "T1E2E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708259, "uuid": "eb83b014-aadd-4734-b2af-218eea421a50", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708259, "uuid": "1774ac98-6c54-4589-b752-594bc49ab701", "value": 145957, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708259, "uuid": "396b2ee6-0748-4bf0-935a-15e2d3d9278c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708259, "uuid": "74fd1b1b-94c9-4307-9fd0-c40ea48b144f", "value": "cc6a5eca7b9c5260fe8f8342db014443", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32411fb6-7a20-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642703924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642703924, "uuid": "e11a0b60-0e9c-46b5-b979-7d78f8b17d88", "comment": "Malware payload (Heodo)", "value": "477881ed20ef976c6dd8bef21a6cbb67", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642703924, "uuid": "52e246e3-acce-4b95-80fd-a1afc60aa074", "comment": "Malware payload (Heodo)", "value": "3d702c221263341fa14edf51b4d239cc665e2db56c4d1a7c5dbaa80065f182ec", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642703924, "uuid": "7e76e084-343d-4d1c-af42-65ffd7186d94", "comment": "Malware payload (Heodo)", "value": "920553b109bdf631776409ccf1ea4caf8aaee253", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642703924, "uuid": "9b180bc4-9953-4256-9aa3-2d32d36b08a1", "comment": "Malware payload (Heodo)", "value": "12318e2dda7e84d3471d08a10bbab5e108ea1dda11c5876b8bafc521728702626f363b6f5c0b648b80ad35b2b2223ac1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642703924, "uuid": "2c50e9be-7e6d-47d2-9245-980905f15c3a", "value": "T101E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642703924, "uuid": "1d21c91b-da55-4240-bf1d-f9eb59010364", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642703924, "uuid": "ad79b3fc-755d-4a56-b15d-2627a3ea7e19", "value": 145475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642703924, "uuid": "17d1d0ee-9a0a-40b4-af56-fe4a4cab6890", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642703924, "uuid": "dc5f3f0b-b669-4aa5-8be5-a92f3089bde1", "value": "477881ed20ef976c6dd8bef21a6cbb67", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c6de31-79df-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642676276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676276, "uuid": "647968fa-5d80-4af1-8412-63958a6ca8b0", "comment": "Malware payload (AveMariaRAT)", "value": "8278f2ca8414a985705f30669079fdc3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676276, "uuid": "bd80e53a-75cc-4662-9f59-ebf1c14ee89c", "comment": "Malware payload (AveMariaRAT)", "value": "3d8a089bef3b81470f2929bffeb1e2bd44ca72d7fb549c0381b83689c74114bf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676276, "uuid": "577e8646-dcd1-4db1-9334-e2ca5c463181", "comment": "Malware payload (AveMariaRAT)", "value": "69982a4874225f98be9f42d716fb91fcf1e0f790", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676276, "uuid": "4adc64ef-b52c-41b5-a858-6bec4aa7b24e", "comment": "Malware payload (AveMariaRAT)", "value": "84c4a31afc13c269ed0c2913d0035fdf82f859a83aa33690d76866f1642e2d6bf57fd4319d8eba498fea6849c69bfcb2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676276, "uuid": "06eb40c0-a1e3-469c-93e5-c47f86edc287", "value": "T1D9740110B3FA676DF6AA87F5A571905043BA7A1B2632D34C0D8670CF2976F429352B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676276, "uuid": "39f6a030-441f-4d04-bb2d-2f49cc0ed6ac", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676276, "uuid": "d3a5133c-ae8c-48e5-a639-99e9c1c72043", "value": "6144:ScztA5LF3n1tek9/fNDP0HPftSrQRXrGnZ8uAUKfQ9lMAmk:bxal1zfCHPftSMRXYZ8uAUaQ9lH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676276, "uuid": "bbd2f2a6-308f-4aa0-a63c-3acc540c6100", "value": 353280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676276, "uuid": "baee812c-1d99-45fc-a5cb-1d47ccc02840", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676276, "uuid": "21cd8d38-61e7-4bf2-a315-a3fb0abeec0f", "value": "8278f2ca8414a985705f30669079fdc3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6449becd-7a03-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642691552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642691552, "uuid": "189931b8-4588-4d72-9d96-a00a0537e13a", "comment": "Malware payload", "value": "2d4991c3b6da35745e0d4f76dffbca56", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "moonbounce", "colour": "#3A5BE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642691552, "uuid": "c06d0867-298a-4a4f-9b8b-b97cf7d8aafc", "comment": "Malware payload", "value": "3dacf5cd40090a6d011f1e522eaed2d29699b9d892ce122ea406e0c9d03d5d2d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "moonbounce", "colour": "#3A5BE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642691552, "uuid": "d1770378-881e-4370-9c76-cbde5d1a5d16", "comment": "Malware payload", "value": "61340c41787d16b753598670de2cb1dcf50718c5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "moonbounce", "colour": "#3A5BE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642691552, "uuid": "6247f5fd-f3dd-429f-95fb-3305821ba78e", "comment": "Malware payload", "value": "ed909e47e2f8e3119820f4809f7a8318a442a86a93870305f5d753ff5c80a9316d159f589ca56cfb9e670f43337e56c9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "moonbounce", "colour": "#3A5BE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642691552, "uuid": "facf0e0a-340b-4aed-aeb8-f2544268bd39", "value": "T1D9855B5B67A41078E06AC276CD976F36F7F3784A8260870E17B0C7AA6F237617619313", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642691552, "uuid": "78e60bbd-bdf1-46d9-a74b-858bf09ad4a4", "value": "6144:kmfAXkTibUcmTQo1GLvCJpazpEWwrbzM0KI6dh:kmmkTuUc9oALvOaFdQzM0KJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642691552, "uuid": "3bfcf074-360d-49b4-8dab-472c3dcb46ee", "value": 1738768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642691552, "uuid": "f3b56666-a019-4ea5-b07c-e9eb96e1fba8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642691552, "uuid": "0bf20d8d-255b-4574-b411-dd76bba07608", "value": "3dacf5cd40090a6d011f1e522eaed2d29699b9d892ce122ea406e0c9d03d5d2d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fec1212c-79db-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642674632, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674632, "uuid": "a3b3e5ac-aac7-4739-9231-c3e6e5028ebd", "comment": "Malware payload", "value": "a9cd7de5c764b04249512746c0cbd2cf", "object_relation": "md5", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674632, "uuid": "38bd606a-9842-47e1-8fe2-999c83927b2c", "comment": "Malware payload", "value": "3e2b5487258a8ed50227b64178021b7a41c48b3591d98d911036a09e04c6ec07", "object_relation": "sha256", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674632, "uuid": "be7390bb-552c-4cc6-a873-ee21a9732f94", "comment": "Malware payload", "value": "559f112e3f8b0d7d1c7de644a910a309a72c57d4", "object_relation": "sha1", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674632, "uuid": "b78043eb-e5cf-4c10-b465-2c502c7fab90", "comment": "Malware payload", "value": "22f3c3c8c33008e9dd833d408283b40e45cfd3514acd2976e84b95be61305fd0d2adcdf8707597738e645372b522cffe", "object_relation": "sha3-384", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674632, "uuid": "3948e9ad-c708-46ad-9ddd-f56172079707", "value": "T108016D36E02DCD20C42D5789416712A9B69BD347E96204865D148EEDE18B3AF74E8B86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674632, "uuid": "d666fa11-9c1f-42e9-b1f0-0f4df1e263cb", "value": "24:QDKmVP4rrVkDQFGAkc4rHFGGr4rR4e4r4sN4rbv:dMvmEcszr66N+v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674632, "uuid": "b0c9b74a-805b-45f4-8a80-19fce1731c58", "value": 785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674632, "uuid": "d4920700-6193-43d2-8556-ace13a17b083", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674632, "uuid": "09d7b1d0-e1a4-4d92-a495-099be0d0c6d3", "value": "activator.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c2035dec-79d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642672382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672382, "uuid": "a7fbd104-4183-4c91-b66a-01432635b176", "comment": "Malware payload (Mirai)", "value": "5241bc5d17b7be105e1eae84b4b32d27", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672382, "uuid": "786075a4-b9fb-4e40-9518-d5aac57b4ea5", "comment": "Malware payload (Mirai)", "value": "3e360a875e269f4d20576b655fb7c7470f78746f9fb89e1b5edc0ef9fd9e0055", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672382, "uuid": "b699ce96-9865-4bf5-aaf0-f6265bb7c403", "comment": "Malware payload (Mirai)", "value": "7325b23a2ba2522aadadfeba9507197f02061784", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672382, "uuid": "cbfaacad-be8b-4992-85b5-9c74a51137df", "comment": "Malware payload (Mirai)", "value": "b8604788d8762ee640f4b4522fc05292c2d159e81b0945c4dd471cb83596ec6b2aa566937ac9672ff2e3495d3c7cad24", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672382, "uuid": "bb7b30f8-adb9-4ddc-8751-95628ebb89f1", "value": "T1C7649626E60145B2E15809F1356623D87E9A43BF9E6627C3E52E49B4FF3281F01F9DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672382, "uuid": "fb4529f3-9ded-4e53-885d-6a2dedf5ee09", "value": "6144:CeLa15sQjJmMXdZCSpn0UpQKqUgAZ08kjUYxsqyfUkmhxQwoVSUNu:CuagcmjHxrkmhx5oVSUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672382, "uuid": "45c91e4c-9783-4b04-ab80-96afaf6e1835", "value": 327339, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672382, "uuid": "45b554dd-3770-438f-950e-5b59fd14972f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672382, "uuid": "dc8a43ef-d26f-4110-ba5a-de61e0d58f75", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db3bf193-79ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642667271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667271, "uuid": "bf792f56-b0fa-49e2-8505-f59390c102b6", "comment": "Malware payload (Formbook)", "value": "238fa7f1204998f7b13571649e15508a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667271, "uuid": "a721be9f-99b8-4da0-8604-f7a5713959fb", "comment": "Malware payload (Formbook)", "value": "3f76d69c552a61ab3d1207fb64ac3aecf812e98f99c5413a9472d59859c38077", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667271, "uuid": "96358d24-824d-477b-a1bb-b2c8520859fe", "comment": "Malware payload (Formbook)", "value": "e130539aee3a44c1902016476eb9f4304976aa4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667271, "uuid": "54cbb468-4eef-432d-839e-5da2366d45f4", "comment": "Malware payload (Formbook)", "value": "dc041e237aebb3cd72fb93f090a19f328642af94a63fc8edbe7bd02058b572123a08883552682e2c2a094e11d42b7307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667271, "uuid": "1840a053-1f93-4968-8987-311edbe6eb2a", "value": "T10F54121F33F28DF7E1978A3537EB8B65C2F586531651CF0B8BB04BAB193009674AA251", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667271, "uuid": "14d314e0-3062-44f0-998f-17edded8f721", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667271, "uuid": "faa67b38-2016-4f90-ad80-f7c20c3e3161", "value": "6144:owg6hnnFm7ryptMqajgeILsNgpzZND/YKix6WKtfG:r1srSt7aIQNgFm6WgG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642667271, "uuid": "9d7507cc-0681-483d-bf91-b7bfe1a56827", "value": 294260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642667271, "uuid": "563408a4-5e17-42cf-b164-2d4e0da3bfcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667271, "uuid": "13d66375-a891-4ed9-ba93-eafa388338b7", "value": "MV ULTRASONIC_PDA$62,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52ee8ac1-7a2a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642708274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708274, "uuid": "2868296f-f1ef-459a-a4a9-0a1ea3525d25", "comment": "Malware payload (Heodo)", "value": "bf9341df1bbe722eab536c6a3cfe84a4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708274, "uuid": "106a405e-6242-460b-992b-6fb5dcd8b6f9", "comment": "Malware payload (Heodo)", "value": "402b387ff9eaca12395e5ea30d7252c77d49ce1d1478784bdb329641136043ea", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708274, "uuid": "14e14cb4-b760-4000-84d8-3c4ace1ba270", "comment": "Malware payload (Heodo)", "value": "246ff3282a422893e42ce8e3a24a9a6f9e3f7072", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708274, "uuid": "59e909f3-58d6-4e3a-92c7-d4762542be6c", "comment": "Malware payload (Heodo)", "value": "3c838b6b55616e3ab8177a518f9199b00f32c2999537f0fd5017bbdac6670801d7a2596ce4da7b2d00dbc62f159f1c14", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708274, "uuid": "13d4b559-2d19-4e0f-bf98-aeff4cab5c6c", "value": "T13AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708274, "uuid": "9cfca828-e173-46b3-b314-7acad13029a5", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708274, "uuid": "3ff0b7eb-2cac-48cf-9fac-36b2ebc19161", "value": 144566, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708274, "uuid": "c0eb6436-2c13-4eb1-b460-77c002be608a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708274, "uuid": "1412a22a-48d4-4c9c-9851-6ddb1735c3c8", "value": "bf9341df1bbe722eab536c6a3cfe84a4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019a13c0-79bc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642660892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660892, "uuid": "ce6182c9-736a-47d7-824e-dd369dbb5849", "comment": "Malware payload (AgentTesla)", "value": "e19c2e9615ca2677ff0287bbb22e2c54", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660892, "uuid": "1c79fe4f-81a9-4f0a-bfc0-0a52056bd4d5", "comment": "Malware payload (AgentTesla)", "value": "40377b591fa7972e83ba524c278f2184049b4062871e86f9328a2235cee03c13", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660892, "uuid": "0e1fc9f8-8a45-4f64-bede-0657265584ad", "comment": "Malware payload (AgentTesla)", "value": "9eb84f16b99a3aeef5f34302fc3972d64d24acbb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660892, "uuid": "c04ee606-18d9-4992-83aa-b923a6ec5d76", "comment": "Malware payload (AgentTesla)", "value": "c9a16fb51ac7909a0691f002108f67b469d1cead291cdb5b7b9b107e154f281d59a053c1776be95c61dfe64df41e88d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660892, "uuid": "46eeb27f-5c77-4e61-b631-01e9a412c88b", "value": "T18EB4238E132C86741DA1A7AE1517DA822703E651FF77CE48E3C7B6FA4E5085A23141FB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660892, "uuid": "61aa13ad-ca20-49d6-89b9-5a31eb9b27b6", "value": "12288:jOA/7kXD0SfJpd+yj7bu4IVmovNYCFcPwQEiWSuoHWok4zzjYw:jOA0F6yvtIVie00MWo9zf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660892, "uuid": "f7d37f5c-2075-4903-8646-d4ed42059e3d", "value": 529412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660892, "uuid": "a6f8a832-61b9-4cfb-9146-a0937612ef12", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660892, "uuid": "5eab7e96-9d35-4405-8273-f2b547caad6e", "value": "PO #7A68D20.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c62cae42-7a27-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642707178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707178, "uuid": "dd1b1a70-4d03-446e-8c36-15116b2b2394", "comment": "Malware payload (AgentTesla)", "value": "053024486c77e8897f357e7f5e6ac98a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707178, "uuid": "28274d7d-dda7-4532-9c82-477110fe30f6", "comment": "Malware payload (AgentTesla)", "value": "40a96f12e9f876806c1f6e1debdcb4acaad09d65a29b302ab803978457af4118", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707178, "uuid": "c93d847c-e190-418e-a52c-7df4fc269dca", "comment": "Malware payload (AgentTesla)", "value": "db523121f7ff32284b44e32e80fcf73a95824528", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707178, "uuid": "cda7ca45-2d66-4472-9cd8-8bc34e1be54d", "comment": "Malware payload (AgentTesla)", "value": "01e1342122f5ec484cea9f8d184903d8b0872dfa9426e5dc60f476e90d6e29d920c2f93f7d9d870e8971cca977649e76", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707178, "uuid": "fa28f146-f76d-4848-b3cc-42444dd7114f", "value": "T15794024477F613ADEDBA9BF4A531101113B97A9E3122E72D4E8530EE0972B814B61B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707178, "uuid": "f5591a00-5b8c-4a71-8527-8c6b05cd99e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707178, "uuid": "87420896-4bf5-4aa8-a5fb-171f582e0ffa", "value": "6144:c2rtLF3zIURET2wzaMZSTFcbf5Lpm5hI0jPX6d70abdGOe9PaNeLKZ3Ug0au3j1/:J595ojeLTi1lJ0bq90aQOVKCUzau3hU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642707178, "uuid": "23c9fe8d-f570-48c1-b721-7b767603352a", "value": 444416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642707178, "uuid": "27cacdc3-5220-4adc-8157-5610d2eaa5c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707178, "uuid": "c3badc56-21fe-4ff0-ad56-d3d205199a53", "value": "053024486c77e8897f357e7f5e6ac98a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20bb8346-7a10-11ec-9275-42010a9c0029", "comment": "Malware payload (Pony)", "timestamp": 1642697022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697022, "uuid": "94a86980-876e-40df-a267-f78f467a5281", "comment": "Malware payload (Pony)", "value": "c509c11adc8929e2a932b4bda1216791", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697022, "uuid": "78a9a6cc-8efb-4add-b097-6112884d7bd8", "comment": "Malware payload (Pony)", "value": "40d656064f338170882f2de5b2983bd751d102c5986a84ab6a8bd6c61adbf0fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697022, "uuid": "54339748-7ac6-48a8-9b6c-05de5e20a86c", "comment": "Malware payload (Pony)", "value": "985cf44ab37c06fe2d544cc350210e4a65eb3136", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697022, "uuid": "ff44bec7-651b-470a-85d3-fc59ec8e8afa", "comment": "Malware payload (Pony)", "value": "9718e1484fd77a1427190e7b53d093b459b9dda75dad579105d9f18ea9d481c1f1bb48d37cb2cb67975f6eaa2bfbf6c5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Pony", "colour": "#E64094", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697022, "uuid": "defc8fef-a75a-46f0-a937-aabee347e66a", "value": "T1FC142A21F828989DF102BD7029BCB3695208ADBD0111A937FDC97B5A66735937CA1F0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697022, "uuid": "bc0d8e48-39c1-4ed7-9780-8ea486e923ce", "value": "49b15580bd181e45d4d97bbfb270c139", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697022, "uuid": "cf34533d-a9a7-43b8-93c1-ed91c7b7dc23", "value": "1536:KPtYJcwwFEoayOqBc945nRVUCHKo024feE1c1BykFXP5vA4wlIi9yHD9:Ncwwja6c8RySue4c1JXxR/iKh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642697022, "uuid": "0262064a-4969-473b-950b-8f5cf17f12e9", "value": 202416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642697022, "uuid": "6dd33e3b-2aab-4a76-81c9-aaf51e4cf14b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697022, "uuid": "a287285a-bccc-47e8-9f9d-cc6f8479e33c", "value": "c509c11adc8929e2a932b4bda1216791", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abdf9c4a-7a22-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642704987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704987, "uuid": "e218c015-af6c-45a2-a66d-ceef2c387cb9", "comment": "Malware payload (Heodo)", "value": "6bc0b98683ab73b9b80a2393bfd1fe2b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704987, "uuid": "4b018f89-581f-4500-b944-7bdf6fcc59b9", "comment": "Malware payload (Heodo)", "value": "40dd74fb1fba55980387dff7f457cfee8778be09fd503bc397f747bd97d82ffc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704987, "uuid": "e68e96a8-4cf5-4b2b-b287-eae54d31cff6", "comment": "Malware payload (Heodo)", "value": "0587d2d7d5a63ec62d7f79c144bbce0e1c8339d2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704987, "uuid": "0226ab6a-0f06-454c-8e89-f388648832ec", "comment": "Malware payload (Heodo)", "value": "d3fd2f1a3f2dd5c7a92ba14eacc4fe89e6010317c2fe1f5af4c55253ef9fdfd7b8113aa9e83bf4a5f94e62c53d4658e7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704987, "uuid": "a162898e-0fff-4c0f-be4f-272a3b709b5a", "value": "T10FE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704987, "uuid": "995d6f90-f7f6-4248-8d11-6d71cd163001", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642704987, "uuid": "caaf39ca-2f39-4207-9842-13ad37bbc146", "value": 144520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642704987, "uuid": "a8426d93-8721-4fe2-8260-fd3477546d70", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704987, "uuid": "0f5dde37-12c1-4fed-9915-8a4a195daa55", "value": "6bc0b98683ab73b9b80a2393bfd1fe2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac68d082-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660750, "uuid": "229b4288-1bce-4b55-8b85-023bc7ed6541", "comment": "Malware payload (RedLineStealer)", "value": "112d384ad50c94c882f72c0d0ae34025", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660750, "uuid": "f083a547-33b8-4acf-a933-9917fd743a4a", "comment": "Malware payload (RedLineStealer)", "value": "411c9cb6eaa4ff1924fd1d595f534195c38d3392fc161bab99efc30f0249e22c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660750, "uuid": "0cb2ff55-9d93-4b08-a73a-56c37cbed59b", "comment": "Malware payload (RedLineStealer)", "value": "6fcdcbe64473f9f140c3f3f1c1f8a29da50ed84d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660750, "uuid": "e88d9f25-435e-4653-a5dc-3de7c53fe787", "comment": "Malware payload (RedLineStealer)", "value": "41cf9bb74d9c5b18af540be7c92058009e08be8e7b481e92d3670987673ca49de32230980dd32f53fa6fe5868cb30746", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660750, "uuid": "04564d71-3501-4f28-90b5-d6686be24546", "value": "T1D4F5338867AB763EEB4C43766DA17D363BA3638825BC5441F1099302438D39396CE6F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660750, "uuid": "5678271f-553a-407a-afb4-c2effce0d439", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660750, "uuid": "588f0334-3a29-462d-9e2b-ec1e725ee074", "value": "98304:vxYqnwZmw0GUOGdK6CpJgNrOcjjxDZpFWyCOq:nwZmyUUbnErvxD3vM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660750, "uuid": "a35fc948-1fb2-422c-8950-50731bcf4707", "value": 3602224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660750, "uuid": "12de13e5-5e24-4322-9a47-2c55db1adfba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660750, "uuid": "72907648-65b1-4fa7-b633-1bf25a75eb1c", "value": "112d384ad50c94c882f72c0d0ae34025", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0a6a386-7a2c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642709370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709370, "uuid": "7f53d355-cb37-45b4-8502-6c41ef4660aa", "comment": "Malware payload", "value": "c48f84d2b6924b7f7f18e34c5bdac5ee", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709370, "uuid": "011cab26-6111-472a-a1c9-4aef8ed9c5b1", "comment": "Malware payload", "value": "412a893bacdadafb41008f47f9136c63d951d30ce0349f6a478e652291c49231", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709370, "uuid": "dac72adb-5ffb-495f-808a-4b3d8a31ad2a", "comment": "Malware payload", "value": "77d6fdea5af595b0b4148f2b5876c58b48772f26", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709370, "uuid": "6636a630-223c-45de-98bf-440cc9971734", "comment": "Malware payload", "value": "2ea2156f02a3a4f19f2fb1b029e0b0d299bab92c308dc160ce952db69bb52b7547f75c8de9d945e29ded7bf39af3e32a", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709370, "uuid": "f1c584ac-8c63-49f9-bde3-a5e213b47e75", "value": "T12A565C1BB5A318FDC0BBC830875FD6B2A97078984112797B76D49A302F27F605B2DB91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709370, "uuid": "5599daf5-f517-46a8-94a7-f4a0eb017dff", "value": "98304:5+pIxtRKq6YryYjvmUyy++++++qq++++u+uwP5R5R5VYjMYjMtpuVE8OLqjbOqwz:5jtAq6+c/zTVVk2Y2O7TI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642709370, "uuid": "47b65afc-f94c-47cc-ba7a-b7ae07e8057b", "value": 6420072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642709370, "uuid": "6f7ded5e-cf83-4f90-b2dd-630404752d3c", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709370, "uuid": "934d8e6c-bd56-4796-859b-148cad29829b", "value": "x86_64unpacked", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e5b246-79fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642689213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689213, "uuid": "748c9ac0-c68d-4c23-80b3-01ba756670f2", "comment": "Malware payload (Heodo)", "value": "cfa956119b8673f13842951adf49f5c1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689213, "uuid": "cae00fd8-b45a-42aa-81bf-fdac67d73d6c", "comment": "Malware payload (Heodo)", "value": "417bde625790c8bb2b5a6bf8f3e0c5abda0e540c5eab3af803953e22754b0ef1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689213, "uuid": "5de74c89-ce67-4e33-adcb-11ddeb93347e", "comment": "Malware payload (Heodo)", "value": "11cbb5b979e03d230318c049613ef5eb446311b2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689213, "uuid": "1a6a4619-0b05-4259-8339-b019350ba663", "comment": "Malware payload (Heodo)", "value": "09405a2b2e5f215224d69df36ca3723b5ea1a53b4263d7d9407375a3a540caab0800a8689906c77274010560ea090976", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689213, "uuid": "432dbbd9-23dc-462e-97a2-3db44c393fde", "value": "T10FE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689213, "uuid": "2cd678bb-5466-46e9-9b0c-c58b6db25d9d", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689213, "uuid": "e3289526-4d2f-4dc7-af4a-4cd0f0510ee3", "value": 146290, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689213, "uuid": "51a9aaa8-e4ed-40fc-b505-8a4e10efc4a1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689213, "uuid": "bbc84397-d78c-454b-8d75-4206bdc93078", "value": "cfa956119b8673f13842951adf49f5c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1007f3ba-7a10-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642696994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696994, "uuid": "fd90346f-9601-4648-a36c-88f5c3072f52", "comment": "Malware payload (Heodo)", "value": "ebe3dcb48c99aa1130c4465808a7ca84", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696994, "uuid": "0d02ede7-3c0e-4bb5-bcc5-9a20d5b45f03", "comment": "Malware payload (Heodo)", "value": "41c2b1beabd5c1bd872e8542a5be9e4c3122b581f820b19269d3f47b55307608", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696994, "uuid": "caff21cc-4c13-48c8-904a-4124400f0dc2", "comment": "Malware payload (Heodo)", "value": "4c19497068ed82bf1984143d684617bd9bb6eb23", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696994, "uuid": "467f7108-b165-4b5c-b1cd-c2ab1bb96534", "comment": "Malware payload (Heodo)", "value": "03865dbc0d87c9e256f5702c833789a2bb9579dc1441037bf3a78cc00678ecfea0ae83aaab3d73fdd9db7a2211de6c97", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696994, "uuid": "9a60398d-d11c-450b-8879-9d644e0164fc", "value": "T1D1741A9EA104DC32EFFE63F151E5CBA3C05B9430275845AFE7FD91761A3CA989238582", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696994, "uuid": "c9d97ab6-6e74-4695-97c3-577e4ae249f2", "value": "7f57698bb210fa88a6b01b1feaf20957", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696994, "uuid": "eef8fa7f-c352-4cde-b6db-8b13b5fa4467", "value": "6144:cNU5LwA22222GgngDrDRVyYli/ci2tEGW78ODQiEBtvOt:x5w7YM/cYVV7EO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642696994, "uuid": "100ba19d-b148-4586-b0d1-e14b068c2315", "value": 359972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642696994, "uuid": "03bb80f3-3165-452e-8d06-f60ccee64bcf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696994, "uuid": "0528d646-d5d5-4efb-be19-363141fa54a2", "value": "emotet_exe_e5_41c2b1beabd5c1bd872e8542a5be9e4c3122b581f820b19269d3f47b55307608_2022-01-20__164308.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc62cd06-79da-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642674144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674144, "uuid": "6321005e-5627-45a0-ab65-62e91bfd186b", "comment": "Malware payload", "value": "3155a1b31b0f3bf95bcaa4fac879ce83", "object_relation": "md5", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674144, "uuid": "287d724d-9fc1-4012-a91a-507bf2be7b7e", "comment": "Malware payload", "value": "422bb486a15b970229a18c05e36a096dc97da3f5fe6b5a3b0b95e4752a6ec129", "object_relation": "sha256", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674144, "uuid": "82e1a1aa-240a-44d0-b628-30873324f245", "comment": "Malware payload", "value": "e66ac432698104226fac535c0e27d05d6b3382d1", "object_relation": "sha1", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674144, "uuid": "9610dcc1-a70e-4997-97bc-08445838d63c", "comment": "Malware payload", "value": "9367b40eede37068fe549c2620c17ca781c44b5cea3b3f69f5f12a62867910a2967da1321d94332c9dd7c4140fa3bcc1", "object_relation": "sha3-384", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674144, "uuid": "9c3394e6-9491-404f-8bac-d54911d5a28a", "value": "T19E2462053FE4E0A6D066263ADCA5F3C869BBF8B0BD71871F35851B9E8D316508C647A3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674144, "uuid": "e62ca96f-9505-49cd-b901-5d7ef8c80614", "value": "3072:BQY9KSO7EYUeOz1MpU6zZT/LhqrbG8Y5fIEsBiPRVl6tPUyyWZlrwSJ:JR7eCv+TLkG84IEsBiRuUyysOE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674144, "uuid": "3a3cc9dd-55c8-4384-853f-6f5db7b148dc", "value": 230000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674144, "uuid": "7d4cc685-6fa8-40c6-b594-808d17959cec", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674144, "uuid": "9e8d1f3d-d8ee-410f-b7e1-3862937b4517", "value": "test4.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e2b6fcd-7a3e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642716748, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716748, "uuid": "577d92bf-d9f2-4d64-8277-b6f305bfff59", "comment": "Malware payload", "value": "283ca17b8df03a554fb8d402c8064c33", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716748, "uuid": "84228be7-1199-4302-8bbc-45a6ba60a4a9", "comment": "Malware payload", "value": "423c9fe2d7c27c2f91785e754d0281d61626e45074695a9ad965ea73bba4b93c", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716748, "uuid": "f6a879f6-fe16-494c-b203-2a5673dd286b", "comment": "Malware payload", "value": "b438a0342a82e7bd20aef4423b90fda31a7159ad", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716748, "uuid": "1155c8e3-66a8-4d22-a7aa-4c280c330f6a", "comment": "Malware payload", "value": "750bc964c517de6dc016fbf758276ea1c352e68d780c682dab7b9cebeaed1dcda20b9985b306bf7eb12b9d7f5dc4cb7d", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716748, "uuid": "94bab665-6ea8-4afe-a597-891953fbd784", "value": "T197636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716748, "uuid": "2d24d655-1756-4cd5-8843-f08a8ba4939a", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642716748, "uuid": "b520e41a-675f-4da8-ab22-cd70e8aa5ff7", "value": 72649, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642716748, "uuid": "a7c2c316-5759-46b0-86e8-01c597032e55", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716748, "uuid": "9b77b054-dd0f-47e5-bba1-c2bbd010c0c9", "value": "283ca17b8df03a554fb8d402c8064c33", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be5edccc-79c1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642663357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663357, "uuid": "2044b0c3-589e-43e4-acfb-8e8afa9bd668", "comment": "Malware payload (RedLineStealer)", "value": "e63f76862cc7045977c6f6869c68f2c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663357, "uuid": "34079a36-204a-4016-b520-80bf27850dde", "comment": "Malware payload (RedLineStealer)", "value": "4256fe966bfd443f9b41d476f77cee30922d695f5e090910709c1d5971e0103a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663357, "uuid": "6e2a8902-7969-4f0f-b769-411fe2442145", "comment": "Malware payload (RedLineStealer)", "value": "b9c4e1b7da8c94aa4383c59da8dffbed6cb21a8f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663357, "uuid": "ae3aba38-9b18-411d-8e0f-622ebfb78552", "comment": "Malware payload (RedLineStealer)", "value": "ec08a35a463f28dc40e6caec48c8979e1291366b43eeb7dd1b43a921162ab08eaf2a260c3053b61532a687f9d3944aff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663357, "uuid": "6bec9585-a43f-4979-a806-39982a30c593", "value": "T1B284E06135B0E431C4B55A70482ACFB05BBCFC306968C68773A4FB5E6EB12C2566B25F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663357, "uuid": "c65f2455-dff2-476b-9bbc-ca231332f0ba", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663357, "uuid": "73b103dc-bb9f-4533-ae00-2164038b5644", "value": "6144:kVYLPT2YeSIDS1BLX7AdRHlX3P2tuEy02aU7pvKKp9oP:rn2Yel2XRIDvKKkP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663357, "uuid": "7f86b22b-0053-4a4e-9022-ed2753261db4", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663357, "uuid": "d7e089b2-5a24-49fc-a336-2d317c24d5a2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663357, "uuid": "8e64d4e5-851d-468e-afee-26e0aaa12d27", "value": "e63f76862cc7045977c6f6869c68f2c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15b9af3-7a4b-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642722605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722605, "uuid": "193fc515-cfc8-401f-aa0a-1cd49f01a792", "comment": "Malware payload (Gafgyt)", "value": "4a01f6c1d52e7fc969a77ec2adc3cb1b", "object_relation": "md5", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722605, "uuid": "3e6a2b43-e0bf-42fe-9b8c-31cd5591e245", "comment": "Malware payload (Gafgyt)", "value": "4266e6c2db9c6a319372df6ab28f22773b15c447ac5906803d25f86cf418ebd6", "object_relation": "sha256", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722605, "uuid": "6456a597-d2dc-4f34-91fb-2083f9b009e5", "comment": "Malware payload (Gafgyt)", "value": "9e72edff4c7a27cf5f63be239ec2a4b1aa358f5b", "object_relation": "sha1", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722605, "uuid": "96760a7d-5e08-4a71-b628-324b0bf94851", "comment": "Malware payload (Gafgyt)", "value": "5266a9a2e5d8d1a7972cec15c7d30ae7e6c4b3654d2928bd1f43876b7eb9bce7483c31b680bb9068070d1007eecfd848", "object_relation": "sha3-384", "Tag": [ { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722605, "uuid": "c5a29e5e-41ed-41e4-8560-49dfa2c39d43", "value": "T11DF3F648FD44577BC2D327FAEB9D038E37361AA867DB33119A344EB12BC17986D29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722605, "uuid": "eeaa9564-7ca9-40cd-80d3-a4191b4bc634", "value": "3072:UA3hTMYCjeqWD05hUQpe/Dj3uhU2Rm/KqQYbLcGOj1tq:/dMYCje9Q5hUxDjmPRm/KqQYbLPOj1tq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642722605, "uuid": "5bd7d3fe-f67d-4f91-bef0-516847b5fb8f", "value": 158153, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642722605, "uuid": "966ef4dc-d649-4df2-a05d-3625c53d6acb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722605, "uuid": "c5a177cb-adc3-4215-912f-1f9e8fa06aec", "value": "daddyl33t.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba2fe114-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642660773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660773, "uuid": "bfc02a32-33af-4f77-a5eb-ad2743ba7aae", "comment": "Malware payload (Heodo)", "value": "04b006830db46bac4dd4ef853791698c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660773, "uuid": "7787f606-a3f6-4f24-814c-4812a978b4c0", "comment": "Malware payload (Heodo)", "value": "43a573dc9dd0dc79dcf228467e8e6820f4a4f8bf344660ea43eb11bb7b3c93f7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660773, "uuid": "78779187-29a3-4778-ab22-7af28f2670e5", "comment": "Malware payload (Heodo)", "value": "dac03147850b30ec401e7cd4e28171a2b6868899", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660773, "uuid": "a59513f0-fc39-4b5d-9ed1-f2a429f6c3ff", "comment": "Malware payload (Heodo)", "value": "b460b0465312db269c260e263711648467e1dd2b7249d4e2c6e5af4ea9fca15f972a51dcbf2821b71a45f966ae692a4b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660773, "uuid": "d42fa9a1-0cb8-4691-abb1-9907d1aa6d1d", "value": "T19DE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660773, "uuid": "a15f55aa-ee25-4db3-9b36-8df0c5274b9e", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660773, "uuid": "aca76baf-642e-42c6-a35a-9f5d115351bb", "value": 145448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660773, "uuid": "76777bac-4929-485f-a8dc-1d7bb6c97862", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660773, "uuid": "be7a4ebc-097e-48b1-a838-3157043b0b9b", "value": "04b006830db46bac4dd4ef853791698c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182514bc-7a0d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642695719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695719, "uuid": "deab4a6b-8f6f-4af6-864c-51c237b75a20", "comment": "Malware payload (Heodo)", "value": "7589cff39cb4e8d100660f46cd53475b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695719, "uuid": "8c54a1e5-259b-4ef2-88c2-0e2c3174e52c", "comment": "Malware payload (Heodo)", "value": "446673c01480c79b21b7725ee529350f4995cc39532a324b01b61b352f50ab60", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695719, "uuid": "6b2d1c20-ae06-427b-92c5-83540511922f", "comment": "Malware payload (Heodo)", "value": "4de8ce8dc34d5b981a4398f7671025ee2ae769e9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695719, "uuid": "92ae3205-3e27-4636-9705-99908d7a76d0", "comment": "Malware payload (Heodo)", "value": "584ba5d1e02d1b5e8a7202a194295033d827f831ca15ef154d53a52cf66f3a1106e400c1d23db8030be5b74d9d14ad14", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695719, "uuid": "1a85e71c-d95f-4d2f-ad57-ad3d2e45f95e", "value": "T1B4E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695719, "uuid": "e543629f-2219-4f7d-bb73-4070559bfe16", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695719, "uuid": "367dfd00-748b-4baa-869d-793a624824d1", "value": 145740, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695719, "uuid": "fbb2d7a4-9c38-4064-be9a-b3c524d661c5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695719, "uuid": "ed408d8b-bb31-42ed-86df-711f796549d3", "value": "7589cff39cb4e8d100660f46cd53475b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5baf5695-79fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642688531, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688531, "uuid": "0620de9f-69bc-4324-b99d-7e4e5c66a5f1", "comment": "Malware payload (Formbook)", "value": "206826730fc880f75d51f38c2cd94561", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688531, "uuid": "bd6d9bb4-8109-474a-838e-2652fed1d7df", "comment": "Malware payload (Formbook)", "value": "44b17de7c324ff60a195215bf1a73eb41febf731f86699848e68815db5978387", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688531, "uuid": "14079d1d-17c4-4f94-8cb0-b3efa924672f", "comment": "Malware payload (Formbook)", "value": "7d67331de09a33ffcdc8f3b174bedf049f79d2b9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688531, "uuid": "f36c70f3-d546-41dc-aa91-9f20a6000b06", "comment": "Malware payload (Formbook)", "value": "1cb1e3e26373b612c98ee0f6766ad8b54f2f3860f7aecfc92b005b4029bf4fbbf686dabba2f3a9aed5b462f6fb7c41a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688531, "uuid": "66c9a403-b450-4428-bbc6-d670b85b820f", "value": "T1CE5412BE61C588BBD4373B7609B7D72DD3BEA6003781160F2B7A4FBA647A1CA11094D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688531, "uuid": "535fbc2d-8825-44e9-b350-5dd5fc93a3c0", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688531, "uuid": "bd819844-3a3c-4d8e-ad17-14a1403f89b5", "value": "6144:owSrPR/XkmsGam6I3sYyNy/NtPij44cNt83Y2glpAWaLyOA3N0gpW:O9vkjGam6I8DIVh/4cNu35IpVD3N0OW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642688531, "uuid": "9a0f7bf7-f9e7-4eb8-94d1-c04ac455d757", "value": 290171, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642688531, "uuid": "c9c50670-7f64-4acf-912c-6414db770517", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688531, "uuid": "e0ab5e27-c828-499c-8fd7-20f4d84fd52d", "value": "Order-410692-pdf.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b91da70-79d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642669741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669741, "uuid": "cd0932fa-42fc-4cc2-9d66-68789b503d99", "comment": "Malware payload (Mirai)", "value": "4a5245b4781a26ed855c1810cb100589", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669741, "uuid": "6bf891be-86cd-4b39-83dd-e6c8885cc004", "comment": "Malware payload (Mirai)", "value": "44f8dbedaa94518342cb718adb1f0a860198ebfe4243233b5213cc74dde03b17", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669741, "uuid": "ed31de61-ea7f-4e5c-ba7e-de9378b537f6", "comment": "Malware payload (Mirai)", "value": "63b6c1e87fe03f996f59115390f177eaff3cdb0b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669741, "uuid": "bea91c7f-4d5d-40cf-b105-f8e0eb803c65", "comment": "Malware payload (Mirai)", "value": "e2eafd014602b376e5733fa5dc6f7ace4f551df26a3ab69907d0540518ea92debe38d72dc6e4cda75b3e22346cd79571", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669741, "uuid": "9251f7ba-adf1-4f12-89d6-4c850c89dc4b", "value": "T11D330991B9824E6AC9D513BBBA6E55CD332063E4D2CF7313D9204F543ACA51F0E6BE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669741, "uuid": "7d56bdf5-e50f-47cf-b7da-09782df83d20", "value": "1536:m85kQYawggPL6LCgHfjHBSyEvxEy3RCaBy21TJA:LhwgOLQCorHUHvGy3RFs29J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669741, "uuid": "3dcec889-b859-47a4-b28f-2b3883abb23a", "value": 50796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669741, "uuid": "2297a367-5db1-42bb-9fae-637e02099a9e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669741, "uuid": "cce5dec5-4e20-480e-bcdd-e991129f42ea", "value": "gang123isgodloluaintgettingthesebinslikedammwtf.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6e95daf-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642676739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676739, "uuid": "3d1962d1-3c3b-4fde-9d41-f2c85394d674", "comment": "Malware payload (AgentTesla)", "value": "b8d76f60ca055550c213a5119ac6a0f6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676739, "uuid": "936e62d6-9974-4dfd-a5a3-544f19978f05", "comment": "Malware payload (AgentTesla)", "value": "4516d7f9735b5df9acab50a7c725dedfdd97bcab873b5d9c345ea921ec2b84e5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676739, "uuid": "f4caeaaa-fe64-459a-b54c-a182a291df55", "comment": "Malware payload (AgentTesla)", "value": "74343da3b08783397488cdc08dbb57dacd75d436", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676739, "uuid": "35c34059-f1be-40c9-a276-04b8b3a46823", "comment": "Malware payload (AgentTesla)", "value": "f8f6c96f3c55cfd48a33d807500473a1737e324bf3d759ee8d44f9ff8e8d56f406a59136260161a7d029b404ac260b69", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676739, "uuid": "54dcc6c4-4456-4c37-8410-9aae4c434ac5", "value": "T11FD4AD2D4B5ED808E45873F7A13C67A04BFA5D783419C2884BB738856972647FE6C2CE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676739, "uuid": "61c2f401-4b35-4fb2-ad94-fca8065fa042", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676739, "uuid": "a2ff25eb-5ba6-44ab-972d-bc1dc1fbd08a", "value": "12288:ifroi6ILu5WF1UViJiyB7jAZJgYMkRRRRRER:ifro4KVwhAPgYMkRRRRRER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676739, "uuid": "078f40a7-28d0-4a01-a7aa-0f6297526c4c", "value": 624640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676739, "uuid": "3af797e3-b1a7-408c-8c84-4697dbb4a0f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676739, "uuid": "ba6eb7c1-65e3-4f64-9b88-58bf8c760061", "value": "BOE_1426117405_ENT_DEL_GTW_BOE_20211224_122421.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80484e9f-79ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642667118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667118, "uuid": "0a3b5d51-3620-42bc-a57b-99e0cef02ff9", "comment": "Malware payload (Heodo)", "value": "8298be32050f30ca8d5588f4f52f11c6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667118, "uuid": "8858efeb-1ef2-4393-85f7-6f6d400160aa", "comment": "Malware payload (Heodo)", "value": "45d126fc1b396f139e972ba00b31a1af4e6d80c618a0ce0f18ee78e773f61906", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667118, "uuid": "cfbabc20-d427-4fae-8bd8-3ef307378f52", "comment": "Malware payload (Heodo)", "value": "c9cbf1bab1b09e61c69b6c5d0010bcef150f3bab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667118, "uuid": "2d1abd33-8f6b-4577-a131-4497ba458a0a", "comment": "Malware payload (Heodo)", "value": "0ef94da44383e1801936ef072c5db4cf84bcebbc8daa6a54a092c023c46dae40d9be372e132edc9432b15f54afc6a252", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667118, "uuid": "6bb6e5ea-9290-44e0-9838-d3725d297d8b", "value": "T104C4AE12F7D1C07AD1AF12356A2A9B9C63B5BD619DF1C20BEFD53A4D5E306428F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667118, "uuid": "26a5c3a7-7080-4a1b-95b2-c998fb2e9f31", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667118, "uuid": "e3230e2a-880c-4f64-9fc5-28d7b8df41fd", "value": "6144:5Ig427JC2jW8j6bzhO5vDynHoIoxoJ0CopGEfr4BHEUXZXbej1BC3OBtNCkiFPs7:5D42+8jM8WIIU8Gr9IXbeDCxBPs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642667118, "uuid": "8af72416-fd94-4a1f-a809-2b8cd6a5f115", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642667118, "uuid": "0647b948-a3b3-4098-8da1-e53600d89e8b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667118, "uuid": "90279d3c-ceca-45e8-8ee6-c0e38ce9d96c", "value": "emotet_exe_e4_45d126fc1b396f139e972ba00b31a1af4e6d80c618a0ce0f18ee78e773f61906_2022-01-20__082513.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "295cba49-79e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642678998, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642678998, "uuid": "df1ecba0-2601-4de3-bcaf-551b953acbca", "comment": "Malware payload (Formbook)", "value": "41231b6f6826066b344cd4097b2d8d8b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642678998, "uuid": "73b5c025-1620-4095-ab21-fa241b277224", "comment": "Malware payload (Formbook)", "value": "461a639affda3ef87c4d382c25d675638cf4e71e97b2089827272fbb59146165", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642678998, "uuid": "6091faf1-e76b-412d-a2d7-387a20495a38", "comment": "Malware payload (Formbook)", "value": "fa64f9073d3a0cad6759d37d421e30b2518b42bd", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642678998, "uuid": "aa81dc07-d828-4343-8b5f-c3bfa924bf19", "comment": "Malware payload (Formbook)", "value": "b5c48aa1ecece5838d7b211129599e3ea204bc636da0e69966fe539af1488215e38069002f3a920282792bb9ca6fab72", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642678998, "uuid": "51e4bbb2-438e-487c-95e6-747aa0d18e57", "value": "T133040269BB4C38A9C15252B23087E89AD0C4DF51DFE647392410F26ACA38F5E54B3A7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642678998, "uuid": "609f2082-7646-4449-8097-8a3cf45c501c", "value": "3072:F2XgpOd7y4rob3G6oUt1av0oNDtlOC4KYMIbUUXDF2FNNSQFMitdIDA9rKl:omOd2FbRoUt1avVtlOxKtI3XkFz1FBfA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642678998, "uuid": "0d56fbff-250b-4a88-9fc6-fcd3cf107f5c", "value": 186968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642678998, "uuid": "576a2abf-e0ef-4f36-ae01-0f33063ab85d", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642678998, "uuid": "fc38d638-c77e-4d24-9da7-4de5e0ed43c2", "value": "Sales contract no SINV-7774.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5475d5d7-7a1c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642702263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642702263, "uuid": "94631fd3-c73d-46d4-bc7d-35772655a8f5", "comment": "Malware payload (Heodo)", "value": "70caf460cf0c000b71bd37cc9e8d3065", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642702263, "uuid": "e13aeb5a-4b91-4a2e-a110-9c3951e590b5", "comment": "Malware payload (Heodo)", "value": "4627d88cb27d885555625326c40717630dbfc7708869fdde4d0064f2d59e5bb4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642702263, "uuid": "e8782b21-1f64-46ba-94b5-27548d5b1d35", "comment": "Malware payload (Heodo)", "value": "d5cf4d2edfc7466a0292cec8e435839ee139bd7d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642702263, "uuid": "a860dcb3-30cf-428e-b8c5-aa2571d8a349", "comment": "Malware payload (Heodo)", "value": "1ad99190b3dcd965484bce6fb32b657bf6d0b1afff6192e58b0fc2df3a9e80c8962961b3aca7f31df819bae0e3b4721e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642702263, "uuid": "359ccbfe-c455-4b59-8a55-2b0b4a3182f2", "value": "T15DE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642702263, "uuid": "d48414a8-fdf8-4340-a571-7784a55e491c", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642702263, "uuid": "f4243a31-cb4d-4cfe-b190-9654b0bb2d35", "value": 146141, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642702263, "uuid": "be30d10e-5580-4c13-a41d-f048380a9390", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642702263, "uuid": "035c3595-3340-46fc-bb6c-95ac2167c249", "value": "70caf460cf0c000b71bd37cc9e8d3065", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e21db36-7a26-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642706601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706601, "uuid": "1a9fe10b-ea50-4f14-9359-fd6148f715e6", "comment": "Malware payload (RaccoonStealer)", "value": "ae3da3b2c54fb6cd76f044651767da7f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706601, "uuid": "ef8ca08e-195f-406b-840f-34639baebb09", "comment": "Malware payload (RaccoonStealer)", "value": "469bf7bfe84702c7b98818bd5ede75005fd25f08849e440276aad7ada05fc889", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706601, "uuid": "03fc2093-2e95-43c6-8caf-b5fba74e8e5b", "comment": "Malware payload (RaccoonStealer)", "value": "cc6bf63ffabd26329f50c53b28f443ce6e5da1ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706601, "uuid": "7900887f-7b75-42c1-bb32-7f0114521747", "comment": "Malware payload (RaccoonStealer)", "value": "05071bd44999a9c4fbaf4e0ed9740d58f5883e33de2d5ed2d7c8cf7bd354035fc97c526fcc3c3ed7aa2ac7fb3a20fa04", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706601, "uuid": "26567413-be60-468f-bf88-f5edb65ab0bc", "value": "T1B2C40170FA50C171C786177C054ACFF55ABDBC305AA1028B37A866FE6E302D1667A68F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706601, "uuid": "fa54eee7-f6ae-4839-bea5-9e0393d00cb4", "value": "869e638a23c83656faad7512b2575ea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706601, "uuid": "f79cd097-c1d1-4ff5-b0bb-4d83fb17c98d", "value": "12288:PMsqg0LebaO7IqsQvxlL+4MXMalvFQJyrpUCFtLB:kgcb0L+HXM4FQQVUCvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642706601, "uuid": "90aecdf9-afb7-4af9-ad76-b07d377a7566", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642706601, "uuid": "1647e7b8-7dbf-4492-98f5-156dcf2d15ef", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706601, "uuid": "12a3f889-afbf-46f9-90f1-c536f272c561", "value": "ae3da3b2c54fb6cd76f044651767da7f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb26ce8f-7a1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642701684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701684, "uuid": "1be68daa-4df2-4266-b775-68d517811dbb", "comment": "Malware payload (Heodo)", "value": "748c43f28c4b406693e68d5212fb6bb1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701684, "uuid": "4ab43e2e-59b1-4ad7-931c-71176f6f658a", "comment": "Malware payload (Heodo)", "value": "46e0f4dda2735fab78dd9b3c7525c0168e1c14521e9a01f818434fc01646cfc7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701684, "uuid": "217c1fc4-bf89-47d8-a62f-d394c10715ab", "comment": "Malware payload (Heodo)", "value": "cd9cf5b0bdd7bc9680a7c8fdaaf0dd9eed50e597", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701684, "uuid": "60837d4d-874e-4b35-be83-7aa27104d339", "comment": "Malware payload (Heodo)", "value": "1a8f5a3d84bef2502d7965274b516549d10b9ab22557a5468b49fdfddf589056a27e050c702e3b268c21ab46b9a59032", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701684, "uuid": "906716bd-3a3e-415d-a0da-f43709bcee84", "value": "T1F3C4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701684, "uuid": "a81a4ad4-8106-4607-b1a4-e4a3d22c2b11", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701684, "uuid": "dcbf329b-d585-4b18-bda6-811805d55abc", "value": "12288:P78OGF+L8/4UUNyridMhTq/n4vAzdkPs7:D8Ody4aidbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642701684, "uuid": "9d9df18c-932e-45c8-a7b7-7a2381b525b2", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642701684, "uuid": "6b773ce6-e67c-4e1d-a7f1-1d6e3a85630f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701684, "uuid": "73f6d9b2-1fb8-4435-8300-2b2a0433624c", "value": "748c43f28c4b406693e68d5212fb6bb1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e42d172-79d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642670792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670792, "uuid": "3d66b9b7-2b0a-4e9a-bdbb-3464cad97356", "comment": "Malware payload (Mirai)", "value": "3b20c127582501f420df161da3b2a291", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670792, "uuid": "dfad344f-201e-491a-b901-fbe209460d4e", "comment": "Malware payload (Mirai)", "value": "4705bb654943661472f40612e1971b4d5a2c45ef3a3982c24399a30cf73252ae", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670792, "uuid": "08c9e431-3859-46d2-ab73-bafd28795fb3", "comment": "Malware payload (Mirai)", "value": "1d59b3b514a991ac0c173c3164e5466b1887f9d8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670792, "uuid": "b16afbd6-6ee0-4708-b908-b57eb56a4687", "comment": "Malware payload (Mirai)", "value": "9eae2656a136831c683d41d16815fe30d586ecbdb6cdf90fcd058fff27dbf982d23ee32d65cc73e7dd6f917881550123", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670792, "uuid": "e7a343fe-2b76-4f2b-805a-5f747d4b6704", "value": "T1A7C3E731E8044B1BC2D223F6E79A829E3F351E9797973311573879B02FF27991E29524", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670792, "uuid": "b5aac4ad-7259-4db0-be18-c0a25bfd1c87", "value": "3072:FDcYVLWKlAQTv+mYGbpl2m7/L7QsvmGugiNb:WYVxlAk9YGbH2m7/L7QsvmGugiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642670792, "uuid": "be30b2ba-573c-4c2a-b385-125cc6869b8f", "value": 125009, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642670792, "uuid": "228a91e6-c7f2-4b2f-8508-df9fe2d4b04d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670792, "uuid": "73b0b646-35e6-4b50-aa99-de493ceb718d", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca391762-7a0b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695159, "uuid": "e0e5e466-0dc7-4a10-b836-5bbc999e9771", "comment": "Malware payload", "value": "2a9116e15e3b0c420c3ffa0b7a9c3706", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695159, "uuid": "7bf8da76-7c5b-4c99-835c-82bd58c6ff9f", "comment": "Malware payload", "value": "4778aa46bb158ef7b0de4d2a3da136b265d1b1a9bece66392b5a8532f6fdacbe", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695159, "uuid": "335575a0-1756-45a8-aeee-14749d2a7429", "comment": "Malware payload", "value": "ada9b5d97c6ff6ae2963fc5b043c8e9dc34913e0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695159, "uuid": "88cc317e-acdc-4ef8-b56e-d8ed91d5e146", "comment": "Malware payload", "value": "b4a6652dba966950507b73022b6ac2339a0ae18decbc48e23d916b44f86ba52067891525a5e599e3708927b93ecab897", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695159, "uuid": "e153345d-1c91-45f5-a428-3f04dcc5f12a", "value": "T1A6D32915E7408B47D0D2277AB6DB43453323DB95A39B73099928FBF83FC27A94E22506", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695159, "uuid": "614059ab-2d8b-4c69-99a0-04f3126300a2", "value": "3072:PvuarQgQbggn6QBWgRKWONXqm4M/9dZzKxkwYmjwd0ZWmZs:HuarQgQ8glWgRKLNXqtM/9fzKxkJmjw9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695159, "uuid": "2e8846b4-70c8-453a-9026-bab4bdbbcda1", "value": 138686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695159, "uuid": "39244106-08f1-4c3b-ad95-cede3ac4d59f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695159, "uuid": "a20bd0a4-9e3a-406f-b715-0d94ac061e3d", "value": "2a9116e15e3b0c420c3ffa0b7a9c3706", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24510ded-7a1b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642701753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701753, "uuid": "efb4d2cf-e4fc-47f8-956c-a27e716e04b8", "comment": "Malware payload (Heodo)", "value": "b8422df85fc3c4057c3ab3e44349667a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701753, "uuid": "0c4b1aca-eaa2-4f26-adb7-dd833c2096ec", "comment": "Malware payload (Heodo)", "value": "47b55d5918804812bdc25923b93b4d42f3f5fb005f755266aba09ace6d636e20", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701753, "uuid": "85422511-c4ed-46b4-ad1e-088ffcccf1e2", "comment": "Malware payload (Heodo)", "value": "967e2c495077e67acbaae4280fe0e88c8ff3a77d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701753, "uuid": "207b0276-22e3-4043-a665-f108c2ea8389", "comment": "Malware payload (Heodo)", "value": "bac1d807056f9f00bda3c791ebb8d0356b8414e1837c5d54488495b580a118b8357b2cc16be10963fc895ae5314b8f55", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701753, "uuid": "97132305-fb98-49e7-9120-76c6de1aa9f6", "value": "T12633D0AFA1F1397BD225C17DD52C9391F48E92151E88F7C52D60FFA4920279246AE3CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701753, "uuid": "8586db21-c7dc-43b2-8267-a851003a2f23", "value": "768:PL4OjmfxV6sbaLX8iWjzwxmCeOG2S6DaqmBVZKNAxalvxnvy1OA16OiiiiiiiiiK:zjmfxVXAiozeO0XVZKyalpvyR1bZS2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642701753, "uuid": "c86db1d1-ae0b-4efa-98f9-598653b0bc62", "value": 50687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642701753, "uuid": "2627dbf4-3a7a-47eb-880d-ec7d3f15758a", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701753, "uuid": "fbce452c-f8ff-4785-8be9-0243b8b20ea3", "value": "170599257166.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b77d26de-7a27-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642707154, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707154, "uuid": "e0116696-bd2b-468e-b428-639b51f3111d", "comment": "Malware payload (AgentTesla)", "value": "2f59e51ff3e876fd9306652bb3b8193c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707154, "uuid": "b518110e-98f6-4c80-8139-7205ae0a2b27", "comment": "Malware payload (AgentTesla)", "value": "485e2bc6495b81a1a80138ca932975c685a89d2a4f52e2da3ddd911698a5de79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707154, "uuid": "b5c8c4e4-04f9-4b73-bb92-e48a88bb0905", "comment": "Malware payload (AgentTesla)", "value": "fb6ec6922150e7cb196f3c5a6b2d1fb4d4cec415", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707154, "uuid": "e6a52b2c-6c86-4b4e-b8ea-e11508fe7ca5", "comment": "Malware payload (AgentTesla)", "value": "e9401002492436c17663e60acebd9d502c9ce81a68d8b7daf324e67cf7ee6ff1460e206e08bef368c32047def9c59e37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707154, "uuid": "ec9837bb-d803-4b42-b2ab-ca8f01d42944", "value": "T17D0501307FD25B49CB0E87B4987CBC218378B5972898C76F898AADDA13287D15351F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707154, "uuid": "bd56f004-db0e-4c5a-9fff-ed803c814f6a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707154, "uuid": "6956c785-9290-47e0-b856-1f245f3e2352", "value": "12288:3giiiiE9WfXGd3334V+kNtRuJiqRhuWOY6cI6euB7cumS2zA:QxfXk3334ZrcJiqrxOVcI6VyumS8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642707154, "uuid": "b34c1682-7ac4-4a30-9bc9-bb306f241993", "value": 824320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642707154, "uuid": "6433af42-c857-4ff7-b5a8-d86d9b094da6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707154, "uuid": "ab7c8505-0836-4390-a29d-b1380be16be9", "value": "2f59e51ff3e876fd9306652bb3b8193c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0cd20e6-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642666313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666313, "uuid": "434f2dce-ebca-4e3e-8207-41422dad62f8", "comment": "Malware payload (AgentTesla)", "value": "d721b75d85917803a6fca2c336175ddf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666313, "uuid": "8784c924-fac9-42c1-835e-0c98e7c1d11c", "comment": "Malware payload (AgentTesla)", "value": "4860fe0ef130905e083db85110fbe732cb74933dba0567d5b3aa509579f796a0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666313, "uuid": "eff927ff-c99d-4e17-aa65-b1bcc66aebb1", "comment": "Malware payload (AgentTesla)", "value": "83494f6e7e8810d426d638d5985c2910cda69e9c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666313, "uuid": "188345f9-96c2-4ec3-bb52-d29439730769", "comment": "Malware payload (AgentTesla)", "value": "73aa9e8ad9c95f59f131fc38aa5a4cdc9aed8348654280b5bb77b696e3213cdc59e1aa009fd7b36335224e2845eaa06f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666313, "uuid": "f1c7670b-19ea-44a9-8ed8-47e139304c60", "value": "T10F84FDF9E7E35293F8315A36CB91433461327EC9A4E45DF645C8BA2C4E302DE921E96C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666313, "uuid": "9eddeb06-567a-4187-923b-b83eead6f7ac", "value": "1536:O7PvzvDyfSNbzhU47FEdSGVS9ZID9khfC3+bLrubaDuPyVAB3Zfcpn+1MVoyJPkh:O7PvzWuXFEdSAeSD9jIBDuP/5GfqPmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666313, "uuid": "827296cd-75ff-41ba-8ea9-1b000b40f7b3", "value": 382000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666313, "uuid": "116996ab-23f0-4c7e-a748-39a77ed11f26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666313, "uuid": "4214cf06-d792-43a7-b894-b1c1bfd6750f", "value": "DHL_Jan 2022 at 1.40_80BZ290_JPG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2cfffffc-7a20-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642703915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642703915, "uuid": "5cecd037-1caf-440a-a146-be85fd88cadd", "comment": "Malware payload (Heodo)", "value": "949e34205f3e3bb7d67e35c5b13a43ee", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642703915, "uuid": "67008cef-7f72-4bab-a599-8916eed86e65", "comment": "Malware payload (Heodo)", "value": "48645d321856636203f209613f50ae87684d0e12bae3421baf88c25657717abb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642703915, "uuid": "468beb22-4155-4ace-b631-fea62c0fdfe5", "comment": "Malware payload (Heodo)", "value": "9a0ec25b586048c18251691e57ec9515209dcb2e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642703915, "uuid": "4c31f97c-548a-44e3-b41b-b7c84f0d806d", "comment": "Malware payload (Heodo)", "value": "746cc1bcb7669599ae500eebbafa7e6dbf915600c693a419c001415d4ea0fb748398301ea61cdb8369667c98931c0d33", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642703915, "uuid": "2ccc2f79-a350-4c20-9ea5-b53163505f4e", "value": "T1F2E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642703915, "uuid": "e40f3c4d-a5cf-4ed9-931a-753ff3c8074f", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642703915, "uuid": "dcef4e90-3fb1-41a6-843c-a6a6095b3749", "value": 145781, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642703915, "uuid": "0bc01dbd-e38a-41a2-aec9-caf9a9235eab", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642703915, "uuid": "d81676a6-eece-47c1-b448-f5e278b5c84c", "value": "949e34205f3e3bb7d67e35c5b13a43ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a71b5eb-79ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642689764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689764, "uuid": "f00a5884-d3a8-4c59-81a8-ecc39f664d31", "comment": "Malware payload (Heodo)", "value": "6344d7b926677715b9b9d9444edba5bf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689764, "uuid": "aafab260-ccee-4ab9-9861-62e3799b9071", "comment": "Malware payload (Heodo)", "value": "489a8d75e0335e05d649b0e5cae103a142020fe00909e4e1f2d83704f07fff84", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689764, "uuid": "2593f55e-a82c-49f3-b1f8-a5e09a11685e", "comment": "Malware payload (Heodo)", "value": "1079f25db8b032c4422f0b0a25b6f1cdec46a2e9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689764, "uuid": "f2e991c4-8a06-4da6-b700-5d1b29cc6d19", "comment": "Malware payload (Heodo)", "value": "a6f9126896bd67a6d5d314653ad86ab4147a271de872bbbcc59db04342f7362fb7136eec31f9c0cff34fb5c63cf68386", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689764, "uuid": "aa4cfb50-bdc5-4fe4-b62c-24a0eb91e55d", "value": "T1B9E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689764, "uuid": "a8d839e5-f217-4a5b-bb3f-0b01bf815045", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689764, "uuid": "a6fa0776-0419-446e-92e3-38a12fed31bb", "value": 145757, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689764, "uuid": "fc9f3c6e-9270-407a-82ff-6304f15e04ad", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689764, "uuid": "08c87f32-3a6e-4812-94dc-16705865394f", "value": "6344d7b926677715b9b9d9444edba5bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7527addf-7a40-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642717780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642717780, "uuid": "225afcfb-99d1-449f-8cbb-0d0b67765872", "comment": "Malware payload", "value": "4ebe46b6d33d9b93111448da218650d4", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642717780, "uuid": "64f8df09-42d7-4d45-93b7-e32a6db815a5", "comment": "Malware payload", "value": "48fee052f0fa5361ddc892d4768321a00e5c80adabc60654488ea8fc1ffa135f", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642717780, "uuid": "2de2d024-39c9-4923-8adc-652902bbd568", "comment": "Malware payload", "value": "a5fb86134455060541b3a6039aae10dd197cc4cd", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642717780, "uuid": "da0f87c1-6650-4477-98d2-2c2556735235", "comment": "Malware payload", "value": "f83b0fa7e694008923683198957f13f57ff51797a5b3e75681f4f476b62f225c68cf767c034de8b297643833921bded8", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642717780, "uuid": "545c58eb-f71d-4ef0-86be-75e3e5b17f6c", "value": "T1A1636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642717780, "uuid": "10924d0a-4dc9-4abb-9921-99738bfc64a6", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642717780, "uuid": "80b96a71-f253-4d31-b7b3-f597e27f3f9b", "value": 72435, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642717780, "uuid": "288f90fe-34e2-407c-9829-30a8d9c64958", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642717780, "uuid": "9d166944-5e6e-4d10-9c62-51acf9c03272", "value": "4ebe46b6d33d9b93111448da218650d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4659786-7a38-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642714504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714504, "uuid": "c5bd392b-45d8-4a43-929c-081f1aa044b8", "comment": "Malware payload", "value": "bf69d28c36c61894c861f9911460cc5a", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714504, "uuid": "267269d8-6404-4893-81d5-ee22d3067ea7", "comment": "Malware payload", "value": "49d8faa85783425f3bbbbca47f31bff99540c2418f1f31294d38dd7dc15b2f9b", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714504, "uuid": "de3d97c0-299f-4e18-b5b8-a281ed018623", "comment": "Malware payload", "value": "7d98d285d0f0877608d326594a2a4c6317d8938c", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714504, "uuid": "583c4cfd-ed23-41bc-8c59-4fb7f2207645", "comment": "Malware payload", "value": "b3f73ff8b168c303d0e28258fdf47a1fd55f53282ff64482ac7937ceb3f00d5dfc07a72476e8e238bf255df9ad968cdf", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714504, "uuid": "d6274b2f-3086-48f6-8a77-76617e2a9e08", "value": "T19CC4237227D2533D0B7297AA8ABBD1F229D30A290C7B18DE3D6F8C51F79BC5401A4658", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714504, "uuid": "3ac48625-7079-4303-b41d-ade9bfdc64fd", "value": "12288:4L2O7hMb76AjzSZH864DADQ/Bjv8EFURwdt+VyZzeFWNbadkjgz:MU6Avmc64aq8IUWdpzeFWNmKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642714504, "uuid": "0f328592-9576-4cfe-be15-0f5bac11601d", "value": 592086, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642714504, "uuid": "30f103b4-a44f-4453-abf6-7c6393acfe72", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714504, "uuid": "60663a9c-ced1-4e78-8c00-052089cba321", "value": "FS-755-0-22.pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "094797e8-79fe-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642689252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689252, "uuid": "10582f58-bafd-4d37-921d-bc820b1dcc28", "comment": "Malware payload (Heodo)", "value": "c489ae0c647f3e828ee9d0db0f015252", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689252, "uuid": "461e031b-9338-4df5-9ff9-dbcd70493180", "comment": "Malware payload (Heodo)", "value": "4a4ee3f8e96ff14a83d4f61b0c94a52dab1ed3a0bcd3d588cfc52606df19d1d4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689252, "uuid": "b83ef2ee-645f-43b6-9953-154d10b374bd", "comment": "Malware payload (Heodo)", "value": "47c00172666c6219a694b7837c423904de9cbbc7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689252, "uuid": "7a156f04-db39-4e95-be93-8e831402cda1", "comment": "Malware payload (Heodo)", "value": "895e82b08170aab850369725775fe2be15c64da11a80af846ce3d9856db01f743fc1eaf6b547bce55d6b74fe87876cab", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689252, "uuid": "3049f5b9-53f7-41cd-aa61-d4166a970502", "value": "T157E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689252, "uuid": "d13cad81-af7d-411a-8209-5f0993baa1e2", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689252, "uuid": "89e53bbf-a357-4007-8330-5031e28f451d", "value": 145459, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689252, "uuid": "d40ff807-119f-4bd7-a250-620c3a56ecf6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689252, "uuid": "fa8503e6-b128-45c6-b860-c9d3316c9a61", "value": "c489ae0c647f3e828ee9d0db0f015252", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f1922bd-7a0a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642694443, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694443, "uuid": "284bf22f-d11b-4634-b081-7898920374d8", "comment": "Malware payload (Mirai)", "value": "1f2d180d76d6413c26ffc53a46025b3c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694443, "uuid": "a68719b3-8141-4263-a5c4-0b0d498cbc88", "comment": "Malware payload (Mirai)", "value": "4a78228c21cb491be302d249e8a061132e4696196835ccf3229cdb2265eb1c23", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694443, "uuid": "2edfc1fd-286b-4198-af2c-b3b216103062", "comment": "Malware payload (Mirai)", "value": "48532a9bb6a6bb1bd256079ce2538e600a0daaf5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694443, "uuid": "1c5e2cf9-ee29-4105-8e47-8c83512c74de", "comment": "Malware payload (Mirai)", "value": "6769c7126c3afa567d3e3a9eb98aed6497644fd120a891ead3ba173e12b99998d2c6c560fdb53ac79e920f8bc38b12f1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694443, "uuid": "9b6b4944-e7a3-4495-9b4a-0e6693f4601b", "value": "T178833B47E9A19FB7C0866A7565AB5E300B13E9912B4F1A4A303CA7F8434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694443, "uuid": "9707f28e-b74f-40c4-b7db-129aabcc7933", "value": "1536:ClN9YyOXmMSr4k9dgGwKGg0CfjGJCOdojMyTRLmkxVqOEeofzee:g7OXmMSr4krG3J5BQLmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642694443, "uuid": "e48f6c75-cb0c-4bed-8eaa-18815f21e28a", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642694443, "uuid": "ac11ef29-d708-4aa6-9f9b-b1baf2f03680", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694443, "uuid": "64e5018c-c134-4089-83ec-64cda9c5f623", "value": "1f2d180d76d6413c26ffc53a46025b3c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c6d9f24-79e8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642679889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679889, "uuid": "da5b7c18-52b0-4b48-819c-b91fe99bec55", "comment": "Malware payload (AgentTesla)", "value": "49f814cb6468496769cedb70d5e0b354", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679889, "uuid": "d42d7630-0c96-4e74-b540-30eb5e3b25cd", "comment": "Malware payload (AgentTesla)", "value": "4aa29647a515c33bcef2325d086daed9328cc6c185a373e4f111b2549df5e85e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679889, "uuid": "04a7957c-215f-452d-879c-ca673e709ed7", "comment": "Malware payload (AgentTesla)", "value": "d9ff59ace0785d9fe8bdd55985357e77340f9403", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679889, "uuid": "1a22f172-dfa4-42e9-a0c9-f1c9608fb827", "comment": "Malware payload (AgentTesla)", "value": "e747fb397ed14746bb6e8b7c716d871e8ede0017ffbfadcdfaf1a955b7937286efbc718f20e6c39f9415d4c2f15dd2aa", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679889, "uuid": "a7a85403-5dbf-47cf-8ab7-660186fcf9a7", "value": "T1F5F4ADB121695B66E53FEB34232452185FF0FE26D316E67E7C9870DE0472F818A72623", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679889, "uuid": "25df260a-2ae4-4835-b0b6-0be008cbb3f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679889, "uuid": "a5f17c30-7ef7-40ee-ab5c-4619928d2ee2", "value": "12288:Ud+J3YwjApCVaq0aJexkb+ts9zuWFCdfGc1ic1f:Us5YwjACyaJJ9zuTdfGcQc9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642679889, "uuid": "3cf88837-2928-4343-a290-13469ab9669c", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642679889, "uuid": "0caca652-87f1-4298-aff4-ac41ba39265d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679889, "uuid": "84bad066-5f76-4636-b398-cefaab004c58", "value": "OVER DUE INV 033 , INV 041 & INV 042.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fba55f86-79c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642665607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665607, "uuid": "3dbbc14e-4e76-4ece-a467-02a8b17cec9d", "comment": "Malware payload (Formbook)", "value": "99c53ff09a4670777a18d236dbdcb2d4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665607, "uuid": "1fad57db-7ebb-4588-a1db-a63bbf9ffbf9", "comment": "Malware payload (Formbook)", "value": "4aa3e8efd1e85628ca6621c1eba895abaef9db0c713f007af97a8d70a0f76741", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665607, "uuid": "8561bed1-fe19-46cc-a918-bd8e5dfce0d2", "comment": "Malware payload (Formbook)", "value": "c7e9befe7e5ce82d8d15aa15943c42e19ec5f24b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665607, "uuid": "a5443890-2d92-4bdc-b61e-d7b6efa6d198", "comment": "Malware payload (Formbook)", "value": "f8a95bf8fc895b42227422b9e7fdfb41057e439d787c34f96045248d1b8e54e19174e59e855740335753f79d2d404228", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665607, "uuid": "2e75fe24-ec17-4bff-aa06-7d9f820d87bd", "value": "T1E6A271BDD45702988F866BB82B2B5F49108D7A2DF785A632327C577527E2C3E901393C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665607, "uuid": "ba79affd-2df1-4e9d-82cd-dc36e3e15490", "value": "384:MseRjRS5bev1YhdfqXl7QeQm64DZjC4lEysZkJWI3psay:veFRS5bU1wdCimvzEysuJBCay", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665607, "uuid": "2f919599-31d2-421e-946f-f2b3c78a2831", "value": 21949, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665607, "uuid": "192b3976-1425-48c5-9990-e381b6345d43", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665607, "uuid": "7c8dea43-b1d1-453d-b8ce-35a7d5216985", "value": "20221586.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12fd0354-79da-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642673807, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673807, "uuid": "bd89536a-44cb-44e4-aedb-6968900d77c2", "comment": "Malware payload (Formbook)", "value": "cb2f90f127deb8055bc861a7ef11cab8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673807, "uuid": "39be4bf3-0e68-4542-afef-7e39d6fc16ca", "comment": "Malware payload (Formbook)", "value": "4ad33db217cd28e94e816da762375ed676740f21eee05f60be7785b27665cfbd", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673807, "uuid": "ec13f38d-f880-4159-a416-08615e72754c", "comment": "Malware payload (Formbook)", "value": "396c379fd25a09f327e74ac595b554ec01522d16", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673807, "uuid": "d485ecba-7c1e-444d-ae18-723cc9ef2f11", "comment": "Malware payload (Formbook)", "value": "3479104191d8910fe6d92147cf4b615a437155baada85000744daa817ec800f637c4b3c51cc6d385543760fa6728f92e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673807, "uuid": "7f899914-4593-4e40-aab3-ea31459a67cb", "value": "T116A4C007B6DEDA25C215A673C8EF400087B9AF81A513E70E3DD873BC192275B6A4539F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673807, "uuid": "897f9b74-11a0-4404-88f2-17aa98372066", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673807, "uuid": "2bcfc3b9-1977-4453-a59d-1ea688b19d92", "value": "6144:YUYyYIogf+mMfLFDWX5R6L3oRrJubLYRU6S3qJoer7Q+iJ1wS7FQ12akfLZxyaA:cqJMzxQRAnYRuqJPcvrBfya", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642673807, "uuid": "ccc1f78c-d8c2-4c58-a481-4f000f01e2fb", "value": 484864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642673807, "uuid": "3944440f-dcf3-4a02-b0e8-bf3505f6dce8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673807, "uuid": "f2de1e8d-88fb-4b98-adeb-350168e11c2a", "value": "Bank Swift.doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4718fdf9-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660580, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660580, "uuid": "ead99217-133b-49e8-8cde-c1fab6d7888c", "comment": "Malware payload (RedLineStealer)", "value": "29e9bb770d5d1304a10c58af8a3a08d5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660580, "uuid": "693afd10-27e8-4cf1-a179-cb55700168ff", "comment": "Malware payload (RedLineStealer)", "value": "4afd8f0abb04d38a4da5ac907b7b6b9812dc7bba6c6020f37c5b6e3a3ee7c54c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660580, "uuid": "159fa13a-c95d-4456-9b2d-46a5251882a6", "comment": "Malware payload (RedLineStealer)", "value": "480cc8a622ff22bec66d6b819e7d5ed82951043b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660580, "uuid": "2dbe1053-230a-4d54-9f9c-36896967f003", "comment": "Malware payload (RedLineStealer)", "value": "97b57df12544b3d8a80a8d90f6949560b7fdb75939f77c010ad285f55f78f1f448ce99b2a059d642c9b79704edf835a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660580, "uuid": "c6d81c5d-7cb3-43ca-9c1a-dc42b9b68bd2", "value": "T1F584E1717780D472C4DA4630882ADF645ABFBC7119214287B3A43B6A7F723D2626E35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660580, "uuid": "ddeb2a2b-63dc-4bbf-b0c8-700c1e078c0e", "value": "125adc129c50285a2cd4524417d3fdd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660580, "uuid": "6ecbde8b-38f8-4a7d-a7f2-dba9c34ae3f2", "value": "6144:TcUeLM12YVF1JfJjXjLJDYHTDlzpSGLT/W0AB:TcXm2YVFX5hDiXEB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660580, "uuid": "cda59892-5a08-4ff3-a9d8-7328d3c7b9b1", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660580, "uuid": "84328afb-a24f-479d-a9a4-532b20fbe82a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660580, "uuid": "7cbeb44e-90dd-436a-beb2-6af2ab7dcaab", "value": "29e9bb770d5d1304a10c58af8a3a08d5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd09ef9-79c6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642665609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665609, "uuid": "195804bf-5c44-4d7f-8552-3be0a1106668", "comment": "Malware payload (AgentTesla)", "value": "a42c987fea11de442676ccc7e4f46270", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665609, "uuid": "6e3247e8-3b6c-4cca-ab63-604b1b22952e", "comment": "Malware payload (AgentTesla)", "value": "4b0b6c420c20219a94d5893b347523068a92f0f7236c007f43abe28983c5e038", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665609, "uuid": "b8ee1e2b-ddac-437f-911b-549340b23dbd", "comment": "Malware payload (AgentTesla)", "value": "6130731f9a4129557fe5621487c88ab6537c8b37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665609, "uuid": "e68d1684-e9e0-4643-921e-0aa69f950c72", "comment": "Malware payload (AgentTesla)", "value": "e69006c84e186a5483338c7744a65c6b1ed3c83b4e3c8e6623d511f339f39321a97f97d00f3b6d17b2237b34aa22629c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665609, "uuid": "6eb5468d-4cef-4ea9-bfaf-e2bd4aef1698", "value": "T16D9250ADC05703A48F862BB42B1B6F41118CB66DF7959973323CA7306BD2D7B812683D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665609, "uuid": "d771db57-aafe-4381-9d35-93d590296ae5", "value": "384:sjRObNJK7fEvNhR3ErlcjfVUOF7EitSsR0XJgVBium2n:2RObN7vNhJEehbSsiXCs32n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665609, "uuid": "79b8c08c-af60-4d6f-afe4-b9ae613c6722", "value": 20146, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665609, "uuid": "d75e3068-b2ec-4fb5-a7c3-ad8bc76c4c0b", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665609, "uuid": "c168da70-7074-4518-b7cd-72ee7176dd77", "value": "Payment Order.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1248c78-79e3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642677964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642677964, "uuid": "2e49aad6-6f7c-4dda-a53b-7c75b6026bf9", "comment": "Malware payload (Heodo)", "value": "110d7ef2b3b5009e6387a7becdc65ad6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642677964, "uuid": "293cc765-dc22-4bd8-8a69-a049eabb17fc", "comment": "Malware payload (Heodo)", "value": "4b1800da594032e6944a2b0728eaa50223d1ca0a6eaf3883ce9a0dc05d2e982a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642677964, "uuid": "0d3f8d3a-f495-4836-8289-86a0a801d367", "comment": "Malware payload (Heodo)", "value": "151e3cb88ac922df8d742b4df8a49e7488d82a99", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642677964, "uuid": "a21786c5-7873-4c53-9a3e-53e707049d9c", "comment": "Malware payload (Heodo)", "value": "73177e76149f3e86f48344214ea6523ea1ed2be6ef6b618d244fc0a97bc791643900a479dbfa06898d99068b13ce5445", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642677964, "uuid": "6a428aef-8b73-4249-9904-cb75df229d1b", "value": "T10AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642677964, "uuid": "bbd50485-c423-4ef7-921c-e3ca264773a2", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642677964, "uuid": "3c0892d2-d4b9-4938-9c31-9b1a76bcf12b", "value": 145090, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642677964, "uuid": "f07a952d-4b48-4e23-9953-f06a781a1db9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642677964, "uuid": "ef0d8302-0822-4b6b-b817-e120e6d6134e", "value": "110d7ef2b3b5009e6387a7becdc65ad6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a3ac204-7a10-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642697011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697011, "uuid": "387d983c-56db-4e67-a42c-b3a19fc36afe", "comment": "Malware payload (Heodo)", "value": "c3860c8e0968f20713e4c90592d7bee1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697011, "uuid": "7752462d-35a9-420a-8963-d45bd2e0fff6", "comment": "Malware payload (Heodo)", "value": "4b90a0d2855800baf3485d8e0c38ec0e5aea83050ceeb38061af07eca0d16feb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697011, "uuid": "49cbc1d5-9ecb-4e37-a1f6-6d37bdc6fffa", "comment": "Malware payload (Heodo)", "value": "ca12a4b1af3f45e98f487db3c6b1c503dab0ec45", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697011, "uuid": "5a68584d-e303-4ac5-80e4-327b95469b34", "comment": "Malware payload (Heodo)", "value": "385ac371d0405f13490407231b98fb0bd11e4087ca77e84594b226f44e5f38461f38a94df21a5a92cd539f9f7235c593", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697011, "uuid": "1d8ca9cc-6f33-46a8-9166-5b167873bd48", "value": "T177E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697011, "uuid": "8c94e907-f563-4ef7-b12a-3e3e52eb48b1", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642697011, "uuid": "876aaef0-de6b-4938-bada-f54b7822f999", "value": 145248, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642697011, "uuid": "20f8e7ac-3af4-4458-bec2-4a247d72edb7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697011, "uuid": "afe27c01-c906-4a4b-a30b-009597de8a59", "value": "c3860c8e0968f20713e4c90592d7bee1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cd517ea-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666226, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666226, "uuid": "f8379ff4-ff4a-468f-9f7d-a52ef7224a47", "comment": "Malware payload", "value": "ea23a0d5fc98034c5a20aa35c9bd38f3", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666226, "uuid": "2098ffdd-00f7-452b-be55-4689dd2c54e8", "comment": "Malware payload", "value": "4ba26f0ed618d95dca9b940f28961e15dbf5efcd7a437526f06ee0a16b2e9b31", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666226, "uuid": "814a9df5-d00b-4a9f-ad0a-84cad755c19f", "comment": "Malware payload", "value": "457d2f3b09473220e2deeb39a072934437b1aebb", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666226, "uuid": "33f18895-33d0-4d36-8ee1-ab2816edbc3e", "comment": "Malware payload", "value": "5674da8d291811b94b3df896bcb84134047a0507d62aa7ca5e6ab8214445fe91a8d008a1c802117477a7e2405cde7754", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666226, "uuid": "94d1c1e9-393a-4ebe-a2b1-e9c2c6b1d8c3", "value": "T1F0D11DD867CA34440347AEF6793FB1C5E72BCCC1358E454AD225DCC4BC68A1ADAA3931", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666226, "uuid": "cddbbda9-8836-4a81-b223-351e97d5ddd6", "value": "192:Q0rBjvf10kxZmxAo/KU/UIyVXa4ai6QMnE8QeRvWXNmYkR8LND8D/XmgAlJCrVM6:QOBLf10kxZmxAo/KU/UIyVXSoMnE8QeH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666226, "uuid": "6db7974a-fb80-4df8-a840-d2905fea9d9b", "value": 6174, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666226, "uuid": "5edfe062-b7ea-4ce6-a7bb-ccb4f353c399", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666226, "uuid": "8c753875-ebc5-4618-93f8-42973f96b414", "value": "SWIFT COPY.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5988560a-7a14-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642698836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698836, "uuid": "e89a108b-0da6-4c7e-9310-afb4bad32931", "comment": "Malware payload", "value": "a16e7e2cdb9571cf0470324984b53146", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698836, "uuid": "05c3f3cf-796c-4b40-b8e1-9c0f987e8338", "comment": "Malware payload", "value": "4bbab985fdd9eee28a8a9951080d28c2b51de13ad5e42c471e9933d9b596eacc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698836, "uuid": "c5e9cfa9-551c-4ca0-b97a-7df09ac18bcd", "comment": "Malware payload", "value": "757d174a82da0c8412b80c5afffdb4ffdb2a13f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698836, "uuid": "a5deac12-ad94-4c00-ba3b-861d8d494272", "comment": "Malware payload", "value": "b0a8b2d0f5d6ffb9f94ba379add893136bbd1c86ad08f525b02780c79c700f544bcfdbb18ee543d288e61b999191fd37", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642698836, "uuid": "d1ae18a4-0a11-4627-924b-5e038b648dbe", "value": "T15E24CF0472A848B9ED77D5B8C6931682E1B63C101710EDEF03600376EF6EBE5657AF62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642698836, "uuid": "1077f25c-3e67-42ef-9f57-f2f70d61a9e9", "value": "7c661725970e2285630167e2c43a72e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642698836, "uuid": "3f2cd84a-4e37-471b-9db6-31962a2f2b8a", "value": "3072:Ci4LLnlrIewazilkg1+1q7NvNNoLW0HHy185ofDkXvrdqcb2k/+kDeE5i/A7J:uLlrIgcvvNNqHH3GbuZq76h7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642698836, "uuid": "e1957515-f248-4ee7-921a-694413b0a124", "value": 214016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642698836, "uuid": "8153d5c2-2bce-41bd-8b53-118c1f2d86ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642698836, "uuid": "71c5bb0d-32da-48f3-bb93-1a33c1c85d38", "value": "opra.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a134ba36-7a27-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1642707116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707116, "uuid": "f5bd9c0e-b44f-4b1f-8d64-584738ed8f52", "comment": "Malware payload (ArkeiStealer)", "value": "b9baf811d0699c8e079bb480e7af660d", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707116, "uuid": "423d4291-4006-41a6-9bb1-ce6ab1a18abc", "comment": "Malware payload (ArkeiStealer)", "value": "4c0ee61b5477dccfe365b64165e55523ff9419c7f2a5cd0e7c76f98802a06817", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707116, "uuid": "65458d3f-9baf-434f-ac68-4c05151ef6a8", "comment": "Malware payload (ArkeiStealer)", "value": "5d8478ce1f1e17f6dbf37e64217d5558c1408eef", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707116, "uuid": "8f047f48-c30c-4a54-8dae-90ebd59485aa", "comment": "Malware payload (ArkeiStealer)", "value": "fbec853c86cb76c0f3fa012b64e7708172b8e51a5bc713972b2b0c9e2312c6633e21145889272efd5cb40ae14fc2a63f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707116, "uuid": "a4f0bbe1-6244-41e3-84eb-c1356c4f9232", "value": "T12A54BE31F690ED3DC4865634481ACFE15ABDBC311961868333A8376AAE7A3C11B7635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707116, "uuid": "641dd874-d55e-4401-af1b-2f45620c6041", "value": "897a5806e5491100f466efd56d26d7cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707116, "uuid": "1e762a3f-2048-48fd-951e-e49029a12de9", "value": "6144:cAWmL0kZRWYScaZn6t0BSnI5cyjwWckMh:cAlcYSl6iBSnI5cRWTC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642707116, "uuid": "b7302f1c-deb3-4c15-8546-edaf4ed74829", "value": 290304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642707116, "uuid": "ebc93ba9-27c4-4747-9cd6-9d20c267d1bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707116, "uuid": "6d31cc5b-358b-4e4b-8221-baf3e7b06d05", "value": "b9baf811d0699c8e079bb480e7af660d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6efb5a35-7a2a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642708321, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708321, "uuid": "ef383f06-0fb1-42d3-882d-929270ced52a", "comment": "Malware payload (RedLineStealer)", "value": "e92d1cb41c8ef2f3c342a07cb6133b3e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708321, "uuid": "1b3ae9d7-1247-495d-a06e-689aa24b621e", "comment": "Malware payload (RedLineStealer)", "value": "4c39d757572b3eda10c406790fca5e03e48b6c3903078e5c94dcff506126dc30", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708321, "uuid": "44aad4e7-bae2-4362-a8d8-f6a3700f8bc0", "comment": "Malware payload (RedLineStealer)", "value": "18a90e9cf4917c32f118dce608ed837a8434d0b8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708321, "uuid": "36b5e74c-f864-47e1-98db-c065942ef5e7", "comment": "Malware payload (RedLineStealer)", "value": "638a5b502cab43b63274479265c6519e73ee469826e508761baf1d31d1cc69fc2e9f88179b4dd26820016d867bd0660e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708321, "uuid": "07502e4b-8aaa-4265-b18a-a9189c9d4901", "value": "T15CD423537661D5A8CBFB2A3148AB4B73372D5C0A6D571EA73486F31AAD327C09C432C9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708321, "uuid": "d31c5773-b065-450f-8ff5-5ee93630d0a0", "value": "aeac7920ffc8b3ab91c8411edb4377b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708321, "uuid": "6ea01e80-d28f-49e8-9774-876291bb7041", "value": "12288:GHEzSWQcCB/Nz5yKPYoPVDGnF4QWN7ariaW26fIhhD5:GkzSHNNyKPYotDGnFVWRarir26fIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708321, "uuid": "f6f96474-087a-4ebc-b6d1-fd78c2d1d17d", "value": 638896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708321, "uuid": "1e116d0e-c29c-4f86-97ca-8133b0055108", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708321, "uuid": "fda6aa9a-ff40-4b52-8bcc-f1e8396807f5", "value": "e92d1cb41c8ef2f3c342a07cb6133b3e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e9ef6db-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642660726, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660726, "uuid": "d9b1e6db-37ac-4bae-bf4a-415f51fe56ed", "comment": "Malware payload (Heodo)", "value": "a353d520ee0bccb8939aee5dc23d4a2b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660726, "uuid": "85ec5fe8-5751-4a04-a68d-1b9e07c49512", "comment": "Malware payload (Heodo)", "value": "4c3f80d1187f8c8ed466219a7ad4ff851a00a00b84dc6582253fba6415c6f97a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660726, "uuid": "404348b6-dc6b-4e94-a2ca-8f6c2027839a", "comment": "Malware payload (Heodo)", "value": "f25c772bbfd759219b006e5071ade2323f555aa3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660726, "uuid": "7d670c16-c9f4-439b-ae16-7c0b46223b55", "comment": "Malware payload (Heodo)", "value": "a814cd50f8faa88da28b6032bc61f1082bc5cc2fce6db0aee37bd74871deef4e25f1df32bc4d46283f265b11444b0bfd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660726, "uuid": "e2a89c72-b4ba-4430-a020-052bd02bb0c2", "value": "T13EE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660726, "uuid": "5142f9ca-87be-4852-8bb2-380f6052a881", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660726, "uuid": "e374ed27-1b48-4176-b511-de7ca8366041", "value": 145914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660726, "uuid": "eadfb7fe-c239-4fe5-8cc0-6b826bf7ad87", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660726, "uuid": "85664496-2fdd-491c-8d47-45b00e0c3a67", "value": "a353d520ee0bccb8939aee5dc23d4a2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aeb79c9-79c2-11ec-9275-42010a9c0029", "comment": "Malware payload (XpertRAT)", "timestamp": 1642663700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663700, "uuid": "73ff5ede-420b-419f-8a42-4d4b15f2adb5", "comment": "Malware payload (XpertRAT)", "value": "7236e64dc6eb9e21ae4c16239820713f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663700, "uuid": "c9dccfc9-3bb5-4136-8ec0-68eba02cdec8", "comment": "Malware payload (XpertRAT)", "value": "4c57fb95b67660646d6e37a04eb78e010c6a629e1fd8590aaeb4093dea0fad1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663700, "uuid": "a187e254-b314-411e-9718-7b2965f6b4c5", "comment": "Malware payload (XpertRAT)", "value": "f97cc4ecc429d57d44674511d518f9e6b428e7b3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663700, "uuid": "9ef0f9ef-23d6-469e-9374-8be412d45d96", "comment": "Malware payload (XpertRAT)", "value": "9965e4a640b9bac1e36a911a70bea05fa040555c53aaa7db69abde7b20d98cf770a91c1e2ae8d42001ba327de2781188", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663700, "uuid": "79f7b6a4-4e87-407a-b60c-caf4f3cbbac1", "value": "T15A8402107BFE2769EBEA87F876319050937539573163D62C4D4960DE28B2F828782B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663700, "uuid": "fc7d5ddd-a4f5-408d-b952-f8f5b89c2e2f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663700, "uuid": "470f04d5-ce75-42b7-806f-0531cca1d1bb", "value": "6144:kwADTLF3wGGtaEzMjvnkRUcb/YZqGJHyx7txcfez7bEfS8zprR/zGS7B:ArW9taEzIndcb8qGJ4gfenKScrRG2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663700, "uuid": "8c6f25fc-3bb3-497d-9526-cabb862c95e4", "value": 391680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663700, "uuid": "fac1a69c-b8c9-411a-a4dc-5fdb5fca4d94", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663700, "uuid": "5e02ba0c-c173-407d-9389-1f1362ed6d4c", "value": "orden pendiente #3422.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9de10767-7a32-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642711835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711835, "uuid": "f446018f-b38b-4c02-87d0-73bf36d70064", "comment": "Malware payload", "value": "97960ead01b7487e3233c6724a412c6e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711835, "uuid": "22debe06-a586-4606-bd53-961a238a270a", "comment": "Malware payload", "value": "4d905d988ba707e76ad18d72f16b931c1868e3ad4be521bf6142d6b9acf5b28f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711835, "uuid": "103303c6-2650-417f-8afc-3c41a99a3543", "comment": "Malware payload", "value": "1cec02b9f8013d6aefe8ae9547f6e7c0c947760c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711835, "uuid": "6fa982c6-7139-420f-be3c-88f1b743ba3e", "comment": "Malware payload", "value": "dcd7103af75e95c433909aff48e509d2ebf6a0cf67b854916d6df827fb05fb098f39df24659bec1ccdbe725bf7a620a0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711835, "uuid": "d0f5a705-386d-40e7-ba16-9c7fa7d7c152", "value": "T1B254122A3CC5E9EFD64D88711F775B3ED37A9101150A069BAFA20D7950310822FA77EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711835, "uuid": "17a09254-08e7-45ae-989b-3e0ef835bcd3", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711835, "uuid": "ed95531d-a630-46d6-bb21-22f66a6dcdab", "value": "3072:oNyah0mJoOR5xaKMtyoygCZ0VIMDxctGqextEYNu+oVFzJjWRA3qw15N68tSKgwC:owcXKPygCKK4DtEFV1H5lptSnEg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642711835, "uuid": "c7d3f6d5-84e5-4b65-9276-4a3165893a90", "value": 285289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642711835, "uuid": "b7310057-0823-4727-868f-fc2756ebf6a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711835, "uuid": "27303d73-42c8-4c26-ac1a-b5746a7d3708", "value": "97960ead01b7487e3233c6724a412c6e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9849545e-79c5-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1642665011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665011, "uuid": "0313c441-af69-404c-a996-a39f49e9b69b", "comment": "Malware payload (BazaLoader)", "value": "80060b128b6d4813f184d33b53972dea", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665011, "uuid": "58f1643b-cd3c-489b-95ab-bfc67293623c", "comment": "Malware payload (BazaLoader)", "value": "4db56cc519b8fe92f608a30bf32477b62c1f154de183e7f075bb4cf68e918a83", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665011, "uuid": "9e6b1f0a-2f51-498e-b34a-226bb0cb11b7", "comment": "Malware payload (BazaLoader)", "value": "f3bd01cd5ac96d660ec90ad1b81c5d6923978909", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665011, "uuid": "2a1b2b74-9ea9-4107-bea7-dd5f5b9159d7", "comment": "Malware payload (BazaLoader)", "value": "c4f3fed2b0d24418ce529f8e497e35a87c28ca534b291007d570add62e1f37bef1d389e0f42f5fd1ea7bad5f4c1891de", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665011, "uuid": "5a6f7be3-3c8b-4062-bcb1-67ee328eeb62", "value": "T17C85FE43180C819F9867D77421671D97EEB87E47F2C84E1ED1E428B84AEBDA674CA04F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665011, "uuid": "da924605-c408-4f25-9005-9c3c5e7ba6d4", "value": "f30f2b5b65c947eccbf132b668fe3257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665011, "uuid": "182a61e4-8b08-40f6-8828-22cc86357a1c", "value": "24576:ca1QHwgJMrQqj/wAc6QORNx2nAjwkaqm0GV9igWwlnwXQBwfalj21X4GtZ+FdnZ8:oH5qloBMd8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665011, "uuid": "7ca8926d-d1c4-45ef-a2bd-c56e49a6602b", "value": 1816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665011, "uuid": "474eb297-b8ea-4796-be00-8ee00f6bf8ab", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665011, "uuid": "6d7975cc-58ea-4e02-b35f-350e41822791", "value": "80060b128b6d4813f184d33b53972dea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fef3c74d-79d6-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1642672484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672484, "uuid": "279e1253-7cdc-4eaf-82be-1eebdc96f6e9", "comment": "Malware payload (IcedID)", "value": "474639af674b9c7c539e1438f9be3690", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Venezia Design SRL", "colour": "#5C866D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672484, "uuid": "24df062a-2d55-4df9-ab0e-27319cfed429", "comment": "Malware payload (IcedID)", "value": "4de5453891027cc3a82f3e72a71c774ae95e6b6d4587197056cf4fdc85947e14", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Venezia Design SRL", "colour": "#5C866D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672484, "uuid": "5aa27b9d-08e7-4443-afd5-27e4df20893f", "comment": "Malware payload (IcedID)", "value": "f2796afd8824b3a3e97693a752c85d1e2340ed72", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Venezia Design SRL", "colour": "#5C866D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672484, "uuid": "051520fb-7c99-4a50-9a67-2bb16299b601", "comment": "Malware payload (IcedID)", "value": "722580a9d9a9bb8c22282adee5712698bcfad59fb4e09aa71ddf3aa6ab32fd6f098304fd41dba99c2d6f6cc6802e89aa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "Venezia Design SRL", "colour": "#5C866D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672484, "uuid": "05177c02-a0ea-4c4f-a020-20bcd2c99276", "value": "T10FD39D4BB3E531E8D5B28A35C4A11626EB7278710671CF6F03A482562F677C18E2DF36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672484, "uuid": "9b77d550-9fc1-45fa-9511-c98253f60429", "value": "edef9037728b84b25e36127c2e812cec", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672484, "uuid": "50c8b1a2-1da0-43fb-88c1-4b1026172050", "value": "3072:3PEa3oHUmqs8b50xBwyc6SNfZAxT3qU+rV7r567RU:9aW/6QfZu8VX5cU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672484, "uuid": "ec7b0e98-0bf9-4eae-8d81-491fa6c74afd", "value": 134920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672484, "uuid": "e64b806e-7304-46c4-b0ae-e134f53fe94d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672484, "uuid": "6d382ff8-703b-4d27-b7cb-fa1f2d8ff674", "value": "ice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ceb793a2-7a23-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642705475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705475, "uuid": "bbf26b83-fa77-4876-92ea-c823f4a243cc", "comment": "Malware payload (Heodo)", "value": "8f5416fa8e01152c0b71394472c44d96", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705475, "uuid": "73649e05-d7e4-4f45-bf9a-dbe13dec7d99", "comment": "Malware payload (Heodo)", "value": "4e012706695112b7e19ba7cb073f14b4858bbe382890106a21cadf220bcd050f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705475, "uuid": "4e432043-6d60-4092-87fc-1c322238148a", "comment": "Malware payload (Heodo)", "value": "26f3e3aba7a7c4ce11a41d02bdc1f30ff46d4c13", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705475, "uuid": "6b83e221-4757-44d0-8b22-d968029e8c0c", "comment": "Malware payload (Heodo)", "value": "c9c7a9fac3f9fcb8589d923f896df0c58d43b21a79cb8e3ed6daca7fbe850be7dcafd134848cf0d6b1ece7d505884c38", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642705475, "uuid": "9790c96e-c0ab-41cf-a3a9-e6e97b2d3956", "value": "T1F1E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642705475, "uuid": "61289158-1238-40da-b5e1-6fb95d6af6e5", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642705475, "uuid": "68314ccd-7f72-4c08-bef6-7b478ee31266", "value": 146365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642705475, "uuid": "73a484c4-eae1-4248-b2e8-319b1e0b3f77", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642705475, "uuid": "3334d49a-8a30-412f-a4be-241cb815602b", "value": "8f5416fa8e01152c0b71394472c44d96", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2981893-7a06-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642693080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693080, "uuid": "936d4333-567c-4238-875e-9abd4f4d3daa", "comment": "Malware payload (Loki)", "value": "b31fdfb032644bcb1f8b072f4dc5e11a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693080, "uuid": "0bfa07f8-96fb-4e4e-bd41-e08d488cf3bc", "comment": "Malware payload (Loki)", "value": "4ef528f41c74b287a3bc8bcb4cf1cde16d54b0fbdffe11e845e5aa2b656dc961", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693080, "uuid": "2a485692-9015-4a9a-9603-e4e9231af4fc", "comment": "Malware payload (Loki)", "value": "1f4213eeaf0990d62b6c46ea8f29026c1555bc1a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693080, "uuid": "60aae2c4-f6f8-4827-a891-5b67655d2fc4", "comment": "Malware payload (Loki)", "value": "5e97a48d58e124c240abce0bce6d365c6950686e460c847c97734bb8b256ba9dbe28d5cb8c54239a0eb0ccd848816ac3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693080, "uuid": "e9703593-1779-4cff-aa14-cf901569de18", "value": "T1F614F771B440605EF172BF3168BCB355A8193CBE0521697BBDC17B4A19331D3E0A6BAB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693080, "uuid": "eb96b77c-4f7d-4282-8a13-41c82a8873ae", "value": "49b15580bd181e45d4d97bbfb270c139", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693080, "uuid": "39d5c93e-dfca-43d3-a5a1-87bb41263900", "value": "1536:HhsFidcwgFEDQN9aF5kqTwn5wwBq1hYKkoCQl0kzuKnIKSEHQFo/dWP342:2Fccwgt9tyw57kMKN/2kZnr/3/Oo2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642693080, "uuid": "967fa704-7a79-43b3-9949-9cb9d795148f", "value": 202400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642693080, "uuid": "512b9263-8e3d-4d89-86a2-1af42042e0ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693080, "uuid": "133acf24-f590-48ca-9cdc-69149dfa9ae1", "value": "b31fdfb032644bcb1f8b072f4dc5e11a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "309d261e-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642665696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665696, "uuid": "3383bc68-0747-4e6a-aa71-c53b13017d70", "comment": "Malware payload (Loki)", "value": "07442072576d7c9347f71a7118a329c1", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665696, "uuid": "b0f00922-e676-4a68-9c6d-1874ddaed1d2", "comment": "Malware payload (Loki)", "value": "4f470379f973f7f61f43cf6fcafc9b78d64909641ff37375c7d6bcb170dc574e", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665696, "uuid": "d5e6c06d-5fa8-4ca8-9185-59c8f53d6efc", "comment": "Malware payload (Loki)", "value": "70fdeee61d5bf6dee411b6851dedf45845970bc7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665696, "uuid": "a69a9cc9-6505-47e7-bff9-70380eb91100", "comment": "Malware payload (Loki)", "value": "97c006aff59e40cc673cd4495ad0ec2fdd70f500dfd8f26c38d45c5d0ffd97f4fdf4c58a60f8027ff24ff952d4644f26", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665696, "uuid": "60e85a1d-ea3a-4216-939e-f79224606922", "value": "T1271412173BCB4076DE1F9279210147F84A9E5C0B918F1F266D7C7BA68D30F855C96C2A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665696, "uuid": "08f4f7d9-158b-47ca-aebc-597cd5b7d35c", "value": "3072:XBwvgo5mlDjeENvNKcf8XAfdWaUaiDOMZOIAIo+sfuSt6m4De6bMT4AvZ:RwvHQ/NvNKa8XlsiDpOIAIo3BEZEzZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665696, "uuid": "7fbd44d2-7026-4fe2-967c-cb90c82ed416", "value": 192744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665696, "uuid": "3705f799-755d-48fa-ab07-ab5a296574eb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665696, "uuid": "30860aa6-791a-4c56-b8c3-b8bc73262889", "value": "INQUIRY-749659-S1-1130818.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649004bf-7a0c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695418, "uuid": "4347f138-e36d-4550-a2a3-9d72e7ceb1b0", "comment": "Malware payload", "value": "a7d8b036af82294a3c4be007ec03237b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695418, "uuid": "37dee9bb-c698-4cc8-a6d7-e8a42f831901", "comment": "Malware payload", "value": "4f599beabdefba8e35fbf30ddfb2d2c135d09bf83899f361bf6566af61e873ef", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695418, "uuid": "4580e8c2-c2c0-4246-9051-4d8a34f2e1ad", "comment": "Malware payload", "value": "86a3ef33c1c8dbb7ec12f4d64e53fdcfedfc4eb7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695418, "uuid": "b1476e77-d814-42a8-9841-64aa6169ca91", "comment": "Malware payload", "value": "fdc842a2b800dc4e0c240342b4307e1d062eaf0b13af158579af5a6d4202862e547574f5df3ebea2137bc5c51188cb30", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695418, "uuid": "af4c97f7-9f1c-49e7-b809-7293fa03e52a", "value": "T16DF40221BFD15355CB4E87F84DB9BC608378B4972854CB2E998EACDA53387D18720B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695418, "uuid": "32d06729-8cfb-489a-9d3c-8ce1e1db25f3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695418, "uuid": "ed968e29-761a-45ec-8623-408cb63ad252", "value": "12288:H8biiiE9WfXGd333Uw+T8N57CrhXgeeRzMjg5MTrNiRqNRLG:cSfXk33328N57ageeITcYL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695418, "uuid": "421b6808-62aa-43d8-a153-be4332b7d214", "value": 791552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695418, "uuid": "3a750378-b5c4-43b5-bb2b-5569ca64efbf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695418, "uuid": "ed329fbf-79ff-496b-a8fe-cd5f93196232", "value": "Introduction Quotation Request_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2045b816-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642665668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665668, "uuid": "4d8f08e7-9a66-4016-8158-12a0a311c1d2", "comment": "Malware payload (Formbook)", "value": "3c0760d2376c9b0682dcda10e220d5d1", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665668, "uuid": "06110583-1870-413a-bd54-945011b5c58c", "comment": "Malware payload (Formbook)", "value": "502c638afb839fa4c5cce174671eb19d7b8bde00b6b81ab61a938883cd7bc298", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665668, "uuid": "c69b1cd3-ff30-4398-9661-57f9d926e979", "comment": "Malware payload (Formbook)", "value": "f2e66332b4d35739a821b969a8aebe9fa13063cb", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665668, "uuid": "c9b30653-e655-44d1-892a-37db769b6bd5", "comment": "Malware payload (Formbook)", "value": "fe2f02790f06f02452d5889ca281f7185410d50cad847f139617e7ac14795339a7c400c735d30c66317672da54a68b04", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665668, "uuid": "fc2a7b3f-d9d3-4df0-affb-1c598f320eab", "value": "T1A8041240F0489425ED72E132AF677F0E9531EC19B069DDA7FF46732E29B88DC1AA0647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665668, "uuid": "43baf86c-49cf-4bf3-8e29-5e6f1033b69d", "value": "3072:NffEAML3EJQv1v21WdppTKJEEyd1FF0mKufcrfNpEEPCZxkryGl0TvjN19WKMV8E:REAMTEq9+4TPEk1fV9fCLrQxk2G2zNpY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665668, "uuid": "f1ae10cd-d20a-4c7d-ab6d-ffa848f521df", "value": 186936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665668, "uuid": "e74bd60a-f9fa-4976-8305-d4a01a48b9f7", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665668, "uuid": "0ba0c885-179e-46fa-917e-fa543dd7b4ca", "value": "20220120102820952.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90747170-79be-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642661991, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661991, "uuid": "89ecc9e8-9e20-4e00-8363-6f292cc608b3", "comment": "Malware payload (Mirai)", "value": "d3bcd7d304ca56b6f685073ae65fd399", "object_relation": "md5", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661991, "uuid": "0230eb1b-87c8-4bf3-99bf-dd61bb62c572", "comment": "Malware payload (Mirai)", "value": "50f798eb3aadfd6966a479b74dff730bc03901ca78792f77e570ee5393f45c51", "object_relation": "sha256", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661991, "uuid": "13bda0c8-5295-4116-9477-a3d4f0affea9", "comment": "Malware payload (Mirai)", "value": "ce33c18115e73f32e83c693cf51b8b2aa201e886", "object_relation": "sha1", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661991, "uuid": "182025f6-3041-49d7-a4bb-552bfb1e3c35", "comment": "Malware payload (Mirai)", "value": "e73ef0b5113e36797c8210cd322323d1988c4cdb53cc641ab9eed80a674cc31657dbc3d56a87bf6161cb95563e38182f", "object_relation": "sha3-384", "Tag": [ { "name": "CVE-2021-44228", "colour": "#92C2C1", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "log4j", "colour": "#B82EEC", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661991, "uuid": "7cbd48d9-4a09-43da-a1f1-76a9192aaa79", "value": "T107134DC4E543EAF5EC1502B43037EF365F76F03A602ED9C7C39995236892642E9472AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661991, "uuid": "46e33be6-545f-446c-b558-9a6abab958e6", "value": "768:Ms1yfBjf74x6DhdZMddQmJTy5GgOegYEu0ploF4M4Kj9nK:py5jf74x6DB8mmJTyXgY4ploFX4KjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661991, "uuid": "d6a41187-817f-4fbf-9947-f58942b87367", "value": 41744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661991, "uuid": "1ff429b7-187f-4210-bbb6-249a0d92e48a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661991, "uuid": "1c5dab70-bd1a-48a4-a68b-f7e5bec42752", "value": "Josho.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10347e90-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665641, "uuid": "6dd7bedf-d899-4a00-b0a5-e63e21273d33", "comment": "Malware payload", "value": "4d79d98120dc1e4b9fc06f19da02a7a8", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665641, "uuid": "2a84fa43-f19e-49aa-8b9a-43af6280fd6e", "comment": "Malware payload", "value": "5163d4448a8235d25621127c5d088d8cff42c4f1de18d3c171ed1cbae84dc807", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665641, "uuid": "a9d1b0e3-a153-467d-9711-fcbce0a2903a", "comment": "Malware payload", "value": "9dac5109eb8234e2d106d63dc06c1166ca42288b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665641, "uuid": "77640770-c796-4f6b-9fad-88ef8928b2a6", "comment": "Malware payload", "value": "0518bead061ce082e18ec4a6e30d56d838553dd1ff75f614759bf6a8fd4fa09c079655c2a7162f35ffc99376aaef4ef9", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665641, "uuid": "a1b4f867-12d7-430c-98c0-315f0b730401", "value": "T173B57D22F2C1C537D0732E38CD5BA3A89529BD501E28954B7BE41E4C5F397817E2A2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665641, "uuid": "75423f34-f938-49ad-a681-276a55d9c2cd", "value": "49152:4Of9D6XP99EaS563YehmjLOsTPU0ZU5YLEA:99D6XP8aSYIehKSOC5YAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665641, "uuid": "5e5ce148-6239-4849-9591-f946eafcf167", "value": 2328576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665641, "uuid": "0194817a-2802-41ce-9915-530e92e29937", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665641, "uuid": "56ae2e83-4c53-4dc1-83c3-520de663d9c9", "value": "_Contrato-1260740pmekstrsl.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0784f704-79bc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660902, "uuid": "d0825664-6f27-41c3-97c5-da9a9b542241", "comment": "Malware payload (RedLineStealer)", "value": "b22bd2dcdc0e5aebf9f9fc95eee95c61", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660902, "uuid": "dedb0fab-65f0-4311-b270-f2f945a947fe", "comment": "Malware payload (RedLineStealer)", "value": "5169eb4aac96b3333dcf7c0eb628a340f6997c65c54e8728a0f6c8501ae6742f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660902, "uuid": "4f16412f-18b7-47d9-be5a-3ef7460962a0", "comment": "Malware payload (RedLineStealer)", "value": "b76e1864b72d1828f9846c5b1acb240ef69a915d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660902, "uuid": "9b6aaf30-ca71-4f93-a58d-c06511448866", "comment": "Malware payload (RedLineStealer)", "value": "ab280154bd1242ebfdb4291f0042662b7b0cd954113aafdb95373cc0985a28a9cc37f00f7ce8e8cc7b1a15f7a75aed4e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660902, "uuid": "2dff9c35-c130-4839-8ccb-87875b2457dc", "value": "T1FC84E0E175C0D831C086A9308426CFB05ABDFC7568A4464773A53B9EBF332D2A66674F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660902, "uuid": "e8f7af39-42ac-4e04-ac42-ba366a72b9ea", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660902, "uuid": "5af22d0e-c22f-46d0-ad24-997c1198448a", "value": "6144:1v8LCW2YnpXr76KvGSajpp7WZjV8Ckm1rzhDTbV:+b2YnFn9lymHbV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660902, "uuid": "219a02f0-94b7-4511-a42b-7869a3b518c4", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660902, "uuid": "fef1df1a-b87b-4a31-8940-195e23ce5a19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660902, "uuid": "5c8b0059-0c3a-41ef-9717-bed3b88c1927", "value": "b22bd2dcdc0e5aebf9f9fc95eee95c61.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3f5e449-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642666426, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666426, "uuid": "c1cdf6a9-3413-488c-b25b-2e13234282d3", "comment": "Malware payload (Formbook)", "value": "c3121ef1568180084c67f2e7e56714e5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666426, "uuid": "29f971df-f420-4b7d-841c-c44de2110cc6", "comment": "Malware payload (Formbook)", "value": "517377e9b25075808b1192b4e85e09b19b739c1af884f5d87903cc2a7ca311e8", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666426, "uuid": "38132e61-a7e3-40bd-aaf9-c857b3f92fbc", "comment": "Malware payload (Formbook)", "value": "1e1e3c8d5100195abcefeb26fd8711b219c3c0ac", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666426, "uuid": "8719521d-fed5-4aca-923c-478b3ede91a0", "comment": "Malware payload (Formbook)", "value": "a122e60fe8c580ea33da3ae091486367ebad8d4631b0f1e94cbbdc1c4ebd1384306a6f86be81845f7783c13ff55b589a", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666426, "uuid": "9a024fbd-9483-4b3c-a55a-3063e7cfd0d2", "value": "T1D294F19417DAD615D9BA4BFCE4B5416403B8F2023163F70E27EAB0A43E637458B6237B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666426, "uuid": "85ee936e-ecd1-4bf8-9aa5-d0f38db6b7c6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666426, "uuid": "c6d48dd2-fc0b-4db9-b6bc-741af1e053c3", "value": "6144:urjt22xhPZsvgYYkznS1NbQxwJ5Q4MR1KCIafIy+8QDLaNRcLF:Ijt/0g54S7QxwJ64M9z6w+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666426, "uuid": "27e71b30-2ed2-412e-a125-8db6f88f2487", "value": 430080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666426, "uuid": "4d0589e5-98e8-467f-9353-2833e93e54ec", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666426, "uuid": "e6e75711-870d-473f-addf-f38e85730fbc", "value": "DHL HAWB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f804bfd5-7a36-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642713704, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642713704, "uuid": "26f28769-9640-4892-bdde-fd3974a8ca55", "comment": "Malware payload", "value": "2a79c56d99d3b1f6e43efad1f455f56b", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642713704, "uuid": "2a16e1e9-6aae-4cfb-bd74-bc229f2fbd20", "comment": "Malware payload", "value": "51dc452edd7c975ac8f632ad888d6cada4233c19aa061416076abbdb2ac596b4", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642713704, "uuid": "50fd54bf-520d-4b8f-a558-aabebebfbff6", "comment": "Malware payload", "value": "30e782c6d28f73f0b22752b0e07fe07a7e113dfe", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642713704, "uuid": "7128e707-453c-4f46-9e4d-88fcd7a248fd", "comment": "Malware payload", "value": "969fa3f737af293a0cb9e4d6721478936327765a17a4e3c2faf2299b0f15233dd696ab3eaa6458042506df4263198757", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642713704, "uuid": "51b177a3-2e09-4467-9caf-ed5b0a924534", "value": "T116636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642713704, "uuid": "5d1a017c-c633-4c0b-9d1e-89333ad69513", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642713704, "uuid": "c3d4f3df-29a3-4705-bc3d-12d9ed28063d", "value": 72387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642713704, "uuid": "cb570ae7-01c5-4229-8a50-5c2db0ab56ac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642713704, "uuid": "044bf670-fdaa-43b6-808a-f5b7607f39e5", "value": "2a79c56d99d3b1f6e43efad1f455f56b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a9a0882-79dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642675081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675081, "uuid": "be494ef5-c01c-4ca6-8d33-995229c88952", "comment": "Malware payload (Mirai)", "value": "e6c1f0521a7c2c337ae8a57d7ad6d554", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675081, "uuid": "3af7f844-3f1d-4f9d-b81b-fc1e3b4e10dd", "comment": "Malware payload (Mirai)", "value": "53046bdc9d3b9a20a39c7d92ab9bd2476bc5a5b574e1ce58e77bcc8d59c2a71c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675081, "uuid": "0f5d5478-dae5-40e0-a2db-cdbe1eab30e5", "comment": "Malware payload (Mirai)", "value": "e5ce3e8fa6412a1616d03baad50fd3317b06d89f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675081, "uuid": "12918c5a-d839-42ce-b2d8-abf62b1e45fa", "comment": "Malware payload (Mirai)", "value": "5297e8707792a39c103554069e1008564795dfc25992afe42d72539543dc6d83bb73b61e0710585011ea2b7c5f10af88", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675081, "uuid": "0293dc70-c139-4c87-9213-86702a484586", "value": "T1C2C2D139E10FF8F9CDBA0D323E4091F52733498E3E683558548EE652455983EA768ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675081, "uuid": "9db8c570-afa4-45f7-ba7b-10f8a79a6245", "value": "768:z9QPRgQ+YyXTuSYg9H4yLqQNTU5vyer+PYNP4uVcqgw09G:qgQVyX3vRLqKohyWiYNP4u+qgw09G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675081, "uuid": "8a77404e-6d28-45d4-82dd-1c443bcc5732", "value": 28112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675081, "uuid": "678a99ff-bd17-4a3c-80d5-0a971f323da9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675081, "uuid": "4c00e831-99a8-4ae3-9b1b-a8913429d98b", "value": "Tsunami.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0099ee7d-7a47-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642720591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642720591, "uuid": "1e6173c7-2444-4cf1-883e-8ff1bbd6c3af", "comment": "Malware payload", "value": "f771157149f98cd3f617b77050bb6502", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642720591, "uuid": "ee4b8217-9dfe-4308-88d0-048ca73d8711", "comment": "Malware payload", "value": "536582463c4d7bc11c931e61b72316d539e0b4ed677451ec3ab8942f6a02a040", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642720591, "uuid": "b7fb4d5d-cc0c-42b0-9b4e-10d27d0223e1", "comment": "Malware payload", "value": "e03dbcf2d825f75d684e06260b3a559503865db5", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642720591, "uuid": "84b55a37-3abb-432e-8800-62c4407d0deb", "comment": "Malware payload", "value": "1e6b287198f7767d0a2f8e202ebb22820af5246fe65d2f621e66776fb795e11c71cdec3526edea13852855b96d93794b", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642720591, "uuid": "20d7635b-67a8-4323-80a6-7f87a242cc99", "value": "T147636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642720591, "uuid": "21b4256f-5439-4de9-a651-18a05b0fa70c", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642720591, "uuid": "c4e96091-4e65-4640-ae6b-71a470509107", "value": 72814, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642720591, "uuid": "a1b71724-8994-4e5c-9727-6967671cc9c4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642720591, "uuid": "e6d3a39b-6f67-44a5-9a6b-d86fe1c8640d", "value": "f771157149f98cd3f617b77050bb6502", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e89dc098-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642669011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669011, "uuid": "70ca26ba-a094-463f-b633-88ffd2ef4b77", "comment": "Malware payload", "value": "1520517f81c367dacb0ab01e25b57b1a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669011, "uuid": "284e3f4a-171b-4c0d-874e-54b273cfbe74", "comment": "Malware payload", "value": "537de8c4c0d8c8b1f6f5fd5c89334d8e4ce8fb688cf5c99dfd887545e8f62d63", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669011, "uuid": "14557f87-3c61-4f2a-8b12-0276808f1ebf", "comment": "Malware payload", "value": "6842e7591727e2070c8682c288bbf2b506efb0ec", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669011, "uuid": "762717e1-06be-4c38-9b35-e5dd91c7080e", "comment": "Malware payload", "value": "c8b8f4623483606cfa7ac3f6a3011ed7e1b1d439e375acbd004675786a54b8006f90f1b9b4e2fff36cc517ffd6d3e3e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669011, "uuid": "992db285-cf9c-4843-aab8-ec7a6de440d4", "value": "T12B0633060B7776FED8DB56B7D261283801B4B558055B4827E337EF8387E950B4BEA702", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669011, "uuid": "f6ed1ffa-1853-4b02-ba8d-8d9a3e10a956", "value": "98304:zAHhNwhJa4BjKh5nIRFXgemFRj61mL5qBoOd:6hKfBK8RFHmF+BJd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669011, "uuid": "4859a55f-e099-4bce-8939-3d40f77b97db", "value": 3690687, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669011, "uuid": "fe66831b-d117-4c26-b3ff-c62775b5fc8a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669011, "uuid": "9640ced2-05da-40ee-819c-db9abcfed3b7", "value": "1520517f81c367dacb0ab01e25b57b1a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20863016-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666528, "uuid": "a34c06db-2838-4104-85b7-c0e6aa8e6f3b", "comment": "Malware payload", "value": "eb6cf9da476c821f4871905547e6a2b4", "object_relation": "md5", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666528, "uuid": "3b7cebe4-c958-434d-bcde-9fa764da6a6d", "comment": "Malware payload", "value": "54aac0840808311e3ab47f76f8ea4b5639bcaac49e3bb4e3c4c6fd6240c21590", "object_relation": "sha256", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666528, "uuid": "ef9d7b3a-0b22-455d-9986-60424387ac6d", "comment": "Malware payload", "value": "f13f0fbdbb653866307686f45c310532b50003aa", "object_relation": "sha1", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666528, "uuid": "b1d83481-5c07-4bca-843a-2271765f5c60", "comment": "Malware payload", "value": "9ec55887a464b542b7a4d2a14b241041b3a0b9860c19b39fbf05a5ec639cea444bc3e47321263362a7f58f933d65cd34", "object_relation": "sha3-384", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666528, "uuid": "a05f43be-adbd-4c41-ba2c-8f8c6571aaaf", "value": "T10C35337169439C1BE3DD4CF60F5B304A898E3C749FF3DE813696AE634060B4A5B50AAD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666528, "uuid": "35799a75-0c90-4da5-ae9f-48b7e12f4a11", "value": "24576:NUpJnLWC4ReRN1+3f2HmX86+A88kblmaKFYDUcrknAbVja:yrLWC4mG+H0KA88UIa4YA0ja", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666528, "uuid": "b1d0b56d-60ff-4c57-a023-763244526d5f", "value": 1100660, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666528, "uuid": "4c9a3b6b-2096-409d-aee1-45b034c0d328", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666528, "uuid": "8324dec9-ba4f-4b1b-9c09-bd78ec8eea57", "value": "DeliveryInformation.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b38c48-7a25-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642706164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706164, "uuid": "448fd3f1-9c80-478f-97e5-1d4c6a757417", "comment": "Malware payload (RedLineStealer)", "value": "e79d661a8055ff2c8bb5bb0deffe2f5d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706164, "uuid": "54223e0b-6f0a-437a-9be2-28e4f4c8f732", "comment": "Malware payload (RedLineStealer)", "value": "55478eceb82e68758ddcbd0d7268010382a399a00fd8cb91c63025194d515bfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706164, "uuid": "080f7454-8c12-4901-b225-7d0dca029668", "comment": "Malware payload (RedLineStealer)", "value": "aaa10c1b5810e3ffe51ebb56de077207c9a0cc9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706164, "uuid": "cc06348d-6e91-4f27-8ca9-539b4380f0d9", "comment": "Malware payload (RedLineStealer)", "value": "71f4a9ce9f14e4b0e659703522ca4aefc501cc83930211afc9ace44b6785a9977a0a089f6b0aa81e2fdf60ce7eaaa830", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706164, "uuid": "f8da1366-e334-4476-bd09-d4f4f5624b02", "value": "T1AAB4D42839FA5019F273EF759AE874A6DA6FF6633703A55E205103864B13E80DED123D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706164, "uuid": "5fd356fa-32b8-4fae-a19d-c9bb5896a3b8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706164, "uuid": "8682b497-c59e-49ff-b29b-6594b335a262", "value": "12288:f9CpVQt/O4r/+nIZeZqhniRiT1Qb0uelqU:f9geWwe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642706164, "uuid": "7d686b68-bf4b-4bf9-be75-19ad7fe8f8eb", "value": 539648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642706164, "uuid": "905a470b-3df7-48c7-b390-5f01999def67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706164, "uuid": "f3b984a3-9ffb-4e2c-94be-6d649844c30f", "value": "e79d661a8055ff2c8bb5bb0deffe2f5d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f5b20d1-79d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642672700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672700, "uuid": "8ab89595-8789-44a6-9d9f-b8793b34a903", "comment": "Malware payload (Gafgyt)", "value": "acf84db97709527712f89b12f2fda37e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672700, "uuid": "b6604615-9c79-4d43-b479-395cf31184a5", "comment": "Malware payload (Gafgyt)", "value": "55f4af51eb8a40f502e07a8ca7605575934182993799721f1d8f1eb61ee6fd5b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672700, "uuid": "f9b07a47-0249-456b-a91d-6ea014db440e", "comment": "Malware payload (Gafgyt)", "value": "bde3a8fb9c95bfacba5181130acbf97710911d71", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672700, "uuid": "34654343-de9d-49f7-a0f3-f60291611de3", "comment": "Malware payload (Gafgyt)", "value": "cae131cf759ba6157164a231f30287e1c4d39d5bb84dbf90e6933852ca24da8fa9e8ee208381dbf62228a9f8f1b21100", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672700, "uuid": "5e5b889b-3a1a-4883-8183-d81555f433f4", "value": "T1E9433B375692CA7BC0D757F517D796218133B8391F236209B3D8BDAA3F269C82E59302", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672700, "uuid": "5c6f5de7-35a7-4d00-9452-85226d2544c4", "value": "768:U2mQ1KeSZaLGjuL3GoxVbsVFWnyVZSgHo3Gk7IfuXYYYnC8439qS/DDrWMCLsZ:A6/HGSDjbsVFWmSg+7QClKNsZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672700, "uuid": "cfc47e6f-121c-4e78-932f-369cc6b45591", "value": 60197, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672700, "uuid": "65a1475d-5ab3-4fcb-b2d4-c9de1a0b3d30", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672700, "uuid": "daedf0ce-3f49-4d15-b8d8-ec590ca334f1", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8753150-7a01-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642690808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690808, "uuid": "a892f3d6-a124-403f-b681-bffe20f5a54f", "comment": "Malware payload (Formbook)", "value": "6d656f77b56cafe4c1684261b99f2aaf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690808, "uuid": "1f7de7fe-d67e-47b7-9ab2-fcb5a7711018", "comment": "Malware payload (Formbook)", "value": "5683bdb2fc2b2f0bfd524ea328ead3cb7d405f888c54a96fe05dff6ee4d91bd7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690808, "uuid": "4d289627-f111-4523-975f-d6dcc7e41074", "comment": "Malware payload (Formbook)", "value": "bc8d6ab10897163ca494c29a752ea4d9b1bfe778", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690808, "uuid": "bd7f8e03-b5eb-4bc8-b79f-66afaaac76ce", "comment": "Malware payload (Formbook)", "value": "76a8bd37edd6b262a5ebb014202821eb3119be1f70ff31641e54c5ed5745089b10053a1441defd1221d1552d4ea7fdcc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690808, "uuid": "14df87ea-2201-4f03-8953-1620e84e3518", "value": "T1A22512053778C224D92152364CA7C0FE54793C29BC93962B79E5BF4F7AB37B10E0162A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690808, "uuid": "126d64bf-4b9a-4102-a72d-c8afc3d35a66", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690808, "uuid": "fbf222a0-49f4-490b-b508-0fdf27992c99", "value": "24576:bHSDrYGPpZ0FZR/SyDhJbQl4BbOCa5am:byPNZ0nR6yfFUL5am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642690808, "uuid": "8cd31a66-c190-429d-ae3f-617322696f1c", "value": 975872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642690808, "uuid": "45d3401b-44b5-4795-a93a-4c81cc203c6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690808, "uuid": "4dcb76c4-6f6f-4024-8f65-f6d79ebde10f", "value": "vbc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c24a987-79bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642661420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661420, "uuid": "d86b2307-11e1-4b4c-b53c-6e702d35aae2", "comment": "Malware payload (Heodo)", "value": "fb35caa8d26a1e3c6376c57b7e563de1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661420, "uuid": "1cde01b8-1a75-48b1-8681-aa57cc1918d2", "comment": "Malware payload (Heodo)", "value": "568988be186f2035c720ddaddf1e94d748e543b76a6e0f8b1043eac1a502e2a9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661420, "uuid": "bf424703-00df-4648-95a3-5617e082d2ff", "comment": "Malware payload (Heodo)", "value": "8b977e7c2471bfc266d5e2a7e5885b1e4602ecf0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661420, "uuid": "70ee05b9-c5f0-41ee-99e5-31ab4a666ce5", "comment": "Malware payload (Heodo)", "value": "2be71bd8c4923a124d0547ce87a32b1bd01ee3ffb078e3bc6f3fd399001358c69a10d13af9f66de7359dbade9ebfbab1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661420, "uuid": "68968604-43d8-4aef-9b25-68a7be88cd0b", "value": "T141C4AD12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661420, "uuid": "cad0f7f7-46e7-4be6-a5a2-ec6f8df8e288", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661420, "uuid": "b4af973b-fbfd-47f5-851a-5515c4496798", "value": "12288:P78OGF+L8/4UUNyrEdMhTq/n4vAzdkPs7:D8Ody4aEdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661420, "uuid": "1bc048fb-5e52-46ff-9730-c69c282aebde", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661420, "uuid": "8a11e7a8-8e75-46d7-bd20-59788112d2f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661420, "uuid": "c28dc71c-b250-4185-9bfe-560b95b21f1d", "value": "emotet_exe_e5_568988be186f2035c720ddaddf1e94d748e543b76a6e0f8b1043eac1a502e2a9_2022-01-20__065014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df7a0a24-7a37-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642714093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "90c4a8f1-a459-4b1a-b32e-d15d111600fe", "comment": "Malware payload", "value": "25c5b9fd4997236bfcd5f5162c9717bb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "f24b8fec-64ab-4e25-8010-d2b13f934241", "comment": "Malware payload", "value": "56af5b0ff061b7c4da0ed4417987e1067a12fd7ec6d883e69b5773df5190f42f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "99dd1b99-471a-4abf-8c7d-b38304e4da83", "comment": "Malware payload", "value": "14a4c434196d4a40416f0be394bd843472605053", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "cdaab328-0703-4e2c-adc8-dde6baa74501", "comment": "Malware payload", "value": "2c955df6cf2d262971b41bd683ceabeb4bc7422f65ab7a4a2ebeb928167563eb6354ccb0c455759d74277fc6289c50a5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "17999691-ff6d-4578-af91-3a1729475d83", "value": "T1EAD4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "798e6f67-96a4-4fe7-b3fe-a83b46c4453d", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "0daf852d-ebc7-4f8a-af52-1397d4926a6a", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NvG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYDlVnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642714093, "uuid": "9a0bd1fd-bf9f-40dc-a117-772062fef014", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642714093, "uuid": "e55b0cd3-60a7-4536-b505-659d99e3edfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "714f294b-1906-487c-a24d-9f08f1cafa74", "value": "emotet_exe_e4_56af5b0ff061b7c4da0ed4417987e1067a12fd7ec6d883e69b5773df5190f42f_2022-01-20__212805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7415baf2-79db-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674399, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674399, "uuid": "35df861c-fd1b-4b25-9ec3-c2d6a2a0c342", "comment": "Malware payload (Mirai)", "value": "085a89bf604b162fd46a5d45d2125094", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674399, "uuid": "1279128d-63f1-4763-8442-f03eacaef019", "comment": "Malware payload (Mirai)", "value": "56bebd4b9558bb9f539022bd2c5e40aecfa8d59c09784de61d1ba92766e2a30b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674399, "uuid": "754bc0e0-8034-49f5-a0fe-c65fffb74a57", "comment": "Malware payload (Mirai)", "value": "417f4d981d56001b2ad54d2286fcc97afb067c46", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674399, "uuid": "292c0af9-821a-4f69-8544-6553eafcb1e1", "comment": "Malware payload (Mirai)", "value": "e312c28bc18a7e971c543e51929297059d845e9aa67226e0f75094310dc280333c45c906aa2783aabe823571b92bc8d8", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674399, "uuid": "86159b7b-285f-46d0-841f-8801292cd227", "value": "T1D1433A51B8819613C5D4137BF6BE428D3B2523E8E2DF3217AD222F4137CA82F1D67A45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674399, "uuid": "00c4f0ba-2cda-481d-8a17-506221646f9b", "value": "768:lP6aHxzAR6hM2uQBTPpdxnlILKU0vVONy5gGhd2G4NMiplImpcvwJZY10UPZvBqJ:0aHFAzgjjfUKU0NONy5gG+7XtJa10oB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674399, "uuid": "d461ac3e-2f95-4e29-b812-9ee4bb1d10f7", "value": 59860, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674399, "uuid": "93721c6b-7aaf-4bd2-891e-c2ad481ba40c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674399, "uuid": "306db37b-d826-48fb-9876-044f26dd5eb4", "value": "uYtea.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6341989-7a11-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642697676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697676, "uuid": "f094ae5f-a243-420e-869e-f6bbed3b3ffe", "comment": "Malware payload", "value": "ca60170f70b3f1001b462dbef1ef0ac7", "object_relation": "md5", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697676, "uuid": "9031ad0d-7fc6-466b-97d3-cdebc5ac9ae7", "comment": "Malware payload", "value": "56eb79d0a55b118950a2903b78e56e5e6b4a59c8ecc39085fbac8b05f5057cf3", "object_relation": "sha256", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697676, "uuid": "474b37e8-2220-4a74-a4f5-dfc47943a5c5", "comment": "Malware payload", "value": "c6a18d9d9b07882dade71174c12559c3b3a341dc", "object_relation": "sha1", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697676, "uuid": "340de200-1112-481c-bd79-0112de2ba89a", "comment": "Malware payload", "value": "019d684e9f0c9aa729b676d50910f63695fef82873d00f5beea4471fa96baba512c8988e70080bdf8b435ef854977849", "object_relation": "sha3-384", "Tag": [ { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697676, "uuid": "a55e45cd-3238-4115-9462-bdb759c135ce", "value": "T1F7810AAD070FD9FCE123AC88D5DA5A92EFB586210B2CE7C4CFA17DFA3405468D4E0859", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697676, "uuid": "2168f49a-bffc-4938-b338-effff606671f", "value": "96:rlB9iZpRGTzF89OLtIhOy0dBH4BzTXwHZ6FmxlKJ+VI:7zzFUaKszHqzTXiMFme+2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642697676, "uuid": "cf558a51-baa0-4f28-9dea-595c51676bf5", "value": 4185, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642697676, "uuid": "a531c76c-5083-4d06-867e-4df5e41763ff", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697676, "uuid": "86faea02-31fe-4fa3-8e60-a1319188c19f", "value": "MBR_24442589.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "58f97699-79d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642672635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672635, "uuid": "6d1c0dc7-8359-4aeb-9c2a-f3bb4fae5715", "comment": "Malware payload (Gafgyt)", "value": "dca8e03a90ba870187ac0e0c04f1f7bf", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672635, "uuid": "81310270-c0f3-47e7-b866-aad44968cbac", "comment": "Malware payload (Gafgyt)", "value": "57a859d5caf210637bf5112580c39f602ef7ff2020893a56a4251a63929a14d2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672635, "uuid": "a7d7c87d-1c9b-4623-b0fd-609d0d0ed285", "comment": "Malware payload (Gafgyt)", "value": "dca95d321f03563ec25f199b3f353085d3c79c27", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672635, "uuid": "7fc7b5a9-f6e4-48f8-bdbe-6240f5033510", "comment": "Malware payload (Gafgyt)", "value": "72741f9fada8bc6c0bc0e979326cbf408faa49c5a3949d2ca571a50aca025f2489bece3e798c801a4dfc7031c6ded3d3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672635, "uuid": "42b386a3-fc78-4999-98ec-81c04653389d", "value": "T10C531B46F9408B17C1D32BBAB7DF47583B366A54D7D7330165297EB42B837DC2A2A220", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672635, "uuid": "c22ee728-83c6-43a9-bbcb-e4d1bb0aa4d7", "value": "1536:arBtZ5MouctDrxMqvsnLUTzbGZWgKADDH0o:QuC1snLp1KCTn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672635, "uuid": "41283d69-9cb8-48ab-b401-05f84053569a", "value": 66592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672635, "uuid": "ce996025-616e-4109-9af9-f2314fded0be", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672635, "uuid": "8770df5b-3b69-4eea-8ff1-233a5e6df12d", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0750221-79dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642675467, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675467, "uuid": "ed538867-2dd7-4296-8654-22fa7e7ad405", "comment": "Malware payload (Heodo)", "value": "f06722729a45e266b3c1070597e2bf42", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675467, "uuid": "98009a01-fd5c-4dc0-b44f-3eb22fc7d809", "comment": "Malware payload (Heodo)", "value": "586e224b3318cab7302593d796161ac68658fde8b22259b5d2151438239e566f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675467, "uuid": "8f04175f-eeaf-49fd-bc45-115b7da57bce", "comment": "Malware payload (Heodo)", "value": "0495d0b8d1bbc013fa84c9808a8e3d87b590febe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675467, "uuid": "e044c5b6-0074-452d-ba77-b525e0b8159a", "comment": "Malware payload (Heodo)", "value": "01aef0f4dfd8970e48dc1417167ebe1ae110d27572c05485a1421334122820c7db85f9484a659c7a3810eb46ed625f59", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675467, "uuid": "ed4a763d-3f34-414a-b7d3-f0989f69b6ab", "value": "T199E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675467, "uuid": "e9d63f08-d6c7-4893-89b3-cefee5caf7fb", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675467, "uuid": "e5569ca5-e12e-4d2d-8970-29b9d325132b", "value": 145454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675467, "uuid": "1da8c0a6-8305-4ece-bff0-8631e2f6de98", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675467, "uuid": "58e03b90-e74e-4702-a25e-1e8590b07eff", "value": "f06722729a45e266b3c1070597e2bf42", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80493958-79ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642667118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667118, "uuid": "35924554-87e5-4267-890c-1c804fca9722", "comment": "Malware payload (Heodo)", "value": "16af573e52d7a49a137e701abc860f9d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667118, "uuid": "21a5a7ff-984f-4456-992e-699fdb0340a9", "comment": "Malware payload (Heodo)", "value": "58fd2a2a2bb516283b61d6251b7ffda228608b830cb5b6ef23ecb0f4c3e12517", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667118, "uuid": "b46e92dc-7336-421f-9b9d-9e477efabe1b", "comment": "Malware payload (Heodo)", "value": "23caebe934f6e7760c7e62b19949f6aaa7eaaa37", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667118, "uuid": "790ea082-1d73-4c5f-acea-81d66b704830", "comment": "Malware payload (Heodo)", "value": "4f77544d9b4eab38f4a07415b7c1830971d948c48edfd141c7873fdbb71e46daf2db56742d1163f1fdb236f8f941915a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667118, "uuid": "586599af-5d7b-41e4-b049-2bef8a95d105", "value": "T1ACC4AE12F7D1C07AD1AF12356A2A9B9C63B5BD619DF1C20BEFD53A4D5E306428F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667118, "uuid": "d0f9ca95-594f-4821-9543-2dd442ed289d", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667118, "uuid": "9670278d-bf6d-46c0-be1d-b3dc0924830a", "value": "6144:5Ig427JC2jW8j6bzhO5vDynHoIoxoJ0CopGEfrdBHEUXZXbej1BC3OBtNCkiFPs7:5D42+8jM8WIIU8Gr8IXbeDCxBPs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642667118, "uuid": "357d54b3-3c47-4fb1-9bc3-d2273d6aa247", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642667118, "uuid": "008ddbf2-5950-4f7b-9892-f3713a245767", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667118, "uuid": "512ef259-9a39-416f-9049-342614425b8f", "value": "emotet_exe_e4_58fd2a2a2bb516283b61d6251b7ffda228608b830cb5b6ef23ecb0f4c3e12517_2022-01-20__082513.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "815e123a-79f5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642685588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685588, "uuid": "469fb79a-620a-4e32-9dda-87761dea67fc", "comment": "Malware payload", "value": "a5cbdd259527a635a3c06e90d5607dd0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685588, "uuid": "39d9b25e-3be1-4c3a-b148-a836baa84631", "comment": "Malware payload", "value": "596445c91248a0b1f58feaa8b365fbc4347c9a81d12a7549f8a274db3affc020", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685588, "uuid": "705c303f-8cae-435f-8f59-e9d456e9f632", "comment": "Malware payload", "value": "bba6d4ae0c75807e4eb36fc13fba357817a0250b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685588, "uuid": "be8ad3ae-bb3d-4884-9b15-b0305bf01c5e", "comment": "Malware payload", "value": "563701d8d68c9eae0e0a204a486824477edb9d27319541fd4a51f83d9d9c97c9bfca36160185b0e79c94af1e05f05491", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685588, "uuid": "e227cdbb-bd62-437a-a2a4-bd4883cb7be5", "value": "T19A15F8BC312436DED86BD2319B685D68EFE0787B830B9117A41B25ED891D987CF250B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685588, "uuid": "f539fb04-987d-40ef-997d-235235a68676", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685588, "uuid": "3ab4df3a-c3de-40b4-a70a-fb9a06d19f03", "value": "12288:7h0viVeA2SpklRvPJ+0hcyrIaifGc1ic19hTBLrKaIam8nURSsgkV8JEFftmvXnv:F0viVV2mklZPS2ItfGcQczjA4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642685588, "uuid": "b7712dd3-0932-438b-b630-798d41b18be5", "value": 893440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642685588, "uuid": "22a31101-c9e6-4ec0-a117-79d43b8e930d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685588, "uuid": "d5c58284-6a21-4db4-b971-279dfc4afd78", "value": "SOA JANUARY 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be33da0a-79d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642672376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672376, "uuid": "78866568-4e2a-443b-8b3e-428cdbe7744f", "comment": "Malware payload (Mirai)", "value": "a54ec41d5d5b9109a72ce31f195fb310", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672376, "uuid": "6888e78b-3fa0-4f64-81e8-30899de3de09", "comment": "Malware payload (Mirai)", "value": "5965c4b86f9ab0f8c06829bcb75fb868f04522094a47e411766a36fce3c14098", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672376, "uuid": "bd981224-d4ee-456b-af19-f105172caff0", "comment": "Malware payload (Mirai)", "value": "a055fd056e15713248552904c659b36213f78455", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672376, "uuid": "c2a69ba4-2ba2-4333-969f-f3073ab559d5", "comment": "Malware payload (Mirai)", "value": "88e4f3c660feec5d46776974c38151c23abfa47305bd8dafb3723db29e0047f2999d7aa7387b1d65d8721ec2a60f5dff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672376, "uuid": "5efed39b-de13-4e6f-96e9-1a011cc8a616", "value": "T1EE547526F60145B2E1580DF1356623D87ED9437F9E6626C3E52E49B4FF3281A01FAEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672376, "uuid": "225e97fb-0269-4f6b-ab8d-8ea830b5c456", "value": "6144:odgIwfk/o4MXdZCSpn0UpQKqUgAZ08kjUYbC+Bbovm7/L7QsvmGfIiNb:odgI+k/BjXbV6vm7/L7hvmGfIiNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672376, "uuid": "60490f55-6fae-40a8-ad03-9af7e6dda883", "value": 306104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672376, "uuid": "91f2bca5-4df8-4ad5-92a8-ceda8f3674ed", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672376, "uuid": "23892450-3b33-4a73-9f71-78364acaef0f", "value": "armv5l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4bc1db92-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660587, "uuid": "fc9fe469-1d84-496a-b232-bd2afbbb3055", "comment": "Malware payload (RedLineStealer)", "value": "462d9eb4ed89b1c24e5ced9054fbec5a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660587, "uuid": "0e672930-ef48-4365-8712-8b5988ae0813", "comment": "Malware payload (RedLineStealer)", "value": "59a962cb589533aa961eea182c1d55846502a8cbd1930d5290ab05f3a4ff82a4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660587, "uuid": "2ee9cda0-d108-47e7-a1f2-0ddaf0d81a46", "comment": "Malware payload (RedLineStealer)", "value": "14f41b754e0f6230283994929dc4360c50eb3566", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660587, "uuid": "ecbcba33-28b5-4aee-8a0b-3a1096f0a74b", "comment": "Malware payload (RedLineStealer)", "value": "471a7282cf5b38976c5e42db875e208934b14c20eb4985480f1da9ddfe5bc35b41ec21bf0f4b9392f856f526911da4b3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660587, "uuid": "1d24ede0-cada-4780-9510-a47992e80293", "value": "T1C694E13135C0D472F49625314819DFA15EBDB8305A649A4733E82B7EBF623C05AA63BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660587, "uuid": "131e5dbe-9673-4ae3-807e-b8f61f69b29f", "value": "b599c41ba6f3d2fcbb28babbce596599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660587, "uuid": "777f0dd0-6c59-494d-9870-6fe5501990fd", "value": "6144:tiNcwxc9cDWw320kRBiEAEBtl2Ya6/qeShFewE:o+wxc9CW4yRHAEtopexB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660587, "uuid": "c584d468-b250-43e7-bbe4-9c06b00905ef", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660587, "uuid": "d1fe9cb6-f6b2-4662-b145-2498e3330510", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660587, "uuid": "bddcf53e-3037-47a1-ac58-4fbd6296f604", "value": "462d9eb4ed89b1c24e5ced9054fbec5a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c66f4b7-7a35-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642712907, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642712907, "uuid": "170fd2e1-2c75-4b21-b7ac-af07444431cb", "comment": "Malware payload (Heodo)", "value": "74ae7c40cd48622af454308013fc7864", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642712907, "uuid": "e85497dc-5db3-426a-924a-988665c80194", "comment": "Malware payload (Heodo)", "value": "5ba1e7e7b37d9efbafaaa5049277348349998f11e6252edb0aa7fcc37bf94c99", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642712907, "uuid": "9eb90f26-63d1-4c11-9db6-0995b0a0db0e", "comment": "Malware payload (Heodo)", "value": "42033ed962957d68e428875f732b55fe179b811c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642712907, "uuid": "a6fb2a25-48d8-4303-9603-09a776b149ad", "comment": "Malware payload (Heodo)", "value": "ed1826a323b120ebd8f7471e2e965e5e470be45a3d7b8c2b52e8aa896b7051871af79eac10ee2cb5faab3d52ae3bc5a3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642712907, "uuid": "8045046c-90c6-483f-9e29-8625675393cf", "value": "T19B636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642712907, "uuid": "c124397a-9c6b-4e2f-9d2a-c7048bc40f1a", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642712907, "uuid": "207c0c42-5466-48b4-b6a6-f8277c61c760", "value": 72504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642712907, "uuid": "a6116678-fe8e-437a-9042-9d280c1b5acf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642712907, "uuid": "ba7579ad-1ca9-45d1-acd9-1a6aaa0bebd3", "value": "74ae7c40cd48622af454308013fc7864", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f153e2b-79f9-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642687141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687141, "uuid": "70ec81d1-ed76-4cc2-9c8b-192ee3bf9561", "comment": "Malware payload (Formbook)", "value": "5b50768dac4d66d5994925f1528d86ce", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687141, "uuid": "2f665dc7-392b-41b0-ba34-38067a7cfcad", "comment": "Malware payload (Formbook)", "value": "5bb063ee2622e4f4e0d61535b8ddc6acd3e5674d4ef098bb4b595f1bb61b847e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687141, "uuid": "4b2899da-5f20-4c27-aa6a-d218215ca4ea", "comment": "Malware payload (Formbook)", "value": "2ef3642f6d1fad8bd36fec02aaa01f707330a06a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687141, "uuid": "8f802dee-36a8-4bf2-90a6-3242f3bdc814", "comment": "Malware payload (Formbook)", "value": "85bc22a771cefae486cf36369ce09511796bae4a42d36a84497410ef7f28ed93157a979c487f93dd66f2743dae1c2758", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687141, "uuid": "fb287461-88c5-4d27-ad81-7e8166ac83f6", "value": "T1D7542307E1CD9DBFD0834EB4257ECB7BD33C7A4503B01887B7102F86A9951D6962E1AA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687141, "uuid": "3014fcba-4bae-44ec-a552-d7eae9e2b2fb", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687141, "uuid": "9ae860b8-2732-4645-9939-a87c1b99cc5d", "value": "6144:owhpkCZlPznuuiXHuzc7Apz1JKzLCvQEgrA9J5+tK/qkP+8t1e:9p9buDXWqLQwu51/qi+Q1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642687141, "uuid": "63f03385-4b88-42e4-97c2-b773f6f15dbb", "value": 284335, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642687141, "uuid": "d3e787af-6a59-459e-af56-0c759794ce2c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687141, "uuid": "ec49fa93-6c2c-47db-9127-189fb4cdec38", "value": "5b50768dac4d66d5994925f1528d86ce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce408e65-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674980, "uuid": "0c88cbab-e1ef-43b3-87bd-b0fb21c3c211", "comment": "Malware payload (Mirai)", "value": "b51784d2965e13ce72625143c10deed9", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674980, "uuid": "64827b56-a278-4f4d-82ce-1e0bed9f264f", "comment": "Malware payload (Mirai)", "value": "5bfeb3e4370e7706c1d428ed0deedc54c5f16108fea76391b61e6335affeca6a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674980, "uuid": "ae53372a-2583-413b-a31f-4efd68cddfcc", "comment": "Malware payload (Mirai)", "value": "b43a08bc7c0f8bb32bc8452549b170595619cf08", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674980, "uuid": "c9b5b91b-ee24-4d32-820b-a29e035bf5a7", "comment": "Malware payload (Mirai)", "value": "05ff040635b26cad6537543af11950a2f6c12a570a651e5dc1255375b8b603b873d5df7274e4a991745af3735815a0f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674980, "uuid": "54f79df3-b15e-46be-bc5b-eaf800d0556f", "value": "T1A1935D27B552C6BBC08752B42BDFEA615833B4BC0B32720B33D47DA52B259D91E6DB01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674980, "uuid": "687c38d9-13a8-4f22-8ff3-a075ccbd4397", "value": "1536:W7uJtxNeVE8zV7aDlvhE1hmkJ0S36W6bWjK3LyPXfH0mA+KWOXFseaZYxe:4SsVEeVMlpmXJ0O6WpjK7ifUm/KWOXFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674980, "uuid": "a1441be5-5918-4c32-880f-a440559bbec8", "value": 94679, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674980, "uuid": "5bdffe87-9cf9-4764-86bf-397c6fb678b5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674980, "uuid": "cb3eb484-54a8-4dd5-bb01-83c779ba04ae", "value": "x-8.6-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33ecce2b-79be-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642661836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661836, "uuid": "e10cd501-f67d-483f-b21b-366076388d70", "comment": "Malware payload (AgentTesla)", "value": "3a513751269bc0ed6ad80a450be9cd38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661836, "uuid": "86b26ade-b94b-433e-a123-bf75a57d26ec", "comment": "Malware payload (AgentTesla)", "value": "5c32a6274a0a7bd4e25bc4f55d8b27f649b99bfcc00b325462c2b413fcf1e95b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661836, "uuid": "b446f05a-8740-4c4c-9a45-56609715de62", "comment": "Malware payload (AgentTesla)", "value": "0db36bb40c58630316dbdb655ef3245ecf21213a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661836, "uuid": "5c1be949-06a3-43e2-a7c1-5f27339f0cf8", "comment": "Malware payload (AgentTesla)", "value": "fb59297f7642e9edb4a02fad85b5b437335fae6f1ac48df3fc1d5663f8727de8de835419bb2a98a1b972dc388f684ccb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661836, "uuid": "9d0d6acc-244e-46ab-a156-b2d249b5744a", "value": "T149A4020577FD776DE1B98BFEA162520047B678A6A412E34C0D8AB4DE2677F821601F33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661836, "uuid": "6dfe0f24-4cf5-41c0-926a-d5e8f93cd8f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661836, "uuid": "36926d33-a64a-4013-9281-c5b30660942d", "value": "6144:v82WLF3neQlDzoYkqG0bLbSPRqa/X9RcTJ08RaN1EUnBSpPcz+ijDD0nR5O6iecG:Ep1kBRqa/X3cT+N1EIT++f0RxieVBb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661836, "uuid": "d004ef37-16e9-4668-ae5f-b92d6733450b", "value": 450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661836, "uuid": "e484e4c0-ee22-4acf-92e5-9ede8b06bea3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661836, "uuid": "a7bef16a-a240-402d-bc72-d337e9f5aac6", "value": "COMMERCIAL INVOICE, BILL OF LADING, ETC DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c6b229e-79d4-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642671219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671219, "uuid": "5deaee0f-b025-4a7c-9119-8f7c56ef8374", "comment": "Malware payload (SilentBuilder)", "value": "7c7b196f115448bf4bfa36e7b7817e1d", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671219, "uuid": "a1c48906-89f0-44cd-9626-839a8cd444c8", "comment": "Malware payload (SilentBuilder)", "value": "5ca0d333916a14824f0434d5c88430e1f929f2ada4da94f2b1aa4deaa262d132", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671219, "uuid": "5ed9cfc6-09e0-4486-855f-59b48605491e", "comment": "Malware payload (SilentBuilder)", "value": "1d42ff636756c7b8ebf8a844d39b04d85556d9b3", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671219, "uuid": "7b87bab8-4600-453b-9998-3c0269829a89", "comment": "Malware payload (SilentBuilder)", "value": "6787e2c4f5c3269d44b10606968c551bc7b3088645643e609bf0fcb585408620b6c10626438eb47e26ba95b72432435a", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671219, "uuid": "2f5a479f-34c3-458c-8cad-9ecfaff5168d", "value": "T1B5E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671219, "uuid": "22876cf4-c535-4bc7-bf5d-a5f3a3907bca", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642671219, "uuid": "cbac66d5-52b0-4ff1-830c-e69525a40533", "value": 146088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642671219, "uuid": "b7338d3b-3306-4286-a5a0-d1e0819ed6d2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671219, "uuid": "b682a641-ba22-4c2a-977b-5e0fec4ee3b6", "value": "7c7b196f115448bf4bfa36e7b7817e1d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a151a6e-7a2a-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642708393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708393, "uuid": "d9f2bacd-48c3-4806-a8fc-9bfa45dce963", "comment": "Malware payload (Smoke Loader)", "value": "d525e15360eca3fbec935b173e316d50", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708393, "uuid": "7eddd92b-7a8d-4955-a8bb-71e35df4f8d8", "comment": "Malware payload (Smoke Loader)", "value": "5cf79e2271db3a5a25c9273f00e0ac0eee696a8c572f41bff84fd629c5651e93", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708393, "uuid": "c76f0551-40ee-4639-89e1-60c83d75e3de", "comment": "Malware payload (Smoke Loader)", "value": "aaf192b14d7bff009db42df6071194f77b965c06", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708393, "uuid": "e8f351a4-832d-4c09-84cf-d84610a7d8c1", "comment": "Malware payload (Smoke Loader)", "value": "02cf2443ca50efce84b8e8c8131b08593adf7c39ae9e1c5eaa2ae1a060a1d1aace1e2f6854f097d5da96b6ee33dad30c", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708393, "uuid": "d565333a-41c8-48e6-8adc-a1555b8d446c", "value": "T1D6349E71FA40D072D086553058AACFA05B7EFCE25F61C64773992BDEAF322D0666620F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708393, "uuid": "89e2a99f-f80b-4dab-9223-bda786ab0495", "value": "29340e6ca7cc3b9eb89af4981d5214eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708393, "uuid": "43503c40-8cc3-4cc9-be00-4ba4d43b90c4", "value": "3072:Aw4Gz9qLgQVJ0IEml55UaCl343m25s1r+J9bM/h3:Aw/MLgI5Em5U5l38m1yJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708393, "uuid": "bb93cbea-4d8a-45c5-bb1a-bee970717dbc", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708393, "uuid": "bfb5110c-98f3-4b35-bd63-97f0058a3318", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708393, "uuid": "1e71f2fb-4623-4565-88fe-c71285bc40b0", "value": "d525e15360eca3fbec935b173e316d50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3d3a51-79d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642672431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672431, "uuid": "30d59c33-f40e-4b6e-ba0e-8b60b1993096", "comment": "Malware payload (Mirai)", "value": "4dd4e60d2ddf71102b7c29828c98276d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672431, "uuid": "0e8cc4b6-97c8-4f85-a0e7-c7435c816505", "comment": "Malware payload (Mirai)", "value": "5d09edea565b78a98eb80649661a73b58abb94e0388e5feed9717afe8c4477a5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672431, "uuid": "954784e7-b8bd-4311-805f-e0cc3f5187d2", "comment": "Malware payload (Mirai)", "value": "891dbd7a97c608c29ca27f4f0571d2cb9badce05", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672431, "uuid": "8d3ca501-63df-4d71-bbd8-158ebee85be4", "comment": "Malware payload (Mirai)", "value": "5087ef5392e8359654edc25405a8ddbd6b89574aec1b3ef2b3fcc5f659121f6850286f12574425e61e1dc96fa01ff4d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672431, "uuid": "06a8a203-bc95-414f-a031-9055fa5c2872", "value": "T12F647537F70245B2E15C48F130A723A4BDD983BB6C2916C3E55A49A5FF3284A11F6EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672431, "uuid": "386e9ff7-0061-476c-8fc0-ef659e13f1e9", "value": "6144:hG4t3lv8HNZCC5Xk0pg6KEQQZ0s0DkBGjmm/QMurB1nKGNb:hGClVDbjmm/QMurB1nKGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672431, "uuid": "f95863b2-bec0-42b2-8b72-ff5dc9819b54", "value": 315011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672431, "uuid": "24030d95-357c-4d8d-ae3f-43d4623193d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672431, "uuid": "79113cd8-c247-4b28-96e0-8e009e6bdcd6", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c1d47c6-7a32-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642711805, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711805, "uuid": "479ea90a-defa-44e1-82b1-6761c4de428b", "comment": "Malware payload (Heodo)", "value": "f3e1ae9aee3a35093e9a6a10c947e97b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711805, "uuid": "af84e384-36e7-47f5-8f14-6716d289f499", "comment": "Malware payload (Heodo)", "value": "5d372591b1e8b3107e0e57ec3a38f1d2bfd43afef5f04bee85334f46f57d71bd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711805, "uuid": "4c7f9727-6442-4d1c-92ed-ac31a7ea32ce", "comment": "Malware payload (Heodo)", "value": "df1f74474ac185f515c6670b3e1455ea6747e25b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711805, "uuid": "5bf3383c-d492-4280-ba40-146a6c96ff4b", "comment": "Malware payload (Heodo)", "value": "a4875b41d80e91124c51375feb3b6a769063531ef12a678c68c21b298843fc23ccadf005d9eb81f8eca092a9e8e5a8b8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711805, "uuid": "44630f39-4f2d-49e0-9182-39628a5e589f", "value": "T181E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711805, "uuid": "0e1426a0-1475-4ed3-98c9-9a8c4c5c92cb", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642711805, "uuid": "edb1dac3-3112-4b1f-964a-d4faf8338c5c", "value": 144977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642711805, "uuid": "ee812dd1-69f6-4ee1-81fc-366f5354fd53", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711805, "uuid": "18166918-39ab-4b0e-b83c-810b865f485e", "value": "f3e1ae9aee3a35093e9a6a10c947e97b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f9d1878-7a30-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642710738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642710738, "uuid": "0c82878b-0c79-4ea5-a5ad-3b328ad76f36", "comment": "Malware payload", "value": "021ddf6034597ef3dc3bdcf3b92e614c", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642710738, "uuid": "ce1c88a3-60d0-4588-badd-f161430d5d3e", "comment": "Malware payload", "value": "5d6ba77bfd649ae36a50df3bd458879fce4c5fb04a2dfbfbd64c927d086e94cd", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642710738, "uuid": "249d9a30-dc9c-4598-a2a7-6d5dce4667cb", "comment": "Malware payload", "value": "85895da39a96279a3b797c001b5bce7afeb51247", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642710738, "uuid": "56549450-f038-4181-bda2-1e306514a4f6", "comment": "Malware payload", "value": "107749663f8ccbe9abeced3ab43a887a2d6139d4497c254a6318d91bb1a1945951bde8e17b9718a2995f96d00f81b6c0", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642710738, "uuid": "539622b8-cea2-48da-a80c-5cf6cafa1d20", "value": "T13AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642710738, "uuid": "578fe2c4-da10-4850-9192-4c2d6cb815cf", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642710738, "uuid": "69e0837d-7ce8-478a-9c0a-398a645e79f6", "value": 145274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642710738, "uuid": "49db9382-3e59-4473-be87-7f8cc1331f2d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642710738, "uuid": "acbac822-c016-4170-9c5d-3a22dcf255a0", "value": "021ddf6034597ef3dc3bdcf3b92e614c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65e282c0-79c6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665356, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665356, "uuid": "b3eee28d-e421-48e6-b2de-87c0c5a635d5", "comment": "Malware payload", "value": "b614d9872fe70657e14726ee13715f11", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665356, "uuid": "78b02442-cc72-405f-a03f-e09c1383d265", "comment": "Malware payload", "value": "5d78e5463c152615ffe7f151cce16d0bd8ce43e02019a356ad29ee1cff551f7d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665356, "uuid": "ceeccb05-9d23-411b-8cb7-ab4cd5072183", "comment": "Malware payload", "value": "fddb11613578d4f68d2ee8ee7b809e2079bb7d9b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665356, "uuid": "5c44d39c-0b47-4d7c-a07a-a38aef4ba857", "comment": "Malware payload", "value": "3bbcd5dbf6f7411b1542259439134e9e2bb239c7603d321562e6a2b6f45636603b1789633bbc904bcf8cb0c20d6fccf6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665356, "uuid": "e8f58fd7-7eae-4691-bd72-818fbd586432", "value": "T139645D23F7864EB2D59F037235D9432662FAFC244BE1A3C357CA661E9F286D31A32541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665356, "uuid": "0884c7c3-1ee2-4a0b-b0e6-08d77e7a0613", "value": "6144:ReNh9SB5numfrS/VF0YRIxBVEgM2ZPwr8Gk8G2fhrS/w25zY+dcPGm+gjZ+SW2V:Mlp4PwrPTlZ+/wKzY+dM+gjZ+UV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665356, "uuid": "0bccda21-8e6e-4a92-bed0-e082cb24bac5", "value": 327748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665356, "uuid": "f3a1f940-7b77-4344-8bc5-61fabd4c0a10", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665356, "uuid": "6b700724-ae3c-4ae3-a414-ad8885db975d", "value": "b614d9872fe70657e14726ee13715f11.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "faf213cc-7a25-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642706408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706408, "uuid": "fad6ef05-8ef3-4969-967d-0389b6607afb", "comment": "Malware payload", "value": "ee392eeb32913fd07992de655b708865", "object_relation": "md5", "Tag": [ { "name": "PowerShellDropperXMRIG", "colour": "#75E729", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706408, "uuid": "7a843663-d5f3-430a-bae3-fb35cd51bc40", "comment": "Malware payload", "value": "5dfae09ca27d85e3e71f78d21b7b79c8b7250379f155cc332bf471a4b8265017", "object_relation": "sha256", "Tag": [ { "name": "PowerShellDropperXMRIG", "colour": "#75E729", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706408, "uuid": "154b2a3d-d4c9-4853-8095-e73ee5da8151", "comment": "Malware payload", "value": "ce6ae0ca18735355bf4a5408eae3906c955173d5", "object_relation": "sha1", "Tag": [ { "name": "PowerShellDropperXMRIG", "colour": "#75E729", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706408, "uuid": "e9202b72-61fd-4c4e-82de-c1622bf9432b", "comment": "Malware payload", "value": "32051355b243092b72966c4019cf586431bceef2bb37d961ccd1749eb4f5905c914114df0400132d33701a4028fa7611", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellDropperXMRIG", "colour": "#75E729", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706408, "uuid": "6ef34f3a-372a-43af-bc25-bb485a608841", "value": "T1E7E068726996FA38CE81B0E4A067A481DC35952AADD1C49111BEFD1881E1F39CBF46E3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706408, "uuid": "26689f9e-dfc8-49a5-92ec-81c71cabe600", "value": "6:s8qXS1fo+/qOpBRdffVHMG1s7/VnDRY2WrEs/mAIuntOttGaVDl:s84S1w+1nR1NHMG1szIRu7un8qeB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642706408, "uuid": "4a56db17-a6f9-47cc-91e2-61f091d8638b", "value": 393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642706408, "uuid": "a766accb-371a-409d-a1c0-e9b02b308f7b", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706408, "uuid": "7c8c5db7-5675-4adf-9ba3-b21e47a357db", "value": "VG0jspha.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2342dfdb-79d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642670827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670827, "uuid": "610b9cbf-20b0-4316-b467-e544fafcf8a0", "comment": "Malware payload (Mirai)", "value": "6847ac46b9adcd73441d14a637a1f05f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670827, "uuid": "c893f561-e4b4-439d-a809-5c1c1646904f", "comment": "Malware payload (Mirai)", "value": "5f1596017a9fd83a340a82bebe0919f5c6e6f5126b842670f165f236d43aefbb", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670827, "uuid": "710a9b37-80a6-4561-a847-8ec6c9131ac9", "comment": "Malware payload (Mirai)", "value": "cfe6803ea07c7caf04b5d23aea04e8349a5a8438", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670827, "uuid": "9030e499-917e-4f07-8595-459e7693c26d", "comment": "Malware payload (Mirai)", "value": "3cd7b249de8fdcb52dd18981b3605ec9f42485998268c2ab451479b63a39effb5bbcf7c4189c0c7091b5a021a5091ed1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670827, "uuid": "fc567756-9658-4daf-8622-efbd6b8ce271", "value": "T1CDF3A53E7A21AF7EE168827107F39F70CF9529D326A19341E26CF6185E7128D0C9EB54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670827, "uuid": "d5b32671-878c-4b08-b845-6563fae35fc5", "value": "3072:B7esBFP23rWfOB7ZOOyGSWKmrThPaLEne7rNb:1euCloGSrmrThPaLEne7rNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642670827, "uuid": "41a677fe-5afc-40ca-bfc3-215c492e16d4", "value": 159493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642670827, "uuid": "1de81aa4-ead1-48ed-b95e-68ed59040242", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670827, "uuid": "8b710782-b5f3-4849-9dcb-be82e267f878", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c028782f-79fe-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642689559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689559, "uuid": "762f8852-9e0b-46c5-9d5f-101e6b4d3d12", "comment": "Malware payload", "value": "fed66da1cc6c5d02b8a6097dd1e23fcf", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689559, "uuid": "43def19e-569e-40a7-8a00-99ef171f09a9", "comment": "Malware payload", "value": "6040917d2c6d320455c8d9473ffed8f215a5cb4da345605e1ba936611b82f815", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689559, "uuid": "3ce03059-729a-4c4e-891c-fd91b981547e", "comment": "Malware payload", "value": "b1490d75205848b311443640567de140fb095db1", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689559, "uuid": "e5d6b08c-20da-4fc7-b335-dfcafae80c87", "comment": "Malware payload", "value": "b03ed230c5d984fb4d04f01c0f4b27565e7d84b2b95cde474e4725ed494f69bedbe55de29ba56348a7fb75013a88cb9a", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689559, "uuid": "9466affb-8c33-448c-ad44-e8c39ed7fbd3", "value": "T11404027EB5C9261FE1D7E0F780E4502BB2C9BEA3101A6C28B2A9714D06BD4C375653F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689559, "uuid": "f98f3812-3d1d-4796-80fe-57e69d8467c2", "value": "3072:MO8fhogQ9fQPzLhLULtxE7kUzroW6k46M/9TmrJuzTRQPYE9MUpckNHQ6h7B:dCogQxYHhLULLE7pFj4PsrmTCPYESUhV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689559, "uuid": "876f006b-bd1f-4f33-b6f5-864ea8c4d6ef", "value": 187176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689559, "uuid": "5478a436-6ee9-4567-bbdc-ad482460bdfc", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689559, "uuid": "ace2a646-3a91-4450-8443-76b867510fc8", "value": "Quote.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d67c8b8e-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666404, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666404, "uuid": "fae6a4e2-f989-4761-a5e4-82e52b6ee099", "comment": "Malware payload", "value": "aa7e600161d7614b3e08d40494f2d4bc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666404, "uuid": "7d8e8c64-343c-46b6-95e1-29063b99fb8a", "comment": "Malware payload", "value": "60993129337e1a1f07964c4a34bee86292cd508e7a02d49ba1ca119fd02203f8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666404, "uuid": "46bcc471-e369-4e55-8189-2ff90910c05e", "comment": "Malware payload", "value": "9d3780e0e0d6413711b2440cf6da6ce7cf79e1f2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666404, "uuid": "69f19fde-136f-4168-b576-42ea9f47db06", "comment": "Malware payload", "value": "576227efd8cf57b1f7709dd2c699408667d5b1d1e3d336712e037a6b06bdbd0adc13e870e9e8be6180d022131d50d5c5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666404, "uuid": "baf0566b-ea62-4c8e-b997-f0b29a1f233c", "value": "T158F533B9EBE231F5FBE80CB23D7696CF1AAA4410F6AE5195FC4CA70540053EE865D384", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666404, "uuid": "1d5fcb3b-3e0e-42c5-a929-9f010d2d2813", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666404, "uuid": "fc54ffea-8323-498d-b28a-a5fed78abf89", "value": "49152:80pZBHN6wAm4ZDABnZ9MALy4b9a4aFhK16Zv5wGeKCjaxsaexzcPr8BIQCJUwVbA:5tJQ65a4LUxeKCjaxO1cge/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666404, "uuid": "ad0cc699-4c72-46a7-9499-e24f8a1c7b7a", "value": 3505152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666404, "uuid": "aec7b184-ff1b-42dc-bc83-32d365e3f1bd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666404, "uuid": "bff0a5e5-3b9a-465a-8e0e-83011ee81b7c", "value": "aa7e600161d7614b3e08d40494f2d4bc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b6bf9a2-79fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642688611, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688611, "uuid": "bf486b42-03f3-496f-91ec-567a69ad7e8c", "comment": "Malware payload (Heodo)", "value": "08f1300f42c2939ef8a73a30b4b5d8e4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688611, "uuid": "494f8809-3cc6-41d9-a442-406069be7b0b", "comment": "Malware payload (Heodo)", "value": "60c25a5867273c0dd739df5c10f6807d4fbfeb7db9b8ffeb4aac58a2da169010", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688611, "uuid": "a7fe42cf-cf88-4c57-beb3-e010152a1ee9", "comment": "Malware payload (Heodo)", "value": "82531a9464c76ccad2a047278f8d0dce8ff29e05", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688611, "uuid": "c676d6e3-cd2d-4a33-94fc-b5c4cf265c8d", "comment": "Malware payload (Heodo)", "value": "55628f087d81e1dbbba557ce76df8de61727cdb59193a0d9e5f2db15da8e3b9dacce02494960da89ab4062db78f24aed", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688611, "uuid": "d38c18d8-62ba-472b-be0b-76cb29382eef", "value": "T155E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688611, "uuid": "7a44348c-4344-442d-be61-a7f5877651e5", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642688611, "uuid": "7a4238ca-2dbc-48e7-9fd8-863192ca0d73", "value": 145116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642688611, "uuid": "84e9c23c-0598-4aff-adec-d75806950522", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688611, "uuid": "4d6c514b-70ac-445b-a258-d69ae588fd2d", "value": "08f1300f42c2939ef8a73a30b4b5d8e4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5191242-7a1d-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1642702882, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642702882, "uuid": "513fd665-811c-4cef-b389-8391a036df80", "comment": "Malware payload (NanoCore)", "value": "b117d294aa47674cdf0d1a4f3366787e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642702882, "uuid": "f3c38dac-fd0a-4503-9abd-e74fc1945239", "comment": "Malware payload (NanoCore)", "value": "61004944921826aa2cdf48c60720daa7e45a6694606ce82e62ea38c655856c0f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642702882, "uuid": "c15c7785-f9b1-4537-9a55-52f2b8d549a8", "comment": "Malware payload (NanoCore)", "value": "22db9eb3888975fe808a2a34c6d73ba0eb827aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642702882, "uuid": "f9cf2425-e775-4fb7-99cb-e32a12b6832d", "comment": "Malware payload (NanoCore)", "value": "0b71f137977bd03ce1c303e9fc3f8bbfade324b805d85171934c0f20bc184ee650e9959e5e90b6b604da7f8131c3a857", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642702882, "uuid": "99476ac0-e729-481f-a1c5-1164a710d625", "value": "T140E41206E3D0CCA5E07024F0972ADA7135F9AF86540E6A3939FABC47B5742D39986F1C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642702882, "uuid": "adc6f9cb-e5c6-4f3f-a2a7-ab723f255f95", "value": "ef471c0edf1877cd5a881a6a8bf647b9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642702882, "uuid": "fb919af1-b01c-4ed5-8aa0-2347bff1b06c", "value": "12288:H0X0KOnD/voMRQlNmrbhod2hiRAXQNO0Ox4oavnTsnXFKAJ01+5y5uxxp0lF54sU:UX0hD34ShYVRygOzgTsnXFtZbxyF5JVG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642702882, "uuid": "56cc7a19-4f2b-424a-a2db-1beca0b3df1d", "value": 705536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642702882, "uuid": "7287f184-fd5e-4b53-afa3-f51874592617", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642702882, "uuid": "9f4d872f-9db7-4963-b862-fc325f0f2de5", "value": "b117d294aa47674cdf0d1a4f3366787e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64709284-7a27-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642707014, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707014, "uuid": "90be7e01-89bf-4709-aff4-34c59903d814", "comment": "Malware payload (Formbook)", "value": "21155d9069a790123b2529c630aaa7ea", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707014, "uuid": "5b32a579-60ed-42a1-a7f6-57d51d03fbd1", "comment": "Malware payload (Formbook)", "value": "613da322379246f3911263dcf429c2c7d52a37300a29d42397a13bc7a4cc13fa", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707014, "uuid": "9d6cea8f-3361-481d-be74-f65fa4ff3723", "comment": "Malware payload (Formbook)", "value": "26cba7517754dc7a492c34eb053b0b364e6c0d33", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707014, "uuid": "afeb4d46-f710-4da0-b660-d909a566cde3", "comment": "Malware payload (Formbook)", "value": "83ad20f126ad8eb558dd57706fc517719184addc065830b34ffc8202a16bb72d42462589d7c091c61cd89ca6ccff4df6", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707014, "uuid": "1100c47d-04be-4f1e-8e62-8dc4291eae11", "value": "T1231412223B0A8CECD54331F7865DFB0C834EEC6615516B93022233ADF6745DA25DA7B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707014, "uuid": "1eef2fa7-1acd-4794-923b-99a6312e18d4", "value": "3072:Mg9Pwv65C69QWW1JHIuSV1Ns0Qe3Z0xXwOrgbGp1GIvLGbuEKrj0bTtWK89P:M65C8LW1JHIFzS0jZAAOcKpI32j0bT0P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642707014, "uuid": "9faa26fe-2a59-41b5-88d0-50320d970261", "value": 196280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642707014, "uuid": "acf689ea-8f56-432e-880c-4d7deab0bc31", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707014, "uuid": "e2e96df5-cce7-451a-8aad-c83b21515150", "value": "DHL PACKAGE DELIVERY DOCS BL-INV.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc1f189-7a27-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642707111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707111, "uuid": "58675351-a954-48dc-a67e-85a1d1954870", "comment": "Malware payload (AveMariaRAT)", "value": "f0cb038063e33430efe64c2aef4c9815", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707111, "uuid": "a3bffda9-ae52-4697-af08-bd78f594e97e", "comment": "Malware payload (AveMariaRAT)", "value": "626c607438b9b8d16dc84c0610a9ad73f7831358078d37de63f5778a6c2a2411", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707111, "uuid": "dce6fd68-c3c3-4e7a-9745-6121e1e42d2a", "comment": "Malware payload (AveMariaRAT)", "value": "27972635c227be1784bf0939ae1b078286701f17", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707111, "uuid": "e4698c1e-4ff6-4886-9500-9bfad6761b42", "comment": "Malware payload (AveMariaRAT)", "value": "327adbe84fc61c0624ebec26ccd49874cb6f60fed7ddf8644a968610dd9c960886e63b39cc8fdb986eba3623b6846de8", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707111, "uuid": "8ec40554-fcfb-42fd-a8e2-f37df77b19e8", "value": "T18574F110BBFA23ADEAB987F09522515017767C2A1523E35D0D56B5CF36B3F828202B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707111, "uuid": "64c282e3-cc32-49d7-b1ab-92b30ec1f0de", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707111, "uuid": "df8c2a3b-fdfa-4b2b-8a0d-f6991e256cfc", "value": "6144:pvdJdkLF3NgIkiH4u9p5bpzTNW/UpNVVGjplM1L+h1jXO1U8MuiFQR3XhhMAmkeY:JbMfgIL9ptiUpEjplMlyX0j6iXH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642707111, "uuid": "e0aeb746-7abd-4a75-8333-e98da9f91947", "value": 370176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642707111, "uuid": "09f77c10-5f9f-4b11-b43e-9db8777929a0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707111, "uuid": "6bd9146e-0204-4f01-a9f9-019c9af8a87c", "value": "f0cb038063e33430efe64c2aef4c9815.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da8d1c92-7a0c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695616, "uuid": "450b78d5-21da-4351-9aa3-238fb8d2df92", "comment": "Malware payload", "value": "f64fd67b707789bd6c7a52406f3139f8", "object_relation": "md5", "Tag": [ { "name": "ppa", "colour": "#46E682", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695616, "uuid": "b67b349e-8941-4960-af95-2af4e48ac141", "comment": "Malware payload", "value": "62e848a4f1804bff428ce570397c0e29e2f7752e642a7fe98acfd3af26f2fe29", "object_relation": "sha256", "Tag": [ { "name": "ppa", "colour": "#46E682", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695616, "uuid": "07cd0d88-6287-4ffd-881c-3e6548e35bc4", "comment": "Malware payload", "value": "0547e2c2f1420e1f8a7bdb5b8fc6c9ec9f70ecb0", "object_relation": "sha1", "Tag": [ { "name": "ppa", "colour": "#46E682", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695616, "uuid": "7fa05a16-6d67-49c9-bd9f-26d896edd5f5", "comment": "Malware payload", "value": "6dabc424b54c894324622f3ed9b6f9c590244b0ae8d9b1a5620db02e8f9435d653b1d72685d1a6db5aa9b3ece3b9e283", "object_relation": "sha3-384", "Tag": [ { "name": "ppa", "colour": "#46E682", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695616, "uuid": "8a00705f-9719-4732-abbf-ac3bbad2076c", "value": "T1A683D4043380D532E0675A328DE7D7D97335FCA2AE50472B32D9731F2E7A5A2AE16394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695616, "uuid": "acd81aef-df24-4e71-ae84-9b0ee0e66bff", "value": "384:yTgcMdAKc7Ct3cq02FBfdAYi2wrCKvzVGlzd8zkP3wKlNM0k5lW1fFclFo39D:O+LcWt3cq0OBfaYyrCPwKox5liFcjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695616, "uuid": "90610a85-29d5-41a5-95a1-4ac20fa53021", "value": 81408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695616, "uuid": "e73ce8b2-e818-4058-9590-e6e9abfa9489", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695616, "uuid": "96f31e24-56bd-47e1-8c7d-1abe13ac44bb", "value": "PO NR. 102.ppa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39023ef-79e3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642678049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642678049, "uuid": "45a1e1e6-8f38-43bc-80d0-bb80370737ae", "comment": "Malware payload", "value": "c03c727322d8ba06a33c8f4dcc1d29a2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642678049, "uuid": "3691be57-4ea6-4f92-ac6c-45823e4c6c9a", "comment": "Malware payload", "value": "634979a6cf42f11738a121d6e35828885d9d2596daa24f0f709c035b47b042f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642678049, "uuid": "1387ff63-4e48-4e96-a3bf-6bd475d3d7b9", "comment": "Malware payload", "value": "87f24e6a0b93074a5fb9bfd21cfb1ce0118ff343", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642678049, "uuid": "e43991bd-9146-48a9-b93f-4b630c394659", "comment": "Malware payload", "value": "063aa2df7544b85e7cd705dc400c032d1762240f88c8c0ff7a3bef052ac226454bb766b4fed798fffa82271e1386dc77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642678049, "uuid": "24dea867-7094-4454-8bb3-a6cc68d7147f", "value": "T1AA15F8BC312072DED82BD2319B685D68EFA1787B931B9117A41B21ED891DD87CF250B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642678049, "uuid": "f92cf89a-f3c8-4e60-becc-431a131e61b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642678049, "uuid": "ae17348c-a695-428a-a291-7d421848b2ee", "value": "12288:85z3ivJS9kmM19O/0R6SIeYlJZwfGc1ic1EwHh1kZYixwVm9r6Fq9xUj4vniH3CF:SmvJo49O8R6SIeYlHwfGcQcOwCjAC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642678049, "uuid": "00ad19f3-2eb9-4c0c-b20d-d5786adddcfd", "value": 884224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642678049, "uuid": "36a297fc-4ecf-4d2b-84dc-b4306cb933ff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642678049, "uuid": "169574e0-c275-4964-8e30-f79ce7098841", "value": "BANK DETAILS (2).exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2316dc9-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642676731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676731, "uuid": "a4bd0f92-7ef9-4a29-ab3f-70ca596c6deb", "comment": "Malware payload (Formbook)", "value": "44c14428bd2a5db806fee7d89512aa3d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676731, "uuid": "9c265b88-9991-473b-a670-2e72f41ad2a1", "comment": "Malware payload (Formbook)", "value": "646292b0c5583d53f10119240466a74dedb0cb233d9c2b5052b90d8dd33660ca", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676731, "uuid": "fa742f95-16d9-467a-a597-aa88b60f6779", "comment": "Malware payload (Formbook)", "value": "92eed78caafb19dc9bf9c481ba529a8eda643bd3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676731, "uuid": "353f5883-33c3-45e6-8a05-a075b1d7c176", "comment": "Malware payload (Formbook)", "value": "79f8102c39b5110bc82dcd84e80d03774d5f6d081e5112aad33473283fcae28f2d4bffad99d59d52f0fe3df8bf57f341", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676731, "uuid": "a637790c-a14d-4fbb-bcc3-2a832fc00799", "value": "T1538401247BFE272DDAEA8BF5B472112013B679172622D35C0CC660DE1576B878392B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676731, "uuid": "c196acf4-037c-4544-990e-2882d47c6f27", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676731, "uuid": "ae9614cc-52c3-4f35-be51-8ad4ce4a15ac", "value": "6144:JskjLF3kM6RWdjG5j9OLjWqzzxNBacf/q+aCS7B:Ko6tshG5j90Xnb/qhCS7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676731, "uuid": "98182456-6e10-4079-89a4-af4bbab18923", "value": 377344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676731, "uuid": "d4ddbbf6-298b-4f23-9c1a-05228f00e358", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676731, "uuid": "ba83b909-42e8-4257-8aac-bd584fa40da3", "value": "20220120payment.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f24f774f-79d2-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642670745, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670745, "uuid": "09eea1d5-79ab-4e04-987a-2e1a7dfecbc1", "comment": "Malware payload (AveMariaRAT)", "value": "895b039c1cb9da14bc2cdf4ed78d8b78", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670745, "uuid": "860b15dc-d15d-4799-a3a3-225ed7b95ace", "comment": "Malware payload (AveMariaRAT)", "value": "6534b9213802327bcfb07a0dfca17286e2bed2fbfc977b41911203dc3f430d8a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670745, "uuid": "ca1a251f-1201-41c0-b7a9-e6bd3bd7c3e1", "comment": "Malware payload (AveMariaRAT)", "value": "729fa05d4fcff6f9086ffc8f50f3ffa073a934fe", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670745, "uuid": "4cd446a9-a8e6-4032-8a08-d9970cacda89", "comment": "Malware payload (AveMariaRAT)", "value": "a705981bf464c0366a38a267d6debdfc322ce5e3175c5233a899d3a8cda640ce89e441260bfc72fb5c3facb94936c913", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670745, "uuid": "e22a8a09-22b0-4b1d-aa26-f3cd1753fb27", "value": "T1F5E4A51D16A19887C09E8EF0B85DEB7F14122DBDA722C6363534B19F39123F92D6643B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670745, "uuid": "cae8a3ba-0a1a-4461-a0e3-318a244642a5", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670745, "uuid": "d3b789a1-adc1-4ee2-a8fd-d765cd4e0cc7", "value": "6144:Vw7IMN0BIM945ePQNxGTgiG8Io9bM9UhvioAmeQ:yIMmBIM9qePQNxGT887/hvinmeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642670745, "uuid": "2aa804e3-6cb8-4877-88b0-492e2936b0e9", "value": 717393, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642670745, "uuid": "4777724a-c01c-48e7-bd6f-cd9ba37defa4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670745, "uuid": "92304be7-008c-43a9-b0e7-43d076f4c1c1", "value": "Overdue Invoices for payment.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2938084f-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666542, "uuid": "022c05a0-a3e0-428b-b03b-a71e4e0ca33c", "comment": "Malware payload", "value": "f5ea39b70f747e34ae024308298f70ac", "object_relation": "md5", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666542, "uuid": "3614cb59-75e7-412f-93e3-39b6136d647b", "comment": "Malware payload", "value": "654dd5b6425e4d5bc1de5686383625c76980f191fec0429595e465417793beaa", "object_relation": "sha256", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666542, "uuid": "16990a73-950b-4d0f-ad0a-dc0f9a0ee617", "comment": "Malware payload", "value": "59f87524570187ccf35f0726c7351854569ff570", "object_relation": "sha1", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666542, "uuid": "638b0961-7452-4b50-a62f-3e23f45b4c08", "comment": "Malware payload", "value": "66022f7f78c34bd74bb53366d8affcfffe2d3adb12a5d08622945dc73714487880e01f363df4fd261285dc0d96625b73", "object_relation": "sha3-384", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666542, "uuid": "03623ddb-83ba-4ed0-968d-dbe13bb3dc5b", "value": "T1DC2533B78648B36170156F3ABA77D89EC28C32EC6D1AC854796130DFADC5606FAD0DB0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666542, "uuid": "3278739f-0dd9-47c1-a94d-0f410a1b54a8", "value": "24576:B7nOIjljNIs9Ef+uB4CUwdBFpT11uuI380us:BjOIhNaf+xpwdBFB1PDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666542, "uuid": "539967bd-283e-49b9-8d05-935201fc1bd9", "value": 975476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666542, "uuid": "e5077d6c-99fa-450f-9231-6df56cef06a5", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666542, "uuid": "d080182e-5089-447a-af8e-e143f83fe9be", "value": "Document.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cbc3d11-7a2e-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642710062, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642710062, "uuid": "bf5e0091-5d9d-42cf-a9ac-9ef9909d1bcc", "comment": "Malware payload (RedLineStealer)", "value": "7dded043d9ef8b6e85031642c9d0501d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642710062, "uuid": "50e379c5-0b14-47e4-a022-6242f72b2679", "comment": "Malware payload (RedLineStealer)", "value": "65823cf321b291cbf0dce215271b8deaa12b92f65a0c3709b137ccf8f96f43ac", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642710062, "uuid": "cb958bc3-1dc7-492c-8be6-41a439402566", "comment": "Malware payload (RedLineStealer)", "value": "096863797c6a3c42f94c05ef415ab7c902a3f19e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642710062, "uuid": "382f2de7-d5bf-46c7-9a15-f1f227d1bbb6", "comment": "Malware payload (RedLineStealer)", "value": "e33cc134d0834230376fffc1f6f1e2a706dd9ce49dec0071f687b733b2193513c1381fc31661b422241be5981ba026f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642710062, "uuid": "55854af6-dd44-412b-83b5-ae17fb947b33", "value": "T1B234AE357590F032D4462532482ACFA35A7EBE3D5A65C643379627EEAE322C05F5A30F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642710062, "uuid": "a68349aa-5d9f-494c-8b9b-083aa49c2e47", "value": "29340e6ca7cc3b9eb89af4981d5214eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642710062, "uuid": "d8c805c4-417c-4bda-b156-d170e0bb2557", "value": "3072:o0ohbtvLjwV5zma0axbOGTNq25f3hwUM/h3:o0U1LjoNbrpRN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642710062, "uuid": "9eca18a5-38af-4e95-8d33-8822b6da1e5d", "value": 235008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642710062, "uuid": "fdb8261a-0641-4b95-bbe1-199a936ad1a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642710062, "uuid": "43273818-bd24-4ade-b1b3-d43f1776825e", "value": "7dded043d9ef8b6e85031642c9d0501d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59424ec6-79e6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642679078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679078, "uuid": "2174a878-a686-4470-9dba-7833bd843f36", "comment": "Malware payload (AgentTesla)", "value": "5e05972fbfd1ba27265b850eeef3c55e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679078, "uuid": "8445a04a-0c7b-4c42-8daf-89f6df51675e", "comment": "Malware payload (AgentTesla)", "value": "65f6119ddfe280254486cca669d93a7d5807c191ce4a7a3e2c5136014c00dc33", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679078, "uuid": "64542575-d3f7-4209-9b4b-75d795fc773b", "comment": "Malware payload (AgentTesla)", "value": "9ce5155be1091ab1e6929302f4572882bb28d16e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679078, "uuid": "ff612500-34a8-4706-8b3b-6a9b704269f3", "comment": "Malware payload (AgentTesla)", "value": "dcad09837d3cb9313a2847eac360026ac18e947c8fd063067882ec6a0c45c570ce1a5dae1c7b8e74daa44c5fc0af868f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679078, "uuid": "35fcaf9c-db17-47f8-8850-316bc1e6a70b", "value": "T111C25001F6D493B0E3A6173739EDB14CE2AB9C2C061B9AA6F4507D5D1B312D12EF652C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679078, "uuid": "cadc376c-2d9e-41ed-aaef-590978d195da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679078, "uuid": "5338d680-a9bd-499c-ad46-1e35bdb47307", "value": "384:8dpQ9nLqb4AE0o6ALoLmfAdTkzvNesVwc:8HQ9LqbN+cP0Sc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642679078, "uuid": "fa1f8586-bf4d-452c-9b03-93bb63eb5ee8", "value": 26112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642679078, "uuid": "4b651692-d1e8-466d-bb30-98bec917f52d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679078, "uuid": "b5d87c3c-6e96-4840-b443-4e948aa34a26", "value": "The Deutsche Bank zahlungskopie_Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f280d3b6-7a29-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642708112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708112, "uuid": "68bcd04f-df22-4aaa-a840-a93d5b30cb36", "comment": "Malware payload (Formbook)", "value": "94248646343e4d79881550c1066c43fa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708112, "uuid": "c80ed182-80c1-4e61-9e0a-5a693d6ac910", "comment": "Malware payload (Formbook)", "value": "66057851f8f534441fd89a161f2df30610f1c44554a209c67c09fee531f6a680", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708112, "uuid": "630b7fc8-67df-4555-bdb5-ac45cb0f4265", "comment": "Malware payload (Formbook)", "value": "7c968dcc09c2805c1e18eeed6f894d1aca9c7939", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708112, "uuid": "9122c2a6-420d-44bb-ad02-5be0402951f4", "comment": "Malware payload (Formbook)", "value": "54bed437d208e10225e66a7bb779f22610c3128451b843774368192217e3e086634fdcd9cad73c7522a18bb6949e1605", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708112, "uuid": "1e74865b-4556-4f9d-8b29-3644b243a7d7", "value": "T1D6542286BAC18A9FD64302B10EFFC2B3DBF5B71339950A0757706F5BA4251E2B052687", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708112, "uuid": "44ba224a-5c56-4774-83ec-abc34fd23fd9", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708112, "uuid": "6cfcb9f3-4910-4d26-a539-9f710c10f704", "value": "6144:ow29w+LbpQOLF8wjobR9mqMmyQANFI4oHwOAYF9bUHeqxXoAHS+ukQl:S9vXyWjoDnMmOnoAvzxXVJg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708112, "uuid": "2fd3033e-8f42-4ac9-ac76-7260e69abeb7", "value": 287388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708112, "uuid": "9241f563-ed13-43c0-a6c5-2ddb4a38e83b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708112, "uuid": "f22b8ae7-32c8-4609-bd64-169fcc031174", "value": "94248646343e4d79881550c1066c43fa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "802e223d-79ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642667118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667118, "uuid": "f3cc1631-d8d4-4c2c-86db-9a5c94167e51", "comment": "Malware payload (Heodo)", "value": "134e1e823a24ec123969f0903272b90b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667118, "uuid": "c9d78e4a-45f7-4e6f-bb5d-0e2b4588ad28", "comment": "Malware payload (Heodo)", "value": "6693f7ea72ceb321dacc411ccd68fdc45909683e758201294d3adde6f6da8d11", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667118, "uuid": "8dc75cca-114e-4e43-a450-f653054862b1", "comment": "Malware payload (Heodo)", "value": "74eabc33bc6a261b111784c3607f2813b6074ce2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667118, "uuid": "28c94979-2f2a-412c-99a3-aadd636d92bd", "comment": "Malware payload (Heodo)", "value": "6b756eac66d0e5c1bf46589b54eac82a606e9b7d2ad66ad03649c73a2da078ca28c489dddd6ed274a9a76382be352dc7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667118, "uuid": "0b014ad0-8354-482c-8a46-f094d2e5fc8c", "value": "T12DC4AE12F7D1C07AD1AF12356A2A9B9C63B5BD619DF1C20BEFD53A4D5E306428F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667118, "uuid": "b0ee81a3-4c04-4388-90b8-003ac6ea0de1", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667118, "uuid": "3f2bb867-d9ca-4d4d-bd03-c5457b9d7eb2", "value": "6144:5Ig427JC2jW8j6bzhO5vDynHoIoxoJ0CopGEfrYBHEUXZXbej1BC3OBtNCkiFPs7:5D42+8jM8WIIU8GrdIXbeDCxBPs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642667118, "uuid": "de7f1f94-54ff-4023-b7c7-46c75c71b06e", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642667118, "uuid": "dd69bdc2-30c5-44c6-ba31-107641a15550", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667118, "uuid": "eb147917-3fbc-4faf-a0ce-399a1df9f303", "value": "emotet_exe_e4_6693f7ea72ceb321dacc411ccd68fdc45909683e758201294d3adde6f6da8d11_2022-01-20__082513.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ea2a8ad-7a2a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642708266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708266, "uuid": "d524b5a8-868a-4b5a-9a16-bf16ca9a11b0", "comment": "Malware payload (Heodo)", "value": "e82f4f6978c1cf7251b94c36ce40b8c1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708266, "uuid": "88af4f46-5a7f-4055-91d6-66c8c7aaf193", "comment": "Malware payload (Heodo)", "value": "670b10a706a22c6efc34af36bf591688d08eb44be993d5901a66525c6369bd9e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708266, "uuid": "30296ef2-e58a-4eaf-8fc1-379c148f191e", "comment": "Malware payload (Heodo)", "value": "b2c349fb3d27fa160a89174cf5fdb7e13a6d0bcf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708266, "uuid": "f957e866-e1bb-4d0a-aac9-c74fd21fda56", "comment": "Malware payload (Heodo)", "value": "e54acfe7dd4912516d3b7b21cda9fc6a42e15528fa29fe6899f756b24d5b40cfc633c7fa72f693b92bceda488043a55e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708266, "uuid": "371ac6c8-2ed1-4fe5-b53d-168e892b971f", "value": "T1EAE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708266, "uuid": "55eb1938-28a8-402c-9ae0-b79fd1a6b9eb", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708266, "uuid": "8468bada-cda9-416f-9f9c-3e7c85a3e004", "value": 145772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708266, "uuid": "e3c011eb-ae90-4b01-a15b-3c0552c87a45", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708266, "uuid": "4478e494-401a-4f1b-8c0e-b764ccdcab2b", "value": "e82f4f6978c1cf7251b94c36ce40b8c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddab8110-7a0b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642695192, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695192, "uuid": "389caeda-7bd2-4de5-87e8-cd6d042fbca0", "comment": "Malware payload (Heodo)", "value": "59d901d7697e24415b02952bc1b0560e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695192, "uuid": "7be1bc44-a78b-4f39-8d1e-2c2968c8130b", "comment": "Malware payload (Heodo)", "value": "67ded9d43aaf229f196c781c89724f196e14ad0cd7aefa70ecbefa2723408560", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695192, "uuid": "20cc2e1a-57f9-4855-af2b-b11e5c202e0d", "comment": "Malware payload (Heodo)", "value": "c288bfe9ac6ffd71ec23b352e8f2fe78e3ad082a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695192, "uuid": "6449c134-09d0-42fc-aa06-ef8b76207c93", "comment": "Malware payload (Heodo)", "value": "cb725b4be91e4ac55a6ddc708a2702144ae421af048cc06314df4420c9dade9b0b5cbd0ad6418bf64d8d3c065b12cdc6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695192, "uuid": "9290eb81-fa61-4e0b-93c4-3caf45e87c61", "value": "T15FE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695192, "uuid": "64733932-54f9-4260-affb-9feb874b0f17", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695192, "uuid": "6366284e-1c4b-4fb1-8a35-f2626848877e", "value": 146289, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695192, "uuid": "76f6eb24-d853-4c20-909a-4385c677ba23", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695192, "uuid": "a2a1fc32-1127-4fe6-bb8a-c096d2b24f26", "value": "59d901d7697e24415b02952bc1b0560e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5841fbbd-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708712, "uuid": "d3c19755-6436-45d0-89b1-9e7c0e0c429b", "comment": "Malware payload", "value": "1c89a18a8d7c9c233fa3d8885f99c46c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708712, "uuid": "9c75277d-93d3-4dd8-a938-1cfc1997957f", "comment": "Malware payload", "value": "67faee3ff3e548968fd01adcf8aff8db0a60cc1a788cb12b574ac156e2ab8704", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708712, "uuid": "94991b99-cb0f-484b-953d-db241429a68f", "comment": "Malware payload", "value": "b8b2114c3b1fcf36a1e4657d9f75517bc67f2041", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708712, "uuid": "961896f5-ac11-4757-aa18-fd04116b398e", "comment": "Malware payload", "value": "9698ea1a46689cfffff3624886af3d6919e97f360e81b8f751edcbc7a803ae70f8eaaa0633d07d41522002e90a73cb96", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708712, "uuid": "d934dbf6-d4ab-492b-a0e7-a4fc3cd410ff", "value": "T13F05010171818072E3794B305996F9E84AAAAD7909E4E54FF23C7F796E701835A372CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708712, "uuid": "30639784-9408-4121-add4-1dc97ca95a8c", "value": "71fbe3c598de29fddab33a914b98b82a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708712, "uuid": "45d4f843-c8bb-4792-bc68-1fc169ebb43d", "value": "24576:6WYJJKNaqT6lWYLtAIbo6r+wLCsyYn1cvrLCLjh:6WYJkTWWMXQ5d7rup", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708712, "uuid": "40c617a9-a57f-4382-8018-6ce004afe8a2", "value": 853080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708712, "uuid": "ebdbbe3c-32d3-4323-bff5-0c3a96fd8a48", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708712, "uuid": "70f0a914-b305-49de-829a-ebbf497ae088", "value": "1c89a18a8d7c9c233fa3d8885f99c46c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24e689d3-79ea-11ec-9275-42010a9c0029", "comment": "Malware payload (DBatLoader)", "timestamp": 1642680709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680709, "uuid": "7933f1c5-06d6-4be6-9053-94a753bb0219", "comment": "Malware payload (DBatLoader)", "value": "eacd050015d7069e8988d57e67d2d7ba", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680709, "uuid": "46f6e7b9-f21b-4edd-9018-5fa854e600b4", "comment": "Malware payload (DBatLoader)", "value": "6801e72d76e2131ff91a42e054fdcf34f0c024e203b1e314beefe8dee734acf2", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680709, "uuid": "f710c858-8160-429f-80d9-e376c556e018", "comment": "Malware payload (DBatLoader)", "value": "e5aaf5f32d145c6af1029e643596f9a6500eaef8", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680709, "uuid": "7540cf3a-a4af-4d8a-9cd2-2228a5569ef4", "comment": "Malware payload (DBatLoader)", "value": "ea2e44b88c2d85d82222092a9054c567fdfed44b36e30df6a31f9e9422e39e67c854eb93bc129302ac7efe25d263b87f", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680709, "uuid": "e3c19912-aebc-4ece-b6db-c8cd8a454b1f", "value": "T11C05B023B2A08537D02B0B788C6A97ED6515BF112F58F88776E4BD4C1F39240B52AED7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680709, "uuid": "7f131642-fd50-4859-9104-a33157657eef", "value": "91de5b52d8bb7ad58cc9d7384c309dcb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680709, "uuid": "59677ecb-0015-49af-870e-38bb3878d24d", "value": "12288:cvy7FkT7dEN/x9ADy2P/JQgfKKviABe4RX4tKa/B1HoGW7T3bnvwZ:iuF+dENZ9ADy26cKKqAU8XranXKT7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642680709, "uuid": "02e092f6-a509-44d8-93d0-4386a0bdcdf3", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642680709, "uuid": "337d251e-f372-4124-a6b9-74818d6b6c8f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680709, "uuid": "5030424a-2ce5-43c9-bb03-40828e974155", "value": "Document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6307c61-79fe-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1642689596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689596, "uuid": "fb7b3c55-d165-4db7-8720-624148204872", "comment": "Malware payload (GuLoader)", "value": "596a150a802a59ba52e6e6f401af4ef6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689596, "uuid": "331ba4b4-ba06-4e19-8a5c-1fec30bfd1fe", "comment": "Malware payload (GuLoader)", "value": "680289c529f4d35767c366fee328b3ea12a904d1cce8e429ddc4fa411089472a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689596, "uuid": "c6284063-c1e6-4cde-85a9-146bae8db4ca", "comment": "Malware payload (GuLoader)", "value": "ac13c6ca1080169e189fb7be26d596440edfa141", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689596, "uuid": "d95f02d6-a6ca-4cc3-ab74-370dc31c0c65", "comment": "Malware payload (GuLoader)", "value": "5e9145c46ca092af2608a27e5ee5bcbca843285910ac1408e4e881b840aebf2e28e5eeccf6f5e2a1457db211f0279ed4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689596, "uuid": "7fb413c1-003d-4ef6-85a0-ef68f60bf862", "value": "T160145B82C38051F1EBFB0934D4B38E8046C6BD714752ADCAF96E77261EB3582A51F25B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689596, "uuid": "003718bb-d549-496a-900a-8764aacc3006", "value": "d1dd9a1cc9b847fb0a2f2da39dd0aecf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689596, "uuid": "e71242fe-455d-4a8a-9c69-75d6ba4d4692", "value": "1536:0GfV0NrLHpHm2JQ+BAzs4zdQ6TqcOA69YsqLQ/MBZEb+MojdodY+2Hm2JyH6V0NU:h4HHpGEUs4p8c/69gE4sxwdez2GbHjU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689596, "uuid": "b25b6cc5-f95d-487e-98b5-3c795466c018", "value": 192512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689596, "uuid": "a4c92a44-43f3-4b04-bea0-9885555863ba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689596, "uuid": "46d4320f-d134-4fda-bc93-fd9650799395", "value": "Jemputan Menyertai Sebutharga 20-01-2022\u00b7pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b31d5347-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674934, "uuid": "405a51ff-43d4-46a2-9e07-b2610cf4234a", "comment": "Malware payload (Mirai)", "value": "42724c351763e06b4a4f1add8de03032", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674934, "uuid": "77024418-a9d7-4734-af58-7ae0c47f35b3", "comment": "Malware payload (Mirai)", "value": "68352d89d774596c967d6bbe3322914094bb24a92154a084dad9884079cc71e1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674934, "uuid": "57fc7490-3156-4c98-8767-b62223e15e82", "comment": "Malware payload (Mirai)", "value": "8aed5766bdee29b2d39904851c0d42fbdb55d68b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674934, "uuid": "a64a68f3-e14f-45ce-8fd8-a6caf0ad24df", "comment": "Malware payload (Mirai)", "value": "33b65bc1c12b4f68598470b1f33e3ae97d4b9fb693250c371274be3628297162e3657d5b6d43d5373a2e3d88a5f0b55d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674934, "uuid": "5ee651bf-9153-4b10-92c9-c8e6518572c5", "value": "T160933A47B71C0B53C59B5AF12DAB3BF08B69B9E013D76185A10AEFD00372EB12512FA5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674934, "uuid": "3163c1cb-1303-4409-93d8-c07cf6700a0f", "value": "1536:9QK1n/zXzxuPz5tq57MBtcaKECp/dC1k+8dMLumXxVqDrstKfz9e:99bzI9dtcaT0HMLumXxVqDrIKfz9e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674934, "uuid": "8e8708b5-7f22-49bf-b36b-acc362e34cf3", "value": 93907, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674934, "uuid": "44d697f7-4ab1-419a-b43b-e2833894afdc", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674934, "uuid": "b267154b-6212-4c89-b802-6cae25043b2e", "value": "a-r.m-7.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f41eddad-7a14-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642699095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699095, "uuid": "29d11544-417a-458c-99f2-10846f4283c2", "comment": "Malware payload (Heodo)", "value": "b98526d80304e57b590d741228f44120", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699095, "uuid": "809ed9de-a5bd-40e1-beba-c932a1d2749c", "comment": "Malware payload (Heodo)", "value": "687e234c7b54e2590520375221eec756b91e6e03b05bbb313e8765457906c707", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699095, "uuid": "b77a1b6e-16af-462c-b38b-25cb31d88b62", "comment": "Malware payload (Heodo)", "value": "98c74a9738ff65d0ae2d3fc12afa08e71005e847", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699095, "uuid": "a8e657cc-32e9-4f79-b1f0-4c88fd8f85bd", "comment": "Malware payload (Heodo)", "value": "bfc094fe1c4bb9b458028084337c296cc88b0b0542be986cc0f87b1dd8a6e4b84fc9f44b1a4bdbbaedfa5a56c33c1157", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699095, "uuid": "90f6636b-1437-489e-bd0a-f08565a506fc", "value": "T178E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699095, "uuid": "353e8111-fbc4-4b48-bdb1-d53f48d14277", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642699095, "uuid": "1aac7c30-13e9-4d6f-8b77-c1c51c4a7188", "value": 144486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642699095, "uuid": "0e4d5019-a3de-4c8e-9c41-ce1ff548bae4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699095, "uuid": "b63e6dd0-1ab2-4bd1-9133-776d7f02af4c", "value": "b98526d80304e57b590d741228f44120", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "79f8e888-79bd-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642661524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661524, "uuid": "ac4e843a-6e3e-4c40-99b4-ab4a72efba8c", "comment": "Malware payload (RedLineStealer)", "value": "b8b9269b3caf63d4aced90e7e77af7c4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661524, "uuid": "25ef6366-0140-42f1-899e-70166f4dd71b", "comment": "Malware payload (RedLineStealer)", "value": "68a03036f681dd983cce0963051c546806db97d728baaf14b969432229c3b4f4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661524, "uuid": "41027858-2f60-48a3-bce1-c216c921398a", "comment": "Malware payload (RedLineStealer)", "value": "a11b70541b49954c915c72cb0a8f7ac682419e6c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661524, "uuid": "78e16497-0e20-4612-9f2b-cc624b728cc1", "comment": "Malware payload (RedLineStealer)", "value": "8c72fcdcff7d1c084120a08b1f50fc1bef4da01cb419f7ccfead0a73e90c086214974b57c1c8ca87e227452cb192eee3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661524, "uuid": "7e29995e-d8e0-43a1-ae97-f4a7ab724fe1", "value": "T13484D021B580D431C496BA304829CFB05BBDBC711825B64BB3A93B7A6E313D1B67635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661524, "uuid": "0d847008-02d7-45bb-8acb-105d81ee1aa5", "value": "125adc129c50285a2cd4524417d3fdd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661524, "uuid": "8094edcd-f528-46d7-a6fe-38706f78100e", "value": "6144:l42zLKj2YwmesVnXTOpSYm2tVSVzIJbxNhaQQCwRZU:l4oG2YwmeSnjQSB6SVeqQQRRZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661524, "uuid": "aa856e4f-c2bd-47ca-a160-ea7d71d104fc", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661524, "uuid": "67d8f753-5ffb-443f-841b-7bbf98a5d978", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661524, "uuid": "7e528921-9a2f-4518-ac63-a00f91011554", "value": "b8b9269b3caf63d4aced90e7e77af7c4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d84fdf3-7a0d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695755, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695755, "uuid": "5542309f-16f3-4cd3-bf4e-23f4d23c14f6", "comment": "Malware payload", "value": "e2cd8160c55efb74c1c2b83eeec16b5c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695755, "uuid": "4918d124-7adc-4350-8f35-ec213e7ea787", "comment": "Malware payload", "value": "68b05aed258b75dfbcf6a9acb1b90e5f654199fc4541ec059d924f706e0bdd28", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695755, "uuid": "78740ae3-8396-4a38-a02d-c8f94badfbf6", "comment": "Malware payload", "value": "51a18156ecae8571f4be3156a82f921940d4bac5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695755, "uuid": "f4d7fbe8-5382-41c4-8306-4c22652ac5f5", "comment": "Malware payload", "value": "f650e984a7b3a474086230a9915f3986dedab78cd3026c66c5fef53530b4ceca6a598d6321d6e2f2752d6faf40718297", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695755, "uuid": "474d98ad-531c-45ca-bb4c-307de7f976e8", "value": "T109831AA2B901DE67F40A967A04D34B217230FFE70A5366256217B9BEAE361C43837F45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695755, "uuid": "492245ec-5213-49f2-988b-ee685b5d5557", "value": "1536:h7SdnqOLj68DsX+yl+XQDfTn6VbIO9sMpzm8AoNyfyLt36M79EQ/FvA6VAgH9+nA:hEqOLjPsXH+gz5JMpi8AoNyfyLt38IvP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695755, "uuid": "9dfa0675-eec0-47ac-abc5-8a3eda27f24f", "value": 83457, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695755, "uuid": "fb7fd250-78ca-4f73-a0d4-9ffe9845265c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695755, "uuid": "d048369c-22c8-4cd1-a165-85633dcbaebf", "value": "e2cd8160c55efb74c1c2b83eeec16b5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51d11df9-79d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642670905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670905, "uuid": "7d53abf1-24a9-456a-a882-d96abd5c80e6", "comment": "Malware payload (Mirai)", "value": "e0adb6406181f9dff4809dbfd62b528c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670905, "uuid": "6af5de05-0d2c-4894-8564-43991fe4a470", "comment": "Malware payload (Mirai)", "value": "692bdc5fa1186b08d831762465098fb98c917cc00309fb3e3acbe8810fee01b6", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670905, "uuid": "ff21819c-2a58-4184-8878-3cc524f8eed2", "comment": "Malware payload (Mirai)", "value": "349b5be64acbe858c4cc989826fb566d5572b452", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670905, "uuid": "8bc84632-8dff-4c8c-bbdd-c69b3779b23a", "comment": "Malware payload (Mirai)", "value": "4521cccd6280347a270e481b42b5bee4d0f777b0bde7432d975199faa71062e3f33958c255657bd3744d365733de3834", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670905, "uuid": "f7017728-c36a-4407-bd49-fa7285eacb4b", "value": "T1CEB339376251C97AC08342F526EBD5729C13BDBF0732229A33947D60AF368DA1E99F05", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670905, "uuid": "fa62dc33-1f14-4b53-9753-1d000bfd3563", "value": "3072:uirMUYZMo/QJLRZDsqtxqLX5I/uJiouD2yd1m7FnVqfJXoebNb:SKo/O8qtUbKJbm7FnVqfJXoebNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642670905, "uuid": "2318b643-3104-4b57-a6b0-740acaeb0cbf", "value": 116760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642670905, "uuid": "9f4fde77-bccf-461c-846b-6c6feab44f3b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670905, "uuid": "d4f2450b-e364-458c-868a-71f136587c3d", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37cf19a9-7a3e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642716818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716818, "uuid": "1875c40a-b960-4793-a9c8-d1e569dbf6e4", "comment": "Malware payload", "value": "9ce5fc5f83eaeb4629614e83852e700e", "object_relation": "md5", "Tag": [ { "name": "ComLook", "colour": "#4C842B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716818, "uuid": "710ddd4e-76b3-4c86-bf91-cef764b68417", "comment": "Malware payload", "value": "694fb9d8ffeddf9988e6ae8946a50ee195ebb3021b0d0b0370f5246a497c4353", "object_relation": "sha256", "Tag": [ { "name": "ComLook", "colour": "#4C842B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716818, "uuid": "cbe7a492-0d95-42f4-9186-760ae3807181", "comment": "Malware payload", "value": "56c7be986964ff191f6abfe17d22b2f8c09a292f", "object_relation": "sha1", "Tag": [ { "name": "ComLook", "colour": "#4C842B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716818, "uuid": "a839f732-9fbf-45d3-914c-dff87bf042ba", "comment": "Malware payload", "value": "a42c8eee062c97670baaeba06f8f54c26f3f379c0bf3431eea0104ab787afe75aed79c726ea4b29a5c4a336826911b0d", "object_relation": "sha3-384", "Tag": [ { "name": "ComLook", "colour": "#4C842B", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Turla", "colour": "#0B844B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716818, "uuid": "a3b1127a-34d5-4a52-ab89-dd4cd655327e", "value": "T1C1A59E11E7908076F5FA01F552B762BE9C39AB21032885C783D12DB95F35AD26D3A38F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716818, "uuid": "46d4becb-48ea-4897-8d22-8f34167e4929", "value": "ee4ac9f3c15a225a117392a01b78686e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716818, "uuid": "69b801f1-02f3-4d9e-8a38-aafa152ed43d", "value": "49152:kJ+F0J5jZFUa/peCzlXLF7ZwwWqVNlUoi1t+epqIaGQHxBDscngf3rU:kk0W4hLkiVNOoi1t+HR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642716818, "uuid": "4b79f388-0586-47b2-93e2-366fd816fb90", "value": 2249216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642716818, "uuid": "afea4c01-6e0a-4491-9494-478f8ea1cfc4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716818, "uuid": "92958806-5b1f-4cf2-bc7d-a6d191c3d0e4", "value": "694fb9d8ffeddf9988e6ae8946a50ee195ebb3021b0d0b0370f5246a497c4353.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c6aa6d-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642674779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674779, "uuid": "bcab353c-3e2f-4b26-ba3a-a271cbf83731", "comment": "Malware payload (Heodo)", "value": "dce68291e9783eb07f19e2adddf04547", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674779, "uuid": "03c1daf9-7c6a-42d1-a722-f1c3087506fc", "comment": "Malware payload (Heodo)", "value": "69cce5bc480fc153f2c2565e77466c707647cde2c2f03465d1116c6d970d7ce3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674779, "uuid": "73a2cdd2-2cd6-460e-a6de-c4341f3b9bb1", "comment": "Malware payload (Heodo)", "value": "714571614df9c900700bcfe29e9a7b403b8d0ed7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674779, "uuid": "0c4c88ad-7f75-4d31-b5e6-378aa4d0bf8f", "comment": "Malware payload (Heodo)", "value": "7c082f8fb4da87fd6191d2be13e16703e5f58774c1ad94ea00e1ceb28c9b6cbd47ccd628cafb200d851e2afd00f21240", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674779, "uuid": "873f0d89-6672-46af-8536-38d77bd7c3d2", "value": "T157E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674779, "uuid": "5b92b9cf-38c3-410f-8d59-503bc37b6301", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674779, "uuid": "7405e137-0311-4701-946d-0ae143cb6b5f", "value": 144751, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674779, "uuid": "0bd6eb3e-900b-48bb-8909-ece23cda58b2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674779, "uuid": "f04ac614-7d22-4849-a620-487341ec3268", "value": "dce68291e9783eb07f19e2adddf04547", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1894e4c3-79d9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642673386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673386, "uuid": "2ecb4d82-d66e-4624-8230-ce8cea7c97a3", "comment": "Malware payload", "value": "d78d5e33732d33b065af59f96bb3c1a2", "object_relation": "md5", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673386, "uuid": "14fcbcb2-5962-42ec-89c3-3eaf73fc6b8f", "comment": "Malware payload", "value": "69cdce97685c15f1950b9cc6c532eb16bfba471920cebca1bbacd1204efb18ae", "object_relation": "sha256", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673386, "uuid": "d5b70608-a00e-424c-9ba1-5e09de615fc0", "comment": "Malware payload", "value": "7001a8842ad461ce511cee1c040145f3e55fc5aa", "object_relation": "sha1", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673386, "uuid": "3512ad12-d343-47a3-a304-fcb1b51d41f9", "comment": "Malware payload", "value": "dbc3bb2ef14c035840d5e63ea3022f48e5021a98509efa09bad48a4f60dc454a81ce393ec495833540c07c8b1d1b2a19", "object_relation": "sha3-384", "Tag": [ { "name": "cab", "colour": "#C58E2E", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673386, "uuid": "fe2ffbfc-74aa-4764-8b6f-5cae84551f7d", "value": "T1C9F1BF1202CD1320C1D1CDB7A6E10E9E85B2F82AB3BC90D9522D7DD2D7C581C9E9AD36", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673386, "uuid": "4dd9b515-1e62-4eaa-a89b-f2bf2a8b8e74", "value": "192:ydbWxOU9cZG1cjzqrNLcxXji56ViKgsOBAUaiwpMmQ4iwrcE:OqOKcZG1cjGJuXK6VQsOBAYwpMmDlrN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642673386, "uuid": "040afe86-7f26-40ec-8728-acf7f63a2963", "value": 7495, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642673386, "uuid": "747e97c1-cacc-4c62-9cc9-899856c06b94", "value": "application/vnd.ms-cab-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673386, "uuid": "5456d16e-9f26-4368-8f6a-6da38006b2fb", "value": "sysmanager.cab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90dd347d-7a0b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695063, "uuid": "1ced3213-d53e-41da-93da-2012f4594abd", "comment": "Malware payload", "value": "567edac9cf767a1d9108a51fdf8f9f0c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695063, "uuid": "9240c4f6-4317-4918-9592-5add0380fd7d", "comment": "Malware payload", "value": "69d1ae7e856880b3332a83fa1b0f0d74c306d21f0a1fb02a33997cbea58fd67b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695063, "uuid": "653cc8dc-3add-4919-97e3-3654b35f96fd", "comment": "Malware payload", "value": "5f4dc3259013fcc2fc7d9dd35ffa367a72a3f4f0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695063, "uuid": "769af52e-a4e5-44b6-a86e-58cdbae4f753", "comment": "Malware payload", "value": "dfeaebf75ef60ac45f69428f669a0c2dc6a3ef39d47597d8b7457f949e59253126bfae35b67d08f276cdf7d8759f7401", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695063, "uuid": "e72b42f3-bc40-47a7-be3b-a7c0f43b3f64", "value": "T16B171926F2509E31C0DE473A449F9A115332821A4F97A78702E4CABDFD8D2916F7A74F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695063, "uuid": "3fd62b6f-c904-440d-9887-c2701cd492c5", "value": "fab1678451d75fede9bd13576087f9bb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695063, "uuid": "be112332-a91a-4396-8546-0a84337af356", "value": "98304:NEs02yTKZYcWIcpbIB12l9ebE2eg2znaQQqZwpDmrxBYRsRalZLCwpokCFCxJD95:yLhVl9ebzehDODSexjp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695063, "uuid": "0cc87813-8bd5-4346-9c33-6af26ec48086", "value": 18842523, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695063, "uuid": "4a3774fe-630a-4655-82db-a520e57f6a46", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695063, "uuid": "2c3922e9-7522-40bd-aef3-e6cbb4819c1b", "value": "69d1ae7e856880b3332a83fa1b0f0d74c306d21f0a1fb02a33997cbea58fd67b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb83ec97-79c3-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1642664238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664238, "uuid": "28af91fa-5b4a-45c0-88b6-54a61d503e16", "comment": "Malware payload (STRRAT)", "value": "e5df17e52c9ad8157ef9ad8c42072f6e", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664238, "uuid": "543f72b7-b3ef-4e71-900a-612ccb3ecc6f", "comment": "Malware payload (STRRAT)", "value": "6a695e198d37c905288cf2ad103315559c7f870a2f92b03fbdcfabe0a8a34ba6", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664238, "uuid": "9c297315-a847-488d-b27d-af359912910f", "comment": "Malware payload (STRRAT)", "value": "7b998e5455ffeef99cbf3e02e8ff057220ce9749", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664238, "uuid": "10ccf0d2-b0d7-4431-b9a7-aefb90acbcae", "comment": "Malware payload (STRRAT)", "value": "505ad490b918b25db04bbfc84c3da347e5274c4fe389d7325842cc5993a937036150706e427b45620bd231971e339ca6", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664238, "uuid": "d76c0caf-d2dc-4915-a693-08d1d5fc5661", "value": "T15504F11B78DE9875E40BE1B254348A73AB5A0A55A004E4EF28FD2C551C79C6E1B06FCF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664238, "uuid": "27301cb5-3033-4ae0-84d7-0911a522db63", "value": "3072:0pvzh+EqMPwgN7FIz3PqtgV7eaLAhAUlma/0NvZHWVaKgzXykNsfEaR4Lnr2FM:0ypGvqfqtMz8hNA2VHgGqsf9R7M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642664238, "uuid": "9e71873d-ba55-481f-8106-a2bfaf0f2253", "value": 182003, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642664238, "uuid": "90b6f947-97cd-43e2-8dc3-e77de8bd51f1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664238, "uuid": "0d5d5387-7962-41a4-bfb9-52c3df194ce4", "value": "Remittance_Advice.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80f9a857-79ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642667119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667119, "uuid": "cba9d2c0-45e9-4c43-83bd-cbe5c299cc6d", "comment": "Malware payload (Heodo)", "value": "dbfe9d947dc3d55e4e4f015ccba88a52", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667119, "uuid": "e6979923-6fa4-4375-8a59-308756b52c90", "comment": "Malware payload (Heodo)", "value": "6ac5d975afdcfa5e668e87127525d4fadd155fa6f3be01e50c111ea6581202de", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667119, "uuid": "c48d5598-40d1-4476-a3dc-31e7d6c24941", "comment": "Malware payload (Heodo)", "value": "c1c739d5b15c6e6a2424dd30b2fd6e2f23c2c28f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667119, "uuid": "babf7026-b358-49c8-aed8-c85a98e21595", "comment": "Malware payload (Heodo)", "value": "4824f70c67d35deadfff765f89c642c6da8a3757cb344103077b59cb7242f076de7a4931b996f58c526ae2570cb1dc4a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667119, "uuid": "b5d2667f-c3f8-41d4-85f9-f0b774108d0b", "value": "T1F0C4AE12F7D1C07AD1AF12356A2A9B9C63B5BD619DF1C20BEFD53A4D5E306428F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667119, "uuid": "37a2aa56-e372-4d1d-b517-a94f15e5f116", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667119, "uuid": "7db8e797-4f3d-4207-a283-99c92ea692f9", "value": "6144:5Ig427JC2jW8j6bzhO5vDynHoIoxoJ0CopGEfrZBHEUXZXbej1BC3OBtNCkiFPs7:5D42+8jM8WIIU8GrIIXbeDCxBPs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642667119, "uuid": "4ca481b8-753e-4efc-bc8f-7fe2c6082ca7", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642667119, "uuid": "1a322ba3-bf29-4e90-8a1e-306854c8d75d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667119, "uuid": "034c30a8-271e-4caf-9e86-8e2944716dcf", "value": "emotet_exe_e4_6ac5d975afdcfa5e668e87127525d4fadd155fa6f3be01e50c111ea6581202de_2022-01-20__082513.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9408f88-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674971, "uuid": "75cb04f2-1c8f-48f5-b6bd-7dd62bbae2ae", "comment": "Malware payload (Mirai)", "value": "e2ccec28c7f060ca7d77f258c8955733", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674971, "uuid": "b5e39772-8c47-4807-bfe2-dcd2b2db2748", "comment": "Malware payload (Mirai)", "value": "6ac97488c6127eeaeb2380540d2e940b5f839acc89e33763d7fa51e508e5798e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674971, "uuid": "4ccce75c-56ae-447b-8c31-a2afe69caa63", "comment": "Malware payload (Mirai)", "value": "21a9a4569a47c778fc093010b29506f7365412fb", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674971, "uuid": "dd568f24-04f9-45bd-a72d-d7ef8a9ac4ae", "comment": "Malware payload (Mirai)", "value": "465d13ba92be945e98ed7c87fb23e2e9bc2651ed5b7549367da5347a5ed7bc274fe0aba9ea5b541e13fe317b9b7c00ff", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674971, "uuid": "f10fb1d1-5ca0-4c98-8fcf-19dfd3b80017", "value": "T1B0832B43E9A19FB7C0866AB565AB5E300B13E9912B4F1A4A313CA7F4434F4CD790EF64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674971, "uuid": "8a6de750-e0ac-4b4e-aa20-3a038326ed5c", "value": "1536:ClNtAyOXSU3rUk954CKmg0KfjyJCRujEaX9LmkxVqOEeofzee:gbOXSU3rUkmmbJ294LmkxVqODofzee", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674971, "uuid": "65a26792-ecb9-4a0c-927f-bd58fb55d6d3", "value": 88733, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674971, "uuid": "6d1f78c8-f321-45ce-b406-a134ba845839", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674971, "uuid": "06ba4063-d08b-4f3e-96cc-113569ccb3e5", "value": "s-h.4-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0382e325-79bc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642660896, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660896, "uuid": "13346447-5607-4357-a896-d1a3cbfccb4b", "comment": "Malware payload", "value": "27910e41c08da5869b37b252706b2553", "object_relation": "md5", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660896, "uuid": "5d81390d-ef0a-4566-a2f9-e56a472fd52e", "comment": "Malware payload", "value": "6af7fa6ca7b67173104136ffcd1fdd0f41c3336c7b958c51235be6c7406e3651", "object_relation": "sha256", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660896, "uuid": "95b0ea9b-7668-4ad5-83ad-9c9925562635", "comment": "Malware payload", "value": "3e6fd1b2b8f444c60ab159487c6ffb1e8589e30e", "object_relation": "sha1", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660896, "uuid": "2209dfc3-93cc-44e7-b174-64094db75dd7", "comment": "Malware payload", "value": "a905d43264bb14ce8abca7ab935a2c817d927461387ae7c4d1931f19d8697b1757c0dc3c016cacdeae2f199d3ded2720", "object_relation": "sha3-384", "Tag": [ { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660896, "uuid": "bdda6f92-6059-4785-9458-a53539a000e2", "value": "T1A71533DAB7C2DC60B7C1F2B6F6AC8391A231752BAC51D25E1E5C497622516343B0AF28", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660896, "uuid": "a42b7911-dc19-49fe-b5ac-a80f1ab39af7", "value": "24576:YWPoTB+rsrpfw+U6zvj9c02vfQrGbGhGx17FphH4v3MCJM:pPotrpc6FQfOsG4rppafPJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660896, "uuid": "34d48ce8-4ce0-4ff7-b9a8-3496da152fc8", "value": 881818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660896, "uuid": "d4d8abfe-58e9-4ead-979a-eb7fa589dd75", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660896, "uuid": "00cd2475-908e-470d-8911-53b74340a334", "value": "PO0045982022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054e48d0-7a05-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642692252, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692252, "uuid": "5e73b55c-319c-43dd-bd5d-6cc8cccaa2ef", "comment": "Malware payload (Heodo)", "value": "3ecd8ade02a7acee6758d87a15254aa5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692252, "uuid": "f893cfb0-952d-40bf-b686-10159d370e4a", "comment": "Malware payload (Heodo)", "value": "6b65f37d876f38bcc12bc144f25a9674a7461b5500953b5ff8bf02186d82b3b8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692252, "uuid": "fe79e8b4-4b2c-4d4f-a715-1238603f445e", "comment": "Malware payload (Heodo)", "value": "da23d8630e694d6ca206cfd23c201bae4f2f4ad6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692252, "uuid": "707926eb-4ecf-4bc4-8d7b-368387fb118c", "comment": "Malware payload (Heodo)", "value": "3e305946c2af0461d80b3ddfd07e372116ab1739b6304325de88b6b62be52c24c0307ba05af276b9eca27b60957620fc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692252, "uuid": "95a955fc-5302-4bb5-b890-6bdbdbb488b5", "value": "T13AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692252, "uuid": "b3b06c68-0334-4183-90fa-be500dd62e69", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642692252, "uuid": "926e7fff-29f4-4e20-bd6c-bffb1bd6410f", "value": 145569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642692252, "uuid": "8dc8882c-fd28-4849-a337-aeb426371eaa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692252, "uuid": "40fc79fa-6f81-42a5-860c-fd9d64670a6c", "value": "3ecd8ade02a7acee6758d87a15254aa5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2caa8e34-79c2-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642663542, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663542, "uuid": "8850145a-2717-4f14-8ad5-cd4368e32d86", "comment": "Malware payload (RaccoonStealer)", "value": "5866cb2e91f79585ac02ed16c4704baf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663542, "uuid": "76812f40-ba68-49cd-8809-98acce25c5e6", "comment": "Malware payload (RaccoonStealer)", "value": "6c30d21f796fe02e8e6de2823d8a925a5d3d6c2b248c134e78c18d07d3cb657d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663542, "uuid": "17599f3b-c519-4dbc-b3ac-2a05e459f07f", "comment": "Malware payload (RaccoonStealer)", "value": "13b9a65ff70b9513980b31c27d3e7385ccc0c20d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663542, "uuid": "f90987f1-7d62-40fb-a48d-3277de04d145", "comment": "Malware payload (RaccoonStealer)", "value": "39b672f2256414691d51e58acdc606eed3777e2d8c0232ea74bbfbfe58378f89e59b1d6274136a4dcef5499392e923e4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663542, "uuid": "d06a13d8-bfaf-4165-87e1-0d1244c51347", "value": "T122E401A03990C471C09E2673C919DFB09E7EF8345A61864377692BAE6FB13C0626D35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663542, "uuid": "9fc949af-7b3a-4250-a8ed-c6aa02e801c6", "value": "b599c41ba6f3d2fcbb28babbce596599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663542, "uuid": "cbdaba34-0e2c-4944-aa3d-3781c7db2b74", "value": "12288:OxgQ6pO+W1UgIIFZAJ5GvhROZGMRUwL43WcS8lyxdDplm8:pQ6s+OZAzGvhROZq+b8lyxdDS8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663542, "uuid": "a2ce83ce-c6e3-48ec-8960-f1749dc5de24", "value": 704512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663542, "uuid": "f703b48f-9a21-4939-8d82-69d14e95b51c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663542, "uuid": "cb073850-74d8-4aad-bfa1-d2f0894a0351", "value": "6c30d21f796fe02e8e6de2823d8a925a5d3d6c2b248c1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32ea5626-79db-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642674290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674290, "uuid": "b48b6786-7517-4636-810e-0561c1c6fc9b", "comment": "Malware payload", "value": "57370f75710415d74c099d88b528b533", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mainsample", "colour": "#451468", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674290, "uuid": "70da4823-93f4-4404-9044-40e45357df2e", "comment": "Malware payload", "value": "6c37bb680dc9c51f9c15e988fa3586cb9f0fe8786f2b9c9408aa953894c10180", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mainsample", "colour": "#451468", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674290, "uuid": "38626dbc-6f08-4dde-8353-1f95af148320", "comment": "Malware payload", "value": "13575fd8a086da8e8f8cc2ddad291681b5849241", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mainsample", "colour": "#451468", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674290, "uuid": "013ffb26-c558-4326-8dbf-43f99829aed0", "comment": "Malware payload", "value": "d01773a8b6ca51803fe5ca7b3095dbc9b83d79b6a6cc18a59c1826791ecd99b8a2dd4d1c8bc8a39137f7c4a69db43bb4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "mainsample", "colour": "#451468", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674290, "uuid": "03fa0e22-4309-4de2-af8b-3464ce11d6c8", "value": "T11E46339348A28129C24B02B96067FDBA68150997D7CA2ECF0F74DF0D7DA9B5D42CDD4C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674290, "uuid": "de53dec0-7ec5-4d5c-814a-2170993d4fd0", "value": "e9c0657252137ac61c1eeeba4c021000", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674290, "uuid": "7ea918c0-d9b0-4c24-8cfa-353200b6dd3f", "value": "98304:SybJyK39qHMF5eWDgkO5IFvVdpHOSvTQTt4uZFw9ixAhphx737VGbBHFP:Sy0YqHu5ecgk6IFPpuETQTtVwAKhxpGf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674290, "uuid": "e7bbd8e2-b245-4d01-ae56-8837033bdde9", "value": 5851686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674290, "uuid": "7d652110-57c5-4e36-bd8a-077d642c36e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674290, "uuid": "15c5c791-9d27-4473-b32b-53884ef970b5", "value": "la_marmit_du_chef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae9e57af-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1642676645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676645, "uuid": "0a6633d4-2122-4166-b9d7-41de0f9a14c6", "comment": "Malware payload (Gozi)", "value": "6b5eb3636da46c933fda988c47b9eb22", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676645, "uuid": "da11a837-268d-4fbc-8502-f7d2ab22386c", "comment": "Malware payload (Gozi)", "value": "6c4a29e89016b49c854eaf4d7cf8ee4bcf8e58e1f7ccf4ced62df6a57e0b60ff", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676645, "uuid": "cc57f5bb-e1d5-462d-af53-f50e69487f19", "comment": "Malware payload (Gozi)", "value": "1e52ed3fca888a3d703159627e0fe9178f5b0c03", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676645, "uuid": "3ee25016-b7ba-4315-b630-34e405117fe5", "comment": "Malware payload (Gozi)", "value": "856b6c23f84d2b998d1c1f88a0694713bee8429da75a7294e93fb17bae0d0e5f758d1cac62826ac540072fd4ead874c3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676645, "uuid": "38d7762a-0228-4d90-92ad-0041e5894132", "value": "T10A138D01B6F50CF7C7E30D747614FAFAA3EE4630267151519B13A9CA1AA4963E63E30B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676645, "uuid": "9c8154f9-1014-42a7-bb41-4f71930bac31", "value": "768:3qntVn0N9DLjasP8a03mUPATPOL+EAJg5QsKhGWiKaO4l8KCHQqc:a4LjasP8a03mUIT6+EAJg5/+GWzaO4ei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676645, "uuid": "d173e7bd-1d32-4366-ab46-2e39da57fa0d", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676645, "uuid": "4a78a1b2-efa1-4ab0-b9ce-adee3e424bf4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676645, "uuid": "e3542c9a-ea2e-4e05-8629-8957afb1fadb", "value": "46c0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d16e603-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642668777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668777, "uuid": "bd7906d2-0cca-49dd-b930-27986e77e9d2", "comment": "Malware payload (AgentTesla)", "value": "449fe744967d2c924fb1ec737187f976", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668777, "uuid": "b696496e-56ab-4548-a2d9-09a012113161", "comment": "Malware payload (AgentTesla)", "value": "6c87c4d4bb0afb52c271455df2c87d6c1f45168dae2cf999c1cd28f8a19199b3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668777, "uuid": "4f665f7d-c66b-42db-a708-43aea841e695", "comment": "Malware payload (AgentTesla)", "value": "0ab308680817b921cfe89a171f7b1923dc4eff67", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668777, "uuid": "e90b9d07-3bfb-4898-ac2c-a11ed92d89c5", "comment": "Malware payload (AgentTesla)", "value": "bedf94f00b37b2a98247a010c7898516e249c52285c8d666cf93f90f1b2c87ecacbdb0fe5d4c44e250fbaee46dd7588f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668777, "uuid": "1ab20d39-a574-4a85-871a-602ddc85050a", "value": "T1FE94125177FD7729E5AD8BF8BA65A104477A3E462021E32C0D89B0CE15B3F86D252B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668777, "uuid": "310b8652-6bab-4da5-9000-6635befc20b9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668777, "uuid": "8752c762-7534-4c02-921e-53e929290115", "value": "6144:wDlbLF3KNkNI9Dhx+dS4gKFfXxzoperwcpqlzJTzovTHsqgZk35Ghk+cPV9oRVdv:OJ4km9DmM4gKhxz45cpsJisEccPcjJ7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668777, "uuid": "b1e56f2d-22b4-40b7-a176-a0dd9a4c3c2b", "value": 446464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668777, "uuid": "d3688beb-5474-4db1-98b6-880547edece5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668777, "uuid": "5db1f269-9737-4f8f-a66c-bdcc787d5850", "value": "449fe744967d2c924fb1ec737187f976", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5074c947-7a03-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642691519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642691519, "uuid": "f40cda5e-d31b-4268-83b3-98bd1e1e94a6", "comment": "Malware payload (Heodo)", "value": "5edd92cb2674c2451f0e765f1db01e7d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642691519, "uuid": "fd4d63a0-a4db-4404-8d4a-6650184932eb", "comment": "Malware payload (Heodo)", "value": "6c993bfdab714689f5b5924440eb9d1289f73941b3784a6b1fe4798ef65ce200", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642691519, "uuid": "8b9e35aa-cff3-43bb-b41a-48600126ba86", "comment": "Malware payload (Heodo)", "value": "74f5ca9155b295b0e9db3645e189ba7223d919ed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642691519, "uuid": "3a87a752-7017-4110-8581-8da771dc0024", "comment": "Malware payload (Heodo)", "value": "0828395e96fc342234ec3988d8da515fe49f9acabc2863cd28ab2e8182e5982b2f7022f559bd6b59e644ac9d4eb7b492", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642691519, "uuid": "d3f98c34-4aee-47ec-bc51-d022e278f216", "value": "T130E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642691519, "uuid": "2da47891-7d5a-458a-8831-7c02536f41eb", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642691519, "uuid": "0e1d6820-19bf-4ecf-a173-4b85979611ac", "value": 145589, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642691519, "uuid": "a619d335-4b4b-40ba-a84b-c26d53212b1b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642691519, "uuid": "56117079-9a6a-4b2c-a8d4-4f1cc7a762db", "value": "5edd92cb2674c2451f0e765f1db01e7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df68cb52-7a37-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642714093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "ca862b4d-ac30-4e2a-82de-1b03c5a32e04", "comment": "Malware payload", "value": "43971cea7e4c4e56a0188b86ae86626c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "0a523c1a-9f93-4a53-89a7-de7fcad10c52", "comment": "Malware payload", "value": "6dba1a8483a192bcd7580a84384fcb2d78dc6f1c404255ef9169659c5db4a9e2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "7872e4a8-6439-487d-914a-a40e0ee25fe2", "comment": "Malware payload", "value": "fe8ef3bc86ea25e4a8e47c8d3c402d97d012e0bd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "b3b75568-49c1-438e-8b6d-3e7ab90dec53", "comment": "Malware payload", "value": "773bb8550903a47486cdf5ffb49913963633038ffb37d1ab6916280e854c9c7692a2b2d5344f7bf6df6acab7684d385c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "c491103d-2549-410c-abd5-bb07758a0e75", "value": "T12DD4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "2a30f897-415e-4861-be17-7d1cc620ec64", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "d8b58a18-7662-4956-b55c-4efa0c9195b7", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9N1G1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYDzVnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642714093, "uuid": "8d2041b7-1dc4-4341-8691-c328e499e7d4", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642714093, "uuid": "3fd8aca1-070d-49b9-bbbe-49dbbd5d4ce4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "6a001f94-5ea7-4a90-946e-5051f9922984", "value": "emotet_exe_e4_6dba1a8483a192bcd7580a84384fcb2d78dc6f1c404255ef9169659c5db4a9e2_2022-01-20__212806.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ab02541-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1642668692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668692, "uuid": "b448e384-f6b3-43f7-b6c7-81e73fafcb05", "comment": "Malware payload (ArkeiStealer)", "value": "dddf375a474c7a0e95ed22293e6c9848", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668692, "uuid": "0593dc9c-1c7e-4337-850c-3c0c1519d021", "comment": "Malware payload (ArkeiStealer)", "value": "6e26766486507fac0c2b38d83731be41e0860dfa34dfef9e5273c38cb7d4b826", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668692, "uuid": "54b49a11-808e-4188-809c-b61e4ec9fa43", "comment": "Malware payload (ArkeiStealer)", "value": "71e2ff47b85101f0825111ac5dfcebccc6bd616f", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668692, "uuid": "4fbeaa07-b586-44ef-b257-0a4d7689090a", "comment": "Malware payload (ArkeiStealer)", "value": "3da7a9ce3dc33e1184ae0cd7d589886e57974617dd1605ab27691cf91a4524642c2fbcff1f21e74bd3f1a3999da59a4e", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668692, "uuid": "92cda2ca-a8b8-4b9f-82c8-65644075f2dc", "value": "T11554CEA1F6C0D832D486167D8825CFA45ABEFC311865864377A43BAF7E712C3263625F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668692, "uuid": "f11707f0-d8bf-469c-b9b7-efa122ea9443", "value": "125adc129c50285a2cd4524417d3fdd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668692, "uuid": "4b6a1a04-9d75-41c1-8df7-e1e537857ea8", "value": "3072:YeNw6RQULjaWx44+/cPmj3nusvS4gwWyED/CvNeL5vZMK/F1M/h3:Ye56ULWy44+qUXuQSXf/CvNj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668692, "uuid": "64fa6c2b-7b92-40b2-a361-e8ae6c5e5d87", "value": 296448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668692, "uuid": "27821371-520a-426b-b115-6467e7ba66a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668692, "uuid": "94d43373-1724-4fac-a98a-fb0831ef1773", "value": "dddf375a474c7a0e95ed22293e6c9848.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "946d44f6-7a06-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642692922, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692922, "uuid": "a09e30a9-0f00-478f-8c1d-c22e73bbeeb6", "comment": "Malware payload (Heodo)", "value": "8a0e581f0941ce2a2ea9a64668531f2b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692922, "uuid": "8c7bfa86-2a99-4dc4-8a33-341bdacff1c7", "comment": "Malware payload (Heodo)", "value": "6e5d0e25330f5d7d6c00aea7a32e5256546d31add66431519af4957ae9dca729", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692922, "uuid": "ab537135-525c-400a-9194-120d92ff2253", "comment": "Malware payload (Heodo)", "value": "5a7e9e0869629c3cd3f96e82ebd9aa60b96ae8d0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692922, "uuid": "d75a3053-1dd5-4329-9ab6-830dfb44921e", "comment": "Malware payload (Heodo)", "value": "6b80a5d9a4dbdfa653d8831dc01658e29d2c9c237b4372f93c9f5131d2aaad7597d7f60cce1bb074b72a1f0278ce5b9d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692922, "uuid": "4895ffb1-10b8-4731-a020-2ea34f6021cb", "value": "T146E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692922, "uuid": "bd5011e4-748e-491e-b12c-5f433f08963b", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642692922, "uuid": "5f7b7b8d-c5ec-4767-85f6-22c7d6ce1e03", "value": 145002, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642692922, "uuid": "5feefe73-4305-4762-9609-bc9a83433f35", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692922, "uuid": "c05b8754-49d2-4544-8dcd-a0191d891621", "value": "8a0e581f0941ce2a2ea9a64668531f2b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1546e7e6-7a0d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695715, "uuid": "669a36ef-e6a6-46a4-8e00-b54473464645", "comment": "Malware payload", "value": "978130ca2e060c582edcab56b6282996", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695715, "uuid": "1b525c07-5827-4530-8ae3-b2247f6b3bcb", "comment": "Malware payload", "value": "6e7c13c64f05c5880a8f45688a5dc71e93d5259ddcf283a4c55707175fec5c62", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695715, "uuid": "94c52639-59bb-48a8-9aac-4f184be39c04", "comment": "Malware payload", "value": "f90fedb06da253583e2835614e58e4908f4cec54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695715, "uuid": "b53306bf-a06b-42f2-bc6b-68e12a8062f3", "comment": "Malware payload", "value": "e89fa301d5a17af7aba6acb63d83da442f51d10eb715ea5c3d1499dfbe9d9a08199121b66b00087ae48c9b5cb17ea16f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695715, "uuid": "80ed11ae-2793-42cf-b458-1c393cdfe96e", "value": "T14F63094359254FB7E0426AB926E39F300713FD971F0B5A8D7129EAFC164B5CCB81A368", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695715, "uuid": "88b40787-912a-4d79-9cee-359fe9535ddb", "value": "1536:M49KL6v4xcuxGA2mV0CBhhXPb6VAZ/9UnK0r:zkLVcuxv0mh1Pb6VAZVUnK0r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695715, "uuid": "edbeef9f-c60a-45fe-a5c3-aea1ab049e06", "value": 67843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695715, "uuid": "d492f329-8e70-49e5-a66e-9dcd7f706d8c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695715, "uuid": "a5b94c74-912e-435a-b279-da2d3afd3e4e", "value": "978130ca2e060c582edcab56b6282996", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d85d7d1-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665637, "uuid": "384c73a1-1ce5-4ad1-9292-68a577d7d41b", "comment": "Malware payload", "value": "a1cc9e5e52636d84ba628054c97335e9", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665637, "uuid": "628fd699-a5aa-45b6-9e9d-623b126c40e8", "comment": "Malware payload", "value": "6eac49275e5dadabb90e19b0882ac945d75362cba2ec3c695f22846d0c89d3fc", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665637, "uuid": "73db3f04-da85-4f54-b92a-5b285d09d0cf", "comment": "Malware payload", "value": "060ba6a2f322d3d4de41370e0f56675b8982f7b1", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665637, "uuid": "3f40fd30-765d-47a9-82b8-31d51491850c", "comment": "Malware payload", "value": "c3db7653066a8a53d668920643fdc54ed0676718cfd6145cbd74501efedbf7595206bf5d6c22ba60f91c9c4c31c1941d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665637, "uuid": "455095aa-a474-48bb-b083-ffc028ed2ce6", "value": "T1C4A57D32B2C18537D0B36E3CDD5BA3689529BE501D28984B7AE40E4C5F397817E2E2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665637, "uuid": "6b4f36ba-cb5b-4d6d-a056-0c7559255e59", "value": "49152:gOduarC44HYkMSuO+4uLZT1hHL8TPyhOYMEA:rjCZHr+NLZhhHiUOY7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665637, "uuid": "3f619fef-4e04-405d-9d2e-1fe6a58fefb5", "value": 2257408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665637, "uuid": "df3c0743-0dc0-41f6-984b-0e8c54a28159", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665637, "uuid": "095b02f3-d153-46dd-9c85-444a99e62603", "value": "Comunicado_oivn1190488.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "edb5e746-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642676750, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676750, "uuid": "94c88082-8de7-4d4a-b2d7-d642dad6f4f3", "comment": "Malware payload (Formbook)", "value": "074bfb58479cb97bb894444d3c0ab260", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676750, "uuid": "bea80de3-58c7-4e00-9c0a-7f7027dec452", "comment": "Malware payload (Formbook)", "value": "6f423662abba8257b9204a52c6f35738b19a9fb250b13ba35b02d9252a11ba5d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676750, "uuid": "c38ee40b-9b76-4d32-ac74-8614c311a400", "comment": "Malware payload (Formbook)", "value": "7bdff621df9d9053886b51040c6ab09b2f892b5c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676750, "uuid": "eb581cb1-a3fd-4096-b380-07340439bbb7", "comment": "Malware payload (Formbook)", "value": "4e1d9cfb44f8b7c604a989800029ebf4de1fc1066700e6cce5642055ca5d1cffda12c5626133a75e0144137aa9c532c8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676750, "uuid": "55478e0c-b21c-43b5-a403-c26a439ed9ff", "value": "T1B3A44BDCF664C08ECC34FB7E94F8E9232B646ECA64756C010DB63BE29A31148D56A5DC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676750, "uuid": "088ac895-6137-4394-890c-e78195902e1e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676750, "uuid": "9ba00ca7-c842-40de-bfca-d95018258787", "value": "6144:2vDeBmd4V5j1OAKVeDJObw9ebODaeN+oWd+oBnAxAPP:UUmdS5j1OA4aOblaDaC+1+oOxs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676750, "uuid": "0c60cbd2-ba0e-47cb-869f-4f1d7695574d", "value": 473584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676750, "uuid": "f7354c3e-529b-47b7-8932-20aa6c8ef0df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676750, "uuid": "499f20af-cbdb-4d2f-82f9-b862285501bc", "value": "DSS INVITATION.cmd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43736e64-7a39-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642714690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714690, "uuid": "9e3e495e-c26a-4c81-90d5-a6dc9109af1b", "comment": "Malware payload", "value": "b54682c94a61e6f17ce0990d8f996021", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714690, "uuid": "9b35c865-99b8-49e5-a6cb-5bfdfe891977", "comment": "Malware payload", "value": "6f95d343a882d6e800379be638a48804dfc956537ffcc06361e1f57fa2938808", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714690, "uuid": "8656656d-e125-4957-9b70-7c1fcf4ca5f5", "comment": "Malware payload", "value": "f9ae7ea99c3caa78df9d67cb954758e84259f39f", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714690, "uuid": "6a4da34a-7838-4114-8858-cadca825c5ab", "comment": "Malware payload", "value": "bb42ff4506be6d110d002c11a4825b0c679b646d5ef4a32e97c1f6a2be318aeb921ab47a7ca65ce9ebc26c455cf719d7", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714690, "uuid": "37fc5c78-e232-4feb-b189-dd63b02878ea", "value": "T1FC636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714690, "uuid": "a14605d4-e5fc-4660-b1a8-0d55d39653f0", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642714690, "uuid": "1c8057da-081b-40f9-835e-9c33d24412e3", "value": 71450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642714690, "uuid": "45a29ea9-71a3-4fd3-a359-7e3c05a96ba8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714690, "uuid": "754d2c7d-dbdb-4a61-8694-127d3d2390d2", "value": "b54682c94a61e6f17ce0990d8f996021", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65aa76e2-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666644, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666644, "uuid": "8972b4a9-4e1d-4f8f-96e6-496f96bc665c", "comment": "Malware payload", "value": "a7a30d88c84ff7abe373fa41c9f52422", "object_relation": "md5", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666644, "uuid": "246614c8-1776-4164-a3e5-0c371bc1d952", "comment": "Malware payload", "value": "720a06e64e4fb85ff82dd2f225789a46b58303399b12b8390bbd3bdc4d5c5774", "object_relation": "sha256", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666644, "uuid": "5b4bb73c-432a-4faa-88a1-38f65cf2c3cb", "comment": "Malware payload", "value": "796810df98d4dead88f8cbe379af556621d819c1", "object_relation": "sha1", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666644, "uuid": "71e6fa50-aa66-46b8-929b-2d4369886098", "comment": "Malware payload", "value": "2b103aaa7a5ca1971abad3e3ef91a47f07816eca55d004897c286db67afa1ba8af701970e12299fc198d063c903fe6d1", "object_relation": "sha3-384", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666644, "uuid": "50b8cebf-c31e-4b3c-a1b2-6387d5663a91", "value": "T114353360DA55B96BEF435AFED77252354E052E36F7A501EE0B0963FC8B30E6B2C00865", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666644, "uuid": "042c72bd-39f1-4dfa-a486-ca124de31565", "value": "24576:kLXMRmPRIScwYMyBX82WJZ7T9XZpjmjZ1tpZ8OrMzk:IcRUINdqxzZXZMXZ/r7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666644, "uuid": "2bdc9ef4-8d32-46a9-8fee-084a7e9df5fc", "value": 1090625, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666644, "uuid": "3200c613-b1b5-4951-827e-87baaffc3057", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666644, "uuid": "490d992c-d2ec-4d3e-9d4b-8400209accc2", "value": "Note.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d0cd6f-7a0a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642694430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694430, "uuid": "f0144791-8c9d-4450-850d-cf8d80b42161", "comment": "Malware payload (Mirai)", "value": "365fe62a017003691f9e39335bd4a6c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694430, "uuid": "9dd635c9-70f7-431e-84b5-0e6e1ea52b1e", "comment": "Malware payload (Mirai)", "value": "728237265b14b02496eaaf701dbb5a4affaa30c3425b99d3725da73182d6cdf9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694430, "uuid": "d3a1ac88-8d80-4eda-803a-c9d34f16810b", "comment": "Malware payload (Mirai)", "value": "c56806c2332c114bfc589ce46fb2af09dea7ced3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694430, "uuid": "13a0abe7-8b61-42c5-9531-0fb71661f5f2", "comment": "Malware payload (Mirai)", "value": "bacfd85ee0cc952bddec8db197c86868c3e98ccdac638cce3ccb1f3d018d7bc4b8d26fa13bbf60c1de1fb9f07ed0879c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694430, "uuid": "dc4ef49d-916a-4cca-bccb-84de54013847", "value": "T1CBC32805D5508767C2D3237AE79F825D37325BA4A3DB33215A34BFB82BC27891E39921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694430, "uuid": "4a4104eb-41e1-469e-94d1-f4163518b56a", "value": "3072:ekYPUfsgnsb0J2ag/VfhkDN0dn+mTQOY5NX3cn:9YPUfsgEo2a0hkDy+mTQOY5R3cn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642694430, "uuid": "e9f86760-7d2d-4713-b73f-d3d16b7ac235", "value": 121007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642694430, "uuid": "dc3dbbbe-edf2-4c2e-8303-1efd16e7a625", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694430, "uuid": "0e9e8fd9-300d-4b8a-86fe-597c31eedeae", "value": "365fe62a017003691f9e39335bd4a6c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4158eb0f-79fc-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642688487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688487, "uuid": "1aecf7c4-e545-4b6e-bc97-7ee0006b0149", "comment": "Malware payload (RaccoonStealer)", "value": "50a7d165ac7c5b1c27902c1ec9e8664a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688487, "uuid": "6973eaa5-2b32-4dd1-8acd-26f0b9b8c0a7", "comment": "Malware payload (RaccoonStealer)", "value": "72f4064c6ed879040bb5a91bfbcca2b4829739766dbc7c2d99b8631e5966242f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688487, "uuid": "d90a88b0-ee63-445c-8033-d1748187643d", "comment": "Malware payload (RaccoonStealer)", "value": "fd0d1a825d0b4162606b1651b9f35545dd024d01", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688487, "uuid": "43d5913d-83e5-4875-8c0b-f78c8eafcd9c", "comment": "Malware payload (RaccoonStealer)", "value": "6330f49fa547f8b6023957adebb82d4594481d3dccca2f1322ae7deaa01d23e4b35e878511bbcde17afa520b47fd929b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688487, "uuid": "2d925ee1-d899-4a18-b304-3a10502516f3", "value": "T165A2071F66D0A6E1D1DA8BF79BF3F64002E44F42482EC12EB42733892A3F391BA155D1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688487, "uuid": "a7e98044-3e15-4c5e-9ac3-a2d550f96350", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688487, "uuid": "cce427ac-1629-4e30-924c-56eb93d6c6e5", "value": "384:lit1enlnpG+FPl0L4LrTJYblkIx/klPB/fgxzYruP6JLbU/RpJ3S++:4zEpG+Pl4sHqbiIhmPB/YRYruybo3S++", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642688487, "uuid": "c327ed58-9561-4ace-96ea-0f9a132cb4e6", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642688487, "uuid": "f5e6f6d5-521a-4c1a-a639-b70c26db358f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688487, "uuid": "f2372bce-8d39-499a-93da-fc360b7c02e5", "value": "SKM_20012022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acd9cfcd-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1642676642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676642, "uuid": "d963079b-f569-4ea2-ba2c-82152c197424", "comment": "Malware payload (Gozi)", "value": "da4fab67f5cdf49208bb9065d7b7d1e7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676642, "uuid": "73831194-f117-4f1f-a510-107690e06d7a", "comment": "Malware payload (Gozi)", "value": "73118c724e0d6cb9ce3072d66f2d20fb7e89189699faf60315395ad89b0a1a4d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676642, "uuid": "0f92f221-132a-49cb-8479-8fe4b0143117", "comment": "Malware payload (Gozi)", "value": "d7a399ace98716325d336e10b71049ed2bb7cc97", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676642, "uuid": "93ca0c9f-c02c-4031-9f86-84585ff6d31a", "comment": "Malware payload (Gozi)", "value": "1fce919ff4ec86c13b1edc3777ccb51ece31106975cf9995900d353fce74a3fd1c31c0a3efd0d357ba44f24147a9edc4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676642, "uuid": "d6e02058-6d23-4b7c-a548-d6cf477ef0b9", "value": "T1FB03E1141E59557AFB36CEB5212D313C6A5483022B69904E9FD23E7F8D61E483CBF352", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676642, "uuid": "ee344247-3a88-45a2-9dd7-9270154d788f", "value": "abb1b968d91c75e2b3eff2ef40b80997", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676642, "uuid": "412c589a-ae1f-4517-adca-7a37ee62db02", "value": "768:QpWPY4HN7q7vSPkVmkFtgDjem94Uk5kXXvi5i2NggLTH:QpngN7BwmDCGkGXXvEi2+gPH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676642, "uuid": "beac7882-e012-4926-9d97-c853ed282dd7", "value": 40960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676642, "uuid": "03b5b780-6a4c-4060-808e-aac0a45078a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676642, "uuid": "fa7f8315-ea2f-498c-b01e-f415a6af5222", "value": "41e0000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb91cae9-79e7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642679700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679700, "uuid": "f251007f-9523-42ce-b066-5e5d3f8765b8", "comment": "Malware payload", "value": "3f3cf295d63fb6c22cba4c605f69a59e", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679700, "uuid": "d37ce220-9a04-4d78-a8c2-616eccc00773", "comment": "Malware payload", "value": "738cc2a09be96bacfc95582ee2ffe7c900adbbd07df7d5da54da411d80eab31b", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679700, "uuid": "bf47295e-5096-4e4a-9eb7-feb9cafdedda", "comment": "Malware payload", "value": "cbcf5af9893db4d74f5bea71fb353bfbe78635db", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679700, "uuid": "a2d28fcb-8771-44a6-bea3-73b8914c0c3d", "comment": "Malware payload", "value": "61be4585d7ec39d1b0e59bc7c4de9937a0485100987e7b1eab09ccacaa7710668e692fd296ed0780a508539ab0a7031d", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679700, "uuid": "7128cc0e-3025-4a5e-b327-0e4227222dc1", "value": "T15E714B17EB811855DE5B92FCF9A389C80F1977E979CEA7F3140E26C239A0A53CD4058C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679700, "uuid": "21d86efd-92fc-4bd3-b66b-b7cb63e16a18", "value": "96:IEzV3UL2S/9H3xeUrI5mX5HR+DLcstPaD:7Z329H3xp85E5YDOD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642679700, "uuid": "ee4d5581-ac21-4986-8c71-e50c588c433b", "value": 3543, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642679700, "uuid": "37c4c3b5-24fa-4be1-bb46-4c495ee7f8ee", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679700, "uuid": "6dc58494-ffd2-40e0-9f9a-a8e6d48434db", "value": "views84985543.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68f9bf9f-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642668797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668797, "uuid": "2edc63be-87b7-491c-80a2-3287ee71ebb9", "comment": "Malware payload (Loki)", "value": "1bfd8144bd663827622e87cbd3718150", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668797, "uuid": "be6eb395-8fb1-492e-a320-c8875452b12d", "comment": "Malware payload (Loki)", "value": "73ab05f133367a68416c97ca773dee832f5468b7e5413ccd195ad1213b2899b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668797, "uuid": "2898211f-7b9d-4667-aca9-57a4ae7fef40", "comment": "Malware payload (Loki)", "value": "f54e8c8bcdc9169fdcaef13365aa8c02009c19a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668797, "uuid": "b59ee1c4-2862-466e-aef3-496150d67cc4", "comment": "Malware payload (Loki)", "value": "cb654c528d598181e82bd56debf2faa015b141911aa8ac9eecead4cc86973e1bf2aa24eb5807190436536ab39abc0cdb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668797, "uuid": "eba9180f-5746-495a-9d03-ddc1c5d56e52", "value": "T102740214B7F92B6EDBEA83F56531112057B9392A2232E36C0E9970DF6932F414281F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668797, "uuid": "0fc41aff-3c0f-4cc0-8c20-f244e2ef3ec2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668797, "uuid": "0d052352-247e-47aa-855f-513c7e894b39", "value": "6144:JsQXLF3ld9aggwLHiyJ0h2pk8eNAn0dJA6OMusnmpHf0KOfhtw4l55dY907J5FqF:68Hd9aKbtTpk8eNbj3usnCfgDw8DYkBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668797, "uuid": "bb198ea2-04c6-4a39-8be4-56409cf5ebf4", "value": 352768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668797, "uuid": "16f3538b-8e31-4a02-9cf2-370dd33ea795", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668797, "uuid": "71571d39-e344-4df7-9a2e-d20a5bcd1340", "value": "1bfd8144bd663827622e87cbd3718150", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5ae099c-7a0e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642696494, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696494, "uuid": "5e23fe4c-32ff-4a2e-a9ab-b36be6d3ec40", "comment": "Malware payload", "value": "9d36fabc3fdfd19905faafeaf221516f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696494, "uuid": "3056906d-83fd-45dd-8666-b87b7d09f823", "comment": "Malware payload", "value": "745e05c58713c838b50e3f17baf40bd8af9fc55f690584c024a54a884f1fc462", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696494, "uuid": "02e7f62b-636a-4e95-9a13-86f87aef945d", "comment": "Malware payload", "value": "c4574e16faf17396dd8b6c1e226351f9b0eeeb75", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696494, "uuid": "f378e075-90e3-4830-b695-9d62166e62df", "comment": "Malware payload", "value": "d45d0ad9808cf2a99813485b3a2db1ee0aae41c7f324fe428f981a8a87127c3e023e7c8f303d6881ca3e443f39983125", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696494, "uuid": "0ba4a5d0-d97c-4c89-b022-75e3e4e57467", "value": "T111F40231BFD24356C74E8BF88DBD7D6083B8B5462964CA6E494E9DDA0338B825710B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696494, "uuid": "3cf16426-59ca-4adc-8466-3de641321f29", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696494, "uuid": "dfae0a6d-b597-4b0d-ad5c-081680077ceb", "value": "12288:BxFiiiE9WfXGd333vm4ZeSFTkMZ/Qfz7oGJ:bofXk3331FFX4ffrJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642696494, "uuid": "09321fc3-b6ac-4f16-b141-6ef33f0057ae", "value": 779264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642696494, "uuid": "db963d13-21f6-42b2-ba55-33f00fab64b1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696494, "uuid": "102963df-77c3-4549-9108-ea961c32f802", "value": "producto enumerado.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "890d66cd-79c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642664985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664985, "uuid": "a52690ea-fb16-4031-8692-8e5519c43963", "comment": "Malware payload (Mirai)", "value": "1ed6cac04ce64b9f50e82e6639d85a1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664985, "uuid": "3ef2564f-deff-406b-b0f8-1d8dcbc840d2", "comment": "Malware payload (Mirai)", "value": "747514b6ab4d7b4f72aead6a1c15832bb7a38e70f3125f5191a4b1584d4076ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664985, "uuid": "64e97707-7150-4e2f-80f4-b2e0c7750aba", "comment": "Malware payload (Mirai)", "value": "d49f7392a81ff968f345c266a87a4435208688fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664985, "uuid": "c7b3de64-c7d2-46fd-b668-d0059130ca17", "comment": "Malware payload (Mirai)", "value": "51133bf4d2416f078bac95c591ad2f251434611752e68e06191005b319f5d94b37e04f277adf5ea729c4268253c4d450", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664985, "uuid": "e7e5dc66-e0ab-49f8-994b-2f182279a539", "value": "T1AD23298179829A03C5E4237BFB6E418D332563A8E1DF33179E226F5137CA92F0DAB551", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664985, "uuid": "f0bab4da-3249-4824-8262-d27eca2a6345", "value": "768:cS6POfCRi9bfR1YORAgKPjg0JN/mYBdohJXGb0TE5jQ4vwq+IPNOb7u2bqlsS:APOHJfvTM8YBn5jRvwFbqW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642664985, "uuid": "96742027-b4cf-4a92-85cd-f2be254e4542", "value": 48900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642664985, "uuid": "4c5c3be3-e359-4ab8-864a-e9d1975ec9b9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664985, "uuid": "3f2c61ef-2642-4855-a3ad-741d49dc5fd0", "value": "1ed6cac04ce64b9f50e82e6639d85a1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b5a90c7-79bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642661419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "19e5cdc0-a5ef-4173-8aab-26e67fc618b4", "comment": "Malware payload (Heodo)", "value": "e248b8e94e3b6eb8a8cabf8ea198b82b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "b91ed07d-d6f4-4237-a164-96271a486c5d", "comment": "Malware payload (Heodo)", "value": "747c12a8a2bb0bba75b16607defef907f785e93d36b13c5bce382d8f9c57db96", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "77e54123-0be3-47cc-91ec-20a78f27e347", "comment": "Malware payload (Heodo)", "value": "cb9b90dc1583fad9e09bd846f0bdf2469a6e8d1b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "3357a5aa-7aee-42b1-96e6-ea82c16c3e80", "comment": "Malware payload (Heodo)", "value": "f2dcb05bc1dfdfb0e5727a0d35f92229dde05b8c857b91b584751e45271e288fb60b157eb20d896463e12762e5113804", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "71a2d08b-08e1-407b-b1bd-003797cc820e", "value": "T14CC4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "70c37e1d-eb47-4c3e-b1a9-f0926fa01542", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "9dd7f21d-cd97-4ece-907e-dd5e71599dbf", "value": "12288:P78OGF+L8/4UUNyrndMhTq/n4vAzdkPs7:D8Ody4andbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661419, "uuid": "6c8d8203-5795-44d0-9020-c33cacb992f0", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661419, "uuid": "f0c98508-f518-4a94-8f19-5087fe38a9f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "6c974cbf-728b-41a5-9779-6d1b5f70e1fa", "value": "emotet_exe_e5_747c12a8a2bb0bba75b16607defef907f785e93d36b13c5bce382d8f9c57db96_2022-01-20__065013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33be7a0a-7a2f-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1642710369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642710369, "uuid": "ab5a0d68-fd97-4422-9b61-3105b109d378", "comment": "Malware payload (AsyncRAT)", "value": "1698db183216accc635a1495991ba96f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642710369, "uuid": "ce313755-f077-44f6-9f4d-2553c5a8d154", "comment": "Malware payload (AsyncRAT)", "value": "74d6ce17a5ef1abd3c1c2bf8b9cc472bc8f3816299a06498cc7266c8f479beae", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642710369, "uuid": "0597459b-df08-4fc4-8b32-0ea98db2903e", "comment": "Malware payload (AsyncRAT)", "value": "ea0332707c2e008dacd1023fcc201850f972f387", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642710369, "uuid": "6bc2a506-d485-42c2-8f51-3ab42d409a0d", "comment": "Malware payload (AsyncRAT)", "value": "81ef7359f0e89cbf19f1f9e1d12b7480711b37d4fc75043c23cbb1673b320fcf5026870af130cc875cba1b7c49fb61ef", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642710369, "uuid": "8f7679c1-9696-4a6e-a250-1005b5df9596", "value": "T1EEB48C49DA84C0C6E93F0DF78EBA8EB473A6EDF5D2168933498D34B1092757DACC1861", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642710369, "uuid": "6b7a5890-6ce7-4f77-8ddb-3c024e43f401", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642710369, "uuid": "e83e88e4-be66-40d2-a632-f6ff562aaa15", "value": "12288:GJWJhYH22qla5w/yXbxGRJQp4ybh1KmSdXWmkXnLyyPsJs7Nr9XovSAkm4bdR9tZ:MyhYH0MW/IbxKJQp4ybh1KmSdXWmkXnH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642710369, "uuid": "7dc2b9d9-e4c2-4d59-aea3-a42b2a33e176", "value": 512720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642710369, "uuid": "4314e9dd-085d-4682-9e44-7c46dbfa4d43", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642710369, "uuid": "f4edc17e-c08f-4dde-b932-b30ed1b494fd", "value": "1698db183216accc635a1495991ba96f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b32d6069-7a05-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642692544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692544, "uuid": "0c8dfcb7-107e-49b7-b87d-acdaa189b3fa", "comment": "Malware payload", "value": "bc2cae0511e3689a5b7e92483d7875ce", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692544, "uuid": "2def7472-4d40-4f2e-abc9-b34d72a02ddd", "comment": "Malware payload", "value": "74e90d08e189b4d93a0ad58356c26375c9dda3ecd24d3800cc28a1887d190f9c", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692544, "uuid": "5d4d9f3e-6231-4c44-be8c-80494b21c6db", "comment": "Malware payload", "value": "ecd786e72f097b2cbe41692eb31cec4627548312", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692544, "uuid": "64cae639-f1f2-4f90-9087-fcfdcf161c93", "comment": "Malware payload", "value": "37a2d509291b254aa2a1b1bf83ca64e015abcfacb8a63b22dc5fc76d26721ab9e7164eab32f3cc75d071b1cb754bde98", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692544, "uuid": "26a8c553-41eb-4a1b-88d6-42b4e2b475f8", "value": "T1908114AD074FCAFCE257AD88C5D51653EFBA86260A2CE7C4CF607EFA240056C94F1858", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692544, "uuid": "4bb033d9-8589-4792-8198-e1b70ecb4c66", "value": "96:ypRBWrdK9pS5Yhy5yuRUjwoS542cb4qKARXeIoF3n:ypqrdK9p2R5yuR+woSG2PaOIoF3n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642692544, "uuid": "18808ccd-018c-4c08-8e78-6dc9132fd983", "value": 4095, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642692544, "uuid": "78c31478-734f-4af3-ac78-a26750e028d6", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692544, "uuid": "112d3d19-d509-4670-9476-0a6f6a492fe1", "value": "16871_B16871_16871.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4891fd13-79d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642670890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670890, "uuid": "588c8d0f-ba01-4ccc-8100-6c91f2890c19", "comment": "Malware payload (Mirai)", "value": "23dd67d2d9e4a49a6fbc977ef6a045ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670890, "uuid": "c6a3b05d-405e-4377-a18c-3155627a28dd", "comment": "Malware payload (Mirai)", "value": "7569b6805882676636fa6c8b6c62b7351aa699291f4b71b1909052b4f5e35147", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670890, "uuid": "8be89bda-8d79-401d-bcf7-87eea6d19911", "comment": "Malware payload (Mirai)", "value": "92fca142c804c84601b5169f2eb1d8cab436da7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670890, "uuid": "3b6cb976-9561-4269-bbb6-91f288e56445", "comment": "Malware payload (Mirai)", "value": "e62f72f6b2f0377a5013cfc71d92006669c7b02d1f3b48756ce53fbfe3809a5261e8a32c9744a6a4a86740a9f2d5c57f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670890, "uuid": "080aa684-2928-4f7d-a415-4055e3f2c11b", "value": "T10CD3C73B27170E23C0C950B101E74332AE75DE9B34B952D7AAA07D686F37A843856BDD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670890, "uuid": "b063ccf3-cf79-40c7-9ab0-8c01b5f87220", "value": "3072:3v8G4ZNBQTZiNPR6Iwd9g+pKAOhmm/QMurB12CGNb:RrUlkKXmm/QMurB12CGNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642670890, "uuid": "d63327e7-5799-4380-aafc-791b08bbd365", "value": 130121, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642670890, "uuid": "02a542bd-ddfe-471a-9547-01543a3c1a48", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670890, "uuid": "90ebfc3b-bc2b-4db7-a4c4-68c430c895c1", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80a8d5a9-79c1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642663253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663253, "uuid": "ed072542-700e-4d44-8e4a-bb0dd393f7f2", "comment": "Malware payload (Formbook)", "value": "54cd72095a90a8e9abbb47bd66f1d012", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663253, "uuid": "9fbec1cd-a089-49bf-86ca-0d29ae4f38dd", "comment": "Malware payload (Formbook)", "value": "75daacd428208a7edb9f0ae1221148fcc7145f9aaeab1579ff6899669d423280", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663253, "uuid": "4596c05f-acbc-4b13-8c37-e9d23d2bc4e1", "comment": "Malware payload (Formbook)", "value": "98180d548e743fd0eb556f581a654fdb993c783d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663253, "uuid": "1eac8840-ea8a-46fe-8811-d6b2c57fabbe", "comment": "Malware payload (Formbook)", "value": "d17a412dc572fc97c03f0837fd66d83eb499715a90374a9b9c190d2cf47187cdb4bb8d2314b2c93d160e39853da582a4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663253, "uuid": "1c514d47-5af2-46c4-879b-ad86b1b92bfd", "value": "T1C9940104B7FD271EE3EA8BF96661551053B8B6073A22D31D4D8A70EE1837B468352F27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663253, "uuid": "b7a48b3f-1307-4323-baf5-a880575fa110", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663253, "uuid": "0ab34301-f5e3-4734-90c1-b280c7fa5890", "value": "6144:hrlLLF3GXguxaMb6k4iNo8fnM2E9XgnCqP47ky7uc1SS//2JWXyBr8OXoCD4JR:BxcgA5zERZqg7fqc1F//2JimDZD4J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663253, "uuid": "ad5040de-f6fa-457b-bfa9-aa1d481b5d67", "value": 409088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663253, "uuid": "332404be-7aae-4297-bb51-e97a96a80c6b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663253, "uuid": "7397e70b-f47e-4cb8-b0e6-87b576504330", "value": "quotation-pdf-scan-copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2a7f1d9-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642676759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676759, "uuid": "a11a3a50-2d52-483f-bd9c-f3e8e94eb4bc", "comment": "Malware payload (Formbook)", "value": "8aafb7b98c2133a63251e79733f3c845", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676759, "uuid": "fb0d1820-6225-4371-bba9-3eb998ea0223", "comment": "Malware payload (Formbook)", "value": "76588b31e6cd8b2f35b264ed9b9f7117d5ea212172f1b91f263c6551bf8d7465", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676759, "uuid": "54ac4b58-1e44-423d-a04a-c73ff414cbac", "comment": "Malware payload (Formbook)", "value": "f4ad175a151951a288864cdad550e4730c2cbc8a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676759, "uuid": "2a80ddff-8eb5-430b-bf8d-7bdee721457b", "comment": "Malware payload (Formbook)", "value": "8e5fd1b5e4b5f92b25830d01f2e639b2be49360aa01579e6a4354933ef5fe0509ed95703ae3dafad48ac80224344742c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676759, "uuid": "cd24e7c4-6393-423b-a7f6-4f75b381bbb4", "value": "T159640251A3E884DAFE324EB102B77D35C223BF1E7D75891B279C796928B30871432A17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676759, "uuid": "40301bbb-b20f-4d01-9b50-8bbe7e0f35fb", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676759, "uuid": "a3e76bad-cef1-450e-ac21-ffc311f23bc7", "value": "6144:/wIIw9AfDWMRoCR6edMVuyhVi1TmQCKyP+UKz9+l7wC2F1:0w9AfDWVC0xVbhETBCpGxp7C2z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676759, "uuid": "e341def2-0b0c-4ce3-9001-3fead9b29e8d", "value": 333357, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676759, "uuid": "3ccadb1e-e5ab-4f86-9623-ec7a9ca5fd7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676759, "uuid": "61c58c28-d508-4a10-9d8c-6d52515fddd7", "value": "Form.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78bfebb1-79f5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642685574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685574, "uuid": "4b36679b-8bec-4186-8783-f4c34f58b32b", "comment": "Malware payload", "value": "8cedc424e629342e7bf7b0686f113a9c", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685574, "uuid": "eed41f92-4493-4213-9ba5-e9f0d79e4dd7", "comment": "Malware payload", "value": "76b232aacaf4d413c689d9c98b4e7b4b4b70203bce89d7f276bbdb4c6aef184d", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685574, "uuid": "a40f9213-2f46-441b-86ee-71aa0a6d0ed2", "comment": "Malware payload", "value": "f3d032189aa027262a5abcc05b243cdbb6b60033", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685574, "uuid": "d571bfa9-d83a-45d7-9fb6-2ee142cdf51f", "comment": "Malware payload", "value": "8ec71d92c0e8601cb028528439dbd515e393b00243d612de7bb9d5e096172fabf9e80ff3bf4c3fc204c1305f38658f91", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685574, "uuid": "dd6d07bb-2494-41b1-952e-462b37559cd1", "value": "T144D423D1A56C28958CE7C138CD6961C0F0D94F3F23512E129B9DB87D5831BFB9B8A8C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685574, "uuid": "2214c8a8-2d49-4c19-b277-6839966a0256", "value": "12288:Vh9tWFeO2Spwlfv/JeShcynIap89rPhzfWP309Y:V7tWFB2mwlXvSWIIgtzfy4Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642685574, "uuid": "ff25368a-8983-430b-88f6-17747cc6eb11", "value": 601272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642685574, "uuid": "6581ba63-87c1-41ce-9a50-d9d8bb6114e5", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685574, "uuid": "e0ec727b-70c0-4ded-a6cb-1a07b940c6dd", "value": "SOA JANUARY 2022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa0a23b1-7a07-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642693387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693387, "uuid": "1f09a63d-bdd3-42a7-9993-f9b18cd6187f", "comment": "Malware payload (Heodo)", "value": "a1279864580d5f29c9730cd3aae2ffdb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693387, "uuid": "7a45b2b4-7ab9-4a23-9978-78ea18bd3288", "comment": "Malware payload (Heodo)", "value": "77151a31805014e0dc372a02bdabcbe7cee6ce3eaa1cfe9646290a6969581666", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693387, "uuid": "f161c0c1-064a-4dc5-913d-f1ff0c24ad1e", "comment": "Malware payload (Heodo)", "value": "80173c2e0554da5152a9c3c649bce3fb5b34efb3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693387, "uuid": "58a0c17b-131d-4b43-a9a6-50cf6d833f14", "comment": "Malware payload (Heodo)", "value": "4802abe262d49be7cfcfcc85ea641a90d5892edc62ae6ac738bcaccc292c731c23e5ae9d4cd8d927ee8572f91d2085d0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693387, "uuid": "638e9993-a68f-465f-8bf3-869c3849510d", "value": "T1EAE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693387, "uuid": "225adf06-149c-413a-b594-f9581faa3d96", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642693387, "uuid": "ecdea6a1-84f7-4e20-abac-2a2f5681b4aa", "value": 145359, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642693387, "uuid": "bc4d6940-060b-44d6-80a5-0baee0c68210", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693387, "uuid": "e947d74d-7370-4570-ac64-8697106f74d4", "value": "6214191929289147818 (1).xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fca819d-79f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642684351, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684351, "uuid": "a0bb3cb7-fe0f-4599-ac68-7d7f0e6c47b5", "comment": "Malware payload (Heodo)", "value": "0f8a9bd847e673ccf5adb13ce6fe5979", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684351, "uuid": "03b574e5-81fd-4cd0-8644-34095010f2dc", "comment": "Malware payload (Heodo)", "value": "7798bb812270c2c7736281585caab8c2f272c52405a7d2f9cf5da363192e9904", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684351, "uuid": "e19ffc6b-fa30-43a4-b65d-0837694c5b7f", "comment": "Malware payload (Heodo)", "value": "c84e4613c708eb3ef981218e278149993a3ac3a2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684351, "uuid": "37f68abf-de87-40dd-b726-f54fc2126bab", "comment": "Malware payload (Heodo)", "value": "880e64f96342993aae41e8d7fad42dd754633968abb53cbebb545455fa5e35d23e816379f39baad697eb315d8ff22f59", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642684351, "uuid": "0ae661d8-31c7-4dda-b874-99a571ce6782", "value": "T1A1C3AC0795059FA6C86CC3F9BF0B48D06F01066CE2D539DF28926B477399BBB0A0D62D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642684351, "uuid": "b03baf89-2ba4-4cd0-896c-6c27cd9cce08", "value": "3072:jXKCEvZ8BnW6X1yVkovrepMA5Q6g2X4ins:jXuh8lWoGk+eCP6DX4B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642684351, "uuid": "edceb64f-0ee5-423d-9275-9579fe1fde8f", "value": 118615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642684351, "uuid": "573f11d6-6edc-44ad-90ac-c8e04a0e8b5d", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642684351, "uuid": "81db44ee-65b5-41bb-85fa-b03282be5bee", "value": "673603229988382.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34056bad-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708651, "uuid": "28189a70-0ba7-4a5c-8df3-b5286f9aef4f", "comment": "Malware payload", "value": "091a013bf404967f71d45847b4cbb176", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708651, "uuid": "fb2aef9d-686b-4814-ad24-c0e357a8c7c9", "comment": "Malware payload", "value": "77c9c3633a6020f237d8c89acf95b6543592b2498f93c773ae5d6328861bb33b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708651, "uuid": "af08aac6-7d7d-4e4c-a6b0-c2b9fe2f5e93", "comment": "Malware payload", "value": "42af5799fd6a79f6d47d800abf568d7563d7ba4b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708651, "uuid": "2fd00a2e-6c2b-4c41-b6ba-bdafa01e7080", "comment": "Malware payload", "value": "b6f633bb3f095b2d558bb7d02f0ce2f64b16fe51de2a16a8b931ad67a02b5171658cb2e867a69941a0f1894377f76596", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708651, "uuid": "071347c1-494e-4f5a-8142-ce5096df5058", "value": "T1BF44E011A3AA0DB9D536827D94A31A05E7F1391247A5DEFF07A853692E73BD0813FF20", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708651, "uuid": "06ca4311-0fb1-4014-8bf4-7b2b68e7bf01", "value": "7c661725970e2285630167e2c43a72e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708651, "uuid": "69792586-c5eb-46f6-83bd-30a451029007", "value": "6144:KP04+yMJ9KqbXE/Uhr9sZymE6Hv/Ufq2FvJ:eDY9KtUqy16HIFh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708651, "uuid": "ad5c8b7f-01b1-4bae-83bc-8281c330f330", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708651, "uuid": "0d0f8ba6-b616-4164-be3a-7bc25b5f5b89", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708651, "uuid": "ef6db19f-47ba-4e4b-a86e-ae9fc9c4442a", "value": "091a013bf404967f71d45847b4cbb176.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "597cd78f-79f3-11ec-9275-42010a9c0029", "comment": "Malware payload (DCRat)", "timestamp": 1642684662, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684662, "uuid": "1d6afe47-ceb8-4d1d-8919-d4a12d7b8d3b", "comment": "Malware payload (DCRat)", "value": "ad7507c90821598ae3ed6e8b6c3fdb36", "object_relation": "md5", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684662, "uuid": "3880ec71-c433-4f03-b372-b46773517c5a", "comment": "Malware payload (DCRat)", "value": "785ebbdf0f15d1bb1fd3bbe1fb5a3486dead09dae463c91368653510c3814aee", "object_relation": "sha256", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684662, "uuid": "245d3ef6-e7f8-45f6-a546-83bcaf62ca11", "comment": "Malware payload (DCRat)", "value": "b94839035eb055acacef724166489e2c0cb60eaa", "object_relation": "sha1", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684662, "uuid": "6f2532e4-1f91-4292-8ba6-5e46a73342ad", "comment": "Malware payload (DCRat)", "value": "62eea19693ee63d6d4e149688f49c18241d444f68c6224fd03e2578c55bec0ffa57e7d57ce9acb54485a499c124e373c", "object_relation": "sha3-384", "Tag": [ { "name": "DCRat", "colour": "#0366C2", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642684662, "uuid": "39f98541-9300-4a92-a583-aaf37bab2104", "value": "T11C555A077A44C921D0690733C9EF419563B8AD413A22CB1A7E9F3F6A76B13929E0D5CF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642684662, "uuid": "984a42d0-8741-4a8c-8a6f-490ff09dc44a", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642684662, "uuid": "b0d2fd9e-930d-4791-b046-dd218cba11da", "value": "24576:z2G/nvxW3W5+pFxmV1Vm1pQwiwZUDMKbl:zbA3djG1VmqWUDMKZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642684662, "uuid": "a73dc9a5-3d08-4ab9-b85f-ea34310abd12", "value": 1353533, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642684662, "uuid": "377e9de4-b4fd-49a0-9ec1-ec303b1c6827", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642684662, "uuid": "7b0031fe-9cf3-4098-9bcd-7f9e877118df", "value": "ad7507c90821598ae3ed6e8b6c3fdb36.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68048e55-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642665789, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665789, "uuid": "6983e2af-1b95-4036-b34e-87940261713e", "comment": "Malware payload (AgentTesla)", "value": "b0d352bcf789fb47c736ae568330c93c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665789, "uuid": "e9fb4ada-3ff3-438a-bac5-bfde400fca7f", "comment": "Malware payload (AgentTesla)", "value": "788555a20f5709235d42d3328a2f6d1e2c327a41758dbac0b986d53cd8306282", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665789, "uuid": "d5898d9e-4814-49fb-bf35-48d08be26cc5", "comment": "Malware payload (AgentTesla)", "value": "815ba8e46ecdb66103b6e546309c20019b0c1df5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665789, "uuid": "bea0d1d4-f8d3-47b9-90fa-8efa01e0405e", "comment": "Malware payload (AgentTesla)", "value": "bea20e0040a08091ae228cba8a704fce576549acad1afdfdd182fd1c9e94195d923d3537711b51f199e8498f090fa3d4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665789, "uuid": "2855a855-dfb9-4cca-a2eb-6dbfc72cd41a", "value": "T199C4D056B7DED921C264567288DF800043B9EF85A613DB0E3FD833BC5A2235F5A4729E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665789, "uuid": "4692aa28-8466-4d36-bc89-d758ce616672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665789, "uuid": "70cd2f8d-0519-4ecd-9568-9c01b841eca5", "value": "12288:c2fXJztnf+qIyZ51WjQrdxRFkE7yyHjMV7nb:BptnGqt51FbRKyDaTb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665789, "uuid": "51633e8e-9126-45b4-bdd7-4e9063184880", "value": 547840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665789, "uuid": "9c166947-3a28-47dd-b5dd-28cd2bcc11be", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665789, "uuid": "68b0e6d4-dc06-49fa-b206-d6165270ffb5", "value": "Ocak sevkiyat\u0131 i\u00e7in yeni sipari\u015f,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aee1bf9f-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642668914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668914, "uuid": "8a06be61-145e-46e5-b3e6-85182d5d51dd", "comment": "Malware payload (SnakeKeylogger)", "value": "985fa53319b68730400c1c7f0064a47b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668914, "uuid": "b7bbaa4a-0478-40dc-b51e-1707a096c1b5", "comment": "Malware payload (SnakeKeylogger)", "value": "789c115542a9d9525e1068e759cfb57c9f1072d633897cd06a1f73114e7b4287", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668914, "uuid": "255d7dcc-661f-4f81-9dd7-d2ff23ca1243", "comment": "Malware payload (SnakeKeylogger)", "value": "24e3d34ae7df1f97063a69d7c92fba30d69b9366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668914, "uuid": "04e9052e-c794-422f-91ef-c7ec6d697259", "comment": "Malware payload (SnakeKeylogger)", "value": "0ed5a29a2cb316530edc8deb004b3838230ba5352d15dcb3f3f110a4f193f019904d10cb0a889c45788c10f25b9595d8", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668914, "uuid": "9a8b5cd7-1dbb-4181-b14e-ee0b72b07d49", "value": "T1A1F41AF6AD058A42D23427B3EF61B3318F394FD871E26005E61AB6867035F9E892DD53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668914, "uuid": "c7de1b1a-96b6-4f2f-beeb-110a1b2a2e0f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668914, "uuid": "cbef3d70-537b-4e1f-96b2-69a3ccaf14a7", "value": "12288:r3VjtV0FxeCE6jEBE5gAGVT6oYYB/RbuBY1QT:xUxHbEAG968uB3T", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668914, "uuid": "83544180-621c-4999-b5ba-584fe12614de", "value": 745472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668914, "uuid": "66418828-a94c-4485-bf35-64fe7ce7afdd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668914, "uuid": "24b90cda-bf48-48b1-a4ef-ae9379543bf2", "value": "985fa53319b68730400c1c7f0064a47b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7b3deab-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642666352, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666352, "uuid": "af033366-57cd-417c-bdfe-e76b546e8f98", "comment": "Malware payload (AgentTesla)", "value": "ab45d121d7a4539901ccab4f3513323b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666352, "uuid": "e1c2a623-32b5-4cc0-87e6-1358723f82da", "comment": "Malware payload (AgentTesla)", "value": "78d63bc0b4b2838daa6a15165ef18a3abe299a28ca7194444f5d9f264d7237bc", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666352, "uuid": "1d61e44c-aa61-4ddf-a4c5-a543a689ae15", "comment": "Malware payload (AgentTesla)", "value": "51c261194e9142f208385f853dcb2b59e1f2b419", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666352, "uuid": "63933167-21e0-450b-b1b5-bc64657782aa", "comment": "Malware payload (AgentTesla)", "value": "7d16425f3bdb58b5f3c38d1e254e49a39062d0ea060c34d7cd197029fe1a4109037012ac84eeb57356056bb53a6b5bf0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666352, "uuid": "08356d93-8f70-403f-b2c4-5e400b67b67c", "value": "T1939401107BFA9729EAEA87F42572104063F83A577116E36D0DC6B0CA5873BC2A751B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666352, "uuid": "8e06c19f-86c9-4272-bb21-54a3235994d6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666352, "uuid": "0139c138-e865-42df-b2fd-271996d4fcea", "value": "12288:3twgN+vSPNiozqLHF4ul37yUIps6n5LNkd:9OviSLHOul25mELa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666352, "uuid": "1dcce178-ae3a-4873-bffd-4ef22100a3d5", "value": 448000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666352, "uuid": "6bc7d76f-85b5-4cf3-aa67-58da11dd09d8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666352, "uuid": "d5e64fc6-0b74-487a-942b-a458fe275d5c", "value": "DHL - BOE_AWB1426117405_ENT_DEEL_GTW1_BOE_20211224_122421.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d3922f2-79c5-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1642664992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664992, "uuid": "9372b86d-bd5f-4a00-9b50-7240feb196d0", "comment": "Malware payload (BazaLoader)", "value": "ac96920684c5c701f1c69152019d50ac", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664992, "uuid": "ddba6afb-d4ea-411e-a582-82ce33300070", "comment": "Malware payload (BazaLoader)", "value": "7912ecf58bf36144f792f5fb357c4194229b1e3728d9852c4376fa297ddaad5f", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664992, "uuid": "6df189d9-c180-4817-b5e5-e355930bcd2e", "comment": "Malware payload (BazaLoader)", "value": "faaceebc1bc32ff76a338cadf0df9988ee7d326f", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664992, "uuid": "2456c212-ff85-4208-a8db-9c049a7a1bb2", "comment": "Malware payload (BazaLoader)", "value": "8bb3d8bafa69b5cb93f44989d5a9d37a49e33c2d281a15d597162441b38bcd385b8e3b23cceae66aa68a00673766afba", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664992, "uuid": "d6df324a-5df9-4289-9475-2aee6837ff6a", "value": "T15485FE43180C819F9867D77421671D97EEB87E47F2C84E1ED1E428B84AEBDA674CA04F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664992, "uuid": "947abb8e-b9d6-4eb4-8641-34def64c417e", "value": "f30f2b5b65c947eccbf132b668fe3257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664992, "uuid": "d8973b64-5811-4324-92b8-ca1a303b394a", "value": "24576:Ta1QHwgJMrQqj/wAc6QORNx2nAjwka0m0GV9igWwlnwXQBwfalj21X4GtZ+FdnZ8:JH5qloBMd8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642664992, "uuid": "47118aa9-e8eb-4d27-974c-885d5becf28a", "value": 1816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642664992, "uuid": "54f42806-bfee-4079-89b0-a9871f645c2d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664992, "uuid": "f77e79da-f8b0-4a2a-a97f-498ee574504f", "value": "ac96920684c5c701f1c69152019d50ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d43864f4-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642676708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676708, "uuid": "73f71367-9fa6-4618-9dcc-96a4b623b2a8", "comment": "Malware payload (AveMariaRAT)", "value": "66bad4532dfb0768050e2caef762f5e0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676708, "uuid": "bf8f89b0-7684-4b81-9434-7e3454eebb9f", "comment": "Malware payload (AveMariaRAT)", "value": "79e5689152f3865a8d93d733e56d120c129b338c3d1ee91b90f3eb4ff43f1622", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676708, "uuid": "925413f0-59d7-4022-abfb-da314434c3f7", "comment": "Malware payload (AveMariaRAT)", "value": "2a69a5f5578cce7ecee151aa3a1446b556ef341d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676708, "uuid": "7ff6c74e-c25f-4e1f-95d0-5b676145fc94", "comment": "Malware payload (AveMariaRAT)", "value": "54e02c32c79072a9b8f36f3fab8cc83dc8734b96003c06ecc5c98b239bf466daaacd627f4b599e5a7f65f96a2811468f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676708, "uuid": "d6dfd615-797c-4139-b381-f8801fc97737", "value": "T1F0A4D091346C92C7E5BA0EF2AC5BE13022B439DEE19AD14F35C9B79A20B2351405F77E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676708, "uuid": "6f77b89a-b7e8-4dbc-a138-0da1f856190f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676708, "uuid": "14fa5cc7-a245-4e4a-9469-6d616be49db3", "value": "12288:dqPwgYdAbc0Cnjlxdsu6HJkj81KzwCl2+AJNCLl+a/lyAKp:iYdAbc0CpnEJwHwClAfCLlx/lWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676708, "uuid": "b1b2b98d-d514-4c8d-8432-fd695b4f1da3", "value": 473600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676708, "uuid": "017a4bfe-9c88-458f-bc2d-f9a0e07c7866", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676708, "uuid": "d60cbe30-f847-4f9a-bf2c-c9d46b7a9166", "value": "66bad4532dfb0768050e2caef762f5e0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7146f3cb-7a4b-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642722498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722498, "uuid": "b7559862-5298-4881-bfc4-ea5d30a45608", "comment": "Malware payload (Gafgyt)", "value": "ab72de94d70762bd5fc37db318978a37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722498, "uuid": "b7542f6c-4786-4b43-baa5-923a2372374c", "comment": "Malware payload (Gafgyt)", "value": "7add9455afaf34040b285b5c55ee9542765c7c7befd6cd84872405aa635f27ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722498, "uuid": "8cb9a7d3-9f5b-4eac-b6b3-7ab27ab53d17", "comment": "Malware payload (Gafgyt)", "value": "c1ea9e509cae050add464c7d9b6f3c83d170fa0f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722498, "uuid": "a324015c-7fb5-4d19-8ae4-dc72edce784f", "comment": "Malware payload (Gafgyt)", "value": "943b785caf18c4769a4f45031067b455f9a98a75e6b1f649e5a79fc7b72033e35eca36428643e283365ec53a9c219258", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722498, "uuid": "9d2cfe81-dc23-498e-9c21-313bb3987a99", "value": "T1C3F3F705FD04976BC2D327FBEB9903CD373616A967DB33169A34AEB02BC17982D25520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722498, "uuid": "16891f3c-4ed9-49e4-a528-1afb10903403", "value": "3072:GAnKDuco30IDxt275hUbipe/rjX5VC2mUTrQMbLfWBj/9q:pOuco30IDG75hUbTrjJM2mUTrQMbLOBw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642722498, "uuid": "51647b7c-0bb6-4f5f-825d-9826edd1551f", "value": 162635, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642722498, "uuid": "d67e7557-e5f5-44a8-b2db-32d063277a54", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722498, "uuid": "922bfff1-8520-4237-bfec-15a054e7ec2b", "value": "ab72de94d70762bd5fc37db318978a37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8782486a-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642660688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660688, "uuid": "ea983f8f-9f35-4ced-830e-5406ef652852", "comment": "Malware payload", "value": "e875e5b2be55999f3fe9e7ec7af2877b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660688, "uuid": "86d12b94-8586-46aa-961a-8ca76bd4c9db", "comment": "Malware payload", "value": "7b1e42e4b280898b08acbbc6d7ef24d8995da993c45210b394950e0f1fe67515", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660688, "uuid": "98b8aa59-ef4e-4525-b4be-3c311413cf8c", "comment": "Malware payload", "value": "2e3ccb5a1022bde9c91c0d9448a3483aa39bddc1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660688, "uuid": "d1311a91-bd95-4538-a510-f09535c44678", "comment": "Malware payload", "value": "b3a0378ce1c5978b93cc54abe10934f718fb8aaaeefe5d9c7e3555de5a6cd354d49dd2155e3cae2c606c0384c40731dc", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660688, "uuid": "12addce1-e746-4069-8f02-0a72d235ac94", "value": "T15413F02F80C188EAEA7B58B6495E13756B749BF12052CC13181866F14E916BF74F3F88", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660688, "uuid": "cdf2e80a-522f-47d6-85c4-42b24667814d", "value": "768:I76K35ngVhBhNUaDac0CrqMxSAT9UI2tFFElzrh0HIAw/w5jt8EdJgGlzDpxYsqx:I7ld87MaMs1SPST4tVrYeD1ni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660688, "uuid": "5f200a50-53b8-4501-a588-4def4cdfdacb", "value": 45080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660688, "uuid": "e201fc58-79da-4951-8a6a-feabb52bbc2b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660688, "uuid": "736d8629-8e2d-452c-9faa-aee2c4616d73", "value": "e875e5b2be55999f3fe9e7ec7af2877b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ce7ca9-79ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642681997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681997, "uuid": "878b8e68-c08b-4e41-a08b-4955ffa89072", "comment": "Malware payload (Heodo)", "value": "50c327c92589a1bdc7266f2fa3f727d5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681997, "uuid": "55cab9d5-037a-4998-a156-d42126d2cbb9", "comment": "Malware payload (Heodo)", "value": "7bcc81bd2ed657103d32c3786d4ed067a429f084675d83b1a7b4517c48680820", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681997, "uuid": "ed40dd99-f892-488b-9f0d-951da323e1c7", "comment": "Malware payload (Heodo)", "value": "9848353da325f5a5d4cdb76edb4554672134a7f2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681997, "uuid": "a0323289-2311-423d-8007-f8a437d18518", "comment": "Malware payload (Heodo)", "value": "91ed17194e2b00cd10f5ace5dd2c48da2a084317bf3d12cd48402e5034501419a90e78306862acfc43483766bd2cc7c0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681997, "uuid": "8cca4c82-8d41-4cc8-9f71-0c79b0f282dc", "value": "T157E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681997, "uuid": "00906c3e-ba01-4266-ac15-97cf0e201881", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642681997, "uuid": "59354f05-17de-44ed-9b45-2266de1a98d3", "value": 145282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642681997, "uuid": "116f19cf-1017-460c-b9c7-fc06b3a5535f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681997, "uuid": "cd6a4841-f6c3-41c6-b764-03be5a840449", "value": "917466279697918005.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5296cfbf-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708702, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708702, "uuid": "10d1ba95-032d-4b47-95c8-26964e961525", "comment": "Malware payload", "value": "77aeef9da4c439800e2d6c9ecac07265", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708702, "uuid": "aa84825a-68ff-47a3-aa73-9d219fdd16c9", "comment": "Malware payload", "value": "7be54dceaa1992dbd94c8d70b4fdebffe3b24e3f0228d4b80dc8a61f17fc1871", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708702, "uuid": "96c50fff-a042-40df-ac7a-b912bfb8bb00", "comment": "Malware payload", "value": "d1f71551b780bc205dea17019b9a23f799193199", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708702, "uuid": "1d938598-c6cf-4294-a037-76ef4d178b05", "comment": "Malware payload", "value": "5644074e4307b450c351fb600054ddc25ca37761450751ce3a0250ea9672adb65317ca31fe9018ac80f89baba3490870", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708702, "uuid": "ab1301cd-ab58-40c9-b914-195956987297", "value": "T1F935FF43180C819F9867D76421671D97EEF87E47F2C84E2ED1E428B84AEBDA674C604F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708702, "uuid": "4b62a51d-6b0f-4799-8303-6551fcbc118c", "value": "24576:ka1QHwgJMrQqj/wAc6QORNx2nAjwkagm0GV9igWwlnwXQBwfalj21X4GtZ+FdnZ3:6H5F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708702, "uuid": "a5469328-2c57-4e69-927e-5e71eece526a", "value": 1062396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708702, "uuid": "5792d1d6-bdb8-49d8-b650-c5e19ba4a4b4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708702, "uuid": "0ea95804-9d91-46c4-9624-bcf161fbddd6", "value": "77aeef9da4c439800e2d6c9ecac07265.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4074491-79d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642672412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672412, "uuid": "edd1101c-48ae-4515-a8d0-f1412fe68056", "comment": "Malware payload (Mirai)", "value": "b0b3c7220cd79b01e5a88d93d8232a24", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672412, "uuid": "9a780653-d449-4bd0-aabd-198df7d48346", "comment": "Malware payload (Mirai)", "value": "7c90adbc4a803ac3e420fe6213433a7b371c6202cea99dd2a36800abc7c5a69b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672412, "uuid": "27bdbd5b-e19b-40fd-8d8a-05bbdf140b51", "comment": "Malware payload (Mirai)", "value": "9b10dd066a2fbf137877d1695d3f6a7b68711be3", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672412, "uuid": "e88eeb45-9416-4b76-a6c0-99a225aa68d0", "comment": "Malware payload (Mirai)", "value": "4f15271628fcc999283277c5036f6492f4dc8be9143a82c71409be203a0d11a26b9b4eca31acea64d261eb9d171179af", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672412, "uuid": "db87f8ab-d0f8-4d5b-b74f-aae2745d3b86", "value": "T1C8744236E75149B3E41C4CB224A622906DCD827B59652BD7F56A89A8FF32C0F01F7DE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672412, "uuid": "1f39b1cb-bed7-45b9-b220-c37927d118c5", "value": "6144:J8IYDkZ7MXdZCSpn0UpQKqUgAZ08kjUvq2wFmrThPaLEnvPrNb:iIYDEjk0mrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672412, "uuid": "a9736e1e-ac31-4d4f-baaf-46c1660cacec", "value": 338272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672412, "uuid": "a5752be4-6f2f-4195-8d20-15254136cab5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672412, "uuid": "2d94b3a3-ae2d-49db-981d-a9d80c320457", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c0742f4-7a27-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642707054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707054, "uuid": "c6778afd-bc60-4d9d-b67b-2593cfaa6e34", "comment": "Malware payload (Formbook)", "value": "4891415ab0895f94954e864fbb22fdd0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707054, "uuid": "215ee378-e2cc-469a-875a-511edce7c72e", "comment": "Malware payload (Formbook)", "value": "7d1b0018f19ea705eca5d476f4d2aa2cb8899b269b99df63185aa8a3faa1b9f1", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707054, "uuid": "83719c13-88b8-4949-a7ff-06e435b2e1fd", "comment": "Malware payload (Formbook)", "value": "7fca6e7716ad0460124fe10904cae6ec81332a67", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707054, "uuid": "01f79888-4544-42e5-9be3-a813a7497298", "comment": "Malware payload (Formbook)", "value": "d01e93f01f25f71d2c810758e46fb6e56ce64cc36d3825e5d7663290609da82e80820c6c4a565b54159c6f887b317ebd", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707054, "uuid": "cdc1adf7-7367-4ca3-a034-92ab4d889a5c", "value": "T1FEA3F13ADDBA10B4C1770BF5C10F69B719EBBF9804E66647C0A5B0DA11779928DC8983", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707054, "uuid": "e87cfc07-3e28-4007-b863-154631cdfbe3", "value": "1536:PL8II/qSfMld+3+JuZzbKe7ldlZCTTp606FH7QmLFOEn9nto8f2a01aSO7Zoc6xY:PgL/qNc+JszbKe79CTMnFRtd4MSOa4iG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642707054, "uuid": "4c20cd00-caba-46b1-b2c2-7b219b6c33eb", "value": 97720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642707054, "uuid": "559e7d7d-5860-4610-9d6d-e2298f25ad67", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707054, "uuid": "43b504e1-9112-4036-a406-38584a18c690", "value": "PAYMENT INVOICE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd5e2b88-7a15-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642699433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699433, "uuid": "e0f7bc7f-782e-4c4f-829b-663403c6405d", "comment": "Malware payload", "value": "733382e2efa2e203e27752e4f679cac8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699433, "uuid": "1b70f55f-f511-41c0-b18e-582d8edf54c5", "comment": "Malware payload", "value": "7de0d1f12f44904eae6b56b385d1e712048698c0fd532f7fea032312aef7f348", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699433, "uuid": "36d341df-5e9d-4e1e-9b17-d984887e577f", "comment": "Malware payload", "value": "ca57542bd125089c66bf84366e73748f9a0739be", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699433, "uuid": "47879a0a-4d4a-42fd-979b-52dd77961353", "comment": "Malware payload", "value": "be33bfa4c5f2aa6e232b7b68811761580d6964c87aecbf13769d54345be80bea6601e9bf2469042f49806e778bed8dd1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699433, "uuid": "2c8adb03-11bb-4ab0-b62c-f29de9f19fee", "value": "T12EB361E19DEC15BEE1530E736AE621C046FA9F07B8552E1743B0F80B55BAD8D8071E2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699433, "uuid": "c3606178-cf55-493f-be87-d097cf36f33c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699433, "uuid": "79c1eba1-5594-44a7-8d53-11e8383248e1", "value": "768:yw9b+1nikTAr5iiiiiT3vTKiiiiiiiHiWWj:d9b+1nikIiiiiiT32iiiiiiiHihj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642699433, "uuid": "f2caccff-dd5e-4108-a301-0ad7f77daf00", "value": 113664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642699433, "uuid": "1f75a521-665f-44cd-a139-34cda03bd762", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699433, "uuid": "adc26297-6547-4d35-9a4a-636d91f40077", "value": "Nuovo numero PO46220102222.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57b200b3-7a2a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642708282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708282, "uuid": "b71872a5-c0c6-462e-8af0-64e9acc0c78b", "comment": "Malware payload (Heodo)", "value": "68860e57506daf140b151ccc3f1f7e2c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708282, "uuid": "e7d04689-69ce-4405-86e4-5897f075682f", "comment": "Malware payload (Heodo)", "value": "7e95d5f31df3b9fc9934f70690ad92450133e8a8718b3cea37e558141aff2011", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708282, "uuid": "31d9cc0d-9308-4583-a7bf-af614575fe0c", "comment": "Malware payload (Heodo)", "value": "aff0e4c45019b9c544903b1ee455822d3e15dc5f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708282, "uuid": "da551e89-c0ba-4b49-aa06-f22c0130fa27", "comment": "Malware payload (Heodo)", "value": "7bf14fc44104338a83dc64a6ab7c712535e0844d37741a08375b548f30cf8d1a88f181fd72ffbff32e3ac5636944264e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708282, "uuid": "2148c1f8-27d7-4717-a355-aae581b19dc8", "value": "T1F1E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708282, "uuid": "1c024db0-46a6-4319-8da0-c90a95864455", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708282, "uuid": "ce1dfd0d-eb80-459e-a9d1-76baaa4a4469", "value": 145126, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708282, "uuid": "0d002c35-b513-4dae-bc20-ac33005c2654", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708282, "uuid": "ac5a8816-322f-45f6-b4fe-3f0a06883e9d", "value": "68860e57506daf140b151ccc3f1f7e2c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a5b8e6e-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666625, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666625, "uuid": "7fc6697a-e279-4529-986d-cc0e6fe7d6ef", "comment": "Malware payload", "value": "cc4a9d5248095e64c1f22e8a439416cc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666625, "uuid": "0f7c6533-aab3-47cd-80e4-902760b9d9b5", "comment": "Malware payload", "value": "7eaf61e7e974d02110133ca2c9f410fc18580aefa525523845a9326141734ea1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666625, "uuid": "c282ecb5-c5ad-48b8-b8ee-35b9cbc67101", "comment": "Malware payload", "value": "98ee9e79b7ca736f515245d5c39f49b2518f60fc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666625, "uuid": "24e3e69b-316f-45b8-a9bc-fee3942c5be8", "comment": "Malware payload", "value": "b555b29ab2f22334144f6aa5189f4eac994ddac2a39d198cebbccf3fa83ff7a37ac0eaeb4025a7de783de8b9f10cecf4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666625, "uuid": "4c2ebd03-3fe9-49dc-bc4d-085a9942863d", "value": "T1F827B02638C10AD2C26D4E75EF6DB375C0A7FBA52C79736D63849B4E06FB683D908112", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666625, "uuid": "a7d742d5-8f13-457a-a85c-c875daf1c97b", "value": "bf23bb47e3c12f8ede313906b5ecfee1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666625, "uuid": "4e790a1c-1c3b-44c7-b21b-492516ffc149", "value": "12288:/9Mv1YFzuWu9aqdDhzu6dW/rPt6jgdOacngLdGrkTB/hMvzBrl0eqbt8S1qJt3uH:lMv1qzuRdetMgkaDRX5hMbZueqSS1GU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666625, "uuid": "b89f0b2c-d57b-4016-8397-ad67faae2a21", "value": 22099968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666625, "uuid": "1813509a-17c8-4fa6-97c0-3cae4350e08d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666625, "uuid": "c2911776-7bfe-4bb1-a3d2-4a8025a3c4b7", "value": "mslog64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdb48fd8-7a2a-11ec-9275-42010a9c0029", "comment": "Malware payload (AsyncRAT)", "timestamp": 1642708560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708560, "uuid": "80ef6573-5b0d-4e2f-bd97-00281b03a2c6", "comment": "Malware payload (AsyncRAT)", "value": "45a4b5682899474927c9184aaeeed2a0", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708560, "uuid": "c8faa487-68ea-48b8-ba10-7b1e3f014259", "comment": "Malware payload (AsyncRAT)", "value": "7edb2695de8a294a93f6ad48edb3b1e8199fbfbed4a6dd78c180e3c29e7eaae6", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708560, "uuid": "3b7fba74-07e8-4220-b814-a777c4e18ff9", "comment": "Malware payload (AsyncRAT)", "value": "07106912a9aff461a3b4e8201474e0a70c0c4afa", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708560, "uuid": "c170cf1d-d23a-4da5-927a-8ff0885b1626", "comment": "Malware payload (AsyncRAT)", "value": "e699948938a3576489fbd8a6e85c387012a510eabd86d4c8eb6d156556a9e5a6a9a946cd21af3a023df204d2f7b0af4b", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708560, "uuid": "d41bd58a-6d39-4de8-be13-80a4f662d445", "value": "T1C913E8117A9CE594C8990631CEABE7F036B4BDC69122CA9776F93F1FBA33306DA01505", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708560, "uuid": "0faf6796-041c-4d76-8ce7-3f950b7a9a94", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708560, "uuid": "fb60e1f0-cc6c-4b6d-a7dc-593faaf97418", "value": "768:VFj0q/2vGoA1KUMqnbBb8BskgFCGtsPD2o4wqQ4UcAY:DgRGoLfmbBb+goJPioqjiY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708560, "uuid": "a65266b0-aff4-4fb8-95e0-13ddced55ac6", "value": 42496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708560, "uuid": "6bdd4f85-187c-4ba0-9913-b5ec6da4fcf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708560, "uuid": "499428df-1ada-4560-ba1b-2ace92bd6dbd", "value": "45a4b5682899474927c9184aaeeed2a0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a65b11c5-79d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642669759, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669759, "uuid": "05dea3e0-7b04-46bb-b13e-543bb44e5bf3", "comment": "Malware payload (Mirai)", "value": "d4d49b9698a76db7b89ddfefb16a8218", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669759, "uuid": "befcede5-05b8-49da-ba1d-710323d8e461", "comment": "Malware payload (Mirai)", "value": "7fb561f40280a2e0f2708b186d37c56e487266ff8da5f2166cee3e06aa9f0881", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669759, "uuid": "d8d5e616-2f9a-47f8-a56d-12d6d9ec7b0d", "comment": "Malware payload (Mirai)", "value": "e074c1a7e2ee5f7afb490ccb30ffee0c23112fa7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669759, "uuid": "6fd55485-f660-4e2d-b338-8f362d8c6ec7", "comment": "Malware payload (Mirai)", "value": "b5df4227eeec1fee9d5fddcbbfa3b3b9bdfa36aabfe801f0f06d7eb51eb1a524757e0800cd86304148d8e9bcffdf79ba", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669759, "uuid": "ec4eff53-0bfa-4bdd-82ea-8b9bb41edb49", "value": "T1A093D709BF610FF7E86FCC3709E91B05198C550A22A97B367A34D868F64B65F19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669759, "uuid": "55c481b5-862f-44a8-8878-51cf004573f6", "value": "1536:nSITUINkErQWG6fZnH/zoSAkaI91rFSEZa72PRU:nSITRNgWjtHUibSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669759, "uuid": "813657ad-7940-4aba-8e3f-cac9c9835ec8", "value": 97568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669759, "uuid": "1aac3718-abfa-4245-8702-9ea8a8496a1c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669759, "uuid": "d7d414a6-d88a-4802-8f16-5d1f821c629d", "value": "gang123isgodloluaintgettingthesebinslikedammwtf.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2a301e-7a09-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642694065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694065, "uuid": "0cbea10c-982a-4542-a4e6-3fb42e07356f", "comment": "Malware payload (AgentTesla)", "value": "8c46f3414e18794ecc92486bb5c0f66f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppa", "colour": "#46E682", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694065, "uuid": "48decfa7-4fe4-440c-9e60-7e64e6b860c1", "comment": "Malware payload (AgentTesla)", "value": "7fcbe29b97aabb785680812a692ae177ab0a030e5e47fce2ed0ced4caca45e99", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppa", "colour": "#46E682", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694065, "uuid": "85ebaf5f-72e3-4e11-a37b-737cddfdddd3", "comment": "Malware payload (AgentTesla)", "value": "bb7fffd4ba1967cabc0bca77b05b9c49463e01c1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppa", "colour": "#46E682", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694065, "uuid": "c3d9e50f-ac4a-410b-9956-65f609cef77d", "comment": "Malware payload (AgentTesla)", "value": "6bd77d634291bc6b1a18a7599c2c6af46aa3c4c5de6a7e84f847e49b55aafc3db05c671f729d299bde8b3413143e44bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "ppa", "colour": "#46E682", "exportable": true, "hide_tag": false }, { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694065, "uuid": "af141666-ebd9-4168-9163-3dad238395f5", "value": "T1C183E4047380C532E06B9A328DE7D7DC6335FC92AE51472B32D8331F1E7A5A2AE16394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694065, "uuid": "d44c2b5f-65c8-4149-a4f0-34c21685d7fd", "value": "384:bfgcKfdLpc7Ct3cq02FhfdAYi2wrCLF5Gl/d5zkP1dwKOMiAFW1/vclFo39D:LQfvcWt3cq0OhfaYyrC3wKLiAFCvcjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642694065, "uuid": "5b083b19-732b-486a-8ca1-f43b12e63768", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642694065, "uuid": "41c2cc13-515b-4767-abe6-693da1fee995", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694065, "uuid": "64082d13-726a-4ecd-b67e-b64a4405ac27", "value": "Wire_Confirmation.ppa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4f2629-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665933, "uuid": "3aa55789-058d-4963-bd81-66f36e9cefff", "comment": "Malware payload", "value": "94739453dbb46e8a7a0fb6d0ae83212d", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665933, "uuid": "bc4332c0-002f-47b5-9a93-f0edd59131a5", "comment": "Malware payload", "value": "81c1465a3e90448669bd1a84fd10d3cc286871988d6f9d331ce21014a8bfe0be", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665933, "uuid": "1e11ba60-f9e3-4ca0-94d7-d6fa263a07ab", "comment": "Malware payload", "value": "9d7c69c9de561f90ee1f20168cfc476d557f6545", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665933, "uuid": "aee9efd8-af4a-4482-9fea-74305a54c419", "comment": "Malware payload", "value": "a5bee7f302d5c0509b3c3839550df57654476354ebee5d4f53b92550e384422f8222dd57f4027cfcc61b8bac0da4edab", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665933, "uuid": "f4e40044-ca34-4782-9ce1-b807e9ca9aba", "value": "T13C1229E30AF069D8937E6203E6F43B6843352CB3B7A5BE933586DD4518229C19CD25F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665933, "uuid": "428fdac9-a1f2-4da2-9e02-a328cdafeda4", "value": "192:glfzixm421qoJBvgQ0oVS0EfLpHtWHanX3yn2muj:e4u6vL3yn2B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665933, "uuid": "5cb17855-7ca3-4e4a-b4b7-d1f9071587ef", "value": 9480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665933, "uuid": "5d6beebf-3d3c-4ebb-ac89-5362901cdb43", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665933, "uuid": "85dcf0cf-ed6b-49e0-89ba-7e2080872d00", "value": "odeme bilgileri.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bca187e9-7a0b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695136, "uuid": "81a7ed2e-39bc-40d2-9ca2-71d571d1140a", "comment": "Malware payload", "value": "fc82e3e2a4caa8b8bddabddc4b227880", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695136, "uuid": "4563d0d6-ceff-4e64-90f1-5897569914c8", "comment": "Malware payload", "value": "82a26b1bad113d48489d06f8d221af65ffc06b191ce72110a98334242c9b1c44", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695136, "uuid": "c6913f7c-61e1-4af0-8d81-73fc0de95e29", "comment": "Malware payload", "value": "530d7e293c7cffd7b9ebdd9f81a547d9985cdc88", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695136, "uuid": "5b287bc3-7567-4847-92e8-34ecaf15a9c7", "comment": "Malware payload", "value": "4024e19ca850282496f8bd844a00f33bedf9e6b6ef624508b4d0da3614efb208944e16603f121164d0f22bd7e1a8ec28", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695136, "uuid": "8e24372e-37f5-4b50-bff0-23bdae16f3a7", "value": "T104A3A6253A21AFEFF16986300BF39F3052D5B5D72A919385E26CE76C2E6028C1C5F794", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695136, "uuid": "9b43ec2c-a831-4029-a209-d9c4b94e9cbe", "value": "1536:OTrGpv4ZzqvcGdUASMNMQ8yNHyH1oySNeCuTBx9Rg6whEHwF5higrVcr:1cCMQ8yZyH67uTBx9LwhEHwF5hfrVcr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695136, "uuid": "329b9203-85da-4a1b-a17e-fc3579b259fe", "value": 99020, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695136, "uuid": "4563f1d2-e00a-4276-8ce9-0d4cc1b77bf4", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695136, "uuid": "73eac51d-a796-4612-a8da-4783f1c220ff", "value": "fc82e3e2a4caa8b8bddabddc4b227880", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0b21bfa-7a4b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642722604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722604, "uuid": "8c7df6d3-6921-4c9b-8461-7330302f870c", "comment": "Malware payload", "value": "20cf4ef67cd1b1fd26fe1c50a1fc7787", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722604, "uuid": "311c003a-71ba-4826-8c43-25ca1a06efc0", "comment": "Malware payload", "value": "82c3a44eeb615d7fa0a087958d3fec4b680cec9374ea9407accb112d1ce85b83", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722604, "uuid": "c7e80572-3a10-40f2-bf9d-ee9ef31deb88", "comment": "Malware payload", "value": "434df9d2e3b1c693d02e90884baa02b8e421f62f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722604, "uuid": "622bad7b-fe53-48ad-b3ff-6f1be5a5576b", "comment": "Malware payload", "value": "3784514a75e3a10d011b03104adaa04d1ebc7fc5efabe65f206360045e20d19e37b629547dc95ff4594f96fb99d38b7b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722604, "uuid": "f912730b-5390-4838-86e1-6c3c7566e9b7", "value": "T1B6C35D92AB80C1B3D04306F212D79F164932F6FE1A5BDB46E7A82CB4DF19185B221F5D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722604, "uuid": "407929bf-9559-4610-b0c6-9b8e3c02445b", "value": "3072:oUJdObUZUaUu4cG4MaWZyKD0NvaSxR5hEp9KH1C8Y/4nmrMVduymG/rG+8:KkBpV4XsaSxR5hGKHznmrMVduyV/rG+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642722604, "uuid": "7273bf02-49db-41f7-a80f-094add72165f", "value": 123159, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642722604, "uuid": "ae8682fb-2beb-4f80-9c35-002d51ea58aa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722604, "uuid": "36550588-ab55-48cf-9a4a-8abce78b9fa4", "value": "daddyl33t.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e798454-79be-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642661988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661988, "uuid": "9fba83ca-6010-4bf3-b5f2-e2744202be24", "comment": "Malware payload (AgentTesla)", "value": "663eb42b1c39d5dc985c16a849cd3dfe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661988, "uuid": "8db76a0b-eb82-4384-a9f3-b93b7720d210", "comment": "Malware payload (AgentTesla)", "value": "834d14d96b15202e1ab5bf18241d9c601b0b00c3d813607e036b52020cd9604b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661988, "uuid": "c68ff281-f138-4305-b6b5-39624ac7cb19", "comment": "Malware payload (AgentTesla)", "value": "7ffcc64038d3187c2d4ff28ffc9a5ed39e8fef06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661988, "uuid": "bcdcf105-a287-4256-a3dd-8bc62e6e3f59", "comment": "Malware payload (AgentTesla)", "value": "04bd111bd26a74611df4e9830ec9581ddd203fe9df874954a0aa9bfa3914e8ae232be865ccc29d009cb3948577849235", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661988, "uuid": "c26a376e-0f6d-4268-8f5a-b2f2f15f4870", "value": "T1B0A412023AAE517BD9A45BF52442126093F451FB61A2F3CDBC45A1EE1AC7BCC0BB1B47", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661988, "uuid": "8198bd9c-6cfa-4a24-b762-a97b1c3498b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661988, "uuid": "833b2775-fa6c-49b8-b520-2e37a278da7b", "value": "12288:EqLa7ysxwaDRmOMcGP/Enpi70DU2uUBnrYTZGmUQe:baZZtmNcIWUwBrQ4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661988, "uuid": "c109e02f-0d82-4a62-888c-ead7b01ceb48", "value": 455168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661988, "uuid": "a5eb5ad7-be51-498c-9600-7420184b4f5e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661988, "uuid": "bce29c03-f102-4c08-ae1f-025560bafb9c", "value": "MV AMIS WEALTH CTM USD 40,000.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e92393fa-7a1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642701654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701654, "uuid": "14758972-3730-48e1-9c58-b95ebad2a056", "comment": "Malware payload (Heodo)", "value": "8614f257048222da423e77b3eb2dbf02", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701654, "uuid": "a20d811e-a558-42aa-a901-1cc13f37b762", "comment": "Malware payload (Heodo)", "value": "8367f873c806ac8d56f4ddb2f158e4d559c67dc1d7b66ac3221cd28a2c8079f9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701654, "uuid": "68e8115c-25ac-48eb-b5a7-d10db7c554ef", "comment": "Malware payload (Heodo)", "value": "cd10af0d741df96c84f440d39a963eac73f22bac", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701654, "uuid": "dddbffa3-3883-4247-8b75-7b6c8d1285c6", "comment": "Malware payload (Heodo)", "value": "73902fe6ffe9c7f23f013a284f884e24b68e4ca55b83f7619a561b3ea6779afb03b897935cf0c822a57ecf2191c8d8a7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701654, "uuid": "fe63097a-95db-4603-8b3d-c6ccbfabe4d1", "value": "T173E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701654, "uuid": "ab821ddc-3ec2-4013-8363-4a575aa85db5", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642701654, "uuid": "022e299d-a489-45cf-8682-7f90db6f4390", "value": 144850, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642701654, "uuid": "0b25eb17-5a40-41a1-b611-2790ea555b88", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701654, "uuid": "521afc0e-b8a8-446a-beb3-80199955e9d7", "value": "8614f257048222da423e77b3eb2dbf02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3822545b-79fc-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642688472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688472, "uuid": "9466214e-8648-4f26-9371-82429587ac23", "comment": "Malware payload (RaccoonStealer)", "value": "99656e4fee1b27122a02a670da4d62c8", "object_relation": "md5", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688472, "uuid": "28995dbc-d522-43c3-9c77-e64b035b9c75", "comment": "Malware payload (RaccoonStealer)", "value": "83d2b26d5261101ef765312c5eec9621f428f000f73ff27ff3f807c1a863d462", "object_relation": "sha256", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688472, "uuid": "88903d0c-4590-48cd-8b28-f4f3b74c8c13", "comment": "Malware payload (RaccoonStealer)", "value": "a3edcde3caa652698ed0818152d7653ebd90b173", "object_relation": "sha1", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688472, "uuid": "19862c40-67fe-4bfa-9ff8-26b36cbedf24", "comment": "Malware payload (RaccoonStealer)", "value": "858ed8d4db371ce6966a92efdd4d5fb370e8f263ad8c8be25965cb419e9e39ac8b049988f76fc8bafa3ab52c1f9c58f7", "object_relation": "sha3-384", "Tag": [ { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688472, "uuid": "c138253d-9e32-4d4f-b7ef-abffad699726", "value": "T15783D61E669096E5D1DA8BF68BF3F10002E7AE42487EC11E752F33492B3F3916A117D1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688472, "uuid": "20f4db7c-b56b-4e15-abe3-ec6f63cb5d88", "value": "768:M3zEpG+Pl4sHqbiIhmPB/YRYruybo3S++:GzD+PusKbbhgbxbo3K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642688472, "uuid": "becf1ee4-56f6-4087-b7a2-bb90fd8964f9", "value": 86016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642688472, "uuid": "ce28601b-2220-4470-bc76-510758b9833e", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688472, "uuid": "80a0b76b-1981-4df0-8169-bdfc5fbbb2ac", "value": "SKM_20012022.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b57cf72d-7a3b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642715740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642715740, "uuid": "a3c6de97-37d4-4f80-86f2-32cc42703425", "comment": "Malware payload", "value": "457a43b41d0fa7d9f0f3b95ddf80524f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642715740, "uuid": "49b9866e-413e-4fa2-a494-3b2b70fc2b13", "comment": "Malware payload", "value": "84561eb87d2085a557c91a77d928c3d3437afe4f2a62631707300bfb14c34e98", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642715740, "uuid": "8afc69d7-f9cf-4b22-97da-652a18fb83de", "comment": "Malware payload", "value": "0cff829d8121bbddce1e1b9dc0fbfb7a2610a50e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642715740, "uuid": "ef367ac7-1830-4b63-a008-f60253969e36", "comment": "Malware payload", "value": "51c99cd4e885d671bc4fcfdb20d185651807d33027a42db1389b262bf96b8ba7390d3f3b4f71eac9fa9940910bb19958", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642715740, "uuid": "92540db1-e308-4f90-9302-ab084947f3d0", "value": "T12D45239A841325A8F8D02DB215BED9C1534EB5133A843E212D57C9CEB534EE6EBD3E0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642715740, "uuid": "cf26f4f5-353c-4c99-856a-f99281d649be", "value": "acc384cfc66d33262df1bf4ba30ff02d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642715740, "uuid": "3eab741d-9337-44f0-ae26-6e30eaf6d6c9", "value": "24576:oB0NWp6nr52LyDXRfJ5dwEztbXCmAUscM7P8g6A7Vpg83atTUHnlr:oBSDnV3XRfJ/emAUscMoCVuw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642715740, "uuid": "a1f1b4b7-12fa-4b58-9ca0-72bd13aa5568", "value": 1238016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642715740, "uuid": "e6fa87d2-a5eb-4288-b75a-9a12910be5f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642715740, "uuid": "92aace05-b031-4284-8e2a-15516cc5772c", "value": "457a43b41d0fa7d9f0f3b95ddf80524f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0bec5a3-7a08-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642693935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693935, "uuid": "22096491-8a72-4301-8b69-c89efdb4dd07", "comment": "Malware payload (AgentTesla)", "value": "9ee022110947abd35911862929f0bc3e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693935, "uuid": "6c6b68cc-c8d1-4700-b997-7b8692018014", "comment": "Malware payload (AgentTesla)", "value": "84744f4ebb7f55b33517b9aca7b9682e139347836397e50f6251c83b6f249d27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693935, "uuid": "a014546a-82d5-4a78-820c-e45dcd4e83e9", "comment": "Malware payload (AgentTesla)", "value": "81e89fad46736165d7cff831077044a0cf358f96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693935, "uuid": "97af06f7-7fe8-4bc9-9d85-455658a1674e", "comment": "Malware payload (AgentTesla)", "value": "52abda005d187a5eda7d740a35484e306aedcff9b65eb941c08a2e8c9eaa7e3364467e5e9a9dcc7c6e0f816e32326d6f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693935, "uuid": "2265dfb3-4347-4a11-a542-63777f0398a8", "value": "T163242A5A6715D521CB5F527EC01A821831F1EB03972AD38F59A2D8EA1F832CDF90BDE4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693935, "uuid": "d0e8d967-a201-4455-8914-fb120d65876d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693935, "uuid": "1eff31df-12e8-4a7e-b166-20da946093b7", "value": "3072:N+36Uf5utoR+NP36uKWqu6Q5jQ8U/43RiAGosPpZ7JfKups0lAPGMulhg6vP8VQ:fAg36uKWqu6QDUKZGDT7cups0K+MFMP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642693935, "uuid": "07cd4887-bf99-400b-bf97-6b4cf0731894", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642693935, "uuid": "6d4bd9e2-ae38-4d72-aa29-7220f258b272", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693935, "uuid": "7a555f37-80c4-4c55-ac99-df6c8bedd5ab", "value": "ArjIHfgOuBchYoKWLwSAalUQtMcu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22720e10-79d4-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642671255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671255, "uuid": "ef3a97e6-e676-466e-9a89-5cd230b0adc0", "comment": "Malware payload (Loki)", "value": "7aa8091f0f4c45f690c7e461bbae7830", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671255, "uuid": "b96b63e6-bcbc-4aa1-98aa-6d779456f51c", "comment": "Malware payload (Loki)", "value": "84dfdfed02e3df2b8629dd10d5abf7cc0d3e6c9776f415de642f115b23a2a1dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671255, "uuid": "58aa980e-f256-48ea-af19-3deaa9ad3a15", "comment": "Malware payload (Loki)", "value": "b655936c4d5f9ecf241def67df03e0fbd7033093", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671255, "uuid": "09f00389-291f-4348-bfd1-7bcf201b3e4f", "comment": "Malware payload (Loki)", "value": "6955592a105b66c806d2f7d7aacf9496be8865b36a3370756e413f9a97075212eb4d167f46370ebc5e2a5176faddd235", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671255, "uuid": "34b1249a-b731-4cc3-8143-64aedd8f7736", "value": "T16D54120A36C6C6FFE16761372AB39F6BC3FF66001A70660B67354EDF1566087864A113", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671255, "uuid": "e7971a37-c584-4e20-a170-6d005039dabd", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671255, "uuid": "9aea2a23-aff9-48ac-8f69-85123d43bd06", "value": "6144:owYSZjnpiYQ4iNiOLzLM0K09HKgwS+DeAYBVs9bDRV6l/xqzV1jkeF:1VpiciNiO/LM0K0BK6+gs9bnUqzYM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642671255, "uuid": "9f81a852-99e7-4f6f-b61c-a741e3feb612", "value": 284811, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642671255, "uuid": "55fdb4ae-bc35-43f5-b5a7-52f21f82a997", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671255, "uuid": "00a82c4b-c89a-4f6c-857d-04cd1500ad0b", "value": "7aa8091f0f4c45f690c7e461bbae7830", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "922b7aeb-7a32-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642711816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711816, "uuid": "c7e4e927-12da-4595-9ae7-fccd4cd31341", "comment": "Malware payload", "value": "461380a155ec8d325c84571ed59c9317", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711816, "uuid": "cb40ff4e-a1c1-4cbd-9713-3435373727cd", "comment": "Malware payload", "value": "856971479f118377817bebf83dd614799d320e1383604c67315508314529512f", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711816, "uuid": "6207bd3f-35e6-4f14-b853-907ab6271248", "comment": "Malware payload", "value": "f428781ff704baaef2f76308fb3fe2b035ef52eb", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711816, "uuid": "25d00aa7-8647-47e3-8882-8be85db06293", "comment": "Malware payload", "value": "79c4defa2f1084eb776a4a0814a4cb95308dc1b876b931c689cf5718c8bc11a50893a36c29ecd11ed295e52039a51f32", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711816, "uuid": "6a9563b6-5866-4dc1-a4da-6139d0a47b93", "value": "T1EAE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711816, "uuid": "a89c859c-e6cd-4c9f-99eb-d2718fdb423a", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642711816, "uuid": "b0b64868-16cf-4230-846d-d0309ade590e", "value": 146067, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642711816, "uuid": "03b366df-53bc-4881-ae50-44980320f28e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711816, "uuid": "544b7c2e-6502-418c-9901-3963f2fef4fb", "value": "461380a155ec8d325c84571ed59c9317", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "952a224b-7a0f-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642696788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696788, "uuid": "a16626bb-e1bd-4add-8dd9-1264791fdb22", "comment": "Malware payload (SnakeKeylogger)", "value": "773c7adad111dacf5eab1061c9f254cb", "object_relation": "md5", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696788, "uuid": "96df9dee-dd71-4315-85c5-40a58e833fba", "comment": "Malware payload (SnakeKeylogger)", "value": "85d81b6f9a9ec97701b96279ed76f478e6c528fa999c2c62afa883afd35146e5", "object_relation": "sha256", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696788, "uuid": "d03682b3-7570-4fed-a222-a273ccef88da", "comment": "Malware payload (SnakeKeylogger)", "value": "90401b587834daf8e0306b3b4a2808afe1825df1", "object_relation": "sha1", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696788, "uuid": "2d80acf8-688a-4f32-ba9a-493a5f842adb", "comment": "Malware payload (SnakeKeylogger)", "value": "926aae8bb14ab39f4c8318c855c98ff7249ea4e803dedc00ad04deed1d367e5b92a65a3059f0dec1bbf9a5d07c709969", "object_relation": "sha3-384", "Tag": [ { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696788, "uuid": "afbddcf5-1124-4b31-b608-2b7492cc012e", "value": "T1A2C2D0E06B132B79C386483B0526990267213057C782BC969F687A7DF5C1FD1266FF8E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696788, "uuid": "4671394a-a12b-4c8d-a6ae-cb0be1e5a6d3", "value": "768:dWsbFp7RHizQYeHeCBcaC34jImh7LKMi3:EUeHezsKti3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642696788, "uuid": "1a551e76-ca0c-48c0-9ee5-d4e12593ae06", "value": 27942, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642696788, "uuid": "c5d2d0b2-4fe0-41f9-b208-11ac791ada06", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696788, "uuid": "45ec9fe4-39df-4cfa-8204-2f7836eeea14", "value": "1201500787.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff20257e-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642676780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676780, "uuid": "71ff298e-f8f7-4400-89f7-4a592634aa6f", "comment": "Malware payload (AgentTesla)", "value": "2d03e501c871551adf75355dc5aceb3a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676780, "uuid": "fe5d5514-6345-4abc-97e3-4628c78671c6", "comment": "Malware payload (AgentTesla)", "value": "85f1d65f7f13aef5ef14ddfd2e556b84a34b46efc9adfa2d078033081f1222d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676780, "uuid": "f62208d9-4639-4697-9602-333491a5e081", "comment": "Malware payload (AgentTesla)", "value": "bc65495908ff7c1e40e17f4a4ea23d857910f85e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676780, "uuid": "5af578ec-7e94-46be-8db5-a382361007bf", "comment": "Malware payload (AgentTesla)", "value": "b1a07fe5bceabea52efb8c1ea67934dabbd37bc3a72be3e5e15a703a3393b289646deb1d5222f8ea91300355c1eebf50", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676780, "uuid": "e1385bfa-d26f-48bd-9961-1872964db1f1", "value": "T1D794021473FA2739DABA8BF165321014437A7D2A3572D31D5DCA30DA1977B828712B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676780, "uuid": "b745568d-b2d7-4928-9bcd-e14653c81221", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676780, "uuid": "2bddf3bd-ccfe-4ffe-b874-36fd37303238", "value": "12288:plKRJENCxHfmwdy0ncyCLto8LycWyGYMdl239lj:LKR6Nc/xMLyCxJucWyVB39R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676780, "uuid": "8b98424b-eb2d-49c8-8820-53278a7532c6", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676780, "uuid": "7ee8af4d-1fe9-4fd1-af2c-abda26f6ba9e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676780, "uuid": "b8ed34a3-cd96-4b61-8dff-ce014ed50be2", "value": "SAMPLE PHOTO.jpeg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e7d8a12-79fb-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642688214, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688214, "uuid": "89308700-6c5c-4aab-bb35-983f366c5474", "comment": "Malware payload (AgentTesla)", "value": "1a67cbcf2d9f92645d1ac6ebdd4e272c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688214, "uuid": "d5b2e730-f234-4296-a0b2-e8cdb0d4c1e7", "comment": "Malware payload (AgentTesla)", "value": "86009e0fad9d25ea974045c267300114349a721dea15fb1b684e98000f30a318", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688214, "uuid": "232b2e40-b9e0-4a83-8085-f595aec66588", "comment": "Malware payload (AgentTesla)", "value": "64ac1feb20a411f9d00b2b499292bfc6fc4617a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688214, "uuid": "26583866-3aa1-4210-bf1e-2f25b973da28", "comment": "Malware payload (AgentTesla)", "value": "2f88a6b44e0404e0b3c80940ec93fac0c21feb100104ba8258b5e7e8904f225288c83aff986217d942b39f78610c1e0e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688214, "uuid": "d3baeb94-cc8e-4eea-ada0-a522b478fa25", "value": "T1FED4018072F93BBCD4AA4BF9651210402F7AACE655E3E74D0D9871ED4CB93418787A3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688214, "uuid": "3be85601-f401-4cd9-b8d9-fe2fcd70b544", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688214, "uuid": "dc844ec4-ab18-4cf7-9237-d9781140587b", "value": "12288:XJ3Y0CMJMqrsiEGjjjiFhl1+c9dgmkSsCkptFVeMw/8j+5rhp:XpqMJMqBEGnjiFhTJdgSsral", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642688214, "uuid": "4515e7a2-13ee-41fd-8ba7-fbc7ccab43cd", "value": 614912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642688214, "uuid": "8312ea94-a85a-4ff6-96ad-061e975831f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688214, "uuid": "076e003e-21ed-414c-a683-243a841026d2", "value": "31-3044 REV Gerber files.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc8b3df8-79d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642672400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672400, "uuid": "ccd53055-0c57-47dc-972d-afb6a299122e", "comment": "Malware payload (Mirai)", "value": "cbcce9befca31bdf008b045938409b01", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672400, "uuid": "95662c6d-721c-4f7a-a035-106c912a6a74", "comment": "Malware payload (Mirai)", "value": "86a4b5dfafcef53d5e534fdb2ff5fd2f16fdc2a2b5872b303da5b3eae00cde2b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672400, "uuid": "7dd52da7-fe63-40ba-a5de-b35f792f82d5", "comment": "Malware payload (Mirai)", "value": "3d681087986e5ed55458c725f819ac246badfc7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672400, "uuid": "2b51806e-7d8d-4419-b238-23837244c77d", "comment": "Malware payload (Mirai)", "value": "74a6e2c5fb20064e46ad2301b7ff1a972f31b1b4709ff37a0316c6fc673adebb20353021be7dabc432f5088da7413787", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672400, "uuid": "ec1c50fa-093e-46f2-a002-72af8f6a09c4", "value": "T143546336F60289B2F11C0DF134A766A0BDD547BB4C2616C3E65B19A5FF3285A00F6EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672400, "uuid": "968cbd59-a228-4469-b925-35f3832db33f", "value": "6144:4GFcDlEgMjyBgKpd9kknRCSNCqeiGEJiiifIFVDmm/QcuLB1niDNb:4GFVLfiVDmm/QcuLB1niDNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672400, "uuid": "862e47b9-9320-47d6-ae21-f9f6ce87183c", "value": 298973, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672400, "uuid": "70b73f15-7ea3-4434-bae6-096190c372ac", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672400, "uuid": "36db9450-5f97-4ca0-8060-f8c048bf449b", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6594eba8-79d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642672657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672657, "uuid": "c46edff5-d2fb-4e5d-80f5-42f7b1284cca", "comment": "Malware payload (Gafgyt)", "value": "f66b5e3ac650fe13885b2ec2a90bb4ba", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672657, "uuid": "9776d1f4-0825-43ab-9202-eff0dc01b570", "comment": "Malware payload (Gafgyt)", "value": "87034d9081bc68c3fb46a438d1f86461a9f488c1a01d501e23c240c5259d51a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672657, "uuid": "e1f79f18-e002-46a9-b519-aeb3230772b7", "comment": "Malware payload (Gafgyt)", "value": "26400745527fd439890706c623e4ce75ab7df499", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672657, "uuid": "396a0c20-666d-45f9-a7a8-703ff1ec43e4", "comment": "Malware payload (Gafgyt)", "value": "40d02b0ecbddb8c92edc1bf3e9626b22542a9d46190a8ab39d9d89fa064a5e5f0386b8760de2d63056182ffe1e4d2c96", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672657, "uuid": "b7c0e110-ccdb-49a8-9675-629a81a3ed30", "value": "T1A3230A02AA46CAB7D8931AF602E76B264631FD690F134F45E31CBCF4AB234C8712B755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672657, "uuid": "70cbb117-8a22-4c7a-91e2-4a6ce70471ce", "value": "768:Kgt7wTPL4dKYWUTeRCiAUTvqRI3HRampwEvBIVIYpwil1aVdcS:ltWz8JWnCATvR3HR1BQ7e5cS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672657, "uuid": "88c59aa1-8bbc-46d4-895b-868f3115de9b", "value": 48300, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672657, "uuid": "5c2fa237-ac8d-4fd2-bfd8-09924a49908a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672657, "uuid": "5b3f57a6-4c85-4163-90af-40860b075657", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f9dea9fd-7a2a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708554, "uuid": "97c6c932-d08e-4ae6-bdf4-695636688138", "comment": "Malware payload", "value": "87d589d17bda65a8382de6d161aaea81", "object_relation": "md5", "Tag": [ { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708554, "uuid": "00eb57f1-7545-4e82-acad-6b826a5400dd", "comment": "Malware payload", "value": "876881f4c658ce8525f54e0eb06bfc8721f238878c3ff3e7f8387d7f84e13150", "object_relation": "sha256", "Tag": [ { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708554, "uuid": "535fdbd8-0dc7-4b10-85e1-a34737486932", "comment": "Malware payload", "value": "ce836da7def9bfddb7cd8989f536ccbfecb77048", "object_relation": "sha1", "Tag": [ { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708554, "uuid": "7d062752-3240-4119-a940-fb756bae4049", "comment": "Malware payload", "value": "a6989237a0b1d574bc5ce907c4994c37315c2d521694e66fd8e0e2a61668e411555310968dccab3077db660a8f21d064", "object_relation": "sha3-384", "Tag": [ { "name": "cryptominer", "colour": "#FE9C51", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "XMRIG", "colour": "#0EAB84", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708554, "uuid": "f8475306-d67d-46dd-adf3-9895e8a25af8", "value": "T10B462A57F8A644E6C6BFE1348691A323BE7178B58330B7E35F9096761A26BD06D3D300", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708554, "uuid": "41e2204c-1c21-4354-8c2d-9bcc0fa9acb8", "value": "49152:EpY+u34OLg5WDOPbb/5WtEQauJZyugcfp9qzomsJg6thtIViFYaj7dtS5g+A:a3ROLwPP/5WmqZUcfp9qzFQDIsz+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708554, "uuid": "5a8048cd-5ca1-4ab5-9622-47264e17202b", "value": 5398528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708554, "uuid": "520be37f-cefe-4631-a9ba-970f2e96498a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708554, "uuid": "cd45b993-2893-406e-b76f-c2d8b2f6d4d9", "value": "nide", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d00ed84-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (BlackShades)", "timestamp": 1642660670, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660670, "uuid": "916ef5ce-cdd8-4f9e-bccd-3b2618206503", "comment": "Malware payload (BlackShades)", "value": "4f425a5dd8910cb84d404db29cd93445", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660670, "uuid": "92cd3eb7-631b-4511-ac94-065964959354", "comment": "Malware payload (BlackShades)", "value": "88726ea9b794283304d214900932a835a6be2d8a13083d99af85d3c9ca49524e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660670, "uuid": "ae517b12-4073-4911-b873-716cc1fd90cc", "comment": "Malware payload (BlackShades)", "value": "7e775f2ee7ed3cf15b205273711830462be0d707", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660670, "uuid": "54046cd2-393a-43e6-8e74-1cc05a57e5d2", "comment": "Malware payload (BlackShades)", "value": "9220955fff3f73d2ababccf980f50ce28d6d61232bd4c60aba804330f4253503b9fa3e2241de683533f63cf9aabeb9c1", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "BlackShades", "colour": "#AC212C", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660670, "uuid": "b26a3d02-8035-402d-b119-e33bdb93241f", "value": "T1B8C40263493D3692EC2A78F8511359CFB5742C3A66D44A21B15AFD3B48B5343C80F9BE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660670, "uuid": "ac26f5b8-27b2-403a-b78b-792c15e31ea2", "value": "a459954138cf2a762bc5e5f961bda8c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660670, "uuid": "1d2f01f1-407f-4379-a647-e3826f5d5767", "value": "12288:eLdcfxaeM6fy/KaVUtgKkTZ73coNRJY/WU70GBw3b:GkIZGSAtgN+eJK70GC3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660670, "uuid": "c6eb7dce-e4d7-4ba8-b5df-8d6f45c65082", "value": 582144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660670, "uuid": "6436a1ff-e34e-43a2-a65a-b36636a23578", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660670, "uuid": "46c9f935-a704-4963-8d50-1e7453f5ec8b", "value": "4f425a5dd8910cb84d404db29cd93445", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c739c728-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642660794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660794, "uuid": "ca0991c8-4a34-4fd4-a43d-ea2a477feade", "comment": "Malware payload (Heodo)", "value": "e23da542d301c4cd6944c57b9bef4191", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660794, "uuid": "f65f59b5-fc66-4531-90ac-7a1bea35720d", "comment": "Malware payload (Heodo)", "value": "88c52c4d1940f16219506b7c10ded1fa314e5f05e0aa03cf441a7dee30f41aa6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660794, "uuid": "cf45988e-8d45-4752-b88a-9919279b91a7", "comment": "Malware payload (Heodo)", "value": "7fe5a7e4c870fce66d1f46fe5bb3c79725f02604", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660794, "uuid": "2f25911c-6726-4682-9968-54891022e317", "comment": "Malware payload (Heodo)", "value": "bfeeb6393bc6afdc51b4a368676a3cb00b28090249b3d80c39150a03e75a0ec0c634809d3b1f5e29f5d65d9ea4423232", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660794, "uuid": "d80b601f-3160-4b64-af8c-8af93248a7f5", "value": "T190E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660794, "uuid": "8899c9bf-8dd3-4cf5-9408-b91f3008659c", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660794, "uuid": "774ef943-15b7-4d20-934f-508fd5087239", "value": 145283, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660794, "uuid": "ca55d0cc-99ae-4719-92ce-757e927563c3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660794, "uuid": "b693c457-cf5a-4714-8087-fa17b7513480", "value": "e23da542d301c4cd6944c57b9bef4191", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5da5bf9f-7a19-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642700990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700990, "uuid": "8a216c7f-0820-4d65-86c1-196beef2bab7", "comment": "Malware payload (Heodo)", "value": "48755fad7da5546ba2e5bb892e97b045", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700990, "uuid": "e1945fce-9e17-469e-9b39-e627531a7af0", "comment": "Malware payload (Heodo)", "value": "88f602cd8f6b66886acb349720da52c3f5fdb367fe8a72f76812af27347cf32e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700990, "uuid": "a3d97021-f96a-411f-ab7d-978eb4971769", "comment": "Malware payload (Heodo)", "value": "3bd41b925ae125a9bceb7918f835856a7d237de0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700990, "uuid": "14a73c54-67cf-43ad-aa13-35a3a074df2a", "comment": "Malware payload (Heodo)", "value": "00bb10da22db2cf7d8db0a10ad9e1dd6780052e96279fb78c8814e804d25ea6a4bfbe4acfce5607a8cc7dc5ec4fc6bd0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700990, "uuid": "ba6e7053-b2e3-4173-8346-0675240e207e", "value": "T129E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700990, "uuid": "0f75356c-fd75-4b0a-b28d-696d6bf63e05", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642700990, "uuid": "a763078f-b78c-4e9e-a847-f70beaf542f4", "value": 145201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642700990, "uuid": "bfd5d9ae-aeff-4047-8e17-1071ae0ed901", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700990, "uuid": "7fc8483d-1109-41f2-ac71-a291dabd145e", "value": "48755fad7da5546ba2e5bb892e97b045", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4ef8da3-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674964, "uuid": "2ef7f0f3-323f-4820-8fce-6471458eea79", "comment": "Malware payload (Mirai)", "value": "fffb772d58434c7f7fcbb73529ebb7f2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674964, "uuid": "880dcfc7-be79-463b-91a2-3ab72aa4d526", "comment": "Malware payload (Mirai)", "value": "895735c9e1e9ac0bd001650591a7bf1dad95851de07d204e699dcc3f9ec1f333", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674964, "uuid": "2f0fc2ea-4e7c-413c-8eda-57067e18748c", "comment": "Malware payload (Mirai)", "value": "5ef0e81a3ffc020b9df2a91c159fce904e498c77", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674964, "uuid": "b353caa2-4a54-4eb3-9e01-6a5a2cb4deef", "comment": "Malware payload (Mirai)", "value": "2b51855c506088e2e0bef00f2ba02c213ae779af7b3744058485f16df6d5d7074e7d678011e3aaf7cac7a9831c939e2d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674964, "uuid": "2cdeb642-f0d3-4576-8f86-bc4e1ce2cfd9", "value": "T127C39517BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674964, "uuid": "2128010e-637c-4ac1-9bf2-985c1d52d2e7", "value": "1536:/RHeTECAms/Y8Zm3lKYA43gMJwSkJ8Ep/yDzUh8rmW+IFB1Df11hR/:/R5LqAmgMJM8EVyDw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674964, "uuid": "c1a27341-c4bf-41b4-9553-917d6023acae", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674964, "uuid": "a43bae07-69b4-4e0a-8309-179a8aaec9bb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674964, "uuid": "c3f1dc50-cf3d-4096-ae31-d567ca2b9fc7", "value": "m-p.s-l.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df51408e-7a37-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642714093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "1c3099f1-8206-480b-a00d-d179522ab02d", "comment": "Malware payload (Heodo)", "value": "8672c1e0fe86b1ace8b9b655bc3f063d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "0c0b0e1e-3be7-479b-8e65-6de1327d39da", "comment": "Malware payload (Heodo)", "value": "895993b7c61906827359018a3b2d0c949e2e478bdda5adff2010d9eb449ba2e5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "ca23b480-ef1a-4bbc-81c2-ce58b6046084", "comment": "Malware payload (Heodo)", "value": "4e54ccf758502a75cc8023e2442b3aa9dc81409d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "cd6612ec-46cb-4c97-a924-9d854bb4fcdb", "comment": "Malware payload (Heodo)", "value": "6d10202e3d5a481039b1f0d148cffab27a765b7c417cb0c13039bb4699b407dc712d32a90df6008edb27679743851150", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "c7f92e42-e3b4-4686-80ee-93ca3ec67f20", "value": "T1B0D4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "8746a797-e0b9-4899-a22c-2a8a3f8a2f7c", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "fc13f74a-74e3-4dd5-a489-b473c2c5e4b4", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NnG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYDZVnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642714093, "uuid": "82c5f1f2-a991-4346-8799-9ee011f7c943", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642714093, "uuid": "98084977-8b47-4b63-a21f-26be2d733598", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "e1d633bf-142b-4cbb-bfc2-28c133566c4a", "value": "emotet_exe_e4_895993b7c61906827359018a3b2d0c949e2e478bdda5adff2010d9eb449ba2e5_2022-01-20__212805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cf1b63-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660596, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660596, "uuid": "acbd8222-7fc5-4ab2-b8d1-883ad4eede33", "comment": "Malware payload (RedLineStealer)", "value": "526a67a7d49ac57acbd82d42d89fb539", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660596, "uuid": "69071c36-cb26-435d-a789-a95a03da2679", "comment": "Malware payload (RedLineStealer)", "value": "89f576ede7f4b0aa6a91beaab60946c07e1985e858cda3aa7c7df796ccc948c8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660596, "uuid": "91037c1f-c5c4-462d-bba9-1d0b7dcd98d0", "comment": "Malware payload (RedLineStealer)", "value": "26e38b8af4880debad4c2c7bf016ed939a6990cf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660596, "uuid": "2986f630-37a0-4b28-aaad-25ae5e1ac772", "comment": "Malware payload (RedLineStealer)", "value": "96eb9276c82d781e023f1b9b6e1dde163f6265d293306ac1c9a2822da4166de921db3cceab222c6f90e4de11358cbc5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660596, "uuid": "dfd4e22c-9dcf-4e27-bf2a-07070eb6d92f", "value": "T11D84E0B07580C431F48956304822CFA44ABDBCF354A5D943B7E83B6E6EB5282267A35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660596, "uuid": "aebd8ab1-5883-416c-833f-fa7035410f71", "value": "125adc129c50285a2cd4524417d3fdd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660596, "uuid": "665aadbf-b655-401f-a247-592f340ccb61", "value": "6144:BUezLzN2Yn9nCBbngCwcDnfDyD3c/em4SoWWce:BUIl2YnVCBjg0f+DM/e+oWWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660596, "uuid": "abfd1d9c-1b7f-47bd-97d1-7cbd9e541ced", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660596, "uuid": "65647b59-1e69-4f9b-9983-01f3e0934c90", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660596, "uuid": "0aecf910-bafc-410d-82e4-7d63ec587175", "value": "526a67a7d49ac57acbd82d42d89fb539.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d78ad2bc-79f5-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642685733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685733, "uuid": "d6268668-c8c8-4a14-b03b-23f794b7f5a8", "comment": "Malware payload (Formbook)", "value": "94a403332793f2b8ab589bc40c0cb9e4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685733, "uuid": "7e674f3b-d936-4b5e-97f0-a6aab4c2df55", "comment": "Malware payload (Formbook)", "value": "8bad1870cc1ed1ea03923d7b427c31ed9e0266a0b8d0fea1cf6e6190c94ce46c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685733, "uuid": "8f96987b-8d24-49f5-9384-28cd83d4d58b", "comment": "Malware payload (Formbook)", "value": "50647036426a23d3d45f38fbb1389328bcb29476", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685733, "uuid": "5596e926-04eb-4eab-8ebd-dfaca0436791", "comment": "Malware payload (Formbook)", "value": "3c904fe37a6790be9c5106dd5e18929b92043fd310af955f20069f8be4ca96710ba55f546367cce1b91450cee5c775e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685733, "uuid": "33c47fba-25c6-4835-966f-27ad094543ba", "value": "T14484FDF9E7E35293F8315A36CB91433461327EC9A4E45DF645C8BA2C4E302DE921E96C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685733, "uuid": "38091907-6a88-4f10-9adc-91d53b7eba10", "value": "1536:a7PvzvDyfSNbzhU47FEdSGVS9ZID9khfC3+bLrub+DukyVAB3Zfcpn+1MVoyJPkh:a7PvzWuXFEdSAeSD9jIVDuk/5GfqPmG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642685733, "uuid": "d111e019-a884-4b70-997f-f13fa4647959", "value": 382000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642685733, "uuid": "5f13a6f7-5afb-49e3-a047-4c53c66c97a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685733, "uuid": "f4ef17a4-68c9-4c3d-a5c2-ae185505d150", "value": "Bank Payment Report.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c25673f-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642665715, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665715, "uuid": "b948f3b5-ccf8-43e8-9bb3-30e06e276733", "comment": "Malware payload (Loki)", "value": "b13aa599bfed4df3b120d414e6c03a76", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665715, "uuid": "fcf48649-00d6-4cab-be48-97eeba6ebc4e", "comment": "Malware payload (Loki)", "value": "8c0cb9cfcffb56fddf09ab7a44a692f114ecb464b54f4fd2fc71b2ce7b355fce", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665715, "uuid": "f6a3995f-b9f2-4da8-ab78-850e5820f591", "comment": "Malware payload (Loki)", "value": "d5b1e78026f0edf1e7978996e73a49a216a88ca8", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665715, "uuid": "0f2e1b04-df4c-4231-96cb-d0575d110cb2", "comment": "Malware payload (Loki)", "value": "79f4189dafda1636a7308ee0c455a12711d623f83c6bba6adfcc460350e2077adec400c4461b0739b50e3225e51d015a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665715, "uuid": "643fbe3a-39ff-4444-a90b-20e9d9769c39", "value": "T11E0412C83FAE6364FC8563B94A797627A720DFB9CEA660331191B23C24F3D940755386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665715, "uuid": "94b08a02-55d7-49f9-946a-44818fd39c47", "value": "3072:tT8rviINwrL95GywpluBZkW1lmH6qNygXP5MWjI2Kab64ESy+lDF8LWElWX:N8b92L9obpl3WTdoR/5MWjIMbsSyxMX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665715, "uuid": "57ed7b39-b313-44e0-b358-101744df3177", "value": 187096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665715, "uuid": "131c630f-6ea8-4279-9bc7-452bf164ef11", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665715, "uuid": "70ac8343-e5a2-40fb-a0ab-27163e43cf47", "value": "Enq6211926716.pdf.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "845029bd-79c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642664977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664977, "uuid": "94667fa0-5e4b-4213-8478-a711b1644104", "comment": "Malware payload (Mirai)", "value": "838c3e33f65e84ac7f7011a9b98fb608", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664977, "uuid": "46c9ff25-4033-408b-9fdd-ed6d1bd33b5b", "comment": "Malware payload (Mirai)", "value": "8ca9e50e94cc9c96568ecf1f5f1a1a3d3d9382843f52d7dbca95dace8efe0e0c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664977, "uuid": "73d878de-e1fb-4d80-aae2-125355b8f26f", "comment": "Malware payload (Mirai)", "value": "73bf1e05439801a0dba57edbb464dbe80d014472", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664977, "uuid": "0987b246-d604-4d0c-8eca-886643f62800", "comment": "Malware payload (Mirai)", "value": "ba4a7b8fca5fd8d028f4e1bfcde6194ea90c7ec57839526f55c372df6d930e6ee520019df880eeae54903f7d9a3118a8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664977, "uuid": "824c07f2-3c8d-4aa7-899f-462806cff205", "value": "T1FA334A2279352E17C0E4F47A62F78768B2E5164F25B8CA1E7D720E4EFF10644A6136F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664977, "uuid": "7975bde2-bbe9-4c67-b026-02d92af3b3cb", "value": "768:J3B2oNN/Rq92B90XPBlNnXWPArOXO+p+AvpBI:Jx2UN/RS2B90XPBXX8L0EK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642664977, "uuid": "bcd8e737-74ce-4dcb-b8ae-2ab7617b2fc0", "value": 51480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642664977, "uuid": "54201655-74fc-4ff6-ad9c-87388ec3fa7c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664977, "uuid": "52584bb7-f346-43b3-b7e7-4dd4a416eaf6", "value": "838c3e33f65e84ac7f7011a9b98fb608", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c9acba6-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642660696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660696, "uuid": "50dcbe8c-0764-4d1b-8ac3-8ced150413f8", "comment": "Malware payload (SnakeKeylogger)", "value": "a6587ab37c4a9223fba53125790592a6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660696, "uuid": "ed0dc60c-0a4b-4917-8528-43060862c98d", "comment": "Malware payload (SnakeKeylogger)", "value": "8d18af0f1e3f5f105b58caa5bc4954f6512ceae4218ce0bc9ab2e143fa5bbaad", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660696, "uuid": "285068ac-0ae2-443f-9fa3-369eacda22e1", "comment": "Malware payload (SnakeKeylogger)", "value": "cff6d8dc0bfb07c9664075123ad8d259ff2027e6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660696, "uuid": "027a04d0-b177-4ff0-bdf4-3c107b04020b", "comment": "Malware payload (SnakeKeylogger)", "value": "1192624a662244d075d01439cc1b511b6a05f5047e12494ecbe96bf45b2480e4ed8f691a4fc2868b2be91e0e2db75d52", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660696, "uuid": "7fc37ae7-8e58-4ce9-bb24-a5852a685fa0", "value": "T19494BE03779ED925C1796B7388EF800047B9AF816553DB0E3ECC73AC19A274E5A4939E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660696, "uuid": "1ebe88c2-8ba9-4e12-89d1-4c88d5c2f63b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660696, "uuid": "937bef58-06db-4a80-adc5-e7733be1ff0d", "value": "6144:uhrSuYaGOZtYet6EILFUeFDKUcilwtuDS/f2kIIikM8UGRfXrid+nI:uhvYZ4t6EyKkpc+IuDF62aI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660696, "uuid": "8c30fedf-197e-4e86-8a87-d9b945e9176d", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660696, "uuid": "689a6f98-4abb-4a4c-bb37-29d135ecb7d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660696, "uuid": "7e4b8b94-4470-4d21-a860-5d4ef5767985", "value": "a6587ab37c4a9223fba53125790592a6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0ac486d-7a49-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642721772, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642721772, "uuid": "5c79a801-3690-4637-bc10-aae60314dd58", "comment": "Malware payload (Loki)", "value": "7f1af8c4b34ba46a19f263fa197775b5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642721772, "uuid": "34c8776c-0d9c-4618-97f6-c78928dc3781", "comment": "Malware payload (Loki)", "value": "8d703f973412d884ce4baf322726c7c7c601329b5d5b659fc7979b4066672beb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642721772, "uuid": "80a0888c-87fc-477e-ad8f-d6139cb5f375", "comment": "Malware payload (Loki)", "value": "b2edadc88ba65b233a6f2726301ef0e975b32d57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642721772, "uuid": "ddc3dfb9-6931-49a1-becb-95ba563c0c8c", "comment": "Malware payload (Loki)", "value": "f85f6defbc599361af41724cc8c552f17debf607ae490df3a6b254afb950a2389f06c4eb6417386aff541da1a6dad0e6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642721772, "uuid": "06cc0f10-fcc7-414a-9257-3b706a21a7fd", "value": "T1696423B3E28D37DADF191CF6276A8831966850197FDDE7252EA2C94724343E2B1CD318", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642721772, "uuid": "3559745a-4fc4-4682-a92a-48411dc80c18", "value": "52b98db37640377cdbda8f18230bfd2b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642721772, "uuid": "697c8314-0c0d-42f2-a71f-64f40d163c06", "value": "6144:L6EkB8T+IqJ01uYC/Vu+Sjt/qHSdl7QyukfsRo7RPcBIIl4huE8+Qb:GEmZIqW1uYgMQ27QTkflJcBx249b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642721772, "uuid": "a93a8987-31d1-49de-b2b9-6a361260b0bf", "value": 328704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642721772, "uuid": "50b76b0d-a5e2-43a6-8fd2-fcffa65c4b1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642721772, "uuid": "802e3790-3fda-427b-b453-2394c13c0866", "value": "8D703F973412D884CE4BAF322726C7C7C601329B5D5B6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fb71843-7a0e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642696350, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696350, "uuid": "4a10d5a3-78d0-4545-bb52-eeda6c461ad5", "comment": "Malware payload", "value": "2646b91798b706a0c7b98b98c6c84c90", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696350, "uuid": "8aed29f9-ec49-43fd-bdad-542e4bc79767", "comment": "Malware payload", "value": "8d7ef36c8b47090ad62186cf92e3d31351989c54e53f1c161e027923c26aa206", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696350, "uuid": "49c9e8eb-8e15-41f4-8abf-8043b33e5744", "comment": "Malware payload", "value": "35d659f129f098ca8aa1ea867a60e41b8dc78ff4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696350, "uuid": "c794aa38-ded9-413a-a5fb-542f570a10c5", "comment": "Malware payload", "value": "1e1f2a77f37c4290425ed1ad67fb1465d761946939a4508b7e27d348f193fee1d1bf349edb6bc0f224edbfb42e9bc959", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696350, "uuid": "25c89fac-8592-4017-95ba-bd847e4838e2", "value": "T10B4423561DD1A4AFC5D61AB41FB69F5BD37C7A024B800F0BDBA67F9B2C710834622287", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696350, "uuid": "7cefd323-5e58-45f4-8788-c5f800499b09", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696350, "uuid": "86c45dcd-faa1-4414-9573-825891ddecfe", "value": "6144:ownmCjcAexizK5he8Sfb6Yp3qUZ9LYHUrf4XFA:C2cAmiGnL+b6YcIY0YFA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642696350, "uuid": "7171911d-8213-442e-a2a4-f2dff7e7ddd0", "value": 262776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642696350, "uuid": "90407a4c-865d-4143-bf34-429cc89f5730", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696350, "uuid": "ce77aa59-59ac-4704-b631-e6e28795ad48", "value": "2646b91798b706a0c7b98b98c6c84c90", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23547645-7a0d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695738, "uuid": "a2915e39-e6ff-450a-b77d-61ecd47a78fe", "comment": "Malware payload", "value": "8af356da1372fcb2eb69ffe559c474c0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695738, "uuid": "6fd54d55-f147-4ec1-b066-5c5d1d8eec20", "comment": "Malware payload", "value": "8dece8e7f017fab44e7fd7e429bc772fb495b53eaea2491e7f3268cb6e97fd94", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695738, "uuid": "85ee5e97-efee-4db4-a086-d5dd9cb16fef", "comment": "Malware payload", "value": "c440e2c356379c08bf49cf51120a80dc7fef9817", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695738, "uuid": "948f5ec3-a549-4ca9-8a07-64b300c3272b", "comment": "Malware payload", "value": "78bc1536b5779247b29c7fb2f6b19b7ca380c70fe32552c3f7cb4e8efb8670612de912dc65d9facb9681628e7426aa7e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695738, "uuid": "b6e76b5b-5481-491e-ac69-2a21b8e9fa72", "value": "T17563F801A752CA77F95316B802E79B112132FDEB1A16EE05E328FCF85F551C86127AAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695738, "uuid": "587d8696-1ca0-4316-8855-7b86dac562c1", "value": "1536:v0ZiN+QcGqvvjrwwvQVaBzla775FqpM1kq4SLJV0xH2Cnxx1:v0ZimGqvvHwwvQQplmi2kq4sJV0xWCnJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695738, "uuid": "dbc24a57-2857-4e4a-9029-fed7b9e6deda", "value": 67170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695738, "uuid": "b958f44b-fa52-4879-b9c1-2d17656964ec", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695738, "uuid": "9b9ccb21-3937-4eb2-903e-1c954b0beaa0", "value": "8af356da1372fcb2eb69ffe559c474c0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49cc2f6-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642676735, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676735, "uuid": "23ee9693-6498-4d5c-83ed-dcf9f1ac4c4f", "comment": "Malware payload (Formbook)", "value": "76661f98b6bd857c7a5aed76da3552ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676735, "uuid": "401b61d3-ba0a-424c-800e-91b52b4651d1", "comment": "Malware payload (Formbook)", "value": "8e7173102d77a6ed527fc3e783be4aa446e757f4417d3fa1f60f3e9cd0cff4f9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676735, "uuid": "68777377-5412-4797-81a4-3b3460016cd3", "comment": "Malware payload (Formbook)", "value": "176b8966941a04bf833a19965eb3b8b0a9a9f3f8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676735, "uuid": "3bdc4009-a6b6-4e8c-8dc6-66e2e2d362b3", "comment": "Malware payload (Formbook)", "value": "b7606be42e3e0c95626fdc24dda4d861e88017c1a4935f299ce2e1a9238a84652cd0ca98d1a47800db71acc30744d086", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676735, "uuid": "d3350f87-00f7-4041-be7c-54531463f5d9", "value": "T1E3B40943C1874A58EA2909F423A95B3E827B7D0BE495192AAF88315057F30F77C359BF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676735, "uuid": "c83483a6-47f9-40bb-a01f-5b7c0ce2f751", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676735, "uuid": "cb705061-cb6f-43c4-bc32-0cbe0005117c", "value": "6144:3w+P0YpXtS4K92kcBcpBzidnmJFxWPdvDeY4WotPmpRRGptk/BavA0/tvvu:ukRBWvzeEmDeY3uPiRipvAeQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676735, "uuid": "869956ba-2b2d-4972-8b98-9f55cc2950b1", "value": 494211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676735, "uuid": "5cb04127-f627-442d-bb27-892cbf0824ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676735, "uuid": "6c24293f-0768-48ac-b123-ce1ab03e6308", "value": "AGOCO RFQ NO 105017.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c6af9d9-79cf-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642669232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669232, "uuid": "9063827d-d3a7-4e3a-bc0e-9a9e5d97d64d", "comment": "Malware payload (RedLineStealer)", "value": "7deaf50454d78538183484487fd64c45", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669232, "uuid": "18718db9-5c3b-437a-a45a-bea7dcd2120d", "comment": "Malware payload (RedLineStealer)", "value": "8e93854353199edccef78bae97288dbf5876c2e14afa36e1d33b1ec3fda434f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669232, "uuid": "02a2fcbb-422b-4970-8380-a7b15f378d2a", "comment": "Malware payload (RedLineStealer)", "value": "4c17eb6c2727214bc34df4d6dc2ef88e587c8ecc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669232, "uuid": "41428e63-3838-4b3d-95e5-b77c5d4c3a12", "comment": "Malware payload (RedLineStealer)", "value": "c201a90154c3acbf302d98c505fa98a06473de6d996ddea55336b264378ce19cff148e4309a13260ba40f75eb9e9efde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669232, "uuid": "6ed35070-0f4e-4f8b-bee6-8623bddb6727", "value": "T13384E06139C0D471C4825A334826CFA0CABDBC71F864964777A43B6EAF376D156223AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669232, "uuid": "d270f4b1-0188-4219-bd7f-e9f1af044527", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669232, "uuid": "1639eb09-dc9c-4ce4-a5d2-2976b3038262", "value": "6144:proLx92YW4FTlXt35hOi9aBHaRwPWztEHF/yh6ZMK/VGVUB:in2YW4Fp3caRwe6FS4D/VGV6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669232, "uuid": "9763eb1d-827d-4e27-8a5a-5ff2416c1a23", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669232, "uuid": "be2b3a25-c323-4994-9311-6d2ab0f79c3d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669232, "uuid": "44b4c5b8-f089-4069-b7fc-ba73311d5aa3", "value": "7deaf50454d78538183484487fd64c45.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2a8ca8e-79f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642684355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684355, "uuid": "2160163b-033b-42e8-b6eb-335dff2c64f2", "comment": "Malware payload (Heodo)", "value": "d0dfa995eb72c89052f341457554b904", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684355, "uuid": "1cf2e646-8193-4595-a07b-05e4ea1571fd", "comment": "Malware payload (Heodo)", "value": "8f1c5f756658a90d9007b111594547d054cfdb487aefa255156d07fddd7ee016", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684355, "uuid": "30c97fa7-be14-4ee6-a9b7-3446b7bfbb0f", "comment": "Malware payload (Heodo)", "value": "02bb89c9e8c012c33ff10213e785dfc74bd048f2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684355, "uuid": "f2ab1463-2631-4807-aa4a-dbf8466fd922", "comment": "Malware payload (Heodo)", "value": "d6cd832c53fb5b610178d700053d7f3247fee083862786f1b8d6ee4e7ccd0f49de4ce9607e25e06daad9929bd9d7dd52", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642684355, "uuid": "0cc07e95-eccd-44bc-a852-40084b747601", "value": "T1F0C3BC0794019FA2C86CC3F9BF0B48D46F01066DE2D539DF28926B57775ABBB0A0D62D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642684355, "uuid": "9ac1218c-2752-4920-a8e5-b9af37476721", "value": "3072:kXKCEvZ8BnW6X1yVkovrepMA5Q6g2X4inz:kXuh8lWoGk+eCP6DX4i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642684355, "uuid": "722fd710-0e47-44ac-b1cc-9f2d70cb6bda", "value": 118616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642684355, "uuid": "32558362-469b-46a5-b4b8-62c7ae38d4ad", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642684355, "uuid": "ee9632f9-1c10-437f-90ba-222e914b518a", "value": "lrnqyof0626260.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6666d1-79bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642661419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "fe4bfbbf-da4c-45d7-8d50-a5c42a4ae261", "comment": "Malware payload (Heodo)", "value": "2f7f570739c3b0a9d29db39c26523994", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "57e99c57-41ad-49b7-b087-6ee24d1bf3cf", "comment": "Malware payload (Heodo)", "value": "8f36830ac34e3a70d011e862015777ee2550434ff47886742f17b3616a9a7a29", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "d576e2b7-ff61-4899-9fb9-91659b091952", "comment": "Malware payload (Heodo)", "value": "d5017be1fd3a5fa18817221ad56089c15050febc", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "b77d7547-d964-4bfa-a51a-08db87549044", "comment": "Malware payload (Heodo)", "value": "66bf9a009efa168f859db02befc276f6ec67ddb8dbff40077fe0c81f9223cf208628c39faea31f546e2f16b569693b13", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "6a95424b-9e4d-410d-a107-4e1f51299a5f", "value": "T154C4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "1ffbaae6-7000-4a7f-b1ac-ebec73928dd2", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "651ff451-7f34-47a3-8721-2c111e638a89", "value": "12288:P78OGF+L8/4UUNyrqdMhTq/n4vAzdkPs7:D8Ody4aqdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661419, "uuid": "b2fb8f03-3453-4326-85fa-7190695d202d", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661419, "uuid": "48f9162e-3ec5-4751-9bab-68ad662a8412", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "335093ac-34f2-434a-b469-43d3740eef89", "value": "emotet_exe_e5_8f36830ac34e3a70d011e862015777ee2550434ff47886742f17b3616a9a7a29_2022-01-20__065011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31d30d27-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666557, "uuid": "21c22b59-95c0-4076-b3f9-29c59ef3e2aa", "comment": "Malware payload", "value": "f8d30c45ed9d3c71ec0f8176ddd7fd8f", "object_relation": "md5", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666557, "uuid": "afe6df9a-429f-491e-af86-9087611a9524", "comment": "Malware payload", "value": "8fd9915997ebd3b04ad170186aba94e88222e45c6e46168d19ba7f9df3625210", "object_relation": "sha256", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666557, "uuid": "00d117cc-a6e4-4d71-b27c-ea28f2d5d671", "comment": "Malware payload", "value": "cf1de6e3e6ccbbb0cafadaaefb1b14e0441b513d", "object_relation": "sha1", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666557, "uuid": "90a9efb5-5fea-4442-97cb-6ca4aeaf1201", "comment": "Malware payload", "value": "f031acb1c60258b35d07a7ed7c9b666548a5af38c653249ab3e09c041c0761fd1ea7d00183f058825a1d8a75da7bfa76", "object_relation": "sha3-384", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666557, "uuid": "4eadbb50-8d5d-4085-82e6-7522b9a6998e", "value": "T18535330DDC03A11ACF720BFBB7E7681901543D59751DAEE8B626B067334286473E6B2E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666557, "uuid": "243c5a90-c7f2-48ae-9bc4-830fe1437e6f", "value": "24576:rOpONN6uoIkHjngZBHGeEEyB4V64qy39Tn1:gl7I2jneBH/3c6Tn1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666557, "uuid": "f523ee07-b797-4389-99c3-0ffac063fdd5", "value": 1095812, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666557, "uuid": "65769f2f-8279-4910-be3a-c13cff0b46ed", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666557, "uuid": "06a47d9a-fd9e-40d0-97d0-c0c7df7b087b", "value": "Gift Products.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "463192d8-79e8-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642679905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679905, "uuid": "038bd08e-4fae-4624-b588-f5d330232f8a", "comment": "Malware payload (SnakeKeylogger)", "value": "233cb586e29201d80a88a4dda7b8dfc4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679905, "uuid": "9afb7a35-4321-483f-ac76-6c7fc3c105bd", "comment": "Malware payload (SnakeKeylogger)", "value": "904f29d18a2e624fdff3e46eb8aeef598c74304e9f763d26dcf4fc946812f9e5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679905, "uuid": "b7ed140f-25ff-424e-bd1f-5e80022baf71", "comment": "Malware payload (SnakeKeylogger)", "value": "afc024a8eae4c9afc3a3778a77a60dd9cd29f069", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679905, "uuid": "648435be-e037-40e3-a4a6-b6bee5fad697", "comment": "Malware payload (SnakeKeylogger)", "value": "1634fd16360193e784fb9710ec67727cc5d49daf3d9247d85f1b135b0b6de976a6ff32bdb683500aaca9969648e1b6c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679905, "uuid": "4d79e6e9-1786-476b-b853-d48487ae31bd", "value": "T1C004E425EAF7DE70CA52093BA52CFA2D0D1D2D791D67F8092458FD23EEB6ACC9840171", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679905, "uuid": "7a5c3ecb-1fb6-4305-a267-72d37ad61d41", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679905, "uuid": "1572eaff-7ff6-445e-aa48-f26d26a36cf5", "value": "768:OopFYsWb0PaYPtSHPWcmhVm13jPJXtO5k4ZaDBo+CO8nYjj0a:OoDYsWbu5k4ZaDBo+CO8nWj0a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642679905, "uuid": "2aa74175-9394-4297-a963-ab05f408d921", "value": 178176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642679905, "uuid": "a24dded8-95e0-456c-b44b-bef335a477e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679905, "uuid": "cca70032-85e1-41a9-aa33-f3d7b6618626", "value": "4rodtz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26a7a369-79d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642670833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670833, "uuid": "ddf372bf-f2ed-4937-af8d-c4f191926a75", "comment": "Malware payload (Mirai)", "value": "442bb1f4a0930c73552ed72393f047b0", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670833, "uuid": "d1b588ca-85a2-4cc4-a8b8-0ecf833d6ed2", "comment": "Malware payload (Mirai)", "value": "90dad9aea8f8914b2cfef542d4475d082418cef7058423f55b5d46a0e5fdbab7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670833, "uuid": "16a6e1bf-9c83-4d5f-955e-ba858c82661b", "comment": "Malware payload (Mirai)", "value": "917ab157f9597a2dd9c0eedc4cc95ac823025e7a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670833, "uuid": "1b872b7e-8a0d-4cec-958c-3547bd920e6a", "comment": "Malware payload (Mirai)", "value": "25166b840fdc33982c24f6231b2ff550758677c819aeaa86d19f77b4627a1276688d6c76c2a8626c3195a4f322b065fd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670833, "uuid": "82ab9694-3414-44ac-a137-657bb49597a1", "value": "T1F4F37436B7619E77D80ECE7305A985121C8CD98712D92B6BB2B4E51CEB6BC4F08D3D48", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670833, "uuid": "33934716-3a2c-498c-b4cc-563cbe7a8b38", "value": "3072:1LNqrhHZ0P6bRFBQiVfRjHkLwmrThPaLEne7rNb:1Lsrr0PeRTJvgLwmrThPaLEne7rNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642670833, "uuid": "0e10e02e-a8fa-40a6-a154-f4eaaffda189", "value": 159493, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642670833, "uuid": "eb3ba658-7563-48c2-875c-622ee20dcb69", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670833, "uuid": "d2d46cdd-c5bc-4904-a4df-6c16c3882800", "value": "mipsel", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3505abfd-79f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642685890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685890, "uuid": "8ba9bdc7-e7e0-4c44-8573-7797fd87ad01", "comment": "Malware payload (Loki)", "value": "c9435363b89bedb1adad6edca350e8ca", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685890, "uuid": "5e91d2cf-bb70-4db6-8b87-17447f830471", "comment": "Malware payload (Loki)", "value": "91a4484a9c56e6a29a2c289becabb9c12f27096432019f4ae7d46edf6dd65740", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685890, "uuid": "18f7157f-92c1-4fa4-8112-761abb52c491", "comment": "Malware payload (Loki)", "value": "dda9c1971041f367362396ed9139bde2d80e6d4e", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685890, "uuid": "fab46f64-3210-4cdf-93eb-127d10c8e6d8", "comment": "Malware payload (Loki)", "value": "e7f6c889f9cde4ca8df50e7a672fd767725130eeee8e8cda6434a032216d0ed678a2fe89f81c494987927b8dd6638df1", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685890, "uuid": "8dc923b7-7fd2-4238-95f3-930d09777875", "value": "T1955423E7C61393C2039D739EF87DC1604AD63AC9767EA487A9C13DE999673CE0AC2015", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685890, "uuid": "5df7e36a-6e76-4824-b456-39cb4edd649c", "value": "6144:5Kg2X5HddzHaAKYGYwMZOqGyugwNQgq0ma1pPmU/ZtmNJnE66VB2hvuOgRQ6i0C:5KZ5/zHHKYGYwMy+wNQgq+Pm2/yJngyj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642685890, "uuid": "6491904d-87bb-44d1-9847-661c71d3ef66", "value": 302013, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642685890, "uuid": "67793b4f-0c1b-4540-9515-5f29582199a3", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685890, "uuid": "911f909d-dbad-49a5-80d8-a21652bbca49", "value": "Bank Details_pdf.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a72061e-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665685, "uuid": "6dfb6589-a7ed-4c0f-b98b-cca3a97b9f95", "comment": "Malware payload", "value": "92492330bd6e68ed1d8149f6dfc6b128", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665685, "uuid": "ddf8cadb-9755-4f41-a98e-6d55aa0ada6c", "comment": "Malware payload", "value": "91f504e7399fac50f358bcdbf3c1389ced6a3e12f7cfdb5cdb65b0f5035f9a3d", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665685, "uuid": "d1c82910-9e1d-4df0-954d-7339f7b91adb", "comment": "Malware payload", "value": "3ca841495e6444c98581a2fd5748ed9ddb4d6107", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665685, "uuid": "dadb4f91-6f39-490f-9ab6-6b152b2584e5", "comment": "Malware payload", "value": "17ea399af1ca2da025ffa60fffe2c9416014cbd424f6d575db11ae4a17198258ff67d1a136b88196a1fbde58b423815e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665685, "uuid": "ed8367d9-817b-4d76-9027-7d4cf01b97a1", "value": "T1B404023637149D7DF663D478783E5C7E489ECD3EA414814391BAB309C275A08E3E8A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665685, "uuid": "8338a658-61eb-4d0f-8005-378d845d6fd4", "value": "3072:Hk5/+jSdCTidLTmQp/8W7GVmqeDZuGYQqfPCW9UejAEOfyAAztiqOUOQ2I5CUss:a+6tdHmQd8W7w2Eft1FtdOUMIZn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665685, "uuid": "02bdbe71-9bae-4450-8f6f-9cd26d3ba89c", "value": 186888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665685, "uuid": "d73fe508-eab8-45b2-854f-b41b1cc243e0", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665685, "uuid": "7abbe970-54c3-415d-916e-3ecae4850bab", "value": "P.O.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e4e5b93-7a0d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642695837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695837, "uuid": "abfbd631-2f88-4c0b-9820-c096cf537868", "comment": "Malware payload (Heodo)", "value": "8c124aaa9af64fc38bc0998c42a3b907", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695837, "uuid": "7c21e669-5bcf-4f0f-a110-4a70f80ff4f8", "comment": "Malware payload (Heodo)", "value": "9284fd2cb8c5594f077aa12fa78a72f12ce6287bb52d14f7495aca68ef6b380d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695837, "uuid": "75ffd743-72f2-4d29-bfaa-8cf21e6c42fa", "comment": "Malware payload (Heodo)", "value": "60a9062bf21bd2801237890a514281a94e89a562", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695837, "uuid": "02813cfa-42c0-4a98-9616-025f9fcbd55d", "comment": "Malware payload (Heodo)", "value": "f31abe69535f55c8ea8e6b29a74f4213d38cf9f7135bf62508c114326fbea9eba9d5eed64cb349c77b4a16083cd1f7e1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695837, "uuid": "17637b80-24f1-462c-8148-78b2f24e2bf4", "value": "T18CC4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695837, "uuid": "426dd66a-da32-430c-a4d5-425d6d5b5bd1", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695837, "uuid": "4ca734e8-e89e-4447-9f2b-138514cc1378", "value": "12288:P78OGF+L8/4UUNyrGdMhTq/n4vAzdkPs7:D8Ody4aGdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695837, "uuid": "d13ca9f5-6eac-48ff-9261-26e167241dd2", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695837, "uuid": "ce133851-49ca-4fd3-9aea-12b0a5cd7d08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695837, "uuid": "7bf74e80-c41f-49c6-bb46-2b9009eeba99", "value": "4YB0E11V.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f59d1f08-79e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642680629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680629, "uuid": "1ee24ef4-be9c-412a-9b85-ba52052fd3a2", "comment": "Malware payload (Heodo)", "value": "12f7a6aa0a09e355bd70c8291ae682e2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680629, "uuid": "8b5ebe79-f756-409d-bc63-d9f26771d87b", "comment": "Malware payload (Heodo)", "value": "92f01f34d0d3d902538fa84268d937ddcbfb4e40234b4a97b1b50a227a002f1a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680629, "uuid": "b2ac291b-e29b-499d-a7f6-84e1466f038a", "comment": "Malware payload (Heodo)", "value": "ea7943806f839e871bb5c957d64850ca66118577", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680629, "uuid": "2602dfca-e5ff-42c0-beb3-cbbcbf0b36d2", "comment": "Malware payload (Heodo)", "value": "ecaef352158dc8ec13a056b050319bb966bcb627802555e97ac069015d11e2083ed30b846efd9e65450552b563f921f9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680629, "uuid": "a9329112-fef7-4d89-809a-c38b323bd446", "value": "T1B7C3AC0794059FA2C86CC3F9BF0B44D46F01426DE2D539DF28926B47779ABBB0A0D62D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680629, "uuid": "b4276d02-1710-477e-b393-9a1ca4903fea", "value": "3072:XXKCEvZ8BnW6X1yVkovrepMA5Q6g2X4inL:XXuh8lWoGk+eCP6DX40", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642680629, "uuid": "2b4497e2-5eab-4c1d-a23e-fe8fb2e66d89", "value": 118616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642680629, "uuid": "78edffc5-0628-4d26-879a-94b67ddd3e5b", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680629, "uuid": "2e074f61-b93f-44dc-9497-af7119013730", "value": "HIJN_22991.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e668f09-79dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642675087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675087, "uuid": "653aa9c6-bd08-46a6-b0ba-61f8a655808a", "comment": "Malware payload (Mirai)", "value": "b84970a5b2b9d496696ca83bbef85fdd", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675087, "uuid": "51c1839e-8dcb-4ec4-95d0-b7a7bff4cb1c", "comment": "Malware payload (Mirai)", "value": "9369b8ee146f0e03288de853df6f094000f3cb058d8bbded0d5c2f6b3997c66e", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675087, "uuid": "4cbc4d83-f8d6-4767-aaaf-db8b5a994d86", "comment": "Malware payload (Mirai)", "value": "dadd75b6f039176cc1519b6a0b37a1d22d4c452a", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675087, "uuid": "7ef193c2-cba4-4b36-a216-a36480daac8a", "comment": "Malware payload (Mirai)", "value": "6d7a7bd13a0ff1db664d5e3758a7610c9979d9073d83534e24b33d5c8fa4fd03fcfd15efb9b18afe200f4a5558ad2b06", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675087, "uuid": "7d135204-62df-411f-b29b-dec40f07447a", "value": "T1EF53BFB2D4959EC0C60943B870708ABD5763E9467A1B1EF09E4989AA400FEDCF25D3F9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675087, "uuid": "22bac121-fcdd-47ef-9329-d49d2d3d0740", "value": "1536:6/i6bkd/aesqtb43povT9vaqWQjEKF7ConK3:6a55Vtb4SZSQoKF7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675087, "uuid": "b8cc4298-e20e-4074-8177-5811b99c79a3", "value": 66596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675087, "uuid": "b3f6f4ef-bb6d-4096-be06-e9271b4712e1", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675087, "uuid": "e47ef147-2ef4-4ec4-a58a-78f6bf5c3f6c", "value": "Tsunami.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "214250ab-7a35-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1642712915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642712915, "uuid": "5673c1fb-90f4-4adb-9200-67af453f7e09", "comment": "Malware payload (RemcosRAT)", "value": "4c9ca911693c0c87cb3b01ce300a1ea1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642712915, "uuid": "6f28c49f-256f-4e28-bd8a-55727c953918", "comment": "Malware payload (RemcosRAT)", "value": "9395c1e6ca8f59400a742d292ba944d420396fec84d0dcbec9f2e4f0aeff02b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642712915, "uuid": "dc274765-432f-4239-bba1-e3779bcc7f60", "comment": "Malware payload (RemcosRAT)", "value": "b3acc117cabd6d9a1808807aade7f38847223156", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642712915, "uuid": "b04912ce-45dd-4109-9413-bd9fa8943b00", "comment": "Malware payload (RemcosRAT)", "value": "a649a62f79cff5afb933482bf5521acb3ae95e2ec54217a35706dd6a63874bc8d4f7f473cb7e4d088d61a32f8bab9a6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642712915, "uuid": "1307e8c8-31f7-457c-9943-0dccc34e77e2", "value": "T1AA0512307F624673C74F07B084666C2283BAD4A65898FEDF6D8E6DED1344BDA8711293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642712915, "uuid": "705e0ad2-a170-489b-a299-c04224b1a7f8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642712915, "uuid": "3d560353-fa9b-4636-859f-dee3e1d2209f", "value": "12288:a5fAWiiiE9WfXGd333Yo3D/TXgNfl4A9eqztxCLGaS4gpaY9zoCp/dma18:SMfXk333YozjgNflZzLCLxE97VmaS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642712915, "uuid": "4039794b-5700-4a78-8620-29c3c119771d", "value": 832512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642712915, "uuid": "5f5602e8-08c4-4d66-a4a7-088fce1ed523", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642712915, "uuid": "8fb5de0e-3bdc-4e56-94c0-929ec46c1ea8", "value": "4c9ca911693c0c87cb3b01ce300a1ea1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eed0b08-7a26-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1642706603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706603, "uuid": "c16ed6d7-1960-4ad3-b130-b08e69e6ec2d", "comment": "Malware payload (CoinMiner)", "value": "0672f13398e67c43c7157c82ebc12bab", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706603, "uuid": "7f269808-acd5-48b6-bb91-851af6f71541", "comment": "Malware payload (CoinMiner)", "value": "93d7032a2106ff7bfe17dd46bf426aea166fdb883b37f377e2818f1882e494b1", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706603, "uuid": "4f466be5-c59c-4dc8-a492-44feed2f13e3", "comment": "Malware payload (CoinMiner)", "value": "7d0f4d5a05767f7ef534d7b05c72d5498918597d", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706603, "uuid": "89f1968f-bc70-476e-a15d-47e1f023bb8a", "comment": "Malware payload (CoinMiner)", "value": "8418fee0ff869c5718c19aee2e354ea72e5dcc1418319a15ec0fe2284a4fdbb3ea449245af549dd576818c189f5c3982", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706603, "uuid": "0ba40757-0daa-40b2-ba16-52abb6691f79", "value": "T17E5533DCC2895F7ECC9107793C7E749A9E200BDCD26011BB7E85FA75C962D600AB858E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706603, "uuid": "8ef83e1c-0349-45c7-bff4-9633eaa06165", "value": "272ef13a3433f52c22a4b5302c85cba5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706603, "uuid": "89949cb2-f118-45a5-9cda-745529c45f5b", "value": "24576:ALPl+9vC1oPpE6KdnXF4UHv/tMLl5VHPUAGz7pYV7:AL9+207UPctMNzE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642706603, "uuid": "0975e2a2-4576-4985-b838-a2f49d0a3375", "value": 1321984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642706603, "uuid": "eee454d3-07b7-4d5a-8547-09573b57402b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706603, "uuid": "acbc7dd7-c00a-414f-bba3-c3947b2374b2", "value": "0672f13398e67c43c7157c82ebc12bab.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0411394e-79dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642675070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675070, "uuid": "2e543f0c-5650-41c2-af67-df3b30bee8c0", "comment": "Malware payload (Mirai)", "value": "4b3f1f2c3138251b4595cc62fa2ea00d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675070, "uuid": "67eca8a1-bc0b-498d-bd15-b478df25878f", "comment": "Malware payload (Mirai)", "value": "93f4a4f7435f67a06152b34feb5253152619539d2af61619c3912aa0120ae8a8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675070, "uuid": "e49f8bbb-868d-4327-9f65-eaa56d5f4248", "comment": "Malware payload (Mirai)", "value": "13596109574aa7ef4d19811d5154c4b6b8c24368", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675070, "uuid": "2e4235fb-0d7e-4f8c-97cf-78682f7ce78e", "comment": "Malware payload (Mirai)", "value": "ca0589b91d10d91edb941cbab5e2938f36f4389f9b6450e4b4403487314c49a514a7174536bfea663f2914d899b3fbc4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675070, "uuid": "8ea5f878-11c7-4bc0-a5c7-832058fd6a35", "value": "T11B634BE5B402DF7CF48BDBB685124A09B521A2454B930F2BE367FCD7AEF21948947C42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675070, "uuid": "120b6a34-bf74-4782-a5f3-c69a8f4bc210", "value": "1536:8sb5vw4vIS2u4YWtv4YIoNkKaFRNr4bOb0M8AoBh:86v4xLXNvcMOAX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675070, "uuid": "b5980824-35f1-4c2a-86b5-3514894b565a", "value": 72400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675070, "uuid": "1aaa83c5-567c-472d-8caa-1308f1b08c0f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675070, "uuid": "96208789-4584-4811-91f3-b1cfc57e1699", "value": "Tsunami.m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9e6f26e-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642666382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666382, "uuid": "e2580136-8028-449e-8737-bd501b7a3455", "comment": "Malware payload (AgentTesla)", "value": "633e14b82b0f78249ac5815079895b48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666382, "uuid": "76f90d76-fd1c-4667-b84e-339b6922f8d5", "comment": "Malware payload (AgentTesla)", "value": "941d333c8f2212138778e9dead043b5344cab9e98055da2ff96ac07ec196d4d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666382, "uuid": "319c5907-53ae-4998-84a5-8043de668da0", "comment": "Malware payload (AgentTesla)", "value": "62ad73945d8b113dd4e3c7f1a00ace42e57ebae3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666382, "uuid": "fd88fbc5-6ba6-413d-9740-6381b6eb5a5a", "comment": "Malware payload (AgentTesla)", "value": "dd401701118600024cb8424066de16071f769c4923a8b14ca3992dde593f586292b166098bd4648240d8795dda77ff37", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666382, "uuid": "d63ef497-3c77-4fcd-aeeb-a17199e1e71f", "value": "T1D494122056F17F27E2A987FB01321284A7E4B3A9E276F74D0D9580DF132AB51CA53793", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666382, "uuid": "8c905286-bf13-468c-9355-2a9d2be21a65", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666382, "uuid": "860e1d31-7a30-4120-bdc0-47f790bfcfeb", "value": "12288:tMYdAbc0Cr0R0B+t8ZjRjQmbXGhLcMqkGHOiSUT3PtY84oJo:tMYdAbc0CYR0B+t2jrqhLcVkGHRDrPez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666382, "uuid": "e014e909-bae7-45ef-a0e6-791ade69409a", "value": 420352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666382, "uuid": "26fb4020-4b93-4229-82fd-2b665baa4047", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666382, "uuid": "286f800f-d047-419b-ad58-343bba34c49e", "value": "DHL SHIPMENT PARCELS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72b8e798-79f6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642685993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685993, "uuid": "70ca3591-ca4d-4d29-a392-6e6f79d9206d", "comment": "Malware payload (SnakeKeylogger)", "value": "92af34c08d00bc9e133b98161f557b8c", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685993, "uuid": "671a6ea6-87a5-44fb-9378-eb497af98ffc", "comment": "Malware payload (SnakeKeylogger)", "value": "94610f2fb772a18b06b4b3533a485924d7488800b84e18cfb8d017944a5c5fa2", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685993, "uuid": "eda55ad8-9c09-4a03-a8ea-158102c97e10", "comment": "Malware payload (SnakeKeylogger)", "value": "d4753a212ce4725d7112f8285e20350d93cc1596", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685993, "uuid": "10510bd5-5e96-4d21-b59f-98ab37391f48", "comment": "Malware payload (SnakeKeylogger)", "value": "fdf8b3690e96108fa7e702c18765491ec9ef7d52028be40ebd2a50cef66abda2d02ce9980407cdac2a1475485974b725", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685993, "uuid": "625aef97-39d0-440b-9403-b6cf4fd82e1f", "value": "T1E06423DF8023D5BB34E54BBBAE3218DF84EC18DE62914E54380CEA56AF942C76633715", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685993, "uuid": "ecb07550-ec4f-414b-9ffd-e51d09d0e558", "value": "6144:QBHitA6+v+w+qXf2iM14CLAIyoS6lqNcxIcwdHDUIo+hA/6yy2g:QBiA9SM+iMczJrNcxIcwpFoEASyy2g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642685993, "uuid": "b5d2f9f3-dcf5-451b-9ca6-fa9ae988c01f", "value": 317228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642685993, "uuid": "fcd7cfb9-7a67-4f02-bd28-9994dd777a35", "value": "application/gzip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685993, "uuid": "e8ac5146-c260-4d5a-a655-cdf4c74ee15f", "value": "Proforma Invoice.img.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40799e43-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660568, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660568, "uuid": "1a975dba-e6c6-4454-bd55-e0a4efb43b48", "comment": "Malware payload (RedLineStealer)", "value": "0bfeeb3d62fe94eb0fe52fd1e586944f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660568, "uuid": "f69f5d86-225b-4ea8-a3e8-f3b93912daeb", "comment": "Malware payload (RedLineStealer)", "value": "9548cf665a2aa59e9ca2f1938de081932dab4369384e7132d9ae5e64d2823c96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660568, "uuid": "aaa05856-89ee-424b-96e7-6539e8b7e7be", "comment": "Malware payload (RedLineStealer)", "value": "6c4b307f380a002191dfadd594c3158ef75bc2d6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660568, "uuid": "07f0db1e-b493-4715-9d70-f72de7af21f9", "comment": "Malware payload (RedLineStealer)", "value": "48cbd3472458023c3bee0270b31b37b9dd65cf20f6df344b31549181b4f15308467033e19e24389791d311fff3703db7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660568, "uuid": "d8da3a5d-1f32-42c8-a351-7c75f31faf85", "value": "T19384E0607580D7F1C0861A30B82ACFA55ABDFC7D29610A4773A4376EAE3D291227735F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660568, "uuid": "1d21f0d6-9901-435c-8dd5-1f99db249456", "value": "125adc129c50285a2cd4524417d3fdd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660568, "uuid": "0028d21e-3eb9-42bd-8491-d1495b481689", "value": "6144:jdkXL5F2Y1qoFkRlDIUtXANirUtG48+/PhwSkXjl:jdun2Y1kRlDKG7+xGl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660568, "uuid": "f0d823bc-a338-4fc0-81d3-9b3a30ed5331", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660568, "uuid": "a6cdd900-352d-40bb-9238-c1eb4e8dc678", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660568, "uuid": "04f8804f-a445-451a-935f-722c4f77f5ec", "value": "0bfeeb3d62fe94eb0fe52fd1e586944f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb6c9c0c-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642675055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675055, "uuid": "ef481e46-7e34-4036-9b5e-831bf6fec5a6", "comment": "Malware payload", "value": "0668cad537920cd19c6c1ffd787a512d", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675055, "uuid": "095d3e18-ed85-482a-8d77-3f419e60cca2", "comment": "Malware payload", "value": "95eaf64e3291827802a0e18aae75634438a07d939edd76a6a0d9a6fb9b116cb1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675055, "uuid": "ced6d756-089e-4c51-bd89-81caaf99c42b", "comment": "Malware payload", "value": "61aa30dbefb4809d37c81101c599d5e3953a9163", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675055, "uuid": "fd34a736-7abb-4088-8286-fdfc220a4901", "comment": "Malware payload", "value": "7ab82ac6d546b7c9f61e0ac94a6d281885c878c57cd4369f563e2aa0e8024b427aea6d6d0f6b36449a4fcc28b126a0df", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675055, "uuid": "34f7f4c4-686c-47d0-896d-7231493833c7", "value": "T164C2D13C97523CE388B62D39F429C612F74683B982E4A5513A825DBCB7C1691DADF290", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675055, "uuid": "6de4923f-a1be-43c5-a449-9bce054a7a76", "value": "768:NEtZRjTviljUxl7nn4f+6eD/GQ4Vo1IE7s3Uv:qZTvq0lzv6Y/sWb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675055, "uuid": "4b0a4954-1d80-462d-a138-fb082d6fb10f", "value": 26018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675055, "uuid": "890049e1-164f-4d6b-a7b2-0e95950617e3", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675055, "uuid": "85e1b6ab-ab2d-4fba-9417-85a7edae55c7", "value": "Tsunami.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4bcb4ce-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642666320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666320, "uuid": "0d6ccbec-d075-4419-9003-f83bf1bdc814", "comment": "Malware payload (Formbook)", "value": "cfbdaf7ca4533951acb684abfb9974a0", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666320, "uuid": "6d233f33-4be0-4fb1-b186-df3cb9048b00", "comment": "Malware payload (Formbook)", "value": "960587ab2a2c934aa956be4b67219557a8bb2f2f1a0d47f179931b5cfd7f60d1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666320, "uuid": "3eb64af0-c36c-473f-ae46-13460767a7b8", "comment": "Malware payload (Formbook)", "value": "6effb604b4a84ea5890e28e2d87500ee15c5dbe9", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666320, "uuid": "7edf2f4a-3433-4e65-9d95-b50c492a4688", "comment": "Malware payload (Formbook)", "value": "42112c3a4de437e060ff4bfe85db7af9bad8f51c30e0e9868cf9a513199e341f82c7e2cd1afd6beaf0a0c80683f83b06", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666320, "uuid": "f9243682-0d95-4002-90a7-bec166884cc4", "value": "T18154125259C868D7C88769711927BF9AEBFBD22917B0011307784E673EE20C0EA1D6F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666320, "uuid": "c3970ed5-3656-4b59-8e99-c797f1f2d97e", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666320, "uuid": "df295079-81c2-4e59-8cdd-dc70e43dab96", "value": "6144:owPrVaBvGPHHNEB4yXOOlcXnLoVfEjAY3z8Rtq2yrBwgJU:j8vKnNe4yX1mXLoVfEjAYjT26wr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666320, "uuid": "f0ccea5d-ac58-4e34-86e8-a1fb5d2736c1", "value": 290628, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666320, "uuid": "60b60dd6-166b-4833-abc6-2923bfa98ed3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666320, "uuid": "d704302e-49bf-4166-9fb4-5b8b0de6a866", "value": "DHL AWB TRACKING DETAILS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98ba9f09-79d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642669736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669736, "uuid": "3d5586d1-cb87-4b42-9f2f-94a0921c0a99", "comment": "Malware payload (Mirai)", "value": "86cba3c2a65b9b8ae0e5f88bd5895950", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669736, "uuid": "632e11a3-bed4-4fc7-b207-13fecc884216", "comment": "Malware payload (Mirai)", "value": "963a217135e55f8a7ef6de8c461d2e99905148cd8a5bdaca190cdf54dada9dd5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669736, "uuid": "4e287405-3b3a-4647-bce3-05685cff3acd", "comment": "Malware payload (Mirai)", "value": "6260aad0505e13ef12e2773c72047e9aced50ef8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669736, "uuid": "bbdbe08c-b7f2-4e47-8721-fad6ea3d1435", "comment": "Malware payload (Mirai)", "value": "66322538a4cddae63f7b13431e209241aeb8b22ee826586b3777d158b5141429f9188079a82cc128be0bf78d7b019c76", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669736, "uuid": "a3f048f4-49da-4877-9de8-211fcd3b443d", "value": "T128330891B9824E6AC9D513BBBA6E55CD332063E4D2CF7313D9204F543ACA51F0E6BE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669736, "uuid": "b0bdaa0e-4185-4fc4-902f-5a39295b8894", "value": "1536:De5kgYawggPL6LCgHfjHBSyEvxEy3RiaBy21TJA:YhwgOLQCorHUHvGy3Rls29J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669736, "uuid": "a60fe047-eb32-49aa-beed-8adb61165d26", "value": 50796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669736, "uuid": "a81e6006-e434-4c93-aceb-d690a4ef9c2b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669736, "uuid": "cdd0351b-b1ad-4b0b-a6d1-efe860c0a321", "value": "gang123isgodloluaintgettingthesebinslikedammwtf.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf814f99-7a06-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642692994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692994, "uuid": "060ee85c-bfe3-47b8-9c27-df8a6d8f2d8f", "comment": "Malware payload", "value": "31d984187d7ac703c8ff0719b03cc100", "object_relation": "md5", "Tag": [ { "name": "Coroxy", "colour": "#E2C864", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692994, "uuid": "10e66cb6-b713-4c54-a954-731363afcbe4", "comment": "Malware payload", "value": "964a9d8fbfd1886a93c1c09493db044bd37e517c4def61aa779c8734cb5cd68d", "object_relation": "sha256", "Tag": [ { "name": "Coroxy", "colour": "#E2C864", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692994, "uuid": "84fd234e-451e-44d8-98d2-01809ec7c660", "comment": "Malware payload", "value": "c4468963f00ef44db4ecbacdf50abe0491b6d21a", "object_relation": "sha1", "Tag": [ { "name": "Coroxy", "colour": "#E2C864", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692994, "uuid": "d04a5405-757b-438a-8e7a-9d7da450c993", "comment": "Malware payload", "value": "73276277e9608660d9dac92d8e4c08896e911d3badf6e149473b2c3d123aa56629bb7470739ed9285919d7a2ed0010ae", "object_relation": "sha3-384", "Tag": [ { "name": "Coroxy", "colour": "#E2C864", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692994, "uuid": "6450ab2c-c178-4446-bfd5-254979abf67b", "value": "T104A2A57CA541159ED762C3F2D6AED311D57A352B023AE36FB3B853001F228E6DB50AC6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692994, "uuid": "25942a6f-e55d-4cf2-986b-cc4969f98e41", "value": "20293b10112f971cfd5c0d157ef0eef1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692994, "uuid": "754b78e1-2d35-4d94-89bb-cceac7b8497f", "value": "384:5MZt/zyroeHj4ckTkTWvKEB4JIX6p4Jjxk/ZlFj7UWwoD21pE3nZ6I6:54zyMeHFqLB4JIqp4JUZD7UCspc8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642692994, "uuid": "c71e8a3f-887c-4f79-8e2f-c09ef95ffef8", "value": 23040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642692994, "uuid": "34d6e2bd-9512-4d0e-b29f-9c7430b1c6d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692994, "uuid": "b2572f7d-3ead-4c8d-babe-451a812ed3b5", "value": "server.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "045fdf30-79e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642676788, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676788, "uuid": "996f20d6-4ed8-4496-8091-130cb7b8c42d", "comment": "Malware payload (Loki)", "value": "37326d34108d98bdf461bba93c196230", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676788, "uuid": "e36b5cb4-b3d1-4a57-ad73-9b1ad9c81e68", "comment": "Malware payload (Loki)", "value": "970655d808f6e02ab83fa94ce4294e841d2931d7200f2d7359ded3096ad72acf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676788, "uuid": "f816841a-c2fe-4d06-8c9b-85d898488212", "comment": "Malware payload (Loki)", "value": "6abe21e99971fda6116561583f1df6a20a9c6056", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676788, "uuid": "e11130a9-ad5f-4b43-a525-a6e480202eec", "comment": "Malware payload (Loki)", "value": "ec5d0f143de2672ec186068e68ed7de3b931fea18eca52a9f1dff53bc1890acc1e7353c510c0126a2217e88ce5887731", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676788, "uuid": "4f37801d-60ea-4239-b7bb-9cc99dd67390", "value": "T145A4BE2613D91B54C1BDDB78A378449803F1766BE711E7AFBC9402E9CB11F0A9A137A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676788, "uuid": "64a8eaa5-1c1d-4c9a-ace7-886ab8471299", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676788, "uuid": "004068a4-a4d4-4b94-a69a-d2832af35560", "value": "12288:gTHpvU2Ptkfh6jyAcW5N1HHcuYKZAwleXhPTp9Er:gLp4W5NxHpYuAwlsd9W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676788, "uuid": "52cf81c4-4961-4ee0-94d3-526be09c2728", "value": 458752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676788, "uuid": "961284d2-dc94-4bb9-9c0a-a21859029fb5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676788, "uuid": "b93950a3-d696-4390-8e5e-65e682118131", "value": "ungziped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f969e84c-7a14-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642699104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699104, "uuid": "b0ab0100-dd26-4cb7-ad2e-f5c915262d99", "comment": "Malware payload (Heodo)", "value": "4af66368ee66b966723812486c720bd1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699104, "uuid": "33c913a3-f212-484d-a3c4-a63d116285af", "comment": "Malware payload (Heodo)", "value": "9713bd6e70b57a5f98a05f4c674192803b49850ec2f298546fc6fa8e5b473d5e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699104, "uuid": "2d5d61fd-3aef-4ef7-9e37-375be5cd36c5", "comment": "Malware payload (Heodo)", "value": "1f6e1b58917c9e55be2862a3f0f3926d5ac47f9d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642699104, "uuid": "8efd2665-e9c2-401f-ac41-bdb5880e9eea", "comment": "Malware payload (Heodo)", "value": "4fd66f83a46da475aa03997165583078ad598714be4a313fbafa4707e8013855608c49058dec10eb01ba45d6649889bc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699104, "uuid": "47becb7e-a6e0-439d-8a7f-e9d92f05ff94", "value": "T101E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699104, "uuid": "4e03ca29-b91b-42cb-aafe-336f2f5a04f4", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642699104, "uuid": "06cac1de-a8be-4979-a079-4feacb11eaf9", "value": 145947, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642699104, "uuid": "5f68089a-e664-425f-9085-f7dbc8cf6652", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642699104, "uuid": "5dc03b1b-e779-4c48-a8ac-4919315d8c33", "value": "4af66368ee66b966723812486c720bd1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95ca4eaa-79ff-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642689917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689917, "uuid": "63363f17-bb87-4fa7-b8b2-ef4f83298d25", "comment": "Malware payload (AgentTesla)", "value": "af99072f374e505947f22d9f5009173e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689917, "uuid": "411b53ac-fb48-4d14-abc2-411efa4b2ebe", "comment": "Malware payload (AgentTesla)", "value": "971b2584f8277974196f5f6028198c550c0d0c7b18838da0a8ac8b4849184ab1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689917, "uuid": "b35f4e2a-efb6-4648-b210-278fb0418ff8", "comment": "Malware payload (AgentTesla)", "value": "2ae3a3b712db6efd6c19e9e264346e1b7802abbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689917, "uuid": "42cbd8f6-f5f0-4a22-910a-78910dced6f2", "comment": "Malware payload (AgentTesla)", "value": "825364e0ee4f9d86b86beafd5284047d8dadab6d0c4a5201a6b4ce7e36bb613986d5666edd58d439fa59fecccbd2f7ac", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689917, "uuid": "51686034-d868-491b-8f2b-98fa8427c298", "value": "T13E25BF5E6E05ED25C4B81C7C5903B3A89375BDB0D8B2DA9371993E7FB9329E2140A01F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689917, "uuid": "e0f63d05-f387-47ea-be14-f84ca3f82245", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689917, "uuid": "ca3a80c0-5ee2-4e99-8e55-e132792e299a", "value": "12288:h4E96v6TSwc6+89kEzNUx57GoU0VRAzog5MganQ05opQ35lhX4y:qk6CX9kEZUxZGoJmzog6/pRX4y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689917, "uuid": "400a0b1f-ad22-4f68-ac75-f0226e615963", "value": 1044992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689917, "uuid": "f568ef8c-016a-4066-bc21-a18143157244", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689917, "uuid": "cf30b69b-99c7-4aa8-b837-c471c839e93f", "value": "PurchaseOrder20222001put.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e9a086-7a26-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642706700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706700, "uuid": "b030e1db-08c7-4a96-a6de-55b0608d1909", "comment": "Malware payload (AgentTesla)", "value": "8b28f37cdacbbe7512923aa98df2ba7f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706700, "uuid": "1cd58649-30c8-44b0-b2f1-9713eca14f94", "comment": "Malware payload (AgentTesla)", "value": "98f67746deda101eaf6067f6f81db82acbe0ae6485701cec41acc03ced2c9e6b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706700, "uuid": "784b6647-50a2-40d7-b973-3b97e0075991", "comment": "Malware payload (AgentTesla)", "value": "0666b92d1d7501400126e407458e1d3cd385df0d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706700, "uuid": "62fab04d-e698-48bf-9dbd-4e522696e943", "comment": "Malware payload (AgentTesla)", "value": "74fc366ecf85f0e460ab73932af9398d09af163f6f93ccae3c99a8fcde4b719e2f39d96a5d34a62b20356e5f5d5c813b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706700, "uuid": "c75c6fd0-a49a-4b7d-b53f-aa4e163706b4", "value": "T12A9296ACC09702A88F86ABB8272BAF54118D791DF794A633753C9B7067D2E7D401783C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706700, "uuid": "bd0e0951-9e16-4ad3-9279-7738d1c76ba7", "value": "384:5m6lDDmAlnjXYtGhNyQ18nhhMHPewOMobY:5molnjXfhNzqhhMv9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642706700, "uuid": "a00602a3-3ceb-4065-a1bd-4337fb766e96", "value": 20458, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642706700, "uuid": "0bfd36f5-9ac5-4313-b8d1-e98d3a2d6c86", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706700, "uuid": "95f02f2a-0efc-447b-93ec-2252664b73b1", "value": "exclusive20 2.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a3ba77c-7a0e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642696367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696367, "uuid": "70168ca6-7807-4a46-94f2-dbba11b07390", "comment": "Malware payload", "value": "09012d818d6dfd893907543ec924b23d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696367, "uuid": "96007424-42db-4f4d-b88a-b0ea034b57fb", "comment": "Malware payload", "value": "99338ec37cc70fb66ff95728e7db06e320cc70cfd64236346bc623f0777c5345", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696367, "uuid": "730e61a1-e437-418f-9e38-432d208ef4e7", "comment": "Malware payload", "value": "ec15647ee41366eb071068110c5590f64b2e2ffa", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696367, "uuid": "9be2fd74-69d9-410e-af87-799995395e40", "comment": "Malware payload", "value": "ce17dff4f82a2db5345ac215dd6cc0621386fe54c797c119265ae103e7d64063fd40474c3d8df80623e3fa41ed9c69ec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696367, "uuid": "c6daffed-49f2-4eb6-a4c0-ff90f1c7e8d0", "value": "T1115423967FF5562BD98929F24347833EE3FDA2089264444B27602FADB9B34D3C0161E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696367, "uuid": "4fd80b8c-090f-4313-9c91-fe01da6e9804", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696367, "uuid": "3e373a12-3908-4c84-b7b8-b46f690501dd", "value": "6144:owI8sAx35XtR80LDwdKIEj7f3gJ+T5c0LSYVKkWBDB:88FXP80HOKIEj7f3RSYV0v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642696367, "uuid": "971a3270-0240-48b0-a476-ed2eb60f3c96", "value": 296398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642696367, "uuid": "53b284bf-96b1-43cc-9e8a-f43b5f1d2078", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696367, "uuid": "0ad6b985-1c6a-4c10-8cec-9735e635daf0", "value": "09012d818d6dfd893907543ec924b23d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e88470-79bd-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642661463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661463, "uuid": "1d683b00-6f04-480d-a768-be83fbcafb75", "comment": "Malware payload (RaccoonStealer)", "value": "b321222fdf3c98a7fc8c013edb5bbec2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661463, "uuid": "07aa39a1-cbd3-4583-838e-da3e8e19ef4a", "comment": "Malware payload (RaccoonStealer)", "value": "9a2bd09d8065bb3733599fb8b64ec30e97326256849b268b8f94d4f655dac981", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661463, "uuid": "c1fe1ded-ef14-4264-9edd-ab0243de9d50", "comment": "Malware payload (RaccoonStealer)", "value": "8d9734ef3b9b0fae5540abd06905a2718e5f0a5d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661463, "uuid": "34eda84d-715b-4416-ab74-ac6ee48949a4", "comment": "Malware payload (RaccoonStealer)", "value": "35a963b049738a7f940ad466d3e668100fd504975bc51b9cb5d50bd9643623336b7236d49160aaacdcac9378e6b318ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661463, "uuid": "699ee11b-c2c9-4b5a-ab3f-e5f398cde252", "value": "T12544AD217590C731E08715318429CFB0DABDBC315B619A4B73AB3B2AAF63390676536F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661463, "uuid": "c7a9ccf1-1f4f-466a-822f-9b55c6670bc6", "value": "b599c41ba6f3d2fcbb28babbce596599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661463, "uuid": "f69f8c03-c090-497e-a6dc-5fe1469321bf", "value": "3072:KrVm5rx+q2fNiNWTgpeiXA54yIkm41qeBdQM/h3:+Vm5x+q/WTgpFNQV4SdQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661463, "uuid": "17f74e2d-9fde-4ffd-a5bf-620ad190c2e3", "value": 275968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661463, "uuid": "6fee852a-c75a-4bcc-8485-f89553e59d8d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661463, "uuid": "aed16ea6-c18a-4cbe-b95a-005b23289748", "value": "b321222fdf3c98a7fc8c013edb5bbec2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4452be-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665799, "uuid": "c0da7339-d989-404a-bb63-a6510727fdcf", "comment": "Malware payload", "value": "1f9e74aaa1d8bdee34dda6f5f697204e", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665799, "uuid": "cc514787-7ce5-421e-8e68-309aa6bf2c17", "comment": "Malware payload", "value": "9a40b3a0885cf314d2b94b4c039b2260a199359b49784b9a11d90485b09fd374", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665799, "uuid": "4f3281d3-0cc9-4f87-bd77-4b3a15b3b1ba", "comment": "Malware payload", "value": "629f7bd22d5561e21a61175f1f602a531ee91f86", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665799, "uuid": "5091371e-36f8-4acc-bb17-723677de073f", "comment": "Malware payload", "value": "dc0fef0638d23d10ecb59529378264ac919cddee192f21789feda98966d49a682f3378e201b6ef97892d49d99a8b4e73", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665799, "uuid": "2f6531d3-f183-4308-91ad-35c3a1508f7d", "value": "T1A5F19D6CF1519178E543847BA3251DF1EDAB81EEFC23908B68CA671E0C082C65F0F8C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665799, "uuid": "a8fc4f7c-637a-4b36-a6f3-791fd8fa2114", "value": "192:ez8PA5ZOV/q1NBafphKRgfSRKOMnwF7xc8uM3ihDiS4:ez8PkkV/AbPRIMK5E7e8u26DC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665799, "uuid": "05a1e08d-c43c-46c8-a835-18100544aa1b", "value": 8045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665799, "uuid": "d3ddd8a3-fb14-45ea-9087-85560cff3b93", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665799, "uuid": "d7525516-7fa5-4854-a900-c152bc38f521", "value": "PO 124682.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d665cb8f-79ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642681006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681006, "uuid": "ae5199b2-9708-476f-97a6-540f2bb50bf9", "comment": "Malware payload (Heodo)", "value": "bd33e94b6a8514eadf52f5d4eca7b5f5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681006, "uuid": "497ac885-9bfd-45e9-ad97-fd83b90d724c", "comment": "Malware payload (Heodo)", "value": "9abfbf06900053672f9e159b4c57db0807dc5a3d5816702f17c5b07fe83370d0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681006, "uuid": "82eeaf89-4f47-4427-8701-8328bc9b67e0", "comment": "Malware payload (Heodo)", "value": "2a51fc25a21d1a9b600b13f73757a0f8abdb5b0b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681006, "uuid": "5f9c1446-874f-4afe-b0c1-bac5073cc677", "comment": "Malware payload (Heodo)", "value": "6fabc54610ba5d19bf9d225c4e343a08913a9694d48dc9d8e26bcbd2fa4ae5dfa4cdd3953f5f4fa803e395a7c7459480", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681006, "uuid": "b2e5fab5-bbcd-4c38-b1dd-cab31b0cbc7a", "value": "T1F2E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681006, "uuid": "c66d2387-3e71-4848-bb3c-69dea80a77dc", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642681006, "uuid": "b5c9fa35-e4a8-4e9f-8e53-eff5d86a179a", "value": 145486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642681006, "uuid": "a5e9b302-ef0d-4ad7-a94d-e8736c381847", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681006, "uuid": "5c64ef39-2a89-4144-b86a-8b1e33718df2", "value": "bd33e94b6a8514eadf52f5d4eca7b5f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cae8858b-79ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642680987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680987, "uuid": "ff357049-3ee6-424b-8135-8d78d8709d05", "comment": "Malware payload (Heodo)", "value": "5acca79d4dcd5f379785ab24580f0d79", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680987, "uuid": "82b185b1-a8b8-4a0c-8fa6-12aa5f1f73b2", "comment": "Malware payload (Heodo)", "value": "9ba56efec9dfbeaca7216f658c75a50962169d958ce15e168479e490539e84dc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680987, "uuid": "808f5cf8-ceb7-483c-bd25-fc0a0b517b45", "comment": "Malware payload (Heodo)", "value": "7a3e94b22a89cfd81a745ba01955b1eeae9be0bb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680987, "uuid": "86e95bfb-11b8-4e74-97da-b8e2814fd315", "comment": "Malware payload (Heodo)", "value": "82ca852758a655843091255be50d8cad8422ea2a8f799f0c7a42af42ba4a5a172b03820d5bcfe0fc8ac4d4afd7c1c518", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680987, "uuid": "e52fe901-96ec-4259-b88a-0ab3404e3049", "value": "T1EFE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680987, "uuid": "abcef14e-90ae-43eb-b247-1eb4c4d47008", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642680987, "uuid": "a146b767-edc3-40e1-8d9b-a1402d957527", "value": 144674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642680987, "uuid": "f83da3a4-b7fb-4476-97bb-5ae88e2ccf2b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680987, "uuid": "834ce1ba-a9f6-47ac-a3ce-46bd58e40ad5", "value": "52227622753046258688.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eec71ad6-7a36-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642713689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642713689, "uuid": "5f03c249-7129-4a39-9760-290f0710efe1", "comment": "Malware payload (RedLineStealer)", "value": "3db8aaeede991e343f4a58c029d5bcb6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642713689, "uuid": "b362fae3-6c3c-42a9-8371-3b827bae0d3c", "comment": "Malware payload (RedLineStealer)", "value": "9bf4c9b6c5e930ce91b84920a73d9111793e6d31477458043e94b649147ebf71", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642713689, "uuid": "1364c105-374e-4ea0-8f55-88f4375408fd", "comment": "Malware payload (RedLineStealer)", "value": "dce0cf75d9080b4c31425adbc899d21f0ebb5c0f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642713689, "uuid": "d726a236-9df5-480b-b686-7d1997582233", "comment": "Malware payload (RedLineStealer)", "value": "d0fd3cb15b556b3fd745e55634e74e3a93bf9e111b9b4dd04d359f9fb20d5b285d4cd71645cf76ecd6b360dd324c637e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642713689, "uuid": "b0208776-44c6-43f7-8fa1-f051bddb0c7e", "value": "T1FC3533762720A4EDC54A06B27FCAA57EF740F47483A5E623EF0C93D936518CD06AF252", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642713689, "uuid": "0f43d96b-94cb-424c-a267-c8d7bc0f0020", "value": "ced282d9b261d1462772017fe2f6972b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642713689, "uuid": "7c8abc03-4214-4253-969e-941a9d284225", "value": "24576:XxK+gqdVuAceA3ccBLTNglDRGFSA2po/CpSydh:hK+gqaGAMcBLTNKDscDpUoSydh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642713689, "uuid": "6975d09e-23e5-4c4f-b9db-b5210725f6dc", "value": 1131333, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642713689, "uuid": "ffce970c-3572-443f-a553-bcb24f5cd1a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642713689, "uuid": "6a5e2d0d-8c7e-4bd6-b1d6-5ce74dc0c487", "value": "9BF4C9B6C5E930CE91B84920A73D9111793E6D3147745.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfb4f8cf-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642660809, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660809, "uuid": "51f952d1-e118-4601-988f-2291077a2c28", "comment": "Malware payload (SilentBuilder)", "value": "8e1c2ca3544dee4b1efd2341d5878bae", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660809, "uuid": "bff39c53-48ce-4772-a323-03636d37c121", "comment": "Malware payload (SilentBuilder)", "value": "9bfb1eee6403e410637b319fbb601585ac6858b5c169467e0cf07488ff642845", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660809, "uuid": "c83246b9-58b0-4862-b069-58c86244af29", "comment": "Malware payload (SilentBuilder)", "value": "f716511ae60973f090eb009ee738e960676151cd", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660809, "uuid": "70874001-0db2-4305-bde8-4ad6c39d2158", "comment": "Malware payload (SilentBuilder)", "value": "05c09357abc487016c4dda18aed2c2cfba317b3c5249b6c681715f9e8214ae8091686f63931808a996090ac849b391ca", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660809, "uuid": "06b043e1-5f3a-4fc5-812f-a34f40558756", "value": "T1F8E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660809, "uuid": "aed45d41-33a7-461e-a46e-7a52f5806e30", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660809, "uuid": "1f5c0735-333a-41f7-8424-008d3695ef86", "value": 145741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660809, "uuid": "d5ca2326-1b42-4a3a-bbf9-7aa37876c569", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660809, "uuid": "ca08c0c4-3b0a-4e1e-a234-9bfafa502a25", "value": "8e1c2ca3544dee4b1efd2341d5878bae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ffc84e25-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642675063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675063, "uuid": "665518e7-6446-4ed2-8fc7-d5b5c35e1277", "comment": "Malware payload (Mirai)", "value": "aec3960d5c303ba60dd4b6061070c88f", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675063, "uuid": "2f3ab347-e4f8-40c0-ac58-7c915ef4c1ff", "comment": "Malware payload (Mirai)", "value": "9cb5c190421d175046ae52a90807025cddd39cc8a0747c47d338744f094e8a18", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675063, "uuid": "148e9921-d9e3-4c17-854e-830e6d08427b", "comment": "Malware payload (Mirai)", "value": "b3685a84572db4d97604f49b255001cf0f97c87c", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675063, "uuid": "67212332-7fae-42b9-82f2-506717f17922", "comment": "Malware payload (Mirai)", "value": "57dd575df46cf7fa0c5e9a502b1d8f84521b5ea5282bcb66720fba2b029c0be876268b9cd80a96f06ff5b1b423653958", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675063, "uuid": "ec7f1e40-88a6-4598-a334-77f933c3bb23", "value": "T1A6E2F1205287E8F1EF2018756F7E908A2F464FBD90BF70BF12752198A6C196C39EB516", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675063, "uuid": "31c3a89d-c6ad-478e-a5db-71005dc7475f", "value": "768:RHBll0jxWibuq25vYqSqQy0InrWmqeJn9q3UELBb:RHBll08ibavYqSqQy0CrW9BLh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675063, "uuid": "31f9bfde-420d-484b-8f5e-f171523a48a1", "value": 33596, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675063, "uuid": "9a861ad1-b2df-4206-bb80-7630c8974a45", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675063, "uuid": "009dccfb-c701-4903-b2cd-c4e56eb75fd6", "value": "Tsunami.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bd6d6dc0-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666791, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666791, "uuid": "5e572738-0522-4d33-b0ad-913ffaa3dc4b", "comment": "Malware payload", "value": "11d36c3b57d63ed9e2e91495dcda3655", "object_relation": "md5", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666791, "uuid": "6d932e24-f912-4eb8-93ba-424bcb01c777", "comment": "Malware payload", "value": "9e3b04b2717ac796c71eea419b6d50531cb24a9e2a4bd63c6c6d9d044488828f", "object_relation": "sha256", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666791, "uuid": "67d514e0-b2cf-4c32-a852-efd7eccd54f7", "comment": "Malware payload", "value": "e18b5eac24741747203349c9a11529c8a07e9695", "object_relation": "sha1", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666791, "uuid": "d8b0afb9-eab2-4ac9-88dc-08aa478f3b64", "comment": "Malware payload", "value": "63721a0525e255644861d0be4f931d5a49b767436de03c1ed7f75a746ff70c27a74f26ed45ed348b5145a93447a11a93", "object_relation": "sha3-384", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666791, "uuid": "9ffcc713-7a9d-49ae-b67b-4ccf63e3c794", "value": "T1350523AEA9286C99C74AECB0AC21D6AD90174CADD0FB9D5733206DC24E34471FF65EC4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666791, "uuid": "16138790-565c-4eaf-8596-46b71f7cd379", "value": "12288:XV8pXYRoB5mBZ4/RIY4+vXAja//dMeE3jhFmPomK+qkSWY6Pv6/Zqxs2p38pgTuG:XV8pIE8pdAGeE3jhEoPWPCsfkHNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666791, "uuid": "daa0cfd0-00c4-4f6d-b260-46153874a4d7", "value": 796648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666791, "uuid": "29b4668a-6b76-42d0-8df2-a6509224bf08", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666791, "uuid": "2d4f75f3-827a-4a25-a1b3-50450791c743", "value": "Tai_lieu.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6322a11-7a1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642701675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701675, "uuid": "dcb06e54-4231-4bec-b284-9cd4d68d2783", "comment": "Malware payload (Heodo)", "value": "86fcae916c58fad7d1064138711922f7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701675, "uuid": "bea2ed5b-9896-4731-a42a-bfd2413f9601", "comment": "Malware payload (Heodo)", "value": "9e576586f53c4032e18f3144b601193db9daf41ffa39e6ef5d0e63abb44a4796", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701675, "uuid": "47669b71-2dc8-41ec-ae92-1b2df18a9156", "comment": "Malware payload (Heodo)", "value": "25ea81c1b4831eb27b6d0c547883b28f51c46fca", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701675, "uuid": "97e3baad-b37c-4a10-877c-c4e826e0fa45", "comment": "Malware payload (Heodo)", "value": "65aafff3b011c3ffc4fe99de0d63398c677e22443903613fe671f1fc72890eee599484cf27ea14d6c7566ed0462ca85e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701675, "uuid": "cf931fe4-872d-4860-b5f3-d0bd0fdd4eec", "value": "T165C4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701675, "uuid": "0e795d1e-2e8e-42af-85b4-4bdd81e1d0e4", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701675, "uuid": "95245826-fede-4baa-96bd-58417634ad57", "value": "12288:P78OGF+L8/4UUNyrxdMhTq/n4vAzdkPs7:D8Ody4axdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642701675, "uuid": "5985f2b2-010f-4152-9d87-029b9473147b", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642701675, "uuid": "8e3ef6a4-d216-4b3a-8510-df65352020f2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701675, "uuid": "96f2dbee-1cbb-43bb-98cb-5cb630feed02", "value": "86fcae916c58fad7d1064138711922f7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97436c45-79c1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642663291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663291, "uuid": "4fd666b6-cfb7-4a03-bb13-8f83999a4f7a", "comment": "Malware payload", "value": "023a858bd0fe922a7275653206ea2d17", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663291, "uuid": "897267af-c1db-4783-bf48-f6cdbbdf1336", "comment": "Malware payload", "value": "9ea7ee5a3fe25fdac68eedbd2e2456bfe781299dbace57c9565c02a22872fe56", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663291, "uuid": "e46cfa5f-f82d-4c22-bd2c-5ae79f45ec68", "comment": "Malware payload", "value": "2de90c8e719074b35505e85737533d66b8814f8a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663291, "uuid": "44f5a278-6183-4029-adff-1994489b2ee3", "comment": "Malware payload", "value": "1394b9fa9b101b8b09570875270b502fb14cdd685089e1700f76bdd0e20fef9f2ec03a98ba7aeaf61dee21ab3f768076", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663291, "uuid": "c8e7b2b3-70cc-4a8c-802b-60d5f25de47a", "value": "T10954D09D765072CFC89BC8B29EA86CA4FA50347B571B8213906311EEEE4C49BDF154F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663291, "uuid": "65b2a082-7b91-4661-a716-13ffbd6d42ad", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663291, "uuid": "cc352402-da1e-46d5-b443-3b261474b826", "value": "6144:mdFgbc0nB1y9lkrKiGk36gPhqpmPaVkrno9Tx3+ufqhN09yezNooSCbSF4QyQQHb:mcc0B1sEKiGkKfpgaVkz4PfpyONooWFE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663291, "uuid": "7fe2e0d2-ed1b-40b5-82aa-a8fc8f012475", "value": 305664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663291, "uuid": "cd6a9184-92ca-476d-8088-74cee0971aa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663291, "uuid": "3291c3fc-394b-41f9-9f5f-ffe896c9b16c", "value": "netcore.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77f52957-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665815, "uuid": "77566212-16f7-4dd4-94f6-fadf9ec5cdc5", "comment": "Malware payload", "value": "79780adebaf24d1c11008ab74a7346f2", "object_relation": "md5", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665815, "uuid": "64486333-5418-44c4-9492-b8bda6a84221", "comment": "Malware payload", "value": "9eec4df8d7cecdfaa1102ebe9565c642f56834f5a67d91ed89b138bdfb4da7d3", "object_relation": "sha256", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665815, "uuid": "a653f7ab-325b-4550-9376-db36cbfd02b4", "comment": "Malware payload", "value": "af8882a8592ce18d993933f0f940df0e555f594f", "object_relation": "sha1", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665815, "uuid": "50746132-88c1-4176-89fe-78759033d080", "comment": "Malware payload", "value": "9c059d62364a053df71200b9096ba051069bf379c2b90292408d16e7c6fa3324bdddfda7ae52d6763c953109e00491a1", "object_relation": "sha3-384", "Tag": [ { "name": "pptx", "colour": "#E00C54", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665815, "uuid": "d937de50-e02b-4377-878c-01c836eb9a1b", "value": "T1C095232291422F4BD7A2FFF58C1A0DE1A7D354833C618B1F974DB0AC9F6AC19271A587", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665815, "uuid": "eaf5bca7-5bd9-4bad-af85-883df45e5e3c", "value": "24576:wHuFVZrVe9tYfU4EFmCbCv5x4xB/Iex5F0dP9oY6gjHrKsdpvMZ2y2aaCLK50WgU:+uTZ5VAZbSb4xB/Nx5qdKQG2EPHQxHB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665815, "uuid": "b0c79337-6496-4770-b7b6-fd3652d3f00d", "value": 2057726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665815, "uuid": "bf46ff4e-b403-4a86-a11c-df49c4f493ad", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665815, "uuid": "c446d8eb-fede-4b15-9abd-3db79dd46d43", "value": "220118_Petrochemical update.pptx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e6470e7-79c2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642663598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663598, "uuid": "4c937dd8-e2b8-4fdf-aae1-52a58913ed2a", "comment": "Malware payload (AgentTesla)", "value": "5e5e4ec59e76997893ebe7fb1abf5d2f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663598, "uuid": "cf283424-0fda-4956-9674-a5e0cb19cb49", "comment": "Malware payload (AgentTesla)", "value": "9ef018a18c99fc4a49c745386f6d25dcef449a26b2fe8a56eaacc418843f7f44", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663598, "uuid": "d0aeaed0-7e9a-4c7a-bf0a-381ccd592b5c", "comment": "Malware payload (AgentTesla)", "value": "8b9e4cb0dbe90009f3d37192facab6a1e5e96532", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663598, "uuid": "e661a0fe-59d1-4b27-886d-85c000424c01", "comment": "Malware payload (AgentTesla)", "value": "016bbd5d52525166c1d88ce8f6fb584b2f5d2b34af8b2995e5d28e7bfd8fd2abf451e6ed4bc214d493f66678dc016fa7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663598, "uuid": "caa35d84-28b6-4e8a-b2d4-5836c53e2158", "value": "T1BA940214B7F513AACBAF87F5A165411067763A9B2522E35D1CC9B0DE0876FC28602F3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663598, "uuid": "fed459b8-24bb-49a8-bda5-d5667e3a03dd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663598, "uuid": "4ffa2b32-08e1-4318-acc9-f496766362b1", "value": "12288:pz+3kKchjxjrGEdl4iTITh5aWA9f6tFAY:5PKc1xjrdD4iETD5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663598, "uuid": "28d8b770-9c19-4be9-8a42-f78ec783fa26", "value": 446976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663598, "uuid": "fd5f3699-e0df-4567-a688-192eae7a06b6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663598, "uuid": "888eb5fe-43fd-4dd9-ad26-3a32e16ebb23", "value": "Consignment Details PL_BL Draft.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7bdad34-79d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642672419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672419, "uuid": "5324174c-f09b-4006-8afe-4c40a47028f2", "comment": "Malware payload (Mirai)", "value": "b4fd7a061be6045414b15e2ddcc180e2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672419, "uuid": "14bc1a9c-6a54-4807-b361-1a844bd451c7", "comment": "Malware payload (Mirai)", "value": "9f64c15a091a64f34c347c7fe1ada034690ad5ac72d449a4c657337f9343ee86", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672419, "uuid": "12c87a5f-5268-46af-b402-2abae9957131", "comment": "Malware payload (Mirai)", "value": "15d3e1d13e120611c37e82f9f5d6cfef5d44a8cd", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672419, "uuid": "c9baf452-9014-4dcf-a0c0-edae56193304", "comment": "Malware payload (Mirai)", "value": "1be21770dd1a20eaa29b20c90c6ba3b83defa8ae56b29bcb19ffe32fe8a30e3d771b996aba8c4caab3c0776dd3d7122f", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672419, "uuid": "7ad10b9f-73df-4285-8e76-a36ea9317f17", "value": "T13F546037E70546A2E15D48F1346733E4AED943BB9C2616C3E51A49A4FF3282B01F6EE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672419, "uuid": "bf87cda7-59e0-4180-aec2-4a53ed0bf3e0", "value": "6144:XszYXsZEkTwMXdZCSpn0UpQKqUgAZ08kjUx86Zmm/QcuLmHniPNb:Foyjs86Zmm/QcuLmHniPNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672419, "uuid": "b0d82601-672c-4879-a027-ea028aedf9e5", "value": 300818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672419, "uuid": "3f649907-2dce-446c-8775-a83a44733740", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672419, "uuid": "b6fb891d-08c1-49a7-826b-61cd935bbee8", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6186270c-79d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642672650, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672650, "uuid": "db2222e5-2b82-4ac3-bca9-ce914d98063e", "comment": "Malware payload (Gafgyt)", "value": "93b03d15666755b5fdb1f28128dead69", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672650, "uuid": "bae83805-a3e8-4dae-94c3-172d9239f76f", "comment": "Malware payload (Gafgyt)", "value": "9fbea04b96a1fcaa248a1411566885373f34ea996f9032976f01fd78006663a3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672650, "uuid": "88e3981f-abc6-4153-8943-1552be635b7a", "comment": "Malware payload (Gafgyt)", "value": "e3d36255991f1dfa236148e3dccdde6ae18a7b15", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672650, "uuid": "da30c2df-ecc7-486f-b596-f9fbfaeaded7", "comment": "Malware payload (Gafgyt)", "value": "25e4c27c153c07ccaf800af62b068579a19c20e9c0bbd9f1062d5e6e401eb1b20101f0e4c56936fb505dd5be12c2f3a9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672650, "uuid": "e97ea67a-3864-40c7-a4fc-7f4bcb7a4dd7", "value": "T1FF231A02A686C6B7D4832BF606E79B210132F97D1F178F85E32DBCF48B625887227755", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672650, "uuid": "8ff46105-2823-423f-836a-d0b0a8622160", "value": "768:bRxm/aDxX7Wq3X5RJrdNW3Jq/BgxSh//Id8Np/EIBkMq0uwcS:tUS9X7PnDA3JquK//IWp/E/DScS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672650, "uuid": "8d35a26b-f2ec-45bc-b323-cf5cff91ace6", "value": 48012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672650, "uuid": "f0b3554b-52ad-4bbe-a70a-698f7afcbd47", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672650, "uuid": "05fe283d-8071-45cb-829a-010c22e8c1dd", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70b35ae7-79e4-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642678259, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642678259, "uuid": "35b4a589-df9a-466e-846c-c515a1ae0630", "comment": "Malware payload (AveMariaRAT)", "value": "64cffa1f04add64bacabba501831bd2f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642678259, "uuid": "a32b9a8b-2364-4f6a-907a-c760230ecf1d", "comment": "Malware payload (AveMariaRAT)", "value": "9fcaf1a573e825956bfcb9eb8dbbf4cc744c73083b65f5cf807fe0f0bf1047de", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642678259, "uuid": "acaecd98-4892-422b-8190-4a9fa76046ad", "comment": "Malware payload (AveMariaRAT)", "value": "84afa4a4b5f677feefcf9480292fb52cd1ed0144", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642678259, "uuid": "5fe5d16f-a18f-46b2-b38e-39140a4f6ff1", "comment": "Malware payload (AveMariaRAT)", "value": "c6f747228ad5ac00ef63f36e37b8b396f4d07627c3efaa9b33d2023a67b6d54659f7f1b59a691500be4390acfb476bf9", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642678259, "uuid": "32fa8cea-fa16-4195-8f7b-f893e5c940c9", "value": "T152143626DAF7DE70CA53097BB53DFA130E1E2E7D1DA4F8492818F920EE77AC48844651", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642678259, "uuid": "4983596b-4a22-476c-a89f-8568b169278e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642678259, "uuid": "d470e7bf-e76e-4abc-b385-67e648b61f6e", "value": "768:oZvg/Rb/GIh1Qul0nPqGXcbutkWaYYtSHPWcZhVm13jHJXtVqoST/p80yX6moPCp:oZo5bbhtGqGsbutCG/p80yX6moP3j05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642678259, "uuid": "fd3bd3dd-cb2e-4a04-894d-1d4e8a32bf52", "value": 190464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642678259, "uuid": "428f3864-4e5b-45c9-82a3-f9d94f9790e3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642678259, "uuid": "43f54d87-239e-4d95-b5f3-6cf6567758f4", "value": "303770598415doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f04ea6-7a2e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642709866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709866, "uuid": "ed15a7a4-58fc-4faa-85ae-be24bfb06c2f", "comment": "Malware payload", "value": "63dcf75ad743b292e4a6cd067ffc2c18", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709866, "uuid": "8b0e35c4-530c-46e3-9853-6ee6dd032cc8", "comment": "Malware payload", "value": "9feed0c7fa8c1d32390e1c168051267df61f11b048ec62aa5b8e66f60e8083af", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709866, "uuid": "0706d964-788d-45e0-ab36-d163e05a19ea", "comment": "Malware payload", "value": "0d68ea228f49fdd8d044a2fb0dae9174eba73d7a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709866, "uuid": "4177840c-43b9-400e-af6c-43c56e9be2fb", "comment": "Malware payload", "value": "dc917208765a68bf9bc4d878e727c20c0cae54db6109fdffe40b85cb8dc100f3875411834a6655850515c89bf07f8c8d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "lockbit", "colour": "#8CA32F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709866, "uuid": "12901de8-f972-4d3d-9678-28d13012a316", "value": "T10C253A0593018F96C813207951FE8DB3A877073192BF1CE6A78466DC83B2FA5776B366", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709866, "uuid": "935e691f-d2e6-44ff-8c58-655b2c9cab0c", "value": "216df81b1ef7bc2aa8ec52bbeef137c9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709866, "uuid": "5f132fcf-7212-4a8d-901e-647793c3a495", "value": "24576:uLjr3s2nScu1i1tz3f++5kRzFxk7rMxNeR1R9qpdPF:Ujrc2So1Ff+B3k7965", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642709866, "uuid": "3e9f2765-5e0d-4bc0-8bcb-439244f511c5", "value": 982528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642709866, "uuid": "4659d496-1980-44c6-8d8b-87aab4fd44ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709866, "uuid": "2a3403ad-0840-4224-8066-78c993145603", "value": "LockBit_2ED873D43FE5DD38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6bd05e0-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642676766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676766, "uuid": "3be43da5-824d-433a-9498-740cc7a606fd", "comment": "Malware payload (Loki)", "value": "9dde2f9d6e034b01e5fddd6e343e5a1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676766, "uuid": "e9c71ed9-8e9b-4948-ab19-c4275b8e279e", "comment": "Malware payload (Loki)", "value": "a0db5c96a78bf0f1785819cad807caa178dc01cdcf0481d0fd704fb911910363", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676766, "uuid": "7f47327b-8158-4a08-9fe8-7446f3b938fc", "comment": "Malware payload (Loki)", "value": "54e4cb0e54bfa455a0e370d3c3a6b0de1b908682", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676766, "uuid": "d7b6fb4d-57f3-463d-a2c0-b425a4ae3b3a", "comment": "Malware payload (Loki)", "value": "b5632aa3060fd10ff57df5a4339c3f544821a8eecc112135f634af34eb090032c674b5761e0c20ff2414422173258839", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676766, "uuid": "86be7dd5-c018-4c1b-b118-fef441638225", "value": "T1ECA401257498C8A7DBE935740F42CAB84379EE0D2E41454B67F4BF9F39FD2AB9818081", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676766, "uuid": "b30650ca-2a04-459c-b699-6352c2a62893", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676766, "uuid": "9f1b3727-3bbf-4603-97e2-4739a751667d", "value": "6144:twMmssvDVi+RRuoY7rwLoQstYc1OnluQakKrd8BgCIvTvdqYRV:3g7uoYvJQAYIPkKriiCIvXRV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676766, "uuid": "daeaf7e7-73ae-4ad4-a39e-cc1f6645041d", "value": 449684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676766, "uuid": "ecf4d722-f637-4354-beb8-b12fae5b9db1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676766, "uuid": "786de820-ad28-436d-9860-8ad216363cb5", "value": "New PO# PO4622010221.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54ae5dad-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660602, "uuid": "cd7cd34b-2891-45cc-9771-db0c0e1ebb3b", "comment": "Malware payload (RedLineStealer)", "value": "5f0cb450065cca08cddb140a6e2f909a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660602, "uuid": "ba86b7ca-a6ba-46a5-affc-51c74fab061f", "comment": "Malware payload (RedLineStealer)", "value": "a0e3df170ddc6f7fe8298743e0c158175b84c4605650361c51debe34a26a35fa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660602, "uuid": "311ea6d1-2306-4cd3-9736-b9e83560e0dd", "comment": "Malware payload (RedLineStealer)", "value": "1b6029ee14ab1e4e394256e29258d4ba3408e800", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660602, "uuid": "994141c1-f179-4a99-802a-cea9404e0919", "comment": "Malware payload (RedLineStealer)", "value": "e8484cbd715edf022e956fba2c49588d100fde9c7e03de7482ba213a0186929ebe89ec864fa6cca198ccafb40ad9eb3c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660602, "uuid": "d0d4a206-cc30-4220-877f-457242a96dd6", "value": "T1A284E0217580C7F2C4865A30B82ACFA059BDBC7C58A4518733A93B6EAE7D3D1523635F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660602, "uuid": "9008e75f-f32f-4fe9-83c7-9f52d1ceca8e", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660602, "uuid": "38372ee5-a718-4296-8456-84f9451d7834", "value": "6144:PARLZp2ouMxP1/lVLi51vrSJV63N7VXMzJcc+XRB:Yz2ouM/Li51zxNxXOJN2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660602, "uuid": "18868ddf-b0ca-45d3-bb0e-3822c31bb398", "value": 406016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660602, "uuid": "21de60e4-3328-44a6-adc1-c113ceed46ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660602, "uuid": "3f263580-5366-4af2-a3ed-65d98c013a66", "value": "5f0cb450065cca08cddb140a6e2f909a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8996706-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1642676634, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676634, "uuid": "39b00b35-69ce-478d-987e-bf041c4a1613", "comment": "Malware payload (Gozi)", "value": "11f5556bd5aa4dc72e367bd024d7b8c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676634, "uuid": "a8e23d1e-d2a4-4a34-86d0-6a76ea6aaf38", "comment": "Malware payload (Gozi)", "value": "a11f6525353f77e4e7a1a25c8884d7ce592f4078d920b21ea012203250e9fe7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676634, "uuid": "d92b4edc-2bc3-49dd-9865-359719d2ed2c", "comment": "Malware payload (Gozi)", "value": "7c5cd9aa98c3dd74473687b57cd969acc1d47ce3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676634, "uuid": "00be4e0d-9fba-4fc3-9468-be44a1ae9086", "comment": "Malware payload (Gozi)", "value": "285d0f3cc6c483bbce527f958ef3fd16a561f0c803692eee04bf90fbf6590d0af385dae4d11252935f203ec0e640002f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676634, "uuid": "a10dff8a-7fdc-424f-9f93-102220e045ce", "value": "T12C245AAAA7E40595EC6BC6B5CE53D61BE7F274092B14D30F0370CAA66F17722B21C352", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676634, "uuid": "aee1e9c0-e3d5-414b-8668-3c89cb4bcdf1", "value": "6144:/HExb7VwvtKNbnvSxYNiyf+D3Luiy56H:cxb5wvtKRvSxY0G+D7uij", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676634, "uuid": "130f0657-a50f-4223-97a5-88ff1dd0c3cc", "value": 227840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676634, "uuid": "f0c74321-2440-4f4c-8899-65519c90569e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676634, "uuid": "88f0b0b4-5bfb-4ebe-a540-86419d5678f5", "value": "20c61b30000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9615ec97-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1642660712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660712, "uuid": "93bd3227-3899-47cd-8995-ddbd885dbc8b", "comment": "Malware payload (BazaLoader)", "value": "67f4fd489993694bb055692c0f8bd889", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660712, "uuid": "0c314d57-fc86-4c0f-8326-8353548941ec", "comment": "Malware payload (BazaLoader)", "value": "a19a61482e4b0b342546fdc14c13f206569e47b6c6ae310136cfd54bdc5b32d8", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660712, "uuid": "98362c7e-4f58-4845-b3c8-1aeb1139796f", "comment": "Malware payload (BazaLoader)", "value": "1bc68381f7bad8d3074c2b9c4fe2c82d39bf884f", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660712, "uuid": "a45e4f26-0a06-458f-b96f-7e3ce1f4b365", "comment": "Malware payload (BazaLoader)", "value": "202cdad09c472aa1864f4382192f71d5577afdb6c4e67b9fdaabbcf6b3acaa7920d70b034b92146ab5bf21f789172005", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660712, "uuid": "3dfab265-64b1-4487-b50d-3d1e0f5e5aba", "value": "T19B85FE43180C819F9867D77421671D97EEB87E47F2C84E1ED1E428B84AEBDA674CA04F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660712, "uuid": "31b82dfc-2c31-4c5a-a18d-4be1683b0cbe", "value": "f30f2b5b65c947eccbf132b668fe3257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660712, "uuid": "3b41dfce-7209-44d5-8c2d-4f19bf8a45eb", "value": "24576:Sa1QHwgJMrQqj/wAc6QORNx2nAjwka5m0GV9igWwlnwXQBwfalj21X4GtZ+FdnZ8:9H5qloBMd8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660712, "uuid": "0f6ec91d-176b-4024-9619-32e7b8d86e38", "value": 1816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660712, "uuid": "f32a1f89-5f6f-49f7-89fd-91805953d12c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660712, "uuid": "39f6d0c2-ab35-485c-b3f8-542c5c6c315b", "value": "67f4fd489993694bb055692c0f8bd889", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba4af2cd-79d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642673228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673228, "uuid": "1d7a4a3e-2a45-4787-a250-3554a5a65023", "comment": "Malware payload (Heodo)", "value": "93de92f3e2868b196ea53446264d69e9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673228, "uuid": "b3df1f87-4e9d-440d-8112-13632f6e75d3", "comment": "Malware payload (Heodo)", "value": "a1d4e9c497ec94e9c1182741b7096c47396c0057014747c17e618e82538eae72", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673228, "uuid": "d0cf96dc-3fb4-47b9-adcc-270326bf08ab", "comment": "Malware payload (Heodo)", "value": "5a222d7fc81852ec5fb1ca0abca5fb7810e97299", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673228, "uuid": "bd329ec9-0b25-4a9c-a0ab-215688dccfee", "comment": "Malware payload (Heodo)", "value": "6b8dc571ac319af3f3e405abfde13ddd07022f2886b8d3d173f288df87b5301b2d73cf51f4678157078055d0dabd9953", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673228, "uuid": "5501fdce-645b-4445-843e-195a9abc1b67", "value": "T181E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673228, "uuid": "aa1d26ba-7eaf-460e-9e32-2cde76b891d8", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642673228, "uuid": "7e8bee98-cdfc-4769-97fd-4cc0b6814904", "value": 145744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642673228, "uuid": "4e3d6a99-a5fc-41db-abca-4101914ecd8a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673228, "uuid": "293f6bfa-7016-464f-8921-cfdbaf1ef505", "value": "93de92f3e2868b196ea53446264d69e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5d9258-7a25-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642706140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706140, "uuid": "30cf7dde-23cb-4070-881f-5cd1067e8148", "comment": "Malware payload (Heodo)", "value": "dbec7c9243ac15b3a8a655df66c73b36", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706140, "uuid": "083774cb-e2e1-40ce-9499-5747f4c3aca4", "comment": "Malware payload (Heodo)", "value": "a2f32b5bfd78eeee7b3d4d44b4da8c8aeb98ab866a7998e2adaabc80cd1247a4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706140, "uuid": "5e4ce08f-4d04-4ca0-88c3-1254ea93cf39", "comment": "Malware payload (Heodo)", "value": "bc2363c0f1aeb0167b933b99ccfc2d26e24a795f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706140, "uuid": "c15f1f45-bbcc-4324-9666-f14519e1bf97", "comment": "Malware payload (Heodo)", "value": "6ceaa17ec9ce489564a9105fc4bfea412ed957bc466bc20aa812d5f4c5beb8aaedb62db5b7054f5b3452b1094a8ad9a1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706140, "uuid": "e3daf427-3881-43f8-9afe-f8fdb7980e9b", "value": "T19AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706140, "uuid": "3d535015-a118-47f2-9358-ed7d631facff", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642706140, "uuid": "a8b66653-b0d8-4b00-a570-c742ec74dc17", "value": 146087, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642706140, "uuid": "ff84fbfe-aaaa-43b1-850b-4494745c7f7d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706140, "uuid": "11c50e66-c3f0-4ab9-9741-9228db0a90f1", "value": "dbec7c9243ac15b3a8a655df66c73b36", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c87d35c5-7a0f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642696874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696874, "uuid": "992f6cb7-6119-4189-95be-fcc0fbafb682", "comment": "Malware payload (Heodo)", "value": "4e3c63eab98759ab8d749ccb75a8ff70", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696874, "uuid": "78ba834f-8c26-4648-b6d1-4de28a5f0d72", "comment": "Malware payload (Heodo)", "value": "a3182153bbc02b08e54fa468a6a470ede9822cc612dfd6c8f523b9cb5cd4984e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696874, "uuid": "13d9d5c9-6cf1-4ea6-97b9-2d47b0dfa1c0", "comment": "Malware payload (Heodo)", "value": "3a3b2442d81c2c332880df2319b471b63cd1eb7d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696874, "uuid": "82f8e552-e3cd-493f-a10d-0105c341d4c5", "comment": "Malware payload (Heodo)", "value": "1ba979ad202183424e55bb51cea0806b17670ae650f63488bc8d37e1f52ec812564584c5af1cdfeec03f2073bfc9cef3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696874, "uuid": "6e35d1ce-316c-47f3-ac05-38e01bb3b0fd", "value": "T1ADE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696874, "uuid": "c6f4c517-f749-408f-ae96-0ad75f84976f", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642696874, "uuid": "35f3dc46-0d08-4848-a5fc-1fc8c637f7d8", "value": 146201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642696874, "uuid": "d02374f3-92f6-43ea-8fb6-b0a1c1a89b4b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696874, "uuid": "018af53d-677f-4892-85a2-5346d4a874e0", "value": "320456275149848051.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3647df73-79c6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642665276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665276, "uuid": "4e5e2cd2-0110-4bec-98f2-137816471640", "comment": "Malware payload (SnakeKeylogger)", "value": "312da4b25366e5ac3dfe63d68784883f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665276, "uuid": "5fdde74a-aae0-4aab-bd0b-4070d9b49a01", "comment": "Malware payload (SnakeKeylogger)", "value": "a3860764f701ecdc7eb4b23613b4283f138628c4e34df53755cbeea0bea1e49b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665276, "uuid": "3bdeb8f2-070c-472c-8e6d-238bfb2f269f", "comment": "Malware payload (SnakeKeylogger)", "value": "9918fd0a286ae16853ad15f08ea211a7feba12a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665276, "uuid": "a16e3741-be7c-4605-9570-1689033efc42", "comment": "Malware payload (SnakeKeylogger)", "value": "1ee3d89b4cb76ee7de59dc801de7eaf340b356a5d21466f4109a409ce5784c8297ac062c8bfb5fefe60d6714ba804790", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665276, "uuid": "1a62b419-936a-42eb-94aa-efe29728ba92", "value": "T139B457AE30C1B75CD6C4D6B3FC39C5F3E2A4E8427A44C1C6EE673656A6ED1C9811C981", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665276, "uuid": "d15f35e3-a616-4840-b1f1-65bf561871b6", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665276, "uuid": "08bd9541-7b2d-442a-967a-a670f444cdf4", "value": "6144:xwJ2QdecpQ3Q4FiK7996D+fcitH6wCBSP6U+R7XKAxnbx:02fyQ3Z3EAcitHkBSP67Pnbx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665276, "uuid": "a03a2b67-594e-425c-b868-853a2408b529", "value": 500897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665276, "uuid": "e365b699-4123-4543-b98b-d5e43af1f2d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665276, "uuid": "2cfda399-f06b-4a34-b583-9b1fedf3ff8e", "value": "4987654345678987654345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09a7f9b5-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666060, "uuid": "0806a2b9-e339-47b2-b9cc-b5a75e7544b7", "comment": "Malware payload", "value": "ae1d8dff73dfeab8c6f4e415df0fb70c", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666060, "uuid": "2839ce7e-c2e8-4781-94fd-251d73cf442f", "comment": "Malware payload", "value": "a3937eb4681dc2a090360d9220c42ca25b51075542902a647839fe5f3c892097", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666060, "uuid": "faad702c-32a6-4fe3-bc61-3f0de5ae0f6b", "comment": "Malware payload", "value": "dbf57d38bb7366fc6f86f3d571f5aeae11ce9af1", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666060, "uuid": "414990a9-ed96-427b-8c9f-0804ea90a76b", "comment": "Malware payload", "value": "9132fa82c5f13b294bfe9df784e6e68bb4eebaa0672c3cc3d4db3ab40caa90d8bee8a3067b06b8c35e5c1367927f3a0f", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666060, "uuid": "54fad2a8-4479-4fb4-bd65-93f5abc3b35f", "value": "T176C10068718074A04783CF963B1B74C9F27B68D279D8040BD621FD90787A67EF592973", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666060, "uuid": "99f923ba-548b-4b95-bfa5-5e40ff816fa8", "value": "96:bKhaSvbsDn0Hu9Q8gaekuZVKgbZVkYf0+3TbdZqGiIPKDyLhHDzWSuqDO0EGcdyo:bKaSIz0H+KkurK2ZVkYf0+3TZZjiIPih", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666060, "uuid": "115ef017-be8d-43cf-84c1-d8d72b986511", "value": 5843, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666060, "uuid": "f46c9313-5f8b-4536-9d57-62ac8c6faa80", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666060, "uuid": "d31bdb80-862c-4f64-8dac-ba641a8e3221", "value": "Payment's Copy.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c88d646a-79c0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642662944, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662944, "uuid": "5bef6e6f-2f58-4734-ace9-64a658accf90", "comment": "Malware payload", "value": "934c7b7c31d84728f0086be9b80ee1e4", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662944, "uuid": "158cf49d-c710-4a5b-9d50-369eb277eafe", "comment": "Malware payload", "value": "a3a1968fefab3c9d11976f8c00a9f726e0729f8e21761247f41790b4669bfde8", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662944, "uuid": "1cd1829f-a132-43e8-8361-5c7f56c41021", "comment": "Malware payload", "value": "18e4203dab96fefd1b2c0c7e653b354fb3d27add", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662944, "uuid": "4df808ed-8b86-4122-b23d-35247a30c008", "comment": "Malware payload", "value": "2a0cfcef27c0f360ac28263a07c7c056590b2d493506208a6b6ef2b78d043890a3b11f7a89bf179365110c79d3309fa5", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662944, "uuid": "9fa436f9-01b9-456b-a778-80f9e9a2a375", "value": "T135D533E6FD1CF65BCCF10F72904CA6264B6188EA84D0EA0C6FDE9F1D96919551BCC08E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662944, "uuid": "17198968-ecf9-4118-8a97-9f0a7d3a61fb", "value": "49152:O9fiEFysXXWSe6Yo2NaCZnB5Lusrhp1thr77XC6pQPh8Y0aT:OJfEsnVwoAD5LHrTNrvCdTR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642662944, "uuid": "49381c87-b58e-4450-b4a8-cf6baf3cbc95", "value": 2965214, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642662944, "uuid": "9a22bf31-72e3-4f92-bc69-a2456c366428", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662944, "uuid": "73c21bc7-990b-4740-aa30-9d16f4149e91", "value": "JPMorgan Chase Blockchain Project Review.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71c9118b-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642660651, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660651, "uuid": "e72f5183-61d6-42f2-adee-185d2d71acd4", "comment": "Malware payload (Loki)", "value": "09832f2cab13dd341ca6e813bad19217", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660651, "uuid": "5aea394c-afb0-4b9a-bcb8-79890c684474", "comment": "Malware payload (Loki)", "value": "a3a38953581a2af596a1ec58069a91c688fcc7f02cdb9f8fc60ab3a10f63752d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660651, "uuid": "883803e8-0cc2-4840-a2e0-492e291e6e0e", "comment": "Malware payload (Loki)", "value": "8e130aec71a162b48529770e162346de718707c3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660651, "uuid": "051dd444-5b2c-4695-b30e-44c0d176f4ce", "comment": "Malware payload (Loki)", "value": "3623be029320a8f04058805c8666ad1df31bdd3d3bcd0c83bc331730efedae375c5aeed33b3d8aa4d9b94adad2f8a978", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660651, "uuid": "987f0388-8339-4109-b6e5-1c6e078b04ff", "value": "T1C684BF03B7DEDA21C2656A7288DF800183B4AF81A953E70E7DDC73BC192275F5A4539E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660651, "uuid": "fa8d07af-6b8b-4574-8936-598b754809c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660651, "uuid": "1a715dfe-f40d-42cf-8768-29290e08c570", "value": "6144:KgAKL3zOgmOuVnQh49LFF2agUAXhd7nIfe8wAJIFdwP76MtyMzdlhO8:T6gmOv4tqaR6dnIlBJIzwP7jhO8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660651, "uuid": "1d130986-2146-4927-87ad-7eb4c0a3ab8e", "value": 404480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660651, "uuid": "d395b446-851e-4289-aa44-e89da847e070", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660651, "uuid": "8cd49064-8047-4293-9d7e-ceed7d63ee6a", "value": "09832f2cab13dd341ca6e813bad19217", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "42656fc2-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708675, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708675, "uuid": "b26246c1-ee97-4128-bc66-f35b8629eb4b", "comment": "Malware payload", "value": "0eb2c4baf6bdbaf8dc015fd793eb57a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708675, "uuid": "08f031fb-b967-4e9b-b4c0-6e0247b143c5", "comment": "Malware payload", "value": "a3e00e65b36f432a08f2a7bf492671bd498f07df86c9cc6a9ad5f7170287ab4d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708675, "uuid": "7d9bb7ce-4d0b-4c66-b059-1b7a8040abfd", "comment": "Malware payload", "value": "0f3356dec4be3775d151f42b91ef910c16e3367d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708675, "uuid": "034eaa52-0f5e-4c2d-9579-6e511863a63a", "comment": "Malware payload", "value": "1620d7406b05cb41d8f4a24c71dfb87f28ec347ee2d9858a59b3b93537218f281761d3becce8e173b6b0a601e02c3ead", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708675, "uuid": "42f55083-2b81-44f4-907b-9b63e680b2ff", "value": "T19EE40131BFD21355C74EC7B889BDBC6083B9B5862954CB3E8D869DEA13387915720B23", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708675, "uuid": "a6bd2489-1f26-4cc9-93c0-11496ac2ddaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708675, "uuid": "2f3ad8e7-e138-42fc-9cd0-7b494b580838", "value": "6144:N0bG1YJ8zWTeD8ndCIgw8CIgw8CIgw8CIgwSVUBAl7/q8MXNwkoWdg5Wnw333GGl:IiiiE9WfXGd333Newfw4VMbxgRhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708675, "uuid": "541b2ed7-f035-4595-b300-09c98c624611", "value": 674816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708675, "uuid": "e23da5db-27be-4828-b685-bb32bbd860c4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708675, "uuid": "c6e85ef6-e896-4ee2-a92c-4d33c81214c5", "value": "0eb2c4baf6bdbaf8dc015fd793eb57a8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a22a96f-79bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642661417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661417, "uuid": "b6671eff-28fd-481c-8d28-0197353ed61b", "comment": "Malware payload (Heodo)", "value": "cbab1515e5fc97a5e5c856ec7c169474", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661417, "uuid": "a92e4236-ec94-47e0-8c90-124ec7c65119", "comment": "Malware payload (Heodo)", "value": "a422151f53794c32b8219eefafe92b5856544186c267596634b224f11a8fa25a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661417, "uuid": "ab3b0d5a-32c8-4d8a-bff9-db43af97053a", "comment": "Malware payload (Heodo)", "value": "540c80cfc8bb5e2c86b07d336c644cd6aa5d74ab", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661417, "uuid": "03466e2f-1d1d-43a5-92da-14893ba42cc7", "comment": "Malware payload (Heodo)", "value": "383c056da5a8048710027a2694626f3c15677355c9df77665198e98006c386904cb45b5e1be20647a6ddef65f91146e8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661417, "uuid": "78874f81-e72e-40ec-9687-7c19e7657b5a", "value": "T1D2C4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661417, "uuid": "480de3a8-a52b-4bd2-8f4e-c6c3191af470", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661417, "uuid": "f47d76af-8d8a-44e8-abc6-70a524b63921", "value": "12288:P78OGF+L8/4UUNyrudMhTq/n4vAzdkPs7:D8Ody4audbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661417, "uuid": "4c67824b-74e2-40ae-b5a4-73fc34dda056", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661417, "uuid": "1c8928e2-5731-4562-a926-958b5ffdb132", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661417, "uuid": "67296b23-d115-4815-a32a-bf5f7cc187b1", "value": "emotet_exe_e5_a422151f53794c32b8219eefafe92b5856544186c267596634b224f11a8fa25a_2022-01-20__065011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4221dc4-7a01-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642690908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690908, "uuid": "03628d2a-ecd8-4e8d-8fd4-93ecbe665cf2", "comment": "Malware payload (Loki)", "value": "6eaeb3b2575361e191ee34c0baacf7b7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690908, "uuid": "06a5f963-015d-45db-a265-4b6eb51e5f48", "comment": "Malware payload (Loki)", "value": "a42c56999d2837f01e3d1e04b7ce70fb17b1357a3ffb08d1e29eb09f8f8b0c05", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690908, "uuid": "7bdd98c6-b102-48f2-b945-95bb1efbb0d4", "comment": "Malware payload (Loki)", "value": "673bf4970b55bf5d4a89cc14b0a977ccebb53789", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690908, "uuid": "1ab42bc9-10a5-49c9-b1ea-8b365c83e1e7", "comment": "Malware payload (Loki)", "value": "5ee4fcb1920e67bcccce308fdd517eb653644968d5c21fe793ea0550f9ad0f3b6143eb1c0d20612cbba96ee14d46bd5f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690908, "uuid": "f8113499-42a9-41e6-83e6-70b409446488", "value": "T19C141863B9A8A00EF152BD75246EB785A9097DFF8651C83B7CC06F8D3533182E19472B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690908, "uuid": "cd2f023d-fd4f-4261-b2b2-f3b99f7b4b19", "value": "49b15580bd181e45d4d97bbfb270c139", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690908, "uuid": "49fc5270-327b-4007-a4e8-252ba1406bba", "value": "1536:KBAOecwwFEAOVk81EYsOuVke5GLu1bYIh9lnAFWYSCtjdlIw9Gji6p:SecwwTOVk8KYZwJGLu1fHAFWDMswiXp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642690908, "uuid": "13fa7740-faa1-4714-b6bc-77b45b5296fe", "value": 202432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642690908, "uuid": "bf3ea4df-5ed4-4f6a-918c-c0f9fcdcf90f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690908, "uuid": "ef230fa2-65e4-4474-8c91-14575e9cece3", "value": "overskri.com.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fd01b0d-7a0e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642696377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696377, "uuid": "7ffab275-d56e-4e99-81fd-2f489c267729", "comment": "Malware payload", "value": "7a6777cc34f256f2bd37c4e84fdf3e6d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696377, "uuid": "a83bf0de-5eb3-4b14-bdc3-db476b70ad95", "comment": "Malware payload", "value": "a4a7fc2397f1ce303de6bcd7d38f98aa0462e43f3007304b89701694ecc2c496", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696377, "uuid": "f5af80b5-f859-4c90-866b-bc609d1d4d57", "comment": "Malware payload", "value": "ab2bd482c6a0d0a37233a55e9d20d9bc5e78ac1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696377, "uuid": "0ed1e155-1707-4290-9f53-4dcf94655772", "comment": "Malware payload", "value": "ea20cf04e2e1d874493b567ccb820e16537a8c12f02db2bf54e0c261a01d4820e052536b432a1d93c90064f96e5baba2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696377, "uuid": "aa31cde1-b37b-4673-9c6f-db3addb66698", "value": "T16C63F801A702CA77E85316B803E7AB255631FDAB1A1B9E49E32CFDFC5B125C87117298", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696377, "uuid": "9cb96773-424d-4175-85d5-8f9dbe371889", "value": "1536:tjtqWz8pjRPypnZtr3SBR+mlSLJV0xH2Cnxx1:j4pjRPypZtrSRplsJV0xWCnxx1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642696377, "uuid": "bebc09a0-d89f-49e8-b9a3-8bd476432c61", "value": 67170, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642696377, "uuid": "39c8b329-c380-457a-82b1-81e3b6dfda8f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696377, "uuid": "e6a1fa58-a800-4825-bdff-70ca8c009920", "value": "7a6777cc34f256f2bd37c4e84fdf3e6d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a3c29902-79f6-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642686075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686075, "uuid": "e280b09c-2d32-499e-8f83-2dd0c5355665", "comment": "Malware payload (Loki)", "value": "2e99bf41a05731ab85b55f73130a327e", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686075, "uuid": "5e852885-7c6b-41b1-9c5a-8d6e9f81abfb", "comment": "Malware payload (Loki)", "value": "a4b4a0b19ab4e03991a69ce6fbeecaa8e4c19100a9d1924a51b8eb19788468a1", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686075, "uuid": "0c520dfb-c9a9-4042-9106-3a0eb3a06e60", "comment": "Malware payload (Loki)", "value": "35a70f83616bda0280176f60dffe05eb92f11cfb", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686075, "uuid": "6f945543-093b-4e4c-9b2a-48bba24ea200", "comment": "Malware payload (Loki)", "value": "0dd508714ba38a51c41971ac65b4210cde2db6fa39dc0db30a295679b35e092b00314996ddef53f5ccef88df9cb0f95a", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686075, "uuid": "ee72fe5b-0ec8-42e7-a3a4-aaa2268ff94f", "value": "T11E041257DD1AB8D5C472EC7DC82BD0C271591849A5A8CE1F1324B47E5B8ABEDFBB2800", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686075, "uuid": "17e88441-31d1-43f0-883f-127346b34998", "value": "3072:ETF1RDyEJf/nKbuifnoOuqXHhyLIbQvq1LKZYKKlYAMIsmRsIUhwdV3j3:ETTR/3srAOu+HwLIkP4/js2ZUhwTj3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642686075, "uuid": "35844278-bb83-4c2f-a033-132bdc5a5027", "value": 180419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642686075, "uuid": "c8cdf640-da3d-4140-86bc-4c3883dfb504", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686075, "uuid": "1e8ba006-715d-489d-8de5-16522ea6f3c7", "value": "5478_Print_USA.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5435ea7-79c0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642662939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662939, "uuid": "c7558526-dcd8-4c47-b557-ff8e69a46eb0", "comment": "Malware payload", "value": "f6b96b7f0dad624a60b02abe068de7bd", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662939, "uuid": "418ebb83-f432-4d79-8ea8-1cb663963705", "comment": "Malware payload", "value": "a5269f1758baea6638031e0b0f84839a1b0a4ab2db8661b8dc595bf91d850f67", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662939, "uuid": "8dbc2221-b5e9-4008-b525-f31efb8d1725", "comment": "Malware payload", "value": "45f6ffc0cd7142dcab3f87891274ab67ae61e063", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662939, "uuid": "9360d0eb-7b95-4dce-9e25-6b13bca3f617", "comment": "Malware payload", "value": "c9f37c54e807fd92f6804db41426f6449cf8824774dc4c144debc4078a8a3dee02c9bc9e205f5e99bb6d36a8d185fa75", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662939, "uuid": "83deb66c-5ed3-4448-929c-d0a075491954", "value": "T18C642320268041EDF0FD53797AA5D3D9AC36DB7787B2DE54E0642A6602474FFABF0422", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662939, "uuid": "537318d2-8111-46fe-871d-0296a402e77a", "value": "6144:FAjrAp7AGYdi7TOC2kfOYWXlZEh5yrLe2RqI03Ns3Lo+Xil:2rQ4OgYPyra2QJrQK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642662939, "uuid": "3375ceb2-3656-4e7c-9b18-ff584476850c", "value": 310370, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642662939, "uuid": "246ac4d3-d060-4b43-9453-629dbd6391e0", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662939, "uuid": "26530c54-b76f-42ae-9a4c-4793517cd4a9", "value": "Isakymas_V-2701.chm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5879f971-7a2a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708283, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708283, "uuid": "ca09d6c7-2bd7-42bf-8107-ff3970ea523d", "comment": "Malware payload", "value": "656ac5775ae49d223f5d1cdaef6f1223", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708283, "uuid": "9ab18130-4726-4c8c-9719-8fa48cb1432f", "comment": "Malware payload", "value": "a5434f3532d327c98dd46daa30717b384ee264b0c3d17bdaf3561bbdaf380116", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708283, "uuid": "cf5fd909-05e6-4035-bdd1-83a4776bff33", "comment": "Malware payload", "value": "1a06535154e5c4471dd69196e1d0a230478d5bf5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708283, "uuid": "1d95ea30-a866-449c-80bb-0d6e9f09d73a", "comment": "Malware payload", "value": "f9ec1d6b3e0edb4e6b293a54d3b5eb84566a76b9a860be5d51a093f60a15d93f761e9dd53efddeb40db9a2b2aec33295", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708283, "uuid": "e033e04a-8313-4027-b32f-bf4ab114eba9", "value": "T11D23E715338B8399C47C66B081F3092103F6ABEF6773E6477D8401A91F197E19BA6B8D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708283, "uuid": "9ef5d6d8-9d55-41a4-a6c9-273a383fdf91", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708283, "uuid": "647f9bdc-6beb-48b1-8aab-fbbb3c58728f", "value": "768:ztqj9qDy6EPNKJcLmPDXpbVSxqEffffAEnnnEEEEEAEEA1nxn1EEEAqEAl8EE1Fm:ztqjABiLmPDtVSxqEffffAEnnnEEEEEY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708283, "uuid": "64ee4c3f-a0e5-406e-9b24-071de711e1f6", "value": 47104, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708283, "uuid": "0ec50cba-b3b3-4609-a035-ee1ad7789631", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708283, "uuid": "e72ccb87-dae8-4e02-9821-f95a77480bde", "value": "656ac5775ae49d223f5d1cdaef6f1223.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44cc2a4c-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666589, "uuid": "ac79e85f-5be9-4405-98bb-c61b1fc47a1d", "comment": "Malware payload", "value": "0ee738b3837bebb5ce93be890a196d3e", "object_relation": "md5", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666589, "uuid": "129b512a-3b3f-4ee3-984c-babb575cdafc", "comment": "Malware payload", "value": "a571a35c182c209ab755a8e3ec483b155a2b686de0e3ffc382d569cdef80c227", "object_relation": "sha256", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666589, "uuid": "a07dfd75-b325-4a2b-b026-e956deec4c5e", "comment": "Malware payload", "value": "840ec569092152b7eaf24dfbaac384637cda2f92", "object_relation": "sha1", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666589, "uuid": "54f24fe0-6ca9-41d5-8c7b-98a41ebe0f06", "comment": "Malware payload", "value": "09e5f435e978a225ed581f2045605b6ed047737d12a6b13ac7800537d282dd558ca5e8a0225906e5cce846f3da893bab", "object_relation": "sha3-384", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666589, "uuid": "abc66c0f-7cb0-4862-90f2-9f9421a8d79c", "value": "T17EF4334EEB0EBBA2E4D845B5E3F8F318B12B5F0AE3B51667C5E970EA4C18405B91D074", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666589, "uuid": "6569a1b0-5ce1-489b-877f-1007f847f024", "value": "12288:7NZbddnGg/EK2g711HGrDklyugryClFJ1Fzqga4Iw:R9nR/l2g7UCyvryizzqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666589, "uuid": "e4f95d3b-dcce-46a2-95c0-b4a221acd7a4", "value": 763880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666589, "uuid": "b07edfbe-a8b1-4a7f-a87b-55c3886c71c0", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666589, "uuid": "692316ee-ae7a-41b6-b3c0-1507b2f07770", "value": "HS.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac5cf796-79ec-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1642681795, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681795, "uuid": "733ba3f9-0cb1-487c-8562-d9f7cf630c1d", "comment": "Malware payload (CoinMiner)", "value": "d3a2f88493e027bd046fc7e848520b85", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681795, "uuid": "b5b00c0f-97de-4e51-9834-3b62518c3b68", "comment": "Malware payload (CoinMiner)", "value": "a5da2c2da168c53897eb7580f0af6e0988e5c801ed766d7a7450e97b9b000ff4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681795, "uuid": "7c53a294-3a6d-4702-9acc-1a6fa76225aa", "comment": "Malware payload (CoinMiner)", "value": "e65ce924cc391e97b54e5004c284da6dfb1c582f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681795, "uuid": "97d3748e-7662-422f-94d2-dc4172661928", "comment": "Malware payload (CoinMiner)", "value": "bcd86020498b9857e8cba607994a74c4d2e82b00b6b59a855e4a3466e3d43eba5c9fb2590800e3788c9d8338d947efb7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681795, "uuid": "e9435b27-ea15-4888-b49a-8a0cb5746f5d", "value": "T17EF533E1B7846B12D25CC3FF31820219EB59D7D827046AF6F3940703E9939BA86562DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681795, "uuid": "45292b53-ca3a-4557-a7d6-9c2424a8606c", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681795, "uuid": "675ce930-2cde-4044-a17b-795c9cf238d9", "value": "98304:JuL4sBIrcnajzfqMFXOOfaYHNJr/Wuw50e:K4+IIUfRFxi2NtWu40e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642681795, "uuid": "e1ada99c-b6b7-451e-89aa-7d7d51251e68", "value": 3591680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642681795, "uuid": "8a2ede08-1295-4179-9e3d-cd72f112b193", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681795, "uuid": "fc1b5b67-d0ed-45f2-8b50-4ac998bdce54", "value": "d3a2f88493e027bd046fc7e848520b85", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb710158-7a36-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642713710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642713710, "uuid": "9ea5a68a-75c5-4e9f-88b6-d3d881e51dbc", "comment": "Malware payload (Heodo)", "value": "9e70b2c0cd92a0127269d2750afa6e5a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642713710, "uuid": "0fbffaa7-54e5-4f7a-9848-ad3fa062f3c4", "comment": "Malware payload (Heodo)", "value": "a690bda4ad1bf1c1685a7d8a18d09327284fb0d9e74371f97e7c7ee7c6159efa", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642713710, "uuid": "d4b58099-cbd2-4450-9279-87298cbeb6f2", "comment": "Malware payload (Heodo)", "value": "e35081a7ebf943f49fcc4cf23442daf14dd47614", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642713710, "uuid": "2f8f749a-6a13-4a4a-81e5-2b5e03e3b235", "comment": "Malware payload (Heodo)", "value": "c196e6da06adf15252867087fb3ee67bff850d8eee126e6490f2e0f579504638654dd3230f7ecbbf809d4ec3385030cd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642713710, "uuid": "bc1e07a7-352b-45ef-a565-27a262a3b653", "value": "T1FC636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642713710, "uuid": "e72b5402-d71e-4a29-9286-4978eaa1c28e", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642713710, "uuid": "8a3e15c6-b82b-49ad-a32b-fda5e275853b", "value": 71210, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642713710, "uuid": "ea1ef412-1646-4f6b-969f-08bdff95d3c7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642713710, "uuid": "1a0b4734-e2ca-4aaa-9e71-1f59675336ec", "value": "9e70b2c0cd92a0127269d2750afa6e5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69e4510d-7a19-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642701011, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701011, "uuid": "ab7cf387-fba3-4ad6-9160-7982d3349b70", "comment": "Malware payload (Heodo)", "value": "b24d98bd9510e958fd2526c868b5cc8e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701011, "uuid": "73f9f172-7826-4087-86f0-2d0f74d46336", "comment": "Malware payload (Heodo)", "value": "a84e7678cf36347081b2ea3c28aa7d279ca77cb3ebd5fd9121b1898ad0cd20d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701011, "uuid": "998666e7-fb15-417b-a978-abd9358a3816", "comment": "Malware payload (Heodo)", "value": "ba87c3c54e6d2628f858febc31e1658aae7e0bb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701011, "uuid": "b1ceb1c5-0535-4278-84c9-d4f0cc29cf25", "comment": "Malware payload (Heodo)", "value": "a11d75ad1c225f81d83a0788eb6d2f1203ea3a04979f7ff96ebec713afc0c6d9d7e13fba904cb82945866ada446cfee2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701011, "uuid": "d80d8ac5-1c15-4129-b245-4e02f4dcc17d", "value": "T1E5C4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701011, "uuid": "4b8c3ea5-1c16-4803-bd83-c31d3c4bbe5a", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701011, "uuid": "7daf9819-3c4a-472c-a6b6-3de7d526e803", "value": "12288:P78OGF+L8/4UUNyrPdMhTq/n4vAzdkPs7:D8Ody4aPdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642701011, "uuid": "2da06d4d-3551-42f2-9e38-33ae00406912", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642701011, "uuid": "9142a8ff-ca3f-43c1-86cb-33c48af49f6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701011, "uuid": "c76ab2e9-3546-4d60-94ae-7afc66aa1cfd", "value": "b24d98bd9510e958fd2526c868b5cc8e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25339746-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642665677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665677, "uuid": "0e650096-1f32-4cb5-b8a2-d3ecc752aad4", "comment": "Malware payload (Loki)", "value": "fc23bd795617706890727ad838d348e0", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665677, "uuid": "bed32736-f730-4e45-8b0e-c49c47c4ac4b", "comment": "Malware payload (Loki)", "value": "a88c8b8ff8218bcb603dd53a58db2a24923397653920a2392278379e48f72c77", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665677, "uuid": "974def2d-3600-4d50-895c-11eb5812a7bd", "comment": "Malware payload (Loki)", "value": "57bb3646ee6df42a6ca218e0f24b8e01156de68d", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665677, "uuid": "383612e1-ff90-47f8-a267-9bd71abd874a", "comment": "Malware payload (Loki)", "value": "e6b74c7336cc6f9f52299d69809ed091fe7d86badf69654d24b69daf383fff4564715ac97cf267dcd7b31acaf45b58e7", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665677, "uuid": "91d9ceb9-ba2d-47df-b7dd-e13e813919b2", "value": "T1420402672FE7662FFD1E71B62B31C65B1141FDB00612EF0126693789083A6428D73BD5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665677, "uuid": "827fae9b-fd79-431d-89f6-7cc30a4a8511", "value": "3072:KkCD/sAkLr0b9HsvA/X+tVk+Y+SEIynKkFGSRAy/v5HsRKL+C071+n1y/Lz:RKszP0p4OuTbY+XKTSRAynZuKL+V7wkn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665677, "uuid": "2c4e3efd-6975-4be6-bc36-5f8982292a27", "value": 187064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665677, "uuid": "d8b33325-c468-48ca-97e2-78ff7fe17aeb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665677, "uuid": "d01e3873-557a-48ef-89b2-c369d6dd62ae", "value": "MV SEA EAGLE.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7214a38-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1642666324, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666324, "uuid": "06889889-0116-4fc0-9cd9-6be9f25d17e4", "comment": "Malware payload (GuLoader)", "value": "e39aa3c950bab8058083690ec52514b6", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666324, "uuid": "840c9a7e-473a-4304-acc5-5181dcc8075d", "comment": "Malware payload (GuLoader)", "value": "a908397592e9d563adb5f49a8287f6c569f9973203216f0fa5a6c090f43971c6", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666324, "uuid": "b92a8804-dde0-4491-b7ca-01ac9b577597", "comment": "Malware payload (GuLoader)", "value": "3177dba521e719cd506a7ca7a9ce5ded19793b4d", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666324, "uuid": "1755bfd0-11b9-44c4-9563-97a2919294f5", "comment": "Malware payload (GuLoader)", "value": "0f89a2c6419d0161aa7dfa38f47a93f2d4769acdfc09f4e0d623804492fb3870741d91cf14a32276f45def2a3235bf41", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666324, "uuid": "e30a2792-1803-4d83-a2af-b6f970dd7eb6", "value": "T127F35A02B93CA467F2D34EB01470E46195E36C235BC19A3B66739A6C267338FB591F1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666324, "uuid": "c486cd03-08bc-4df7-ba47-3573bfffd6db", "value": "27f666bfefdd93f354d6d261af1f04ba", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666324, "uuid": "0976b812-e846-4241-a5b1-a74ef014fbd9", "value": "1536:vkKSpQ15c/UqomHjxUTfOImq2LBwTmItm7QSXNVuPWZD+JbO0BCCR21TzLXQU:ApQmDSTbmq29BQNiNVu+pIbO04NTzLg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666324, "uuid": "2f5e5096-d122-4d5d-baaa-14f65efd104a", "value": 163840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666324, "uuid": "6c8b572b-63b5-4f4c-93dc-4fa282162509", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666324, "uuid": "eb5b3cf8-3ac3-4267-83f3-7722c0b0c0f8", "value": "DHL Reciept_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e760c608-79dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642675451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675451, "uuid": "f5ffb401-5348-42f7-ad88-607174cf88c6", "comment": "Malware payload (Heodo)", "value": "5bffdae22f776d781cab2ad5309a6154", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675451, "uuid": "eea159b8-c9f9-4dfe-8c15-ac32ccdd55db", "comment": "Malware payload (Heodo)", "value": "a94875a62546e0ff04e0a0ff648b48bc6ad7071b539a8d41c8d1176ce4e1252b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675451, "uuid": "e3114dd0-6208-4e41-a0af-8c394b7374c4", "comment": "Malware payload (Heodo)", "value": "7943586d63be16066060c5482073b1313cbc78b0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675451, "uuid": "3dce8b4d-d34b-4179-9fb1-af5a53583bc7", "comment": "Malware payload (Heodo)", "value": "ebc6e9ce61c1be5f2298ed4cbb3682d1c0a5656829bf8379858309f4957e1daee3ececf30317f0ece858c98cb7e2da83", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675451, "uuid": "5c60ca4b-fc9c-48fb-936f-780947e3f6da", "value": "T19AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675451, "uuid": "95fd49c2-eef2-46f0-8dd3-cbde3f2ed5a4", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675451, "uuid": "ed65ddae-dca6-4612-8c14-c4cbf019e881", "value": 145497, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675451, "uuid": "52fc0c59-0611-4039-a553-692067d9a00b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675451, "uuid": "a2d3e319-2baf-4dbe-ac0c-2912b305212d", "value": "5bffdae22f776d781cab2ad5309a6154", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5fcc6517-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660621, "uuid": "b1195040-99c3-4d87-9354-a14ce328a1a7", "comment": "Malware payload (RedLineStealer)", "value": "9591fefb403773b5b0737af2cd7890f9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660621, "uuid": "a9e9588d-322d-41a1-8590-3591fe0d1e22", "comment": "Malware payload (RedLineStealer)", "value": "a981e21aac19c98e126737f1ffeb2e4040cca00f393d4c3a9b705baf9df00986", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660621, "uuid": "c1274c9e-8f18-4178-8506-c95a0e167964", "comment": "Malware payload (RedLineStealer)", "value": "7728a0a844857f66c885e319a05a92bd90445bf6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660621, "uuid": "2b5ebcd7-dbf3-4e08-8dc2-56ca8496d8af", "comment": "Malware payload (RedLineStealer)", "value": "e8aae6b84c81ddcdf00f08262177a46ea3572948d468620c2b6a540191dd5b85464a3afdbf42abada6f898a47c7f99a3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660621, "uuid": "78f23b5c-1074-4e4c-8585-8ca4854e94b6", "value": "T1E584E070F680D471C0D62530843ACFE45ABEBC74D865564B32A63BAAFF312D1667A21F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660621, "uuid": "d60ac0b4-6cea-4443-816c-1e9ed011fa38", "value": "125adc129c50285a2cd4524417d3fdd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660621, "uuid": "e3cdb5a4-883a-4db7-b310-d575b932a749", "value": "3072:THRyYLz3Gx2Y1tjfy/7FyXjO6fMze9kBIq/6c7ybDGNPNzn/PtOJ5ywY6KnBO4Up:rRyYLzC2Y167QwfBoXDuzFxFnBOv8Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660621, "uuid": "39088c6d-8515-499c-8f69-d872806f8b55", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660621, "uuid": "e7cbcf0f-bbab-4993-b645-bbece67a6682", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660621, "uuid": "0a8061b1-cae4-48df-851a-65c7e3764044", "value": "9591fefb403773b5b0737af2cd7890f9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0323fc-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642665665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665665, "uuid": "cb7ebc2a-0385-48da-9912-5a90dd283f7c", "comment": "Malware payload (Loki)", "value": "d6ea357dd730ef72dfd711cf21ee7012", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665665, "uuid": "d90b54d5-14da-4a76-bbf3-6ce91fc665ce", "comment": "Malware payload (Loki)", "value": "a9d258775afdf9f7c88a336d6671268c4c3911dbcedd5b80d3cf9b01568538f2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665665, "uuid": "f1e786d0-a959-4941-8426-15d404c5335b", "comment": "Malware payload (Loki)", "value": "737b1bb0e96b73946426016418ca543bb1db4c6b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665665, "uuid": "c1ad85f2-9942-410c-b433-e94daee496e2", "comment": "Malware payload (Loki)", "value": "af95d5b0c254fed4081ebc5e755ea0b58161639f42079386a47eb147ad97a6f4c859fc29f93d45146dfbf1f1c0b2e9c0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665665, "uuid": "a6507f73-fbed-46a0-bd72-454c17660634", "value": "T1940412F7F5409B88E9BEF5B54919683029B3DF50D804F0836B6F7728A832DD2285A375", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665665, "uuid": "04a8ea6a-3ab4-4f73-bf34-c5e9713ba1e6", "value": "3072:aFzYncn7goQpWjXqbZa+o7lDcsttL1Oy22mGAdqEpJSWZeg8+VwxBVi:0Y87P0WjXqbZaHZDcjyjm1dq+ZN8+a0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665665, "uuid": "87c4416f-2244-439b-800d-932dad482086", "value": 187208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665665, "uuid": "77228d67-23b1-4c41-b33e-5ad7b09a511e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665665, "uuid": "21ee5e21-f9cd-4805-b10e-5006eeca0350", "value": "224.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af65d087-79d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642669774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669774, "uuid": "58ef4c20-1a84-48ee-861e-82c89e0703a7", "comment": "Malware payload (Mirai)", "value": "062a85b54ec21ca832943892ea235ce4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669774, "uuid": "c13fdd94-92dd-4971-b63c-1ee969ea0fde", "comment": "Malware payload (Mirai)", "value": "a9de98364c936c8fa5f55579f8f1fc16a8be1cfc48f20349bf74fe7162690035", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669774, "uuid": "8ac93639-cf44-4d89-a89a-8279604ae200", "comment": "Malware payload (Mirai)", "value": "19d49bfa6906b14610b5a298660dc07a8e5504a0", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669774, "uuid": "ffd91ef1-ad52-4114-8a96-5f5e25a0167f", "comment": "Malware payload (Mirai)", "value": "2c3a89330a56e373d7d5ac60927ff55be1d519516b58aa816f69c080e8e9e2647f4d98f40a025da16f17025076339a28", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669774, "uuid": "47ad06dc-cc12-4eec-9917-362be92e770b", "value": "T155736B31B9762A27C1D1A43A11F74B10B6E117CE3AE8C61E7E720E5EFF216506503EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669774, "uuid": "68a87775-9d9a-491f-a7c6-cdd5ac8c48fc", "value": "768:Uoao+BTVXvoaRq9/ZPjrglLgABJ7fZo4lJLRmMLGBZSGizO+DksDQTG:3arBTVXvoaRS/ZPjrgtgg7fOMauuTG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669774, "uuid": "dd074add-075e-427e-825d-c0847664ed7b", "value": 76192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669774, "uuid": "a564842c-6d97-4940-9857-36ef2aceb027", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669774, "uuid": "879da7df-b7c7-4f61-b391-1eb5bfacbbc1", "value": "gang123isgodloluaintgettingthesebinslikedammwtf.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "531770ca-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660600, "uuid": "090064a7-3159-480d-9d50-086a82ea5a1e", "comment": "Malware payload (RedLineStealer)", "value": "614732785e0a01328b148885aed49245", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660600, "uuid": "d8cc202b-799c-476e-9326-f39849d53e83", "comment": "Malware payload (RedLineStealer)", "value": "aa6c8b3bd5e222cfc5fca5f11da80ca7d751744d5cbda33ad224b43aa5512ce5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660600, "uuid": "b488b0d5-f7c5-4660-a1be-ba799ee7f149", "comment": "Malware payload (RedLineStealer)", "value": "d2a5bd5fb13475df374abedc303b87b58e8748dc", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660600, "uuid": "5838651e-cfd6-406f-abc5-f4a7a22eacf0", "comment": "Malware payload (RedLineStealer)", "value": "e12eda7d1f32ab8d7f5bcd77f0576aa65434889bd441a6545f39e0e79bf42df60fee70123037d94ccce5b474c1b9c115", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660600, "uuid": "90477ce5-2568-4af4-b3bc-b01026949c9f", "value": "T13684E0213580C432C4865630843DEFA05A7EFC715922D647B3E43B6AAFF66C1667A36F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660600, "uuid": "d1de57d5-8a08-4c54-a1b2-4bd0c63369d4", "value": "125adc129c50285a2cd4524417d3fdd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660600, "uuid": "e49fe6e9-7099-4aab-a7e3-ca3c6fd9df89", "value": "6144:MgENLek2Y1HGxSaFIhe4L7KkDl4WYc/71nsbVskB5xXf:Mgot2Y1mTsLysl4E/VspskB5l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660600, "uuid": "393c78d7-b2ce-4ffd-aee7-5715f2c9702e", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660600, "uuid": "30c0b74e-2206-4e0c-b768-45fdfd400053", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660600, "uuid": "a430d0ad-cd65-4370-846b-e6cc3155843d", "value": "614732785e0a01328b148885aed49245.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c37e41d3-79fd-11ec-9275-42010a9c0029", "comment": "Malware payload (Quakbot)", "timestamp": 1642689135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689135, "uuid": "f08a0878-23e7-49d7-a04d-64655bb245b1", "comment": "Malware payload (Quakbot)", "value": "51f81eccac70d30d37eab17ebae9c02c", "object_relation": "md5", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689135, "uuid": "5050890a-b1e4-4828-83db-e99ae853f1c8", "comment": "Malware payload (Quakbot)", "value": "ab2c0b36b787b8d1c428c9971c8a4db76ffb03c9c3bf659aa0b03ee45e8ed58a", "object_relation": "sha256", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689135, "uuid": "0b655b39-81c8-4944-9b2a-b504514179ec", "comment": "Malware payload (Quakbot)", "value": "30e4eb355e5fae3a7a61fa135fbad369fa95c446", "object_relation": "sha1", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689135, "uuid": "c907817b-d95f-48e9-95fe-6cd1def5d1fb", "comment": "Malware payload (Quakbot)", "value": "ccf2382e0b65724fff6077c4da9569f43dee38e45502239179238c5df44c92079532165f356d7d44f0ba86b2d5513831", "object_relation": "sha3-384", "Tag": [ { "name": "cullinan", "colour": "#E97EC8", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689135, "uuid": "41a50611-b192-46e2-b7fa-74e20ddb151f", "value": "T172D49F22F6D04437C2732A389C5F57689839BE002D396C4E6BE91E4D4F797817B6839B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689135, "uuid": "f37bbe09-fe20-4c1b-b890-eb5065fe431b", "value": "103cdde97f8f89c1d8e5839a60e3d584", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689135, "uuid": "7a1aaa6a-ac5b-4922-8c18-b0820baf6fa9", "value": "12288:L0yyJw7jxx1nVnhHXmfdoS+rEflFnUtGA3:I3GRxvJIdoSLfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689135, "uuid": "6573db04-2f46-415c-8bc8-b89bf91211c9", "value": 643419, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689135, "uuid": "06ab625e-75f4-4870-bc29-a68a14983201", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689135, "uuid": "2236262f-b032-4f5a-bdd9-98bbf985a480", "value": "ab2c0b36b787b8d1c428c9971c8a4db76ffb03c9c3bf659aa0b03ee45e8ed58a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2bba415-79d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642672437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672437, "uuid": "2ffcdd93-d785-4b10-b687-9b0eb898cd1f", "comment": "Malware payload (Mirai)", "value": "b20c8a9214618d3137dc9ccb748bb6fc", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672437, "uuid": "a280f3cc-ea93-4979-9d9f-70188638dfc2", "comment": "Malware payload (Mirai)", "value": "abac38973dc5751fa1f48ada11b14f01a2b41cbad915c5c6cf252c9babb3e1dc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672437, "uuid": "d4db141c-fa83-49f3-b15d-c3af0b539f33", "comment": "Malware payload (Mirai)", "value": "dd996ceebb09dd2936d55b81d2174934c3a86662", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672437, "uuid": "03f8c9ba-53eb-4552-bd24-b4c1302ebdad", "comment": "Malware payload (Mirai)", "value": "8d5be45e8e8231d112ea34a703fc981d775dbe122dcb82256b9beefc2a422c1cc5ed934624f00f9cbc5d962984df43ad", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672437, "uuid": "fbf02c8c-fc1e-4f6b-879e-3b0421f4890b", "value": "T18B546337F74184B2E11848F134A662D4ADC6977F8C2616C3E65A59A5FF32C1B01FAEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672437, "uuid": "1632c38f-1dd1-4795-ac11-5239d1ab1a14", "value": "6144:ebGgzbr8qJpFyc8HNZCC5Xk0pg6KEQQZ0s8DkBCa/aZGm7FnVqfJXFWbNb:aX8qJjDC/aZGm7FnVqfJXFWbNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672437, "uuid": "447f422b-29b4-4c50-a239-e0a692dc377f", "value": 305946, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672437, "uuid": "06e5c646-175f-4c7d-9e1b-342a1d323b39", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672437, "uuid": "aa9a614f-7da9-4329-9d43-46f974e5406b", "value": "x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b6e2d7f-79bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642661419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "ce71cc30-c294-4433-946c-57d13b18e49a", "comment": "Malware payload (Heodo)", "value": "f693a92b28b00442f5473156d2966b7e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "54ff48db-703d-4109-bb64-bb1f34966180", "comment": "Malware payload (Heodo)", "value": "acdd892c624723bc859e4f481e0fc3ab042aca61e02c8bd65fbe1d4e03ceb617", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "36114da8-7697-4388-a642-5a76ec799ca5", "comment": "Malware payload (Heodo)", "value": "43eeced1ed73da7deef0525bce9ecbb18ad3695a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "ba1e9b71-7668-4ceb-9865-7d58a6d93fe5", "comment": "Malware payload (Heodo)", "value": "8f3baf1b50dc597de22bfa2c2ae0b867a25c5720a9628ffbe192df0e2b70bb98cc2dbad03ff3772eeb1354db8c55e849", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "c6587eca-0ebe-4d67-96fc-7c705623a1f5", "value": "T1DFC4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "0b82496c-63b1-455a-9984-420edd6f558a", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "e3ff6bba-a01f-4c04-8f7e-cc9ceae5004f", "value": "12288:P78OGF+L8/4UUNyrFdMhTq/n4vAzdkPs7:D8Ody4aFdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661419, "uuid": "49d83d3c-cc5c-4276-8add-d6a2c5a057ef", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661419, "uuid": "a52f3a35-61e3-4983-8e7d-c9ac1f0bdfd0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "f9a90ec6-3be0-4b66-b28f-b8b5648357a1", "value": "emotet_exe_e5_acdd892c624723bc859e4f481e0fc3ab042aca61e02c8bd65fbe1d4e03ceb617_2022-01-20__065012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d053cdee-79d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642672406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672406, "uuid": "2cd65dbd-e973-4ebe-99f1-b3a3d0e8f1fa", "comment": "Malware payload (Mirai)", "value": "0983dafbe0d62a26eb5a95ae715d0074", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672406, "uuid": "af744f90-97e2-4f37-bbd9-766f4326f01f", "comment": "Malware payload (Mirai)", "value": "acdf27536d47aec6cbb332f5ce8848338980acf204c813a749def656d03245d8", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672406, "uuid": "913bdc93-6caf-43dc-be89-34f74fdb1cb2", "comment": "Malware payload (Mirai)", "value": "857720a93eca7315b57a4db035c623f5357b7b7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672406, "uuid": "7ddc356b-7a2e-4a89-8bd5-dbff27ebd458", "comment": "Malware payload (Mirai)", "value": "2086d61ee4e17cab72fc30622e24298b301b5865db224ad5ace21963b43d47ba44a23cfff4b33e71267b1886edf3e3f9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672406, "uuid": "d90a35d5-0547-4456-81e0-891a799b063d", "value": "T143746636F70186B6F11C49F125B637A4AEC543BB596516C3E15E89A4BF3280E01FAFE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672406, "uuid": "ad1ae154-911a-4d75-af88-7ab683b39c94", "value": "6144:ZVn2w4XMXdZCSpn0UpQKqUgAZ08kjUCzCCmrThPaLEnvPrNb:b29djZjmrThPaLEnvPrNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672406, "uuid": "9d9fa521-e557-4e69-aa0c-d6f69517bd3a", "value": 338224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672406, "uuid": "8e0e385a-72ba-4d7f-9078-afe64f98d223", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672406, "uuid": "ec0ebe0f-7d2a-443f-b876-062b0ab35cb9", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07b25727-79ec-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642681519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681519, "uuid": "b2f1b0ac-cc15-4b9f-a78e-808af8154043", "comment": "Malware payload", "value": "1ca8f85d68ec67c11541139ed76e5fba", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681519, "uuid": "83a511b8-220f-4232-b817-fd5d02849e15", "comment": "Malware payload", "value": "ad488b113fbf9b09ecf688146950efeaa372db2dccbfa060e00dd680fbc7b38a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681519, "uuid": "99656ee4-533e-4f0d-9656-04fd81b413f6", "comment": "Malware payload", "value": "e75cc1ee2a2b781a3c91c44c15dbe111765456d8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681519, "uuid": "88cffa0e-517a-49b4-8112-36f805425a7f", "comment": "Malware payload", "value": "e8a78262d1bfe1661c95a586d5ba67759a4dcc21e79923c2c62e3d8bcae956b4b09b905d0cb96387ce8a0e97b947efec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681519, "uuid": "0b9bc228-30ef-4ccd-807c-979752aaa2bb", "value": "T1FEF39E93FBC984B1F2325A341C42E2555F3AFE153E58C157B2E82F4EAE79681246C2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681519, "uuid": "3ea7f762-23a5-4ac8-93c9-3f7c64003a74", "value": "de1fa96ad5bc81910ffb7ed552e29d0d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681519, "uuid": "628eef3f-8d26-4bcb-bd90-ca2ea262312e", "value": "3072:2gsVXndKtLbLx+fQ1ilKhGojBL5DgOemTxdufr1dsBVwusNNLHAn0OIEVn9DW:3sVXQRbbCKrjv1dufr1dsBVwuyNLrEV4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642681519, "uuid": "348753e9-7364-408d-b9f6-d9dc4c28d71a", "value": 163600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642681519, "uuid": "fe07ed36-a616-4b42-98e1-809280f2f1ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681519, "uuid": "5adfd8a0-fda3-46c2-a439-29e75e75348b", "value": "ad488b113fbf9b09ecf688146950efeaa372db2dccbfa060e00dd680fbc7b38a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "748265c6-7a26-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642706612, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706612, "uuid": "26e62a16-104f-4393-9a23-d70f7b306f0d", "comment": "Malware payload (Heodo)", "value": "209cf65ce75019e061ddcb09f4ac6e2f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706612, "uuid": "e402ee71-11ac-404e-920d-7c3585c410ff", "comment": "Malware payload (Heodo)", "value": "ad511015e8c542a03954c1be8721ddcce85dbe997f7b2048bc6e1b35823c5ffc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706612, "uuid": "13b2258f-aa23-4659-bd20-6742f266088a", "comment": "Malware payload (Heodo)", "value": "cf3efd3f2a615656888209ae76ad914c8d8eda56", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706612, "uuid": "24e7c853-b609-4f1c-8ef4-5ecc8657d2fe", "comment": "Malware payload (Heodo)", "value": "c60de60696383fb0a747749ea622a3cc794e5e86b44965cda80f70c773d0cc3be793954a7cb2df15992a9e721effe0a7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706612, "uuid": "6aa1a16a-85c9-4966-946e-ab8231d30ce9", "value": "T1DEE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706612, "uuid": "abccf2c7-725d-4992-a8a8-9f51350ba601", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642706612, "uuid": "7003a920-4c32-41af-82dc-242e63837660", "value": 144476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642706612, "uuid": "bfae1271-8730-42e1-851a-17522e4fefe0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706612, "uuid": "bbea9526-6f4d-4862-b02c-b05a11aad4bc", "value": "209cf65ce75019e061ddcb09f4ac6e2f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92470b51-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1642660706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660706, "uuid": "b6d3f1e6-4e70-4ee6-8a7b-939db2ce9af8", "comment": "Malware payload (BazaLoader)", "value": "82fd3b42362faaec6999856ed403c792", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660706, "uuid": "9a17768d-5a99-435d-9225-048e75499314", "comment": "Malware payload (BazaLoader)", "value": "ad5f4db4dad54f1c69a36a826311d782671ab5e16af827e17920c8180ec28a2e", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660706, "uuid": "aa742cfa-c9e9-44f0-abc2-9f0df6a0c2df", "comment": "Malware payload (BazaLoader)", "value": "ced3f41899c3c174223287806d3d24767e8ecafb", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660706, "uuid": "bc91a7ef-f680-4060-adb7-6bae39318e75", "comment": "Malware payload (BazaLoader)", "value": "51cf5f20ceac0c7fe48e78282fa7ea5d54f8f85980a9e134c5e551cf0b7fd4c9c18c1e3553af7042188ecd4780a9c152", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660706, "uuid": "38df39f8-9c86-4bec-86a1-b0dd36e01b8a", "value": "T1DD85FE43180C819F9867D77421671D97EEB87E47F2C84E1ED1E428B84AEBDA674CA04F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660706, "uuid": "df24c3b7-f15e-4068-aea2-5481fc942d2a", "value": "f30f2b5b65c947eccbf132b668fe3257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660706, "uuid": "59ea11e9-e702-4e54-9a93-d757452d583b", "value": "24576:7a1QHwgJMrQqj/wAc6QORNx2nAjwkaxm0GV9igWQlnwXwBwfaljN1X4GtZ+FdnZs:8nEKFIhMd8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660706, "uuid": "e0f10899-f969-480a-aaef-989dc01e306b", "value": 1816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660706, "uuid": "a6573024-b07b-4fda-86f4-6aca0f219531", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660706, "uuid": "e339fbdc-26d8-4a06-8c56-ab8286d15f07", "value": "82fd3b42362faaec6999856ed403c792", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ba536cd-79f9-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642687135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687135, "uuid": "dc487baf-5843-454d-898f-043521b8ff4d", "comment": "Malware payload (RedLineStealer)", "value": "02f28a922f6d549e0bc236e5250a5644", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687135, "uuid": "7df46ef7-23b0-4610-8f61-2b6aabf7353f", "comment": "Malware payload (RedLineStealer)", "value": "ad85b5da34b5496176789abe956a1518ecf6ce96c8b363d0927cc52f7c559f7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687135, "uuid": "82d6b480-03a2-4e11-9df9-6cf0c1b0133a", "comment": "Malware payload (RedLineStealer)", "value": "cd824ba4749518033a9814bf73436c211c23638a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687135, "uuid": "a0edbcda-be90-493c-861e-1df3f98c1397", "comment": "Malware payload (RedLineStealer)", "value": "8fc920ed08560c40ac9a7d155e0d75331ae706500ae24863f49d53e2d889329d3777fa5cc58d0bd59762dedde69af243", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687135, "uuid": "f993a0f4-227b-414c-a58e-a82e333b4bd0", "value": "T164F533E5F362D220D5EB12F41ED72717E51FF28C849638A0327C4142F9DA9D7822A5AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687135, "uuid": "6da85c75-619e-4a16-8321-645b21f08c70", "value": "c284fa365c4442728ac859c0f9ed4dc5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687135, "uuid": "030d4ca6-f09a-40c5-9cc5-58c2aa4e1951", "value": "98304:YzoAY3z1CGOmf5OG8cwpQcPD1lND9E0BZ1uESDO:eNsXf07c6PPV+0HsEYO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642687135, "uuid": "f2fd3d61-c141-43ee-aea5-aafe0e620313", "value": 3579856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642687135, "uuid": "e6b89a82-a46b-47de-9ba4-d09c3582a951", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687135, "uuid": "e2f045a7-5aef-4582-965f-19df45008aa4", "value": "02f28a922f6d549e0bc236e5250a5644", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d77cebdc-7a41-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642718374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642718374, "uuid": "bb493f93-e958-4d93-8580-bc1a946730fd", "comment": "Malware payload", "value": "b04d9303595449350d50074dcbf7131c", "object_relation": "md5", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642718374, "uuid": "954c7aab-01b4-4d29-8a59-e6bcd446ebae", "comment": "Malware payload", "value": "aec2322328224504e216bae76697e68ec37167ececb7693615d72235044bf28f", "object_relation": "sha256", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642718374, "uuid": "bd48504c-70ca-468d-bcaa-436b42cb2bd8", "comment": "Malware payload", "value": "dec00ec5644a133c667cbfa55ceb9ecf7a2a9551", "object_relation": "sha1", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642718374, "uuid": "2d6933ec-58c9-479f-afee-ae6487756c78", "comment": "Malware payload", "value": "efb9bff4420861fcef9d0f3b363e8d1b7b47195efe8bfe41235d23daafe0129d14cc3edbfc1ba5c584e1ce913ff4f175", "object_relation": "sha3-384", "Tag": [ { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642718374, "uuid": "9a11914c-829e-46e0-b6a7-a11bfb24cda3", "value": "T11D33D0AFE5B1357BD225C17DD92C9361F44E92151E88F3C92DA0FFA5920279206AE3CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642718374, "uuid": "bc2b0d25-0b79-4f34-b105-22718c1a2c38", "value": "768:q4OjmfxV6sbaLX8iWjzwxmCeOG2S6DaqmBVZKNAxalvxnvy1OA16OiiiiiiiiiiG:sjmfxVXAiozeO0XVZKyalpvyR1bZP30", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642718374, "uuid": "92a8b267-8f6a-4300-9cf7-f6c3fe477e80", "value": 50686, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642718374, "uuid": "33ea7248-f7b9-4d43-9d2c-4a13a6f2be9c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642718374, "uuid": "441afee9-7aad-412c-988e-e31ad2cf466b", "value": "YXG-8748.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb8de05e-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642660802, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660802, "uuid": "44dc57d9-43e1-48c8-aae9-aae651845163", "comment": "Malware payload (SilentBuilder)", "value": "021febc19bb995d8d8edc609e72cc5de", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660802, "uuid": "3b29477a-c952-4a56-bce2-54154ffc76d3", "comment": "Malware payload (SilentBuilder)", "value": "b0255e42b75c0e2899d56ee898a141bb6f4f63c23e6fad05fbe0f4fe08534d4d", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660802, "uuid": "18234a18-616f-4953-8af9-bda365fee887", "comment": "Malware payload (SilentBuilder)", "value": "2db19a873118df9d3212c401d78ffa3d66688a44", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660802, "uuid": "9688a015-1a81-416c-9a8c-a5b95f4c0675", "comment": "Malware payload (SilentBuilder)", "value": "92db2400e2e5bfce4f9fb432e31652d5a09c51436430cd4538c7f5124fbfbca0cc8bf8082193d7c90f4c2429b1e48d22", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660802, "uuid": "de79282c-9fd6-457b-b26b-8e4b81f5fd41", "value": "T1F6E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660802, "uuid": "4d2444b4-151a-4e8f-bcf4-fca9f519df84", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660802, "uuid": "ef50e583-a517-424f-980c-92d1277e1623", "value": 144503, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660802, "uuid": "0065a1e4-1e43-4d7e-ac60-ee3005780b09", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660802, "uuid": "49a14044-65ff-4a47-bd1b-a5d33df29df0", "value": "021febc19bb995d8d8edc609e72cc5de", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a91a0ad7-79d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642669763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669763, "uuid": "335b7c95-43d9-48e3-9f3c-948036612e66", "comment": "Malware payload (Mirai)", "value": "c9ea06feddc54634ebe3e652de9f6353", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669763, "uuid": "36a4df9b-98f5-4871-9102-ea196081572c", "comment": "Malware payload (Mirai)", "value": "b09986377459435ef11a48c662c33237200a204930e82c6eff810fb4df8fff74", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669763, "uuid": "d9f3584e-2a98-4cf9-b9d4-68fc60d1ba73", "comment": "Malware payload (Mirai)", "value": "682a5859f9edfaa76e76e35c0037242a7c5fd950", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669763, "uuid": "e13e7c5b-2e8e-4204-b7c6-08ffa90a72eb", "comment": "Malware payload (Mirai)", "value": "9bbeec00214804275554a9ac84365b7519f16df97a302dbeb0cb45978a5bd827586a86e74226cd460bd2053622b8531d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669763, "uuid": "0c16e5c9-4546-45b6-9a1c-7a2f0e6f87f4", "value": "T1D9634C02B2280A47E4931AB0253F1FE057BFEAD025F4B685695FDB568635E372086FCD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669763, "uuid": "2626ad28-50e1-4ca2-8742-ff39fe487a59", "value": "768:JcM3+VHuQYRPbMlxkSC1yHyx4cDzPH//1ZQV28uGFzpTYqHH5eKnsbmqRr4sGpMd:Gw+fYYC1yHyau3/Od9mREsvkI6wDMw0A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669763, "uuid": "06fb8103-bc76-4da9-bbe8-e71971a6c91e", "value": 70744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669763, "uuid": "4bf4fa8e-b142-4f90-b7d3-eeea04ed1e3f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669763, "uuid": "7c0c6d38-5bfb-4515-bf47-7cffe198b258", "value": "gang123isgodloluaintgettingthesebinslikedammwtf.ppc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9194bc1c-79d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642669724, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669724, "uuid": "151a216b-be9f-4627-a478-1165a85880b5", "comment": "Malware payload (Mirai)", "value": "0ac80ce2cbd6cd4b564e35002500f878", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669724, "uuid": "60630f33-8898-427a-909b-e802ce375f01", "comment": "Malware payload (Mirai)", "value": "b0a84ee978bed6490315aa8a32cea75e4dbf9b3f6419acc8915a77a626023c1a", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669724, "uuid": "a5f73e02-fa33-4e96-bc32-8cd16ba2074c", "comment": "Malware payload (Mirai)", "value": "159052941751ea472e80a312b5498d5b3d6e4ff1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669724, "uuid": "4ed59488-e075-4d24-bcdc-f12d4aea2afb", "comment": "Malware payload (Mirai)", "value": "9125e82965f9a1c364aa10adc00f08c540322cb8065ef2556c799482c9da5c680ad3879239b2b857c9e43de7adbdd85b", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669724, "uuid": "31d1acff-9e94-4a34-8d01-d390925eee62", "value": "T100732996B8929A22C6D4137BFA6E41CD372163E8D2DF3207AD201F6477C681F0D67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669724, "uuid": "43a8d21e-b64b-4a61-946f-d663844c3fe3", "value": "1536:XpXcKpBUlet3DBboJubLCNgpRTZGTkcahWMPiY4g5q9/e35roFp:XpXcKLU1cRETkvhTkgp3WF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669724, "uuid": "e0e0d0a1-db54-4ff9-8205-7cce56b4f8d6", "value": 74744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669724, "uuid": "bafcfb50-1b22-4888-9d11-ae499eba9620", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669724, "uuid": "73b35266-f639-4c47-9a62-d395ecc89458", "value": "gang123isgodloluaintgettingthesebinslikedammwtf.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3d748ba-79d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642669781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669781, "uuid": "a70379a1-22eb-4dcd-8947-10a01134223c", "comment": "Malware payload (Mirai)", "value": "ff5753147a9b7330251764e263250766", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669781, "uuid": "334dcd46-7562-4392-892e-2225fd3233d1", "comment": "Malware payload (Mirai)", "value": "b152341db0dafdb684a2ddcfbef61180afa5b8c7a6399c62115ddabef0a62276", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669781, "uuid": "b1bf92b7-aaf5-4646-a316-ec4046c22425", "comment": "Malware payload (Mirai)", "value": "af863a050f6f192d5b4bc70d0085b8e1ece4ee5f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669781, "uuid": "305c4a6b-8711-4d86-9c38-c88a96b13943", "comment": "Malware payload (Mirai)", "value": "e6823c5c40efa49fe090ff8a63cd7f5cb5886156b1d91f1935714d85572787dcb18c795e770c04bdfcf99585a3676ff2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669781, "uuid": "f7732649-86c1-487f-bbd4-568cdf789e34", "value": "T1D9534BC0B643E9F5DE020674306BEF324E37F6F6211AE987E3E49573AC425419643A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669781, "uuid": "71ea8408-409b-4d7b-8a36-04833eb8b182", "value": "1536:mX23TSwlS4keBfrtOVqlQzYnnmKBPKlo2UWmsvnt05nFEid:1jSwY4keBfrtOCQsnnFkmWBV05F3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669781, "uuid": "27813791-9239-42ef-9bf8-80ef8bfbfb9c", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669781, "uuid": "9400fef8-e1bf-4c87-9300-9d577f2b7635", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669781, "uuid": "294d64eb-da9b-4fd2-802f-09212af8add2", "value": "gang123isgodloluaintgettingthesebinslikedammwtf.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5f2d8c2-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666778, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666778, "uuid": "281c756c-2ea5-4973-822b-62477bb2cac8", "comment": "Malware payload", "value": "e7ce1874ab781c7a14019b6a6e206749", "object_relation": "md5", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666778, "uuid": "066e76c4-b441-4b1c-b574-a0d446486480", "comment": "Malware payload", "value": "b18199aae531c16f3bf634fbd14a82cfd715d387689c80089a6aae07dc04c361", "object_relation": "sha256", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666778, "uuid": "fa119401-5963-42b7-b63f-e5fd7f496ba4", "comment": "Malware payload", "value": "ff4d5487afeb5438c4dd6ba321813efaefb26cc6", "object_relation": "sha1", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666778, "uuid": "b396c317-b4f7-4498-999e-1b23b947da35", "comment": "Malware payload", "value": "600575542ee5aaa55fe70c22552ee68a35808ed28c18c2176e3c1e8f591b776dbb9384084817d0798144f69fb5623fab", "object_relation": "sha3-384", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666778, "uuid": "bdb1a071-c13b-40ac-b21c-ac14a1c844f3", "value": "T16E35335CC1106A9DCDB974F7C9520530A8E0F7B39687DEE43F26EB6948128F3292B355", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666778, "uuid": "dff3d419-bc6c-46fd-8683-be7320f9f96f", "value": "24576:M/axUszxWraf19qfgx2Ea4NQB4Kjgl7s74:HxU1E1QfgxllQalsU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666778, "uuid": "54180310-a15d-4a18-923b-8bdddf2f0969", "value": 1079119, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666778, "uuid": "f1e5e678-68be-40b7-b3ef-b952657cfe5c", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666778, "uuid": "9cb69044-4efb-45f2-930f-a10d10482550", "value": "PaymentRequest.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a1d63ac-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665712, "uuid": "caaa0c7d-49c3-4696-a8b9-6eb168dd430a", "comment": "Malware payload", "value": "2a106315bcd15d8d00a9710b183f893b", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665712, "uuid": "d0e53f6d-fb49-4704-9a3a-bc23822c059f", "comment": "Malware payload", "value": "b1858199f46b1fde50710d86bb50869354e1482b7dd289197da3d1d53e11bf13", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665712, "uuid": "8265d398-dd82-4e7e-8880-3735fa952c21", "comment": "Malware payload", "value": "745f12257c04238199093759e3eda64b10f98b95", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665712, "uuid": "c1a4156e-e0d4-4e3b-85cc-6244bc71f7c5", "comment": "Malware payload", "value": "a35b0f795795aabffb3c91cf1be835b571a1588996a87d278e3d8f7f4ba1736d4a85cb0cc1e03b54c016dfcc2e2c9525", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665712, "uuid": "41689c1d-3328-482c-a126-95d405c9f38b", "value": "T1CB0412EB271C510FF8E62FFA1B19181E5407CC524B1D6122EE8B7E1E71B2E21E6D453A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665712, "uuid": "56bae830-3311-4d2d-bfeb-66948baf5192", "value": "3072:lmV746LbU8u7la4pMvuR1+WOyV+N+u6UqGdDXbwkgQjBZZiwee9It:k86HuJpYuRsWnVm+uELYBqwr94", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665712, "uuid": "12a70e3e-ee86-4780-a1a2-06c6da53f0f4", "value": 187256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665712, "uuid": "c00db51a-91c7-4c72-a46a-5766c0a4493a", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665712, "uuid": "ef5f1445-2c39-4021-9d71-ce9a54b3bb38", "value": "SCAN_REMITTANCE_SLIP.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4208eb9b-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660571, "uuid": "6c921671-24d3-4d1d-9b2f-bab645a8650c", "comment": "Malware payload (RedLineStealer)", "value": "150eb4dbddc9cf62b2dbc2b101b21402", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660571, "uuid": "b8f0e05a-ebd6-4304-b97b-6efbe013748a", "comment": "Malware payload (RedLineStealer)", "value": "b1c678f842132577d94f8d26b1d6247a6cff5ebe12c2e3fe9f9add886f49d9b0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660571, "uuid": "289a3aec-7fa8-47e8-8675-ea3f8839a426", "comment": "Malware payload (RedLineStealer)", "value": "b0626ed02c3cb27924cbe6bf105a0f2d646582a5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660571, "uuid": "26be9b91-15b2-4ea3-9f76-a188dd45a808", "comment": "Malware payload (RedLineStealer)", "value": "517d6188b5bc952caf0cc871dcbeda1ef839b17510a92f3be0bbe525917da29f1fdb8be19ba3b117eafddcd0f70d3baa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660571, "uuid": "f80dd5f8-2ff9-40b4-8235-8e994f380d0e", "value": "T17284E0713580C431C8856A30882AFFB05ABDBC7119A5498B77B03FA9BF323D1567A65F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660571, "uuid": "637dd21c-7746-49fe-a1de-2c62e8134223", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660571, "uuid": "6a19357a-b661-4de2-ad68-eaf55f39829b", "value": "6144:W6SLtz2Y0x19I2M+ES935uJsMW6z0OYC7wjwR7HZOY1lOgV:WV2Y0X+2MbSV5uf0qEEB5OY1lV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660571, "uuid": "a51cd383-0364-483f-bcd4-a4c365ca31f8", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660571, "uuid": "75188a88-64fb-463d-8599-e908196fee82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660571, "uuid": "7e6b22bd-ed5b-4442-80d6-980825314e9a", "value": "150eb4dbddc9cf62b2dbc2b101b21402.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c27bf645-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642660787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660787, "uuid": "b33032dd-e240-4338-a4f3-ea21bfa5d9ee", "comment": "Malware payload (Heodo)", "value": "c2ce0e5d4d7eb7b429e77e7bbdf09801", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660787, "uuid": "dbc138bc-0128-43c3-811f-e8c3772daf2f", "comment": "Malware payload (Heodo)", "value": "b1ee7aa00b7884ed02a3f5ddc07419b6e8dd6e7382269d8cc5511f06431d5eaf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660787, "uuid": "651e85e1-5ae0-4bb7-b4b5-6441fb5066dd", "comment": "Malware payload (Heodo)", "value": "71b41e18f5596cf7a8fcfee18679f84d536fe822", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660787, "uuid": "5531ab82-f98d-492c-be78-3801ddc3e07c", "comment": "Malware payload (Heodo)", "value": "3600466b6b7677dfa6f5a3f13c1027409b3fcc152cdfcfb9db2ecb9db6aec610fd89665ee0712ef48faf7aaa09a18751", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660787, "uuid": "87c468af-05de-4b7d-b8d8-a3f8a416e65c", "value": "T10AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660787, "uuid": "9aa7a3f1-c453-4860-94eb-4ac87bbbab28", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660787, "uuid": "692235c3-29f9-4b88-817b-cd6071e10851", "value": 144795, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660787, "uuid": "a2a3b05e-0c7a-4fc7-a051-95ed509c20a9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660787, "uuid": "80a619c3-8807-4b61-b17a-395482f0a8ad", "value": "c2ce0e5d4d7eb7b429e77e7bbdf09801", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0cf5d26-79ea-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1642680997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680997, "uuid": "b21fb79c-f057-4d34-a7f3-3ceeab0c4f41", "comment": "Malware payload (RaccoonStealer)", "value": "bd1deb82ba2140eae3299f419783bab0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680997, "uuid": "dc6045d7-873a-4cf1-8942-56f025335dad", "comment": "Malware payload (RaccoonStealer)", "value": "b31474d8c16181a103a6ac36d9277eb7ac5dbb7261cfa74f82adbc8b2d06d3fa", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680997, "uuid": "4ade5dc9-b98c-4905-be03-5d3434b5b599", "comment": "Malware payload (RaccoonStealer)", "value": "f124c0e4ad7be58a85271f74b8c9e5d671d70aba", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680997, "uuid": "11012b72-26b4-4cbe-9d28-6abf99af8ac2", "comment": "Malware payload (RaccoonStealer)", "value": "c7b89f80f340ce1a8168eecb972e092cf1d65cebb0b38fd7b54cb0c6b81de229486db5f02e2ab9029eb98dd5e2060092", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680997, "uuid": "d165ecfb-6dff-41fe-b1c7-dc568fa2c222", "value": "T156E4127179C9D031C0468B34492A8FB04FAD7D327A5A824B37A52B6DEF6539046BB34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680997, "uuid": "83e9149e-113e-4e32-aceb-4697dd7246c5", "value": "b7a0d2a66e86e27ee741e32de65d65f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680997, "uuid": "9d818d52-edaf-4c5c-8b56-80f5d1c92efe", "value": "12288:EVhdKDXjhMlyC/az7EP8p3Vr6FRGwFiGm+Qzq+7c:sOX9MlyJnEPeGFkHGm+QNc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642680997, "uuid": "edb20249-e295-42b9-86c8-4a634801fad2", "value": 686080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642680997, "uuid": "01c09f39-0fd7-401c-bb73-da51c2464868", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680997, "uuid": "6f586adf-22d1-4d75-8b35-540f54de88fd", "value": "bd1deb82ba2140eae3299f419783bab0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7cd2b7e0-7a11-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642697606, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697606, "uuid": "7b2007bd-b2cc-401c-b890-ba55cc9d1482", "comment": "Malware payload (SilentBuilder)", "value": "9db324dc873d1b9f5d96ca9f242ccbce", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697606, "uuid": "d41e1169-0a3d-4746-8627-8121e6f2c4f7", "comment": "Malware payload (SilentBuilder)", "value": "b3973d991b4f3e3870404c40bf59257bd40f4207f10dd5a6c34a8d4e29e0f7ea", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697606, "uuid": "bc224bc3-7b94-4e1f-bd80-19c3c74604b0", "comment": "Malware payload (SilentBuilder)", "value": "9219af2794c0c4c3f3ec48cb1067db541372fdd5", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697606, "uuid": "5b4a5fbb-a178-4114-93d7-7b2b04f50200", "comment": "Malware payload (SilentBuilder)", "value": "78350196816778cca36037f67353f1debb54abf909a5b04f1e95059b10b44152d777d0d09164410176fd14a177baa7f3", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697606, "uuid": "4a0bd678-bbd1-49e6-80ef-7c7e6cd11d4f", "value": "T155E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697606, "uuid": "e8eb5003-0d62-40bf-9b79-17960eb17d47", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642697606, "uuid": "a82730d1-53c1-4556-83a2-f9fc17042510", "value": 146355, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642697606, "uuid": "a7394cf8-a6d4-4ba0-bfbf-8197ca38d38f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697606, "uuid": "91d62553-b3e5-488d-a4bd-ec5fb42a9133", "value": "9db324dc873d1b9f5d96ca9f242ccbce", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "259e81c0-79db-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642674267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674267, "uuid": "ad2b9085-0e9e-4e73-adcc-5fbfcd43006d", "comment": "Malware payload (Heodo)", "value": "eb005151261a965e948b90b4b82bd2fb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674267, "uuid": "ab66b62c-4be9-4e9e-b8b2-f742085a1099", "comment": "Malware payload (Heodo)", "value": "b3bbe5c6707c4ecdaab7fb309fd2df58247cfcc4208d3dd5c3570171de51a660", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674267, "uuid": "6ba15ce0-3caf-4b0f-a565-01718a8a5040", "comment": "Malware payload (Heodo)", "value": "987c3ce136ae9781807d70ec0f3f8f8ac093a8b6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674267, "uuid": "0df7119d-feab-4470-b0d0-bae476e82395", "comment": "Malware payload (Heodo)", "value": "3aa65a819e445e4690a4ce8aec9557b12298d84fed21b2def687059f894734c695c63ba6497f295e90f295a376345a08", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674267, "uuid": "d04609d8-8f7b-467f-adfb-f47113421904", "value": "T14AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674267, "uuid": "c0e1e1c5-f015-4acb-ab34-142d1a84a3b5", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674267, "uuid": "84194194-9f00-4afb-a070-90488a3caf6b", "value": 145178, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674267, "uuid": "f2f89311-2058-468a-9ea3-8d266b7c30df", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674267, "uuid": "75d54fcc-65b8-4155-96c6-be8fb9fe1129", "value": "eb005151261a965e948b90b4b82bd2fb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cbdd020-7a27-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642707001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707001, "uuid": "718167ee-ac00-447b-8c87-28848366f3cd", "comment": "Malware payload", "value": "8f03250f61dbe0ba3c025c63a3a2aed5", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707001, "uuid": "3adcc424-2c2c-46d7-b766-442518fbf02d", "comment": "Malware payload", "value": "b415e16e11447fc9afdfdd825bb8a0543f870a654b8ac27e55460c3f760d0139", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707001, "uuid": "7ea5d443-9621-4bdf-9b20-65d51888b9ae", "comment": "Malware payload", "value": "15c6ab6f68cc6dec6b3a5c6ba21b1a964f6a1230", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707001, "uuid": "65238dda-f86e-40a0-bac2-d5857660ad83", "comment": "Malware payload", "value": "928d2d650aa6082d51cb83e8b6d25f4099f583e7aeeed27c7bbe2d29a4dbf7ed60aed11d5d6adf9b5d393f4123a92235", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707001, "uuid": "128af4f2-e307-4747-8fcf-0a4acf07689c", "value": "T1E004023D7F18810BECE72EF1A3DC569B3928CE6C121A8D5B158839EECCB0C0975D9656", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707001, "uuid": "b5ba55de-2b1c-4731-bb66-37f411271762", "value": "3072:hyqgRbuwGVVapVYGpqj8g4UGD+5IuxF7K5rHXtYcrxtVVNRniLf:JgRawGT9E5a2dOGxtVVniLf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642707001, "uuid": "15a90495-7ca7-489f-afdc-86bda8edb3c5", "value": 186904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642707001, "uuid": "957f6f71-6a5f-4fa8-8c7f-a9da793e2331", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707001, "uuid": "421dc2fc-df3b-4ceb-b50a-c757dd6d4b21", "value": "192857356-045516-sanlccjavap0003-11462.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7416cfd8-7a20-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642704034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704034, "uuid": "4cc7796e-a82d-4a2e-b7d0-b01ecf281cba", "comment": "Malware payload", "value": "6f3be0dfe6b5971b16464b7924772445", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704034, "uuid": "40fc774d-70e9-471d-adb3-17f38783ddd6", "comment": "Malware payload", "value": "b51cb6fa584a073fe95bcf8749cf84363cb431f520a5d97cec92aae88329b7cb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704034, "uuid": "9140a1aa-3114-4a5c-8bbd-a429ef1d1682", "comment": "Malware payload", "value": "8af5e975c00f5bdbd843f644a60adbb5f8da8a0d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704034, "uuid": "d76bbe09-236c-4baf-aa38-3bf61b219a3e", "comment": "Malware payload", "value": "997098696ad2ce26d2cd58131a17c58dea5f675a3f7463399503cccffb031bb23d903a017850e5bb96edeb35fd8e7442", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704034, "uuid": "faaa7381-7633-48bf-a65e-ca5b1966ff67", "value": "T14924CF1DB3D200A9ED2B9139C6836916EA77381297609DDF47284764EF2F7E0563EF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704034, "uuid": "cb592cf8-d95d-4f96-9691-5f371d006c27", "value": "7c661725970e2285630167e2c43a72e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704034, "uuid": "33d148fc-d5fc-4dad-9658-7b3c1b5379e7", "value": "3072:GmmcI7/mAuyLKfrsP5PUD1jB8pZbiYbrmdwDb2lyZi4oRWLuaW5FxvwR0N:/jI7uzfrkAjBoZ1bRi2JYx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642704034, "uuid": "0afe1956-36c4-4346-9db7-3eef6d967d05", "value": 218624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642704034, "uuid": "7aa4e429-0c47-4bef-9b7a-5b236be354d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704034, "uuid": "17908134-6326-44e8-8dad-8c27239f8f6a", "value": "fileman.pdf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a942ff3-79ec-11ec-9275-42010a9c0029", "comment": "Malware payload (ModiLoader)", "timestamp": 1642681550, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681550, "uuid": "dc426c28-562a-43ae-b28a-121c55c5d225", "comment": "Malware payload (ModiLoader)", "value": "a18e116f7756a4944dc659230e3410a8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681550, "uuid": "374896a6-7812-4e04-ba71-72d374dba22a", "comment": "Malware payload (ModiLoader)", "value": "b5cea089bb899e75deef98dc1569dc3af17a070f6fa594377b49299d63bbbd8f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681550, "uuid": "cbbe66e0-3937-4133-9f1f-283037a5076c", "comment": "Malware payload (ModiLoader)", "value": "23dad6f3cff1600b13173323f2a07e9b2621e5ee", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642681550, "uuid": "df20c2f4-fbbf-48f6-89e9-a067f1b56cdd", "comment": "Malware payload (ModiLoader)", "value": "95001c61fba3e83c900565ddb09e6716ed688c57a36a3a4edb9ac666fe90e6fc5078e543ae4f5588f2b344731e13f008", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "ModiLoader", "colour": "#54DCEC", "exportable": true, "hide_tag": false }, { "name": "WarzoneRAT", "colour": "#835220", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681550, "uuid": "80dd58be-2886-4d1a-84e9-f48ec252178a", "value": "T1C8156B63F1A18472C8231A394D27EBA95529BE017F197A477BD47E0C4F7A2C13929EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681550, "uuid": "52f61dcd-35db-42d7-af18-eec070a37c0a", "value": "d571f528db93ab4c8d72c51955dc7b93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681550, "uuid": "de811057-b187-4e92-85ef-a4dfba968080", "value": "12288:wHFymIc+xnYsoAFlK/st03JMAIliAhojhZBYf2WZsOvVyW7T3bnvwv2:wHeaAFlKYevUBb2yyKT7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642681550, "uuid": "33cbc098-b5c7-418d-bb68-727112401667", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642681550, "uuid": "9831c005-afb8-498a-ba24-63a69fa2f0ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642681550, "uuid": "2c050a6b-13dd-4b84-b29d-409c4a4e0530", "value": "Updated New Order PO #000167249-1-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954b44c3-7a0e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642696359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696359, "uuid": "3d362fee-33ad-4d6b-99dc-3a1d07a99b9c", "comment": "Malware payload", "value": "517947745c5a942a3c5a6112cff3bf64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696359, "uuid": "41657dcf-7ac5-4861-b9f9-f74492fda7aa", "comment": "Malware payload", "value": "b674217960f18b4955514f644d8c68b3f380aa4fd11e08cb62a395b3f5126c6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696359, "uuid": "53265f95-f9d2-482a-93d1-ccae7b1c1e1f", "comment": "Malware payload", "value": "c4e2e5ea268d0c2a574dedfe80ea5fb9d17a9170", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696359, "uuid": "c5caa625-950f-41da-b5ca-c460c88fba3b", "comment": "Malware payload", "value": "f3c59b91186c9dbe319452a11ecf7586ef36e5c8fc2e3e29457822ba1ac19930bd6d9ae5963838d4f7b1d7496ea1e28c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696359, "uuid": "04990326-4ec8-4b0e-b3f4-a9c40faba60e", "value": "T16F64228671D2AEBBF1D70D7622FBA778A778F7091A42491743398EE7342018390563E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696359, "uuid": "d928adea-171b-49c5-8f24-bf2a90a61542", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696359, "uuid": "2e6746bc-da3a-4165-a415-8e72f95692c4", "value": "6144:owRuFJPp2bmdYBRVX6JykOHFoE9nwSup1QWTDpGiqmFa/ExlNIk:d0h2bmdCVIeHFtwSup1Q48/mISIk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642696359, "uuid": "0af2b861-5332-4edf-a48d-bf1b31f28a7b", "value": 317821, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642696359, "uuid": "cb982e13-96a3-4670-a532-050da26c8314", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696359, "uuid": "c016364a-9659-48f2-85db-59cd3c846b40", "value": "517947745c5a942a3c5a6112cff3bf64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d2775f-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642665731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665731, "uuid": "521cc944-4459-40fb-b309-3b1779f062f0", "comment": "Malware payload (AgentTesla)", "value": "bcf354b9aed6e68da00a525c4dd8f44c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665731, "uuid": "86c14469-1440-4ed1-9692-7efe0613dc84", "comment": "Malware payload (AgentTesla)", "value": "b6819bb999fc8592457dacdfa3a36389c935abe925b400f3b9f0a3304f96c482", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665731, "uuid": "65566690-5bb5-42dc-b152-cc1614d62787", "comment": "Malware payload (AgentTesla)", "value": "3a5beef1a11c617a911c3762edefc73ecd2b0b1c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665731, "uuid": "4f3ea4f7-cfb3-480c-81d9-5008d5894020", "comment": "Malware payload (AgentTesla)", "value": "962c91f003bd0538c5e84882e4a8297c1b590cfe8138743d39dce5fa19600e5c5a8e6bd5eb541aeb35ccae3980adfa6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665731, "uuid": "896b776c-94f9-4261-85d1-75c08abd1b4b", "value": "T1A464120929E5C873C6A7393020F30A639AFADA013332199BBFD40F6656E51DBE41F567", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665731, "uuid": "35ec761d-907d-4059-b526-46a3cc6e5a99", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665731, "uuid": "1bb15917-7417-452c-ab3e-0375fef8ea50", "value": "6144:owSEOucVOzKmEmscW0FEkQ/gTObEkKFc1S3PfLYyOVzLdeQIIhOm:mEOKzKmERcW0zQ/0Q/KW1GHLYyOdAQIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665731, "uuid": "21127c05-d485-4ac3-9bdc-231406efb276", "value": 317014, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665731, "uuid": "4add5bb6-ba29-4c02-8250-d2a97537d8c3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665731, "uuid": "a8799fac-0ae0-44b7-8bad-50d0b22a9648", "value": "Halkbank,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca9a0beb-7a06-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642693012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693012, "uuid": "da7920ec-c13e-45a1-94c1-7421e7857a35", "comment": "Malware payload", "value": "f08aee9a68532bc3496dcfdf2f619f7b", "object_relation": "md5", "Tag": [ { "name": "Coroxy", "colour": "#E2C864", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693012, "uuid": "21697fe5-4b3d-46d9-a48f-2fc87ab8996d", "comment": "Malware payload", "value": "b68bfd96f2690058414aaeb7d418f376afe5ba65d18ee4441398807b06d520fd", "object_relation": "sha256", "Tag": [ { "name": "Coroxy", "colour": "#E2C864", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693012, "uuid": "198c1500-28d4-4b4a-9d78-1b9cde93e8f5", "comment": "Malware payload", "value": "470dd40221b64d1cb8ca40ecb17b3877bef93437", "object_relation": "sha1", "Tag": [ { "name": "Coroxy", "colour": "#E2C864", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642693012, "uuid": "3ebf0041-509c-4d5c-8d50-2580b2845833", "comment": "Malware payload", "value": "e971f46c521c2b18e487c92c36de353f9e2c49dd6914b39c8b0c8953b475c21d51713130dbe8bd74f6b9d1711cef7291", "object_relation": "sha3-384", "Tag": [ { "name": "Coroxy", "colour": "#E2C864", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "hacktool", "colour": "#059CDA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693012, "uuid": "0fca3558-2985-41c5-8ee5-34ff7f677b3c", "value": "T1CE52417232E5C6ACD8C0C479A7F3E276D81234314635B152F3E256533E24919E97AF93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693012, "uuid": "5244afcf-0d3b-4a43-8765-3943a691225e", "value": "192:GVOmE3N4EnztTqF2opnHnpola6Zu0MqzNHhCyLtVm5cc3t:kRqTkZnHkdZHhCyLtV2X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642693012, "uuid": "bf7d67ee-1d81-4c27-9a98-6a47a22a49c5", "value": 13896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642693012, "uuid": "b765cf7c-f363-47d5-a2b9-e6dd8203d24e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642693012, "uuid": "77419d59-e9ff-4c9e-aac4-59601a8dfb83", "value": "server.out", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23270f26-79f9-11ec-9275-42010a9c0029", "comment": "Malware payload (TeamBot)", "timestamp": 1642687148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687148, "uuid": "d8c4e494-67bb-4558-8bd8-2ac3526bc24d", "comment": "Malware payload (TeamBot)", "value": "0c4d308254cea8285969f26023123a46", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687148, "uuid": "671e1608-cea9-4302-ae82-4cba47deae1a", "comment": "Malware payload (TeamBot)", "value": "b6f3db88b8c6070f8d31d9c36caa59ac7fbdf99b9eeb741ec3e25c73b23bc822", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687148, "uuid": "45168947-8db8-49d5-9eed-ade2ea076926", "comment": "Malware payload (TeamBot)", "value": "54ffda34ec3766b837d04b36987c01facf183098", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687148, "uuid": "6bf16a3b-2347-442e-9289-82d4a2a2d7c0", "comment": "Malware payload (TeamBot)", "value": "ef679642380ab899b38b9eb4e209c4aa2a1b76dd1b40a8759ee779d5097e78415e4e9c199d58921ddd37d9d210df4e0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "TeamBot", "colour": "#0020E9", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687148, "uuid": "091d9df6-3057-4e1d-883c-b6252f9966e8", "value": "T18544AE317A80C431C08B5634842AEFAD9FBDBCF56AA5464337A4276A6F312D0167B35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687148, "uuid": "e3063764-dbed-434b-94a9-cd87099810ad", "value": "897a5806e5491100f466efd56d26d7cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687148, "uuid": "610e657a-1880-4b0a-8e86-37e7d17b17b6", "value": "3072:tLYwLANDpa47RECfKm6wleL5rfkeF13RM/h3:tMwLALa4OCfOzfkU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642687148, "uuid": "4c4cd4d6-ec3d-4964-a6e2-058d2061cc38", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642687148, "uuid": "780a7f9c-f1d5-4a4e-9078-e71c28428949", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687148, "uuid": "3299e97a-2b9a-4230-b2d8-21af937792bb", "value": "0c4d308254cea8285969f26023123a46", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5263024-7a01-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642690909, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690909, "uuid": "a59e9faa-48ba-40c5-bfae-bcd409bbe1fc", "comment": "Malware payload", "value": "0bd0f1dd8b03c11b3d59da2c5fba2e45", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690909, "uuid": "1626d151-7dc6-44f6-b335-26e6c44e0412", "comment": "Malware payload", "value": "b70b431e5e961e8d8d27887596cc1c53a420292832f7f354979eda3ad80382df", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690909, "uuid": "99e67227-20bb-4c7e-bfd0-ae1c4313f4be", "comment": "Malware payload", "value": "32b705351c75c8fd87068530a851e735bce5cb22", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690909, "uuid": "d81fa8f4-0873-44c7-b840-b44cf22b393c", "comment": "Malware payload", "value": "b68f6ec1eb76360022f78982ca278a1caf7fbba342c955fe502a1fe5ded73464de5706074783e5584489ab76c216dda1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690909, "uuid": "faebcd16-2bb3-416f-ad4c-000d7d2a735a", "value": "T16A57BF7E3720D0B5C96F4A32AFAD733A40FD5E1E9685A1DD52407C6B6EA485C8180F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690909, "uuid": "6506c422-ebcf-427d-8c4b-da72a03af2b7", "value": "af675de55cde0d1713ebf4ec8c8657f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690909, "uuid": "31cfb18d-dbf8-42a8-9bf5-97b21b5322df", "value": "24576:7XgtaCtBu7TdIdetMgkaDRX5hMbZueqSS1GU:EtaCtA6dQkar+bZN3S1X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642690909, "uuid": "9168e26c-0dd9-496d-9337-7f96244f68ef", "value": 27233280, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642690909, "uuid": "9788c47e-6a3a-46ba-8cfe-06227aa30ff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690909, "uuid": "531dd64e-d17f-446d-a0bd-5fa600efb507", "value": "b70b431e5e961e8d8d27887596cc1c53a420292832f7f354979eda3ad80382df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "15b3150f-7a13-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642698292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698292, "uuid": "bed58408-1196-49ca-b7aa-71136b97f871", "comment": "Malware payload (Heodo)", "value": "8947daa408d80be28de8fcbb3c8d4580", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698292, "uuid": "363f2d67-aae2-4c83-958e-81cf53baa0b9", "comment": "Malware payload (Heodo)", "value": "b7c12da037688c432bf94d80c88811b29b1a4d379a84ff3d6e6ac95eecf15680", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698292, "uuid": "a32816ce-a077-4100-93b5-59ed5e79c9e4", "comment": "Malware payload (Heodo)", "value": "f523055cbadd5692ba7b846ac32c05325c428972", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698292, "uuid": "bd5fbb09-2bc8-4300-8624-2f4be6cd3d0d", "comment": "Malware payload (Heodo)", "value": "bb0db7fbbe3ee0609d3695a49d3fbfcd79614e8cb5543cd7ac1fdd16ca8ea8f0fee53077973234652f4b8fe06ad14d3c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642698292, "uuid": "e4d1bd19-9687-4cf2-a6d6-2a5afffec7bf", "value": "T155E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642698292, "uuid": "16cecc71-42ad-48b5-91d8-70cd79e83e91", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642698292, "uuid": "f29b737f-bd04-4f6d-8c62-59b31a824df1", "value": 145824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642698292, "uuid": "dd9ecee4-3476-4cb7-87a8-e1bc5d3c6469", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642698292, "uuid": "9fd019cd-69b5-49da-8828-dbc469ca408b", "value": "8947daa408d80be28de8fcbb3c8d4580", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b61f0e1-79bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642661419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "247a9786-7e77-4bd3-9264-de350d828e5d", "comment": "Malware payload (Heodo)", "value": "b98b6f48278e09e61479317c3cd69b13", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "a28f4b38-3618-4add-bb22-65a821145ed1", "comment": "Malware payload (Heodo)", "value": "b7d644c9fe89b9263dbdd3618f3dfa8c951b2dfdcab7cf43e64136982a70dcd8", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "25ef1666-0919-4791-bb36-54536835aba6", "comment": "Malware payload (Heodo)", "value": "6b28b2c4750d6297d90291a6422aeb23dfed17a0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "29cc4637-3ac9-4e8e-bdb4-411c36f450fd", "comment": "Malware payload (Heodo)", "value": "8416866809fd87a1fe5f9c58c958942e94078f7527f59e6c3a59fe16c830f4c68ab051e3772ecbcbc41b23dd457ed8c4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "d2841776-0ab7-4a1a-a1e2-0f750fa76c64", "value": "T10CC4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "e29e1aa6-4178-48ee-9b01-38827cf3e37c", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "b652051d-fea1-409a-84f8-826b69a52216", "value": "12288:P78OGF+L8/4UUNyr8dMhTq/n4vAzdkPs7:D8Ody4a8dbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661419, "uuid": "aa59d255-a600-4fdf-b78b-5add0c997d64", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661419, "uuid": "6681db59-63c6-483d-ae0a-c508ba89ce50", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "8ed925d9-86d4-48ef-9812-f50249e9e7ae", "value": "emotet_exe_e5_b7d644c9fe89b9263dbdd3618f3dfa8c951b2dfdcab7cf43e64136982a70dcd8_2022-01-20__065014.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27f03b07-7a28-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1642707342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707342, "uuid": "eebc6119-b13e-412e-9371-650bea11e2d1", "comment": "Malware payload (BazaLoader)", "value": "06e70aab2069b7c471f4cd3d70ba3829", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707342, "uuid": "fbd075a4-e8cc-46be-b701-9103996006ba", "comment": "Malware payload (BazaLoader)", "value": "b86125097a79fa65922b0161fcd1f2c6f4fb70237b3074746eceabf8f799b253", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707342, "uuid": "d4ec4223-430e-4103-acb2-0643c848f7b2", "comment": "Malware payload (BazaLoader)", "value": "2f0963a785963e3c78c8b5eee742caf1d0368db0", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642707342, "uuid": "d6f86790-6550-47c9-88d9-8e3c15dbdf4b", "comment": "Malware payload (BazaLoader)", "value": "aa066d5dcb4feff5d0dfa8ec8cb413916a3a12704321a0134b2ac45e293554b911fbeeb13aea9e3db2f38771453b013a", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707342, "uuid": "e0175390-535c-4968-a0b1-b685ddd06d2a", "value": "T103552C83081C45BFDEA3C66421661CA3DDF57C57B2C85E1AE5D868785CEFCACE08618B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707342, "uuid": "57380f59-0bf9-4107-8daf-f458b23855f9", "value": "f30f2b5b65c947eccbf132b668fe3257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707342, "uuid": "e9b19296-6a33-4d0b-8568-00c279b3a7a2", "value": "24576:ANdPtE5JMrmdumG4tTgP/4we8ZXWt6h732WiGH/uwi+7Cz2It75V5iMAck3zP2d4:3U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642707342, "uuid": "a0f1f404-8588-4349-90df-05a7a9938059", "value": 1372672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642707342, "uuid": "92cc49e4-9fd2-4752-8c91-91cb60841086", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642707342, "uuid": "48387d27-7061-4e19-bcec-f0178b26b505", "value": "b86125097a79fa65922b0161fcd1f2c6f4fb70237b3074746eceabf8f799b253.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea45a78f-79da-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642674168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674168, "uuid": "541c6926-8152-409c-8550-b7b95249744b", "comment": "Malware payload", "value": "ba08f3bf6daf1e6175a847e7b480c725", "object_relation": "md5", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674168, "uuid": "408c08f0-19ac-4718-8d28-b40b76ebc653", "comment": "Malware payload", "value": "b8ba198d916393f6b78fffa850c27c6e86adc35a7011e34b61e4a25f21e9688d", "object_relation": "sha256", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674168, "uuid": "748d27a3-0290-4288-92d7-fda0f4a87922", "comment": "Malware payload", "value": "608ad2ca45885a723be0a78ed96f433eb1310e05", "object_relation": "sha1", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674168, "uuid": "80622d24-f497-4ba3-b57b-bb005210a02f", "comment": "Malware payload", "value": "830419172fa2b33175e358efc8eee7c5d13ee7dcfc3e8c9624f06d9f755b447888cc7e5fae27fdbffec1ad0204d7604d", "object_relation": "sha3-384", "Tag": [ { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674168, "uuid": "0a4bbfe0-942e-4309-b666-5ff3ab490ff9", "value": "T146948E106BC7C07BEBE32675806A962F293572F5033496C7D3851B379A983D3A937386", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674168, "uuid": "a581afbf-3189-4338-b177-35a5ead917fd", "value": "6144:kKWyo2BcJ0ZrvFHLn0Phf8frkGMYbrmkFtld9DTp9TBvfurFP:T5cJQrvFHT0PV8frkWmkvNN9TB2rF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674168, "uuid": "a836a70f-2720-4b24-ac9d-6b6a97005361", "value": 409600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674168, "uuid": "66004014-552a-48fb-a67c-0d1c2fed362c", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674168, "uuid": "5172ed4f-20d5-4c96-a1c1-6a4a51394d12", "value": "test2.txt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c1915c-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708673, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708673, "uuid": "c6ad7992-dab7-4d99-9938-bc252e52936a", "comment": "Malware payload", "value": "f206d3c5c2ff33e66028369eab23b0cb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708673, "uuid": "dfd50d08-d71a-4b47-90cd-23694e27c8a3", "comment": "Malware payload", "value": "b8d6463337eb00ec57b8f5596b6680330b591fd73913acea30f96b5cd726abb5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708673, "uuid": "7a2973d9-e27b-4e09-b531-715159174976", "comment": "Malware payload", "value": "12e8ad4cc8bb81450497f2fa1ef3372780771c1b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708673, "uuid": "cf38bb7c-d2ef-465a-9750-9b22da72f41a", "comment": "Malware payload", "value": "139bc8e52b32dfb12c6983035dc536cbb7bc235978a83687bcf7f51129e7401c0316c583551c5940bd619d507e997492", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708673, "uuid": "bb0a7d05-9f70-4bd3-bb31-646818c431dc", "value": "T19AE402217FD24356C75EC7F88D7D7C2093B8B5963964CE6E4D8A9DEA0328B818710B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708673, "uuid": "eb4db935-eba6-4eaf-bab8-e7c92c041ad4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708673, "uuid": "de4b7a7a-a893-401c-95c3-5d0623cd7819", "value": "6144:BM3Gn8xiI5sT2zeTW+ndCIgw8CIgw8CIgw8CIgwSVUBAl7/q8MXNwkoWdg5Wnw36:fiiiE9WfXGd333xu2MUzopAhbpuvqd/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708673, "uuid": "7d6c6e2f-de8c-415f-adfa-20d6f4a9c9a6", "value": 701440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708673, "uuid": "d0d63198-5198-4ea6-b713-4011e581cc21", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708673, "uuid": "61a6a590-d394-4159-b7da-def425a1f131", "value": "f206d3c5c2ff33e66028369eab23b0cb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56c6d888-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642668766, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668766, "uuid": "97d07cd8-2dfb-461d-a505-0c02e3b840b2", "comment": "Malware payload (Loki)", "value": "5207efdcdf362807f44ba6e61d1d0a64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668766, "uuid": "a841be47-bcae-4edf-bef3-1d7049c0adf0", "comment": "Malware payload (Loki)", "value": "b8f4efdf0e587bd2f32fd55618c5f40b5934353699ab6e4288ab47a5acb9e295", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668766, "uuid": "5af0ade0-5bde-4317-8782-25fcb91730df", "comment": "Malware payload (Loki)", "value": "77b73e06ae35f38316dda50c386f1a746731f3af", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668766, "uuid": "bdd93c35-23e5-4a61-8fae-66dfc3e5e5c6", "comment": "Malware payload (Loki)", "value": "b99d9ab04afb07a1e8f2de3bba2e60f0a2788a7bdb773d84a8c376f2ddc17ba3b7b944ff4627f2d26936677962d5424e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668766, "uuid": "e8b90157-5e36-40a1-b7bb-d181ae978a72", "value": "T12C5412DDA1D588EBE1945F322563F79EA670E2063AC004CF0B651F3F7D982C3A609693", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668766, "uuid": "0b54dcf5-4082-4636-997c-2b9b36d682a3", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668766, "uuid": "bca97b04-5af4-42e3-807c-cd93ee190302", "value": "6144:owFiqPYjrcNmlMIgKck7/qg5y7NDtdNbCa2dCdoHGJ:BiqPdNmlxgKD7yg5y7vbw0KO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668766, "uuid": "3d40224d-69d0-4762-90ef-d8896270883b", "value": 281807, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668766, "uuid": "1aaf2e6f-354c-4a67-b964-a8ed8f788854", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668766, "uuid": "56d715a1-6063-4a99-bd9f-23ed4d9dda44", "value": "5207efdcdf362807f44ba6e61d1d0a64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fbee872-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1642665721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665721, "uuid": "f71fc980-c640-489a-9f53-e255f2d5ba5d", "comment": "Malware payload (BazaLoader)", "value": "f75225bfef07aa3184aa677b61520bd3", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665721, "uuid": "c3c2909d-5ac5-49ea-8ac3-12344c3bb5cf", "comment": "Malware payload (BazaLoader)", "value": "b9161245a81bdee1f12e09a4a66abb8ec219f10a4fbfa2023dcf2ca4a2ab7114", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665721, "uuid": "2555eec9-e3ee-479c-b988-aebc0789f5b1", "comment": "Malware payload (BazaLoader)", "value": "dc32f7bdb0fb5c76df8dd1a235ef9c0f85138af6", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665721, "uuid": "7299188b-6d24-4617-90be-a3f3dea66abf", "comment": "Malware payload (BazaLoader)", "value": "4880a3f8a3df4cb94ea861294c44d74aae9f828a63d0063e1886fa5283cc6253c39b8361e5c9856b75da2112c60fe4e5", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665721, "uuid": "b2f8a0df-cf12-4618-91a0-dcf5cd0fc7a8", "value": "T16985FD43180C819F9867D77421671D97EEB87E47F2C84E1ED1E428B84AEBDA674CA04F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665721, "uuid": "4bd67809-d503-4c95-ba28-e4914cedb3f7", "value": "f30f2b5b65c947eccbf132b668fe3257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665721, "uuid": "79eaec71-d6b3-4b28-9fda-584f8609d4c1", "value": "24576:Ua1QHwgJMrQqj/wAc6QORNx2nAjwkajm0GV9igWQlnwXwBwfaljN1X4GtZ+FdnZs:ZnEKFIhMd8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665721, "uuid": "c37294e8-7aa2-49a4-933d-91d267d896ef", "value": 1816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665721, "uuid": "4cd29dd7-776c-4902-88cc-e360bc2e3ef0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665721, "uuid": "c305f276-8341-4b2f-b605-b53fe4973452", "value": "f75225bfef07aa3184aa677b61520bd3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76ec9025-79c2-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642663666, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663666, "uuid": "c7337de6-521d-49cb-899a-74d121b5c215", "comment": "Malware payload (AveMariaRAT)", "value": "f93501b5a5c7c1fc7041a97993054502", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663666, "uuid": "4811d5e7-edf9-45e0-9cf0-c0cb673b4073", "comment": "Malware payload (AveMariaRAT)", "value": "ba8756835598445a7e081795f634f2e3d0af453967867c04558b83e833009ab6", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663666, "uuid": "e16665c6-0ea0-42b8-998f-6d134a4137f0", "comment": "Malware payload (AveMariaRAT)", "value": "efd817e4638608728f93831dc42e1851d377d6d0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663666, "uuid": "2b325d3d-8ad5-4dde-8076-e06df592b0a5", "comment": "Malware payload (AveMariaRAT)", "value": "432b47aaf1a288c88f4cf0548ecdefc28ea1cd5bcd804350a985f4853b60e24229476587d57d4b282069a11eca762dd5", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663666, "uuid": "b2c295fa-b632-4b83-8393-e2e022adf56f", "value": "T1E162AF6583A700CCC7EEF4BD6DD03ED8A35D3B81416BAA0592385C7C483B6DB594E789", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663666, "uuid": "40a675b2-a232-4885-be17-8873393cf0fe", "value": "384:lyXWVuAgRCnC3Qk8cqVohajxXbjE+kFidoPhY:0WopQC3Rq+ad/UFidf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663666, "uuid": "a753f55c-ce9d-42aa-8c67-af69850c8d3e", "value": 15365, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663666, "uuid": "96a131a7-9429-4a12-b382-7d46bca439a9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663666, "uuid": "edc3f05f-4331-42a2-808e-36958bbd8d67", "value": "DraftXContract.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c311af-79c6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665349, "uuid": "21c26e32-0df8-4cf9-bf78-76bc77c4c7bd", "comment": "Malware payload", "value": "18deb10d263acc159fe6352fccc35a2d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665349, "uuid": "ebb2bf05-b7c2-4d00-b429-2ecb6ed0b455", "comment": "Malware payload", "value": "baf8917aec82318f9025b714ea31ce0c96fa1c74199807824f508dc332a2a992", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665349, "uuid": "e54dcbc8-9bea-4fe2-8ec5-6b1a41502ea2", "comment": "Malware payload", "value": "19f22281628ef08a2b872e13b5d4278c358b5ea5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665349, "uuid": "9d471143-ee2d-4e99-8d9b-3a1d7a8eb27d", "comment": "Malware payload", "value": "b32339c769225fe1a69fbba093367538e39009f2869b4881887cbf429e9bb56641922e808ee8d1b5dfebbb99b8ed6d99", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665349, "uuid": "fd6bddf6-891c-4267-ad40-8106767590d2", "value": "T16A934B23B6C091E3CF9200FA30B9A776897FED32A039D44BA7A419555D320D1FB1AE47", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665349, "uuid": "779eecaa-dc10-44e8-b513-29ad9fe674ff", "value": "1536:389Af6sHpUi9Hn+d7FEUP9Wmevdi4reW1dUv9sFA9HqWptQgCMvXG746kop:UAf6suip+d7FEk/oJz69sFaXen", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665349, "uuid": "eb6068c0-05fd-430e-83c5-60f086371a6e", "value": 89771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665349, "uuid": "7c8b184a-1766-4dc4-945e-b3637b757f1b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665349, "uuid": "10eef932-09e6-4c92-92b8-1f57540bf934", "value": "18deb10d263acc159fe6352fccc35a2d.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ea22d7-79d0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642669483, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669483, "uuid": "8389db2a-f265-4854-9f82-2ad898d24d79", "comment": "Malware payload (AgentTesla)", "value": "80aae0d065ce385cd29002b59aea88fe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669483, "uuid": "dc780adf-d544-4446-8f48-3669f0d76df5", "comment": "Malware payload (AgentTesla)", "value": "bb61009ea4375108c7cc8b8f8fcd1a413147a702605585fea63f43d9660fd271", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669483, "uuid": "89a507b6-6e1f-4143-a7ac-6bec4c3f8583", "comment": "Malware payload (AgentTesla)", "value": "b90d43507f7e2103deaf4fd781da7d1e140888b9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669483, "uuid": "f23765bf-a53b-45f2-9bde-b6d3e32dd727", "comment": "Malware payload (AgentTesla)", "value": "902ef3143208622d7016abd7741ec71b9f49fc4266f673c7c3198b2fd8d5ebeef8348efaeb09d715be93316d3b2bdb84", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669483, "uuid": "c2a63c02-2b81-44b3-b42f-833ee6d9513a", "value": "T1B6A402007BF96B19E6BD8BF87522214017B97E6A3161F72C0DCAA1DD1532F868742B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669483, "uuid": "ea72a9c5-84fc-4fb0-b36f-f6a6100540ab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669483, "uuid": "3f72468d-4c1c-488c-86b4-75dc52a4dfe5", "value": "6144:Ug32LF3IS+5YFc4nEQjEJenet6GVWeo1EQB6u45/+wHEJfYRxDMEaaADfiYq:Zky5Kfn2J96GQ7XB6XfDEio", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669483, "uuid": "ec8bd550-5162-4a3b-a62a-95782e272c14", "value": 454656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669483, "uuid": "e13120a9-b8d1-41b0-a8d9-5c97034da7f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669483, "uuid": "563b36df-d96b-4baf-87d6-3bd000572039", "value": "80aae0d065ce385cd29002b59aea88fe.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0849dd5b-79dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642675077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675077, "uuid": "b3a19548-0db1-49ad-9858-7378e0e46cd4", "comment": "Malware payload (Mirai)", "value": "36b3146b12692fdab1e57cec4c679a9a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675077, "uuid": "b37ba7da-8030-4287-85e1-95b12ebd2578", "comment": "Malware payload (Mirai)", "value": "bbaaa4133670cc329e4780d3898e0508097a27b254e737afafbcad35f8568d56", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675077, "uuid": "90914b6c-e372-46ac-a29f-41551052333c", "comment": "Malware payload (Mirai)", "value": "ee8e16e09341b5afd8771af3c1a025af769dd9a8", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675077, "uuid": "86b40a74-93da-4861-b254-2c290b9a03bf", "comment": "Malware payload (Mirai)", "value": "6bed7a8975cbfc23f413d7c2719ac04dea4f089178cb5f1c783b981b5b8508f08d20fab3b5dd445cf95494deee3b45de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675077, "uuid": "054e7e40-1670-4c71-ac9b-fe6fd1093eea", "value": "T103E2E18DDD99B9E4CF1D0ABE84CE06259BC47492B14FE7891B099C44FFA5E8C790D028", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675077, "uuid": "452122a0-2650-4838-92ee-8a0bb8442b25", "value": "768:6aqE0210qfs/yRSmCSq3vopFS0gkakUxWRD:kNStk/y+Sq3QF7gbkUW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675077, "uuid": "26ee2de8-1ed0-449c-98d2-4b84117fcf4a", "value": 31656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675077, "uuid": "dc80efb5-0b54-4a8b-a9a4-44cbe4c2f6f7", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675077, "uuid": "1b80d0c3-cc38-4d6d-ac50-6b0a7050b131", "value": "Tsunami.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8959cc9-79cc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642668071, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668071, "uuid": "5b3cf4a9-e148-46bf-9df8-6016c22e3a51", "comment": "Malware payload (Formbook)", "value": "ba0522ceb915a084ac7b8f3e7d8868c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668071, "uuid": "6ca0a04b-a5a4-4c1d-9947-652054fe1fd6", "comment": "Malware payload (Formbook)", "value": "bc09ecf5cb6364f4d053ec0420282fa6e7a1649a8a5ca2af2ca933aa27f8b90c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668071, "uuid": "de04ba9b-44fa-4ffb-899f-17c4c9c6fd84", "comment": "Malware payload (Formbook)", "value": "39764b91316a1fa172c7b5db9e4f6e58dacec306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668071, "uuid": "64dc8876-83d4-413d-a008-7352c981adf8", "comment": "Malware payload (Formbook)", "value": "2cc528993d2707cb7bce982bd0bfb36732420d88a0e3cb4770e35c4c789c664ba89ce864ab2a1fc63a4f12e0052dc939", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668071, "uuid": "4eb533b9-b16a-4e44-bea0-da659602754c", "value": "T196A4F082F25248F5DD7D03726E778D66126BBCBEA8F0564F216DB62817332C310A791B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668071, "uuid": "2872463f-d6e1-49f6-b1d7-2ba0f1ae9979", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668071, "uuid": "3d902d47-9264-4e8f-b4e1-85baf6dfc691", "value": "6144:xw18f/M5U5xzJkr8BtRD4iMQLPxKNm9LO3cTqYGXoubM6gQZq:YO/rXVkuRFMKpKM9LO3cm3owM6o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668071, "uuid": "1320001f-aa05-433b-ad3d-a7194afd4815", "value": 451147, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668071, "uuid": "84ccfc4c-8117-4119-80ce-f25217bfd042", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668071, "uuid": "d6b16f66-39b2-4fb8-9dfd-121750e794cb", "value": "COVID FORM1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b643e3c-79bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642661419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "5da94de1-1b4d-4c04-a585-7b7713a1b145", "comment": "Malware payload (Heodo)", "value": "1855ccf1f8c41177187bfc76ad558a5b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "1933817f-1ee1-4ea4-b190-284c9b41f0fb", "comment": "Malware payload (Heodo)", "value": "bc55b65405a2d0392ee98c370390c46d4119985b0fa80d19609ee9418c185e21", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "6b738eeb-304b-453d-bb2a-c584f024ebd2", "comment": "Malware payload (Heodo)", "value": "5b0d90c77062136f4bae0afe477b726263eaec1e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "fa37600a-e9cf-4d3d-b1c6-a0f332721d37", "comment": "Malware payload (Heodo)", "value": "541a76be6ae8e8865ea6c8d4b9ca697591be0e8ac5443026794c715453302256a3605bed3a85ce1dc8b4a3887484e33f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "b9027866-8d82-42ff-b50d-4714a4d107be", "value": "T1F2C4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "4a9b93d9-330a-4b08-872e-a79514c4de8c", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "e2904934-c4f0-4885-9a75-21649b89205d", "value": "12288:P78OGF+L8/4UUNyrxdMhTq/n4vAzdkPs7:D8Ody4axdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661419, "uuid": "6b3e3064-ec9f-463f-a10c-8e5b40be6e33", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661419, "uuid": "bedea7f1-efe2-4a77-b4bd-ea52669dbb64", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "939ae690-4c9e-48c2-8245-fd05e4ac16d7", "value": "emotet_exe_e5_bc55b65405a2d0392ee98c370390c46d4119985b0fa80d19609ee9418c185e21_2022-01-20__065013.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08a5e235-7a13-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642698270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698270, "uuid": "566ec66a-fe73-4509-9153-7dad20c49993", "comment": "Malware payload (SilentBuilder)", "value": "db6e6aeb476e4e4ca21699fc9b0c6053", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698270, "uuid": "30bee49c-fb47-40eb-a631-f1e57faf1681", "comment": "Malware payload (SilentBuilder)", "value": "bcfa7cbaded9c6144689692a9ea193431c16e7bf18e7ab361ef65fce375d93be", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698270, "uuid": "3add6f84-06ab-40e9-8c43-bfae7920fd2e", "comment": "Malware payload (SilentBuilder)", "value": "a702a5f3e72b564be112a6bd0bf5b3dd7cfbd779", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698270, "uuid": "519948c4-0831-4309-bdf2-81fda1877eb2", "comment": "Malware payload (SilentBuilder)", "value": "dc8987e4bb6db5e6c6d429477f9cf72f564be1c2f5af648cb3bf0d019606dfcd051109626a052c9505d456a8f3156d76", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642698270, "uuid": "661196ad-0d15-47a0-9379-41029f2e5aaf", "value": "T1E6E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642698270, "uuid": "fe3833c6-8f08-4d68-b561-dc7138c4d441", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642698270, "uuid": "3db711ca-54c2-4395-be7d-31d513aadd1c", "value": 145974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642698270, "uuid": "820834e6-c65f-4e6d-9a9d-2df0950a9071", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642698270, "uuid": "cacf92d6-c5b4-4bf3-8ee7-5829ecd361c0", "value": "db6e6aeb476e4e4ca21699fc9b0c6053", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "67d6d30d-79e6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642679103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679103, "uuid": "d0514311-a06e-4983-96e7-55ba97f9ef1d", "comment": "Malware payload (AgentTesla)", "value": "a960bbd200f9771260f61fd3f137db48", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679103, "uuid": "cf68b6dd-bef4-45df-9278-58a51a70c73d", "comment": "Malware payload (AgentTesla)", "value": "be001aeeba8005c5acc6c9763fed8a2d92e6739c794b4b0bca0469623985fb9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679103, "uuid": "ab314fad-7564-4606-a162-55001bc70b4f", "comment": "Malware payload (AgentTesla)", "value": "fc0894198d7a1cc9c44d41fbf236f2d2519bd357", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642679103, "uuid": "213669c2-6e26-4d81-a3d5-eaa69f31e67e", "comment": "Malware payload (AgentTesla)", "value": "0e14c2dd8a7aff97b5791c8b3a7c5aa3d5c566a3a94449af29cf063c46b1a526b46f22cc9e510aab61cf491491783fa4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679103, "uuid": "6dfd1823-98a8-428f-857a-45d6bfdac919", "value": "T1EDB4CF92F4D444AAF8570B31BDBAA431255B7FEC91A4910E268C7F2A31F3742644FE1E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679103, "uuid": "a4a0e450-4244-48d4-a598-2a584fc22df5", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679103, "uuid": "ee2a48ee-6e6e-4cb4-a932-c9f633a34da7", "value": "6144:HwqQQyYCYoDJ7SpTMcmSx7NvMg6WAhylEspfyM/fxEsb+icT+I8XAngLb/KmUV+U:5LyYCAT5m27o4mk6M/Gs7++rAngn8E6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642679103, "uuid": "fec0a58a-7e78-4073-8da1-989f85dbd4ec", "value": 510233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642679103, "uuid": "29562186-8050-45fd-bbcf-f8649e5d563f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642679103, "uuid": "93edb163-27ca-4d1c-8e94-45b49c337365", "value": "Document_PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d7df4117-79c2-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642663829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663829, "uuid": "25c3c05a-74fb-4c30-a2c6-250852bac1b9", "comment": "Malware payload (Formbook)", "value": "fb55802ac8a807177bd16cf4e3322d1b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663829, "uuid": "f9c8fdd6-23aa-4dc7-befe-5c61eda64f81", "comment": "Malware payload (Formbook)", "value": "bed2b6abf700b607d4f856c63832bae23f4120a8786b5af4cbdaa0d8525a47bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663829, "uuid": "90ed9cd1-d84a-4a49-b914-c2607fc18b76", "comment": "Malware payload (Formbook)", "value": "36514cb2b383e907fef665d1b4cbc4613ea8b570", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663829, "uuid": "a4fdc1e6-6928-45b7-817b-a706fa901099", "comment": "Malware payload (Formbook)", "value": "49ab21138da5918a99d36f0a1899a8603d5d14b66a2c433903bb1430db923bd169dacb5c3d66521b2a68cdf16dfc0c5c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663829, "uuid": "e955dd0a-ae36-48a0-9138-3155c879cf20", "value": "T18A25AF23A2904433D4371A784C27ABE9592ABE102E28788B77F47E0C9F397517539F97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663829, "uuid": "56a30360-f720-4627-8561-688e2f2c2b28", "value": "9277af176d806a0016d6f2aea1e276c8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663829, "uuid": "806e16f6-de19-4f09-a4f0-11455ac0e327", "value": "24576:xx5RK+onXkmS7OR6gPSshzLnDyXranXKT7vHGe:xx5M+Sbos9LDg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663829, "uuid": "8dcd04c2-158b-41e4-b18e-3a82b4ab2752", "value": 1026560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663829, "uuid": "32ed296b-64bb-4bf8-b4c3-8f5195b265e1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663829, "uuid": "58b5185f-552f-45de-b1ea-18786d4d7c44", "value": "proforma fatura.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5c3e7d2e-79be-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642661903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661903, "uuid": "4c6076aa-250c-470d-8bf0-73a323a01aa0", "comment": "Malware payload (AgentTesla)", "value": "3eff9491953424af30b31b08436af9bd", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661903, "uuid": "0b567257-87c4-4073-8023-253ab72132da", "comment": "Malware payload (AgentTesla)", "value": "bf45934ee0bdc9686c376ab5d5b6a9e864f0c57caef418c82c43a5e35538f7d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661903, "uuid": "cdceeae7-cfd7-4e9a-af40-9a01a8e69d2a", "comment": "Malware payload (AgentTesla)", "value": "bc3164d53b87a4b367f777eecf4b940343126ede", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661903, "uuid": "3ec491ce-2be5-478a-b3fd-9ec2ec5e466b", "comment": "Malware payload (AgentTesla)", "value": "41b835d232867217fed4d39bae55cdcc3a2f3333ea0bad30eb7d5558655d759a290359d199d1c07c4ce9a0e5b4eeb433", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661903, "uuid": "ca5b58f1-481f-4ddd-997a-e625a3c093a3", "value": "T1B0A412047B6D823BCD6CDAF8140221B677B8467A2046E7CD6DCDD0DE44E2BDE99026E7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661903, "uuid": "f6917abc-fa1d-4342-b9e2-f5ded14d04e5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661903, "uuid": "ed4cee7a-30a9-4375-a6bd-16b0b3799262", "value": "12288:mTmD2LZnhdzjFZf4uvPB0RUDiw0OU9KNIx//JPAu:TDiphdzRZgudiwOKNKJIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661903, "uuid": "bb8ab2e7-496c-492b-8b08-f461cf53e2bd", "value": 454144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661903, "uuid": "126a436f-efab-4ae0-a9ed-73586ee7645c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661903, "uuid": "95fa073e-57e0-4eea-a47e-1f97095a883a", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3321b2b5-7a2d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642709509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709509, "uuid": "2b60a5d3-74ed-49f6-b0c2-166bde3ceb90", "comment": "Malware payload", "value": "31c81908e76ae7baacbf7e9b72bc67a2", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709509, "uuid": "ceebed1d-5c98-4971-8500-17b3cef34a67", "comment": "Malware payload", "value": "bfac26ab02610df8fcd5715afdf8f6bfb0aad82206ea24bad6d6c7fc359f83b9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709509, "uuid": "90699d61-93fc-4b2f-b19f-f1cd5b75da6a", "comment": "Malware payload", "value": "6a83796b66848b4eac9ba8ed1d8cfacca92c7b04", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642709509, "uuid": "797af3bc-0e74-47a4-82e4-9118c9f94e96", "comment": "Malware payload", "value": "76cc5d4228f2b16dc4c6c5d24a008b9bdd844e1202b52eaa781a5b2c1e83dd2ac5a2eb828661aebaec531418f65c1dbd", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709509, "uuid": "141f0472-8f86-4521-b315-7d6b81f331c1", "value": "T14BC43989BF18DDABC3510732CCEA83B81735E3943B4696271E7C513C1A3A6ECEE42595", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709509, "uuid": "d7e28b93-1b98-41d6-9c87-88b2bb9cf226", "value": "6144:Jqy5jWobNbF6iOo0fHrk2D1xSdsEfEU83VU23XWqE2qt0Zz6r+72VcP/5611:sy5jWobNbFgRQ6K8O8qtCza+RE11", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642709509, "uuid": "1174f5dd-5d4f-4c32-ba14-0c58c9f0252e", "value": 568992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642709509, "uuid": "b94824fb-33a0-4b84-8317-b0d90c4a9f97", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642709509, "uuid": "4f3ac322-6f71-42a0-a296-3ee2453efc8a", "value": "bashirc.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab6fa471-79f2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642684370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684370, "uuid": "aead8739-3bdf-4962-981f-72d94b8fb9bf", "comment": "Malware payload (Heodo)", "value": "547ed1890cba91c2553b516d64e6beb2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684370, "uuid": "1ccbae54-8699-471f-b9de-b822d5b41cfc", "comment": "Malware payload (Heodo)", "value": "c00fde8c38e8b4c0c0f538ebc3e15353f409ce1b147c85f25a14e96cfc5afb3c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684370, "uuid": "e83e9102-2bf9-43bc-bb94-57d7ce1d46ce", "comment": "Malware payload (Heodo)", "value": "47a39ddd2a614fe0f1b5106708d0f4c12345e1b2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642684370, "uuid": "c692460a-6891-4045-b17a-86181a2cca8e", "comment": "Malware payload (Heodo)", "value": "d6c160a42d33d6cd85d6e86ad15a8858a1e2420ebe0814a9aeb8d439cb2119f242f0192a4d76ebd3ae0bd8ff33318e47", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642684370, "uuid": "bb57e080-75ab-40cc-b8da-cfdc7a734833", "value": "T13BE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642684370, "uuid": "5c31014e-4271-4066-a6e2-8a95d0aeba22", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642684370, "uuid": "7e412ecf-37f3-440e-8db7-089457e84c01", "value": 144480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642684370, "uuid": "4c554604-adc5-471b-bfbf-34902ac26b90", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642684370, "uuid": "cbd5f6ec-ed09-46af-b4b0-fee7140b7c45", "value": "1754957373.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61c8b769-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642668785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668785, "uuid": "356c2088-ac99-47fc-bb69-f8bfe52b1825", "comment": "Malware payload (Formbook)", "value": "c8d33f72301ac9ac24009e27ac7e53ef", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668785, "uuid": "b33f643b-f9bc-4c3e-924e-6e51e5986ded", "comment": "Malware payload (Formbook)", "value": "c0904a36e97e50225bc8ab11f7a9c588ebc758b1dc624d39d94da1f5268b847e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668785, "uuid": "5c398538-1d83-47a1-9da7-a970688261f3", "comment": "Malware payload (Formbook)", "value": "1e1fadb528d4a707d91387c3a7525ed3bd1ceb05", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668785, "uuid": "1f4e921f-f7f3-4801-a8aa-781a1661146a", "comment": "Malware payload (Formbook)", "value": "d941792904a4c748956f39704866094fc6176f4f0cbe7b906d2575a12eac5bf43f0f70907411d20fe4d933b22f6cf81d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668785, "uuid": "36ad0dcf-8355-4265-be3d-fb48449bb440", "value": "T1C654224D3AC5E0FBEA4695352822471D97BAE1872220069FD7B40FB96C173F16B023E3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668785, "uuid": "6558801a-1aa0-4d99-a2cd-415985d1c63a", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668785, "uuid": "d420b39c-ef05-4943-adf8-bb57e81d4e32", "value": "6144:owU8Br6MGwDxAO72NoFxBCOQZAz59yNHtLVUZ9rw4V7oI3Z3cNS:IirIwCO7FFxBQ0594W7rwi3ZOS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668785, "uuid": "ac8c4079-58b2-41e7-8af8-f649a997fddc", "value": 290157, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668785, "uuid": "6c14ec55-7a2e-4350-9024-468584403ad2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668785, "uuid": "3375bfba-cb2e-4289-a98c-e6a05de7dc7a", "value": "c8d33f72301ac9ac24009e27ac7e53ef.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01ea9a01-79dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642675066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675066, "uuid": "85db2584-d967-4b09-8fdd-2a3bb6e9f9d3", "comment": "Malware payload (Mirai)", "value": "07eca219816ec1f92eeab4dfa1f572b3", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675066, "uuid": "6c9dbb96-75b9-494f-b9ae-c1c303814367", "comment": "Malware payload (Mirai)", "value": "c10af9664f2173409d089f47b0d81d86937c71f5275de04f13264dd2506e5cff", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675066, "uuid": "f2cfef2f-db27-4df6-9c81-48e4f7351f28", "comment": "Malware payload (Mirai)", "value": "78807768ddf0ae238089f550911d8252dba1a82f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675066, "uuid": "1dbc5cf4-7ed2-4beb-bb60-61bf6ae3ece1", "comment": "Malware payload (Mirai)", "value": "410495368a73501c7444fda0098695a400d14bbcf9210064f89cd4987b688b563c0b539593a26e0c0687c03202041b03", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675066, "uuid": "78a550d7-f511-40b5-928e-fd9c84fe13c7", "value": "T12E330228965AF3F0A5E0CC759C90DF8AC1030537C5CD5EF132490A726AEDB5ADB91B83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675066, "uuid": "9ae91994-787e-4c42-86a6-15551234356d", "value": "768:ocidfHINzR6YzQyP6YzLKcoVxtn8ee2sVsbdofi3P+y/e9h9q3UELt41140ORu55:9RpR6YnBqcuxWQbeq//vL6114phBLV8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675066, "uuid": "52fcaf52-69c4-4cc9-9fc7-337a8a55e90a", "value": 53588, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675066, "uuid": "4a85367a-e1bf-4c0a-bd8e-1eeb24a4535b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675066, "uuid": "05b02eaa-270c-48c3-aa5c-a2e10ae89b1e", "value": "Tsunami.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0225d8b7-7a1b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642701696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701696, "uuid": "7d2509c6-c54d-490d-84b1-983628109c41", "comment": "Malware payload (Heodo)", "value": "17d43f283e84dcbe5452498c4ee3738d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701696, "uuid": "7db012e9-c3b4-4ede-9570-aa854db29ea9", "comment": "Malware payload (Heodo)", "value": "c19c802aa0f4d4c58da4bebe2b0ebf75d89fd3171288a799ee34192cedf138a0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701696, "uuid": "d635ac1f-d48a-440f-95fe-52c8be32be80", "comment": "Malware payload (Heodo)", "value": "df07189dc54aef40644675b1c9b03e2f66e77871", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701696, "uuid": "5580ad6f-f010-4876-9602-7963d6443c80", "comment": "Malware payload (Heodo)", "value": "c33de876c09000323e18717e9cf154c22a3a9f9351fbdad8380e153f8c9de2ffd545c9d0e208f00b2c1cb24d0ac952fe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701696, "uuid": "eb52976d-40fb-44ed-a499-642fa05540fd", "value": "T145C4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701696, "uuid": "a11a5052-883d-4f4d-950b-4aa4c9abb5ee", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701696, "uuid": "2bc0b9bf-2694-4f35-9c3f-aae087645ea8", "value": "12288:P78OGF+L8/4UUNyrCdMhTq/n4vAzdkPs7:D8Ody4aCdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642701696, "uuid": "775ff266-5829-45b6-acd4-4c62139e8bef", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642701696, "uuid": "a8dc4122-59ac-4108-985f-7c060349cbc0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701696, "uuid": "ba152b04-5e2f-4564-85df-b67bde7921b4", "value": "17d43f283e84dcbe5452498c4ee3738d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e94b854-7a47-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642720641, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642720641, "uuid": "44b7eb4d-419d-4ccb-80f2-3b212748b61d", "comment": "Malware payload", "value": "c02fb442f5b0bc80ab54e0212a9df1e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642720641, "uuid": "4634208e-3b8e-40f0-a66a-5af3097a227d", "comment": "Malware payload", "value": "c204a4b1cd4f900aebab2e0ca7bfa999f04e5b85dc5b1e7d357e927a159e06bf", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642720641, "uuid": "fb301b0c-a438-44bc-91da-bdb89334ac58", "comment": "Malware payload", "value": "ea0540b816c491138614bc4659c29a0433cfb844", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642720641, "uuid": "15be59de-b15f-4b3e-a368-a1b0046e9cd2", "comment": "Malware payload", "value": "8c468888bb7ffd64f0cc2c82af61a7684570d142054fb490fa47cd85b5bafc82e44f576a7013f76ee2752454810f4fda", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642720641, "uuid": "028f37de-5419-4301-8765-a69040ea8049", "value": "T18C76BF01E5125534F5DA01BA9BFA1A2DAD28BF501F0854E3B7C8A89ED2F77D2353321B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642720641, "uuid": "1d982311-d848-4e63-b107-7eb17f16d13c", "value": "cee0d35f02d65473314d4d37d8ea4846", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642720641, "uuid": "497e36f4-6924-43c4-8301-013b95b501cb", "value": "98304:bd3CYIUHEnq98693wDjgLtNDGPFe/sXJFACmnXM6vTpOcJF7sq67:cMHEo3wf8tNSPFOGJFACQM6rwQan", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642720641, "uuid": "fd1451e2-cb12-46fa-8d0b-a0af995485e6", "value": 7244800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642720641, "uuid": "53c2eda2-96bf-4284-9624-f83b0d1d0f1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642720641, "uuid": "dc1f925f-5d1c-4f8d-b307-512ea062cea0", "value": "SunsetCrack.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e749021-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642665692, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665692, "uuid": "b370c144-c3b6-4379-bd60-5decbd2b530c", "comment": "Malware payload (AgentTesla)", "value": "d7afb90b2d9c4291503c596acf423742", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665692, "uuid": "a23b3386-dd1b-4173-8ad2-76c792f3c366", "comment": "Malware payload (AgentTesla)", "value": "c22529ebccfeca497b3e983cb1e66f770051fa2a2dc6ec5cdce079d23897b6f6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665692, "uuid": "380a9f93-dde7-42da-b17b-c6a4f7394e8f", "comment": "Malware payload (AgentTesla)", "value": "727daff0cd6afd229839464c53d5a1cf24c45001", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665692, "uuid": "5a6c0b1f-8fad-42cd-9082-6318040adb79", "comment": "Malware payload (AgentTesla)", "value": "85c9235b5340315457fa05bf05638759134b57b69143d907761c73af5561ac76c41665a24384b6694c008dbf1d3337ef", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665692, "uuid": "9e27de44-bf2d-4ffa-a270-a32de34ef23c", "value": "T112040296BA7432D7FBBB1B3C2AF529A56412CE908439F204B0FD371CD5729288D5683D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665692, "uuid": "498ef2bf-3fbd-499f-b8a3-509dc90c3235", "value": "3072:kFntVyjXM1WdHI6Ic3dWabpwCe3hZpiQmZZn3xsVFhxwwSa+pTnuzjXGwaVgh3:VXXo6dWa1o3Xp5mf8h6TnuzzGwWgh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665692, "uuid": "1bd12df0-7b61-448d-96d2-098e7d61f137", "value": 186872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665692, "uuid": "020d373e-b7fd-4902-9047-4084d9fdafeb", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665692, "uuid": "9eeaaaa4-adfa-4640-857e-49b5d62bd5fd", "value": "Arrival_Notice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c24f71a-79d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642672668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672668, "uuid": "63a95219-1297-411c-9b00-7389f394f14e", "comment": "Malware payload (Loki)", "value": "111840a7690e30b83a93a3409a0b422d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672668, "uuid": "2390d5b0-6400-4cec-b0b1-872499e4ba25", "comment": "Malware payload (Loki)", "value": "c27e339893d3e5fc1e61e73ffafac8a7bcf76813a92f91ecfa38535210d6c7a7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672668, "uuid": "8c21cd36-9b5c-4f3a-8ccf-bc0d0ef2c774", "comment": "Malware payload (Loki)", "value": "0e1e49d5701efbf5858726f4a0375d99ac72a1ed", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672668, "uuid": "e48a0c2e-b724-41f9-a729-ab9511d83d69", "comment": "Malware payload (Loki)", "value": "26d1027726db4c5d6a8414f537efdb73d82aed327971f7966dd5d82c9d7b60c3d889cc6186a9a5c36a113d5707b4ab5b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672668, "uuid": "ae02bd92-e77b-4a87-8a2d-1505ed7189d9", "value": "T14D74D0112146F83AE4BAC6713483F067B2867F2459B109AB93173E7D85B1148EAFFD36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672668, "uuid": "b3433a8b-f586-4383-bf4e-2e3cb90c0df5", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672668, "uuid": "2b9a4fb7-8e6d-4888-a9d8-2422293a4921", "value": "3072:GNyah0mJ8VJymxtLjT0x62UZB9VMT8fj2gn65/BK3w82gidE8ch5MDI7IeNoG58/:GwzbvMuuT3bnb9peNosOEMJlCRbIe0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672668, "uuid": "97c9eff3-6870-40ff-8523-7df955d400b9", "value": 349062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672668, "uuid": "f25ff4c1-9eda-404a-aca6-431dc47c4c6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672668, "uuid": "8366276e-5b8a-42e3-b1f7-cd4c4dea2d23", "value": "gunzipped.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "779afe5d-79f6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642686001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686001, "uuid": "4830a2b5-d9d8-4591-b031-8234254a21ae", "comment": "Malware payload (SnakeKeylogger)", "value": "d21c967f4c0c62aa89187f836abbed66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686001, "uuid": "0ad44a34-b7ba-4f34-8a20-f438329f5fb1", "comment": "Malware payload (SnakeKeylogger)", "value": "c2a7ebe98ead78ed4321228c7bec26a70224cfc471abb3f263d71347a2ec617c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686001, "uuid": "9ab2fc50-a84d-4916-9b0b-e58a647d441b", "comment": "Malware payload (SnakeKeylogger)", "value": "979157be60c1d0c1d47590a7e67a2909a695819f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686001, "uuid": "df974669-d4ed-4e81-b7fb-d807d5f77cb9", "comment": "Malware payload (SnakeKeylogger)", "value": "3f1254059b47c985f7d3f19c769ea8551542aaaa7f6732dde101806064ab764702249a4d088859f3133dfacda052e075", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686001, "uuid": "25fe06cd-2521-42f4-9922-6792b9c1f600", "value": "T17C84F151A7F91A6AFDFA8FF475B0001017B57A8A2561C3AD1C4DE0CD1BB2BC29621B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686001, "uuid": "a620219e-ac67-4a43-9436-d14d12159530", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686001, "uuid": "777cf47c-7783-4569-94d2-074d221de6a5", "value": "6144:JRfgDLF3CLgF2ie1YCNAockG6lqdolIGMdjDGIc+hA9gynI9x2:DkUgkie+zDrdolIGMV7cEAKynI9x2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642686001, "uuid": "a46401d9-cac4-4588-aa7e-cf0d79cbf860", "value": 390576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642686001, "uuid": "b3504116-a2c2-4799-b12e-ef67925814db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686001, "uuid": "9a7f62ae-f4a0-44f0-b5ba-ee5efee9b813", "value": "Proforma Invoice.img.gz.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df3e309d-7a37-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642714092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714092, "uuid": "ef1f9b88-f129-45f2-b19c-7a6182925533", "comment": "Malware payload", "value": "cc44d7c5aef75aa0e849300893d4986c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714092, "uuid": "ef0743ee-7c34-4be8-af09-edaf71e71172", "comment": "Malware payload", "value": "c300f59d1e787958a83630aefe4ecf6d6a33f2154040e3a7c1884a43c1e2a3f2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714092, "uuid": "cdaf9c99-5ea6-457c-9a99-43765d8d60cf", "comment": "Malware payload", "value": "059b4ad6672e387a58605c1ef5f45c59cc0386d3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714092, "uuid": "c9d0b079-30d3-452f-85cb-dbaafc0bcc99", "comment": "Malware payload", "value": "263fb4c69dc670fa1a702645b5664d22029efa2a3e5518cff028b332c7380b84d25038e6f500e6c0c725cbf80b97d3b3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714092, "uuid": "942ef0c2-c3bc-40d3-a53d-fbf879fa8ae6", "value": "T136D4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714092, "uuid": "58599d25-8653-4225-8bb2-2f324fdaf702", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714092, "uuid": "b9e90fce-a5f4-4708-94ef-36f33f57f8fc", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NOG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYD4Vnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642714092, "uuid": "2bd5d83b-35c2-40e6-a395-e31f5bdb3821", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642714092, "uuid": "de4b43ef-7c10-470a-87bf-48325a891c30", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714092, "uuid": "54c0c300-4759-41a7-87a6-fe41abc3b4e8", "value": "emotet_exe_e4_c300f59d1e787958a83630aefe4ecf6d6a33f2154040e3a7c1884a43c1e2a3f2_2022-01-20__212805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbb496b4-7a46-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642720583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642720583, "uuid": "db07431e-3028-4dfe-aba4-0038a7b1e7f5", "comment": "Malware payload", "value": "c006a39b1e78cdd816862fbc9d3612ae", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642720583, "uuid": "7d0ed032-4d0a-409b-bb45-2415485da3cc", "comment": "Malware payload", "value": "c3782f393e6dca8cbded5a7bbb73789792cd1bf807f4f71cd863b12992beda95", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642720583, "uuid": "98eab451-0946-44c0-8605-5273bae33fbd", "comment": "Malware payload", "value": "bd24c289bb13d4f83e1c7c9bba8fb2143c483c31", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642720583, "uuid": "38a384a2-e9be-4c11-9c01-e80344008343", "comment": "Malware payload", "value": "83f202a8cbf15b6499a7f31c27feeb0fb8ca22fe89eb4cd4eabaf980106dc644be35520abf1ad18916b481e7f13cb926", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642720583, "uuid": "a1a9e050-faab-418a-98fe-6c31ec4ab130", "value": "T19F636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642720583, "uuid": "dae43c0b-6874-4b8e-8bf3-fbea5c96d735", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642720583, "uuid": "372c5d59-beea-4e7d-a638-8d0ab3cd694b", "value": 71571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642720583, "uuid": "cc3be8ac-6528-4018-a4d2-88b072b7a33c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642720583, "uuid": "8f1f6f72-be31-4668-97ab-27576c03e1e9", "value": "c006a39b1e78cdd816862fbc9d3612ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a872354-79d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642670866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670866, "uuid": "c193741f-b756-4120-88f1-e3a527281b75", "comment": "Malware payload (Mirai)", "value": "1d5adc0688819dd13c6cf7a252f5298a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670866, "uuid": "4ab4582a-1bfb-4b93-9e1c-5224e6e2f671", "comment": "Malware payload (Mirai)", "value": "c392cae2fdf2f05caa5829e33ca716bddb86c2776778bca02e809de71ae2afa1", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670866, "uuid": "62dde231-f8d8-42a0-9db8-2a6cea05a1b6", "comment": "Malware payload (Mirai)", "value": "93e805bc90f6f1f3cc1145e1fe4dafdcc18ea4da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670866, "uuid": "5e6f0dd8-4fef-483a-8a7e-5c882a6161ef", "comment": "Malware payload (Mirai)", "value": "613de5b8a7fbe3132034fa2412d172390ee79e92bb54c8bc9b136517bea7cc7c07d86b158dc044e209f1bb2bc3e10de9", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670866, "uuid": "2b30cf49-dd8f-423f-8b25-8fd617fb5f49", "value": "T187B32B37A61C0B43C49B55F02CB77BF24F69AEA312A611C4A309FED04B73AB12551F99", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670866, "uuid": "02f64152-72ce-41bd-9264-ed6640e38129", "value": "3072:Uvc29uyIcxE/sZxw+OqFKZmm/QcuLmH26PNb:Uvl9jIg4sZxjOk4mm/QcuLmH26PNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642670866, "uuid": "75edad18-212c-4fa9-97bb-a2d16ec02833", "value": 117027, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642670866, "uuid": "e139da19-f897-4288-85bb-cfadad442665", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670866, "uuid": "4fb1aa11-269b-431b-b3c9-470f338d14ae", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe553403-79db-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642674631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674631, "uuid": "3375eeea-564f-44d1-9802-0f05b6a897a4", "comment": "Malware payload (AgentTesla)", "value": "46c9d2d26f88128c11444567655a2745", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674631, "uuid": "504d17d7-9fee-4d40-95f2-2faaa5bee1dc", "comment": "Malware payload (AgentTesla)", "value": "c4264b2ba949186aa338859d87d819d8583ad6f61da52e215db59b2144b5e32d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674631, "uuid": "65b7b604-82f2-4330-9a23-e2b43809bc39", "comment": "Malware payload (AgentTesla)", "value": "f771148804a3dc63509fa769ce42b745d53d3970", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674631, "uuid": "d6210edb-c816-4e97-8776-3149ebf1fcd8", "comment": "Malware payload (AgentTesla)", "value": "af805bc69b25299bfeaaec89bfbe1cbdb8fd4084284d4a35bca85cce0681c23960f17af8afa9f52b10fa46321a3451bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674631, "uuid": "94eb28cc-89a3-4408-9435-691a56a1571f", "value": "T108A4022036FD672DD6E54BB6B131021057B67A3B2121F31D1E9A70DE157BF8286A2B33", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674631, "uuid": "6378324c-fa7d-4198-9378-4f0dfadd2cc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674631, "uuid": "60efd4e3-a734-42d6-88dc-5fa688001b8d", "value": "12288:zmI54zzyd4IgD157uZGmZkejnkj9gKFEm4c:yvzmqxD1tuEmZkejkJkm4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674631, "uuid": "c17eaf4c-bab7-4983-a689-b1b7dddc5c1a", "value": 450560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674631, "uuid": "54be586d-e399-4e7f-840d-20d639d8b91f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674631, "uuid": "3f758afe-ae62-4d8d-8ad7-4ea67809722b", "value": "0bvFQdZDyBNL95o.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f40c909d-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642676761, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676761, "uuid": "f6ac4bdd-3bae-40a4-b033-0670a3ca6472", "comment": "Malware payload (AgentTesla)", "value": "293c1a69c08ca367baea582baac0a35e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676761, "uuid": "fbb8c00d-5b07-49f5-9301-e433c172d37a", "comment": "Malware payload (AgentTesla)", "value": "c4b0b6b0afc82bf62f1d05d166ca475d5c530dd441aee9a42178afcd7c140975", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676761, "uuid": "39215435-c033-4060-a480-6e84e3b124b3", "comment": "Malware payload (AgentTesla)", "value": "1b8c06b7673184988cd0ab3224adad5fd598ba87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676761, "uuid": "55b2f3d4-2924-4fda-9e05-19ed5047fdd9", "comment": "Malware payload (AgentTesla)", "value": "e34105d2760194f426b6497f16b324714af2cbd4ca1e0618eb0f88cc9f61100b2098ef5e06e840f2c9e03e9f525046fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676761, "uuid": "10beba08-8ad0-4ab3-96bf-3bdd4de62200", "value": "T1A6B401501BFA9344D9AE4BBCF9BA025003B4F2022193FB4D2BD570E53D23B55CA9627B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676761, "uuid": "fef4de74-2457-44be-a23e-5c84d05760c4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676761, "uuid": "a9aad87c-db4d-46e8-a36c-df6ed9292d68", "value": "12288:cjt/iQmljUZCp/xlyMPxSGzkZyu3I333z/N5EUCoz:cUQhZ8lpk2ko9/N5dCo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676761, "uuid": "a5e57199-7e31-4857-bb22-6d2e2a8aa085", "value": 499712, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676761, "uuid": "044c99b9-edca-4183-bb12-775946675aa0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676761, "uuid": "c849a323-ffba-4a29-8409-d4061b35f22f", "value": "invoice-e0Q79wMHZcHb5xu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7674be58-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642660659, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660659, "uuid": "0c26e4ce-363c-4613-ba00-65929b145eea", "comment": "Malware payload (Loki)", "value": "9cb4c2dc3ff6ace43c496b28253127ff", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660659, "uuid": "cf44db51-b10e-4bff-8f41-feeaf3feb6f6", "comment": "Malware payload (Loki)", "value": "c4c1b199cf84e8aaa835220f5fc34e8f05981c0f3e79ee6def29858780a7ed1b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660659, "uuid": "f6043788-bf4d-4c3e-9eca-721c9d4bae6a", "comment": "Malware payload (Loki)", "value": "b0684d932ece309bb95a512ab182677ff1bf32b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660659, "uuid": "e3fc1fe8-4800-4254-bafd-43bc1319993e", "comment": "Malware payload (Loki)", "value": "ccd9281271c02a98114193844ac4bdbb56445ee2b81fd00051532cc4deb93233e1310e25132af3c7acf56617b2f35272", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660659, "uuid": "8fbb623e-a29f-43a5-82b9-c3ae6aa7eada", "value": "T1BB84BE1377DEC922C159177288EF800443B9EE55AA13DB0E3DDC73BC1A2275E9A4639E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660659, "uuid": "eb459d36-05b8-4a54-b7a1-39c64941c673", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660659, "uuid": "653984e7-ad0c-40e8-b93d-0791607ad015", "value": "6144:W2cZzzzHAyRLFFqF05kSXiY98mBLDnZMiw5gA/3:9wz5Z+PSXiY98mBLDn6hh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660659, "uuid": "e915bdab-8cee-4dfb-9dce-79cb4231917a", "value": 403456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660659, "uuid": "955409cf-0231-48e9-906e-cd232d3049a1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660659, "uuid": "7a0bb3c1-d888-4d35-b1df-b93a66db62fa", "value": "9cb4c2dc3ff6ace43c496b28253127ff", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5787ed-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665719, "uuid": "3b13e0d5-bbb4-4678-a29c-c09e1f025673", "comment": "Malware payload", "value": "70cf3943b421f495fe56a9573d513eba", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665719, "uuid": "4157b623-17f1-4d1b-940a-702e3dfd6a52", "comment": "Malware payload", "value": "c4c9e3af7f1ffcf8512b3bbc6dd51039204a6546fc388d137a92b6f9b608b349", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665719, "uuid": "6b07db1b-5c18-4c94-be39-d57f606f1394", "comment": "Malware payload", "value": "4746987aa5eca41633972626fe60d06a7272dd2d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665719, "uuid": "e283577a-0223-4311-957f-9e4577b67dfd", "comment": "Malware payload", "value": "433390e7f863cb6e6657f51c550d4a7973f55cec4ac509f586a9608d74139872d18773aab32c8ca33d2a13c97e0a630b", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665719, "uuid": "5d1e0eb2-55b9-417c-b607-0d768de65731", "value": "T1B3140235B909FDA3D68D93B14DEC69CD8C30ACE5E8259184069B325C687C4F960D2FBB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665719, "uuid": "7deab681-b77a-414c-abf6-1b6756a60b3a", "value": "3072:2eH2DcNafdInXcYtykKvMho8y+N2+IBi54cuBvVxuaeB4d897+dTaubm9/EKhgyG:n2wNdXcYty3vkNJ2lRVwaeCS+paCms7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665719, "uuid": "79b232b7-9b58-433a-a38f-198600f6051b", "value": 195640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665719, "uuid": "d8856a9b-6208-486e-9f6c-2253db9e6274", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665719, "uuid": "8cf23472-724b-46f2-8e5f-9792fae94be5", "value": "SHENZHEN MORAN SLIP.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14a6ff19-79f0-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1642683258, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683258, "uuid": "a3545a27-3b3c-46f6-8612-91f32d2f7b35", "comment": "Malware payload (BazaLoader)", "value": "4925a10905e4df9d65e87afed2d77c45", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683258, "uuid": "61e91ca1-4df7-4da2-a89f-7bd98fb66d2f", "comment": "Malware payload (BazaLoader)", "value": "c4ee1c01c69af8c987dfc5f7790b3c8d2474ae1fe1771d4f2fef9720d54fd3ff", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683258, "uuid": "17829419-4ffc-4f76-a0f5-253c0ff36b26", "comment": "Malware payload (BazaLoader)", "value": "ef913fbd9ec848b59941bc8cce6e0a357d850b2d", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683258, "uuid": "0ca814c1-0de3-4c94-80e2-6bf14c72fa6f", "comment": "Malware payload (BazaLoader)", "value": "a34546df5079a1e529cccf064031e525b561001975740834e72086f91b3129c11e78d4b59e15abeb8e281eadfcb7be0d", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683258, "uuid": "f97ab73d-7b1d-4dff-80a8-c4c0871223a5", "value": "T170056D1AB7B840B6C06AC536C6538E5AF7B2B8514B3083CB4261A75F1F377E15B3A325", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683258, "uuid": "5cbe3644-0a28-4f2b-8248-8d15e2a4949f", "value": "0fa94d0596d4a5a9d544927617ad10dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683258, "uuid": "be253564-2a87-4ab1-b4a5-c9fa2950a920", "value": "12288:hMKk6ZKaLa6pxm7aOO4mKkP8UurFpRlG/34facNQB6+tiEMGZOnEP:hMA26pKaOyKFUurF3kQCcNyX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642683258, "uuid": "3e43afdd-22db-4427-9e12-24f1dae4f900", "value": 813568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642683258, "uuid": "2622c50b-25ff-4cfc-a79e-e143287050c2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683258, "uuid": "ff3c6ab4-edb2-49d7-bf9d-390e02224715", "value": "4925a10905e4df9d65e87afed2d77c45", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fde4539-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1642668808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668808, "uuid": "877f7187-5fd6-422a-85cc-2dcbdd57e44c", "comment": "Malware payload (ArkeiStealer)", "value": "dcf83b27cc203790b44fe3018390f3e5", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668808, "uuid": "d6f60b80-9fc2-40d8-938e-0ef912c10665", "comment": "Malware payload (ArkeiStealer)", "value": "c569b1380c48b910b3b1816594bd02206a8d655f909a38a30e625ea77e28ff33", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668808, "uuid": "6703becb-b43a-4c86-843e-6029192ed92d", "comment": "Malware payload (ArkeiStealer)", "value": "1a9fd639b0632160429a97d0b768037d787af3ad", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668808, "uuid": "019cbd7f-3755-4206-a452-1ae82aa6f558", "comment": "Malware payload (ArkeiStealer)", "value": "9aac8d2066531273f7e6603acbcd64d042ab9a5ef33b21e2e74fa61e3fdfa95e0771c1c2e06269d3cfef0f746d513784", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668808, "uuid": "c91fcfbd-a043-4db0-bc31-a9fd02daceaa", "value": "T16F54BE31FD80D831C4C569748826CFB54ABEFC311969424777A83B6FAE612C2563627F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668808, "uuid": "941ae6fc-19ca-45be-ba17-647af0ef1c9d", "value": "125adc129c50285a2cd4524417d3fdd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668808, "uuid": "3b6b5072-c70b-413a-a1fe-fc9447dd456b", "value": "6144:2mjUUL2W444SbUCNsmXT1oqSsVmvga4Zh:2mXz444lIfj2yqJYh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668808, "uuid": "fe235239-49df-46b2-8a7c-4b4b4f1cd076", "value": 295936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668808, "uuid": "ee3ba494-7a06-49e1-ab0e-a9bb108d714d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668808, "uuid": "c330ca90-d239-4440-9766-1ea9568f1fa6", "value": "dcf83b27cc203790b44fe3018390f3e5.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "601ba0bb-7a2a-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642708296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708296, "uuid": "4363c1d9-f636-4012-bda7-99b4fe2d8279", "comment": "Malware payload (AgentTesla)", "value": "feaa0a9939a5aaa8302c9d41de19c5dc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708296, "uuid": "dd56082c-dafe-4b88-8123-be780c72afce", "comment": "Malware payload (AgentTesla)", "value": "c57fe1ed5d41144d82c9892c688982e7a649e4c3be7c130b48fbd13949448e7b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708296, "uuid": "23df27e6-a0e5-4fbf-92cc-5ecb8efac6d0", "comment": "Malware payload (AgentTesla)", "value": "401ee25df26ed0f3ed12f6541e9e2e90ea029e7a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708296, "uuid": "4537fd76-77b1-4d96-80b4-11c894f1aec1", "comment": "Malware payload (AgentTesla)", "value": "bc1a3e3cc99ef1ce727ff94e79958be4cc2d25eee8c57089ca5d27206aac2c2883350d256fcdef5843f37824f497897e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708296, "uuid": "cd417a91-31c4-48ad-b5db-e83c6360a964", "value": "T18BA40221B7F623AAE6F5C7F8A562415413B93D5B3023E72D0DA675CE2836F424211B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708296, "uuid": "d159fd2b-c6d2-4fb4-8213-c8eae2ca2cd4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708296, "uuid": "2b7a6ca7-4ac3-45ef-8ea0-eab005408cdf", "value": "6144:5hSr5LF3bzI5hYZ6p8gEJVYEav4zi9JBV7cXwVO7hM7+hT6gXkldqtjKbm:eVOfYZ6H2YEav4Wn/cAVcM7QWg0qh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708296, "uuid": "44106c9e-4484-44bf-a7f5-796801886e11", "value": 450048, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708296, "uuid": "6a971c9f-10ac-44d3-b895-2719b1470ff2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708296, "uuid": "656a104e-287c-426a-9dcc-878e2e742966", "value": "feaa0a9939a5aaa8302c9d41de19c5dc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10f01573-79dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642675092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675092, "uuid": "b3dfcee2-8074-4cd6-9660-bf1b0746f2d8", "comment": "Malware payload (Mirai)", "value": "b8864af7e5db0ae048678b0e17b3e988", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675092, "uuid": "ab65ef86-b054-457d-be12-92b59db212c6", "comment": "Malware payload (Mirai)", "value": "c5d1fbd482b20593f0166c352ff025c94e9423ed933305a33226ac557169c14f", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675092, "uuid": "d4db8d52-4c0b-4715-8964-8f19d93190e0", "comment": "Malware payload (Mirai)", "value": "c2e3e70a52e88b5c7eefd5b7656cdff3da2645df", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675092, "uuid": "7ef23970-6527-4f93-8dc4-888e8c73092d", "comment": "Malware payload (Mirai)", "value": "ff539e90e475d3a0ad8d1aa9925925c2c5a0d0b43c52c11e45534b0f225abacd41acdcfd856010d9120339c9e536b822", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675092, "uuid": "062a2eb0-cf03-46e2-8c6a-345de6b0dde5", "value": "T175739D31AD792A67C2D0A03B42F74765F1F2078E29A88B1E7D710D1DFF24AA0652717B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675092, "uuid": "86ce10e7-df35-427c-9ff2-afdce05d28d1", "value": "768:f73N8VyoumJjXxoy9zcXXf9CNWYijqODcgy9TBvwEr2v6FJASG9O+P9mffhNSB:Dd8VyVmJjXxoyWFNvDu9Tdr2CF41mf5M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675092, "uuid": "6f9a3ea2-6372-4927-a9a4-2782b2cbdde7", "value": 74800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675092, "uuid": "fa4b1c1e-906c-485e-b053-e68d5f4b0bea", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675092, "uuid": "af4b5029-bbd2-4f1b-b502-d32a66400684", "value": "Tsunami.spc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05ed650c-79bc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660900, "uuid": "3f3aa097-bd31-4b02-a449-9ac42ac53fa8", "comment": "Malware payload (RedLineStealer)", "value": "b1b9f7a2ad29315bd74bf8ab9875beda", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660900, "uuid": "ab9cb849-cdd1-4ac7-9bbe-3d46686979c4", "comment": "Malware payload (RedLineStealer)", "value": "c616122ddb20e0572157aad9871b38b1e395187e9a3d6127d2dd17371194527f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660900, "uuid": "fc239d58-e524-4432-9394-113d59a286cf", "comment": "Malware payload (RedLineStealer)", "value": "4a11d21de73d8ac33cacf8a905fe2f66320a44e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660900, "uuid": "9ed98d87-1e68-4192-ab48-0b14ba3a0ca7", "comment": "Malware payload (RedLineStealer)", "value": "9ac2951b15413e9b30b6c5958691d4f9a4bb89572aa13686a8b98bf6b4ffb0bb07c125d22a599cb11a711b3cc12090d6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660900, "uuid": "08a9d1bd-7b0a-4d25-b740-b2971f08222f", "value": "T12684E0723580D432C4866A38482ADFBC5ABDFC312865154777A5FBAA6F31383526B34F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660900, "uuid": "1a9915b9-e7ba-4684-a80c-a07a8f3a6f01", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660900, "uuid": "6b3028b9-4ca6-4094-ab6a-b9b73d749ddd", "value": "6144:6yFLdz2Ye0NNw6gclbOQqKfAc1OpJ59IMomGk1HYCb:FF2Ye0NNrgkbjMpJ597omrX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660900, "uuid": "ac083f01-95bb-48c8-97e9-5c37ea22df81", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660900, "uuid": "1c131398-ae7f-47a1-badf-acc1fd7c86fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660900, "uuid": "7919d10e-88c1-4892-92cd-7070b7362349", "value": "b1b9f7a2ad29315bd74bf8ab9875beda.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4a3953a-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642668924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668924, "uuid": "ef69d28b-8f4b-4c1b-94ba-eef2325d67e9", "comment": "Malware payload", "value": "c6e083d78f4cc3fc5fe27bbc511d9d09", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668924, "uuid": "4601f679-8bbc-46da-baff-b9f262c38d3c", "comment": "Malware payload", "value": "c73ae6c7d2e981b85541696fa8a5592c6a7367222140a5d87988585a82e2213e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668924, "uuid": "a3847956-c01e-4305-a6cc-9e432273f6d6", "comment": "Malware payload", "value": "c720eda6dd49a1001b683e88d3f6601fd0f5ae77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668924, "uuid": "065c48c3-1077-4c84-8b93-a3e8ad682863", "comment": "Malware payload", "value": "601c2709edbe55b85388470fb8b304a148e4aac1c4675fee0b364b192f5c3f91cdfb005a7ce4c63c3f6714efae611e4b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668924, "uuid": "29a5d5f0-4a7d-426b-b36b-24f727bc4e97", "value": "T1F7163306076369FEE0CB51B3D2A1283955B5B658099B4827F337EF438B9D5078FEA306", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668924, "uuid": "05ace3a2-fd8b-4089-967d-5d4f1782a488", "value": "9a4258c5d218cf6e5c500e8415d5f5ed", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668924, "uuid": "7630d27e-822c-4bbc-9d91-7dd172a8ed68", "value": "98304:zAHhNwhJa4BjKh5nIRFXgemFRj61mL5qBoOC0LEVg1z:6hKfBK8RFHmF+BJCbiz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668924, "uuid": "0b781d4c-cb32-4885-ba6e-ee90c2cdccfd", "value": 4288007, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668924, "uuid": "b428b87d-9266-4384-b73a-338fab63a375", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668924, "uuid": "78478d46-692a-40c2-88ad-c376670bdbf5", "value": "c6e083d78f4cc3fc5fe27bbc511d9d09.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a46a2b5b-79d5-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642671903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671903, "uuid": "13481caf-400a-49fd-9ad2-30887b77249d", "comment": "Malware payload (SilentBuilder)", "value": "dc3940863db7ebffc476296f74d595ac", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671903, "uuid": "37313e48-2e3e-47ad-9d85-95531eb98360", "comment": "Malware payload (SilentBuilder)", "value": "c74b76fc747a530f581851b5269d66e5aa5a4f99a8136cf93b50a4e2fbd864e9", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671903, "uuid": "3a5c4885-0970-48ef-81f8-9334feb9d9ed", "comment": "Malware payload (SilentBuilder)", "value": "0d020f5ada48d4d6c04b0201c9b7de6a08f3f863", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671903, "uuid": "b6c536f4-d9e3-447a-af0a-40ee024b48fe", "comment": "Malware payload (SilentBuilder)", "value": "b9039d10fc676aa368766714bcf4cac438af28d2f19abee9da1ea7f7a3a19986dc607df99568f21f6bc6cdb715561b66", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671903, "uuid": "3eae5db8-65f5-473d-be95-3b65f22cc754", "value": "T1F6E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671903, "uuid": "077c86ea-fede-4d10-92bf-dfe210968250", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642671903, "uuid": "0818c9c1-adea-4c75-8eca-4370079c4415", "value": 146332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642671903, "uuid": "3686dc54-103f-43ef-b817-333fd79af110", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671903, "uuid": "b365536b-d859-4370-b0e8-e18e7674a801", "value": "dc3940863db7ebffc476296f74d595ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b536bf6-79bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642661419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "a95cc03f-c7dc-4ba9-b395-ffc0d3ffd78c", "comment": "Malware payload (Heodo)", "value": "44b6af2cbf1a6975480089cce0053ee7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "35b2cb14-7df3-40b0-b359-d47bce5f2b13", "comment": "Malware payload (Heodo)", "value": "c7bcc5e61e2a159e68f20aacd3c0d01b2f6196228fb772f7834e9519d72ef421", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "2a0e5ef5-de1a-45f7-96da-5dd25ab5879b", "comment": "Malware payload (Heodo)", "value": "906de1792a4a88f1052dd0f7f32edc66a0d7bd04", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "7f577857-a222-40c7-8552-396aaf2bd031", "comment": "Malware payload (Heodo)", "value": "e156175dde4729724278eab467eb026eae00573e7b937678c217ef4bc350969264689a0775af0d546bef5c5a12ef424e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "69741355-bd02-4a66-9005-01ffe9179d67", "value": "T101C4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "724a6bf6-1198-4563-b614-011493ae6640", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "cba0f941-e921-4df0-90a0-c39fbfd7e498", "value": "12288:P78OGF+L8/4UUNyrydMhTq/n4vAzdkPs7:D8Ody4aydbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661419, "uuid": "a48fcb65-8f15-48cb-b8e0-56a831aa2565", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661419, "uuid": "dbb64314-0280-4d92-9e86-dd69d40c5b5a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "b35539a2-136e-421f-837e-12518aa01df3", "value": "emotet_exe_e5_c7bcc5e61e2a159e68f20aacd3c0d01b2f6196228fb772f7834e9519d72ef421_2022-01-20__065012.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f024ed70-7a41-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642718416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642718416, "uuid": "f19a3576-5792-4c9d-a0ec-20175e8b95ee", "comment": "Malware payload", "value": "b8f2c91126059f4488d2ea2051b46d0d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642718416, "uuid": "b9e98783-0ac8-4751-a491-952e3706b783", "comment": "Malware payload", "value": "c7c0c70f46c2fbad5de497009b739add5a7c7817d656193142138195728ebe37", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642718416, "uuid": "35426b04-f495-4bb2-b24a-68978501fc67", "comment": "Malware payload", "value": "95c611053e467ffd0319ab14faedf66043a779c5", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642718416, "uuid": "76a45a4c-ff69-44c5-a147-be5daf8a0770", "comment": "Malware payload", "value": "54512c31d86a0c94244366d00c1f439ec96db2aa02dcbfec09cb74ebf603f865a1b60f7796d7ffe23253c993ce9f497c", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642718416, "uuid": "b116154e-4a4c-470b-8a26-0be80affdc21", "value": "T188636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642718416, "uuid": "d38e1cef-6dc2-4432-8ce6-0ddddece94fd", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642718416, "uuid": "dad9eaca-27be-4d38-877b-1071cfc4a87b", "value": 73037, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642718416, "uuid": "efc75ae6-0d87-41f3-8217-2999dee20212", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642718416, "uuid": "13943b3f-d20e-4a5c-969d-6b5d976798ba", "value": "copy payment.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "521f06e0-7a19-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642700971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700971, "uuid": "76c8846c-54f6-446b-a307-db1053f9315c", "comment": "Malware payload (Heodo)", "value": "7a4676f3a6cf3ce34b471798fc7e1203", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700971, "uuid": "bb1ee8ba-23f8-45df-be59-91e3ec19d117", "comment": "Malware payload (Heodo)", "value": "c8135ea47a8ccaec467c69c25086fa239e1ed6a2c7ad2494e9baa6b024f7242f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700971, "uuid": "e5a575fc-993f-4d83-85ec-61c46f3cdcb8", "comment": "Malware payload (Heodo)", "value": "4fb440aad04e968a811ba024ca9ee46eae58319b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700971, "uuid": "78d974ad-b469-4ff2-b291-cd11ceb2fbf3", "comment": "Malware payload (Heodo)", "value": "505ca86373ba70a6a1c019f1cc0e89a4650411376bda8a83a7df16e08f80912907ca5ad09fe3bcf221a6e5bf8d5c7989", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700971, "uuid": "ff9881e9-a72e-4c73-8164-3440db6e848e", "value": "T1B1E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700971, "uuid": "cdaff9b5-7f5b-4092-82a5-f7f2e50380c9", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642700971, "uuid": "289bf960-7f48-43a3-b9da-654291f3844c", "value": 145000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642700971, "uuid": "59dad0a7-f3bb-4d00-84ed-d2cfe007586e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700971, "uuid": "01568656-18ac-4f15-a430-2fa7bd4aaa56", "value": "7a4676f3a6cf3ce34b471798fc7e1203", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a4f9d2-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708687, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708687, "uuid": "796f7dc3-0f1e-4d59-bf4b-55af57914377", "comment": "Malware payload", "value": "4d658370321465f62feef44746a5b7e0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708687, "uuid": "0ce9e94a-8667-4d87-971f-33171137a13d", "comment": "Malware payload", "value": "c90b2b849ae98bd11605bdfbd61c267b2889320ee222473c21a312de41facd1b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708687, "uuid": "a1ea6969-4205-4f73-a631-9e7c957208e6", "comment": "Malware payload", "value": "899a2cde5f9f6885fab0e97bed7ebc5ab68a5d52", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708687, "uuid": "c609c9cd-98bc-4266-b46e-65f413337547", "comment": "Malware payload", "value": "c42498b6d8fea55f73d1092910d2f64646a922396d5d11bcaf0fad5a39cadcc38ae518a0068143d8c1223a7ead9ef698", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708687, "uuid": "fd267ef2-aedf-46a8-a1df-d919b903f475", "value": "T17C144A61AC48605EF791BD7228ADB32855453D7C51029C3BBEC23B585EB339AB861F0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708687, "uuid": "2b9434de-5868-486d-bb2e-8899fe3e1ee9", "value": "49b15580bd181e45d4d97bbfb270c139", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708687, "uuid": "b17a2794-9a98-416b-9146-e3025fea4010", "value": "3072:0cwwKN4Iexutn6aAevs4a7herkZmPIeL4:2Noc3sVfEPp4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708687, "uuid": "a1f53b4e-4fe9-42bc-9ca6-55741ebd0fa3", "value": 206520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708687, "uuid": "8c75b422-8088-4ac4-9e44-1f61f7472da0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708687, "uuid": "1ee38beb-4607-40b7-8a04-716dd297cfb4", "value": "4d658370321465f62feef44746a5b7e0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6a0ec7b0-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665792, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665792, "uuid": "ea6daa05-b001-4002-8139-7a5e4cc5ac79", "comment": "Malware payload", "value": "b037a8c44a9778337742d060354cc145", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665792, "uuid": "097634ac-42a4-49e6-9beb-b43052be8425", "comment": "Malware payload", "value": "c930ebc15ae1d31afcedcf4206230ea2fdb58be5a9f1d4a26a7701653316e2f6", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665792, "uuid": "08c9b6b3-9532-4bb9-81fa-5e2382afdbfb", "comment": "Malware payload", "value": "451e9a459eb918754f1722a840d83c79678ddfc5", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665792, "uuid": "37b3e08a-cb34-46dd-8479-06ee49876bb4", "comment": "Malware payload", "value": "75ced20524ecb086d4212875e389a9a11c05bbda7a11278fccbe695fa68f8a259fc6bb4eef429588a27a3a5e66c2f61f", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665792, "uuid": "c531f8ea-7388-4cec-b496-0e307fb9fe55", "value": "T157F18D14ACC21D8BE707BD3FA2420EA77E02813CB6355A099A25774B47063D30776668", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665792, "uuid": "06cd8f20-24d1-45d8-b0b6-4cf9b4e320f0", "value": "192:Pz8P4A9V/q17afbA96/ovLJAZ611VQFdKzKN5woOmPP:Pz8P4QV/A7o/ozyZ21VQ1J1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665792, "uuid": "49b11615-babb-4978-b0ae-5030dc44e0ef", "value": 7847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665792, "uuid": "b00ec5b6-de95-4f93-ae35-f08eca996488", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665792, "uuid": "fd6e51d6-063d-4760-8e9a-e0a14407b770", "value": "PO20202001.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "664c53bf-7a4b-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642722479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722479, "uuid": "6cc004c0-6129-4734-b8da-015f63a89815", "comment": "Malware payload (Gafgyt)", "value": "63607896ce41a60dedd94ed9c478f132", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722479, "uuid": "8945beb9-3aad-4779-8273-42faf72f3bc9", "comment": "Malware payload (Gafgyt)", "value": "ca03a919da50246c8d681c9a9bcf43b9f54be415027422025ed55244232943df", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722479, "uuid": "8b75041a-7312-40e0-b62a-ded74c5af9e7", "comment": "Malware payload (Gafgyt)", "value": "ca022ed49f7ba50a707f2b3d9e748f6707aa0aa0", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642722479, "uuid": "0eaf1f3d-9029-4cc6-943c-256b4fcb2e12", "comment": "Malware payload (Gafgyt)", "value": "962523c0cd02ceabc7a160b6c66886ce548ae4f558100e21b20808c649fff8aea80f55ed8338264c8fdf104759b1802f", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722479, "uuid": "34a374c4-bebb-4539-885f-aa88ad8eb81c", "value": "T153D34927B6E98DFBC05752B02EDF8AA29521F0FD0B32712733D46D902F6D9C55928A43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722479, "uuid": "678355da-4aea-46c7-88d5-f8e2ad2819df", "value": "3072:kcB5V4FlMdiQGw/rcSvmiKEOWm4t+5BphaY4dd9Jtu2FUQmDoud2FHGtJogq:sYoSuEOWRSphaYod9udQmDoud2FmtJoT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642722479, "uuid": "035cbc29-bcaf-4b2c-a85c-4e998cefa275", "value": 141450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642722479, "uuid": "7de7adbd-6996-4f52-95da-22144e5b85e6", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642722479, "uuid": "63cd58de-1946-42c8-80a2-ab612ab4e5ee", "value": "63607896ce41a60dedd94ed9c478f132", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4b95073-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708894, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708894, "uuid": "1ee65713-0257-4193-a027-785888415de7", "comment": "Malware payload", "value": "780965bad574e4e7f04433431d0d8f63", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708894, "uuid": "5c3830eb-52d8-472f-b911-9f8f51b3a952", "comment": "Malware payload", "value": "ca7fb4ee975499b2b1497fb1be69d0187d0a5cf83a2a646ad2855f4e739c8326", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708894, "uuid": "c9e69bab-abe6-4a2e-ba43-db5352f6be08", "comment": "Malware payload", "value": "727af0e445c5d1984c987b7dbd2e20bb081bdcab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708894, "uuid": "f73f6d9b-e5f4-4b1a-aad3-5b332bc62e5e", "comment": "Malware payload", "value": "51bd63a6d760db39e7a0c60c72b67c39f24706e05c411d5d404a4ecc8476ed2190784aa81c56acd03d97bd3c147fe723", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708894, "uuid": "71cc2c6d-17df-45b2-aa1b-ff407a5af0af", "value": "T17B6533F1B597708B95BC269A3F3A84B2588CED13FC5CEEB4E29D950362797D22C4E104", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708894, "uuid": "c3f132a8-3eac-460b-af4f-de8088bfc405", "value": "24576:YXSQzTJA7HRYL41nQzOFhTQYrw+Efx9PdLBZYiEylBPJwbuDRyS+CuyxypSNrUpd:YfPC7jQzCtBrzEvlLfxQW5uyMpSNApFj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708894, "uuid": "e1732743-7616-40e5-9caf-1aeeb8d2ce26", "value": 1487528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708894, "uuid": "a5369ddd-868e-4f5d-97fc-c8ac4aab12b0", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708894, "uuid": "cae0e37a-599b-449c-aee8-62fe5e4c1ffe", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8104139c-7a32-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642711787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711787, "uuid": "8fb591c7-a5f8-4b6a-8136-6055b543b7ad", "comment": "Malware payload", "value": "88b86d8f5161ebd4f12e3c077f5975dd", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711787, "uuid": "5df11613-d85a-4227-8f52-bd8c66b95d25", "comment": "Malware payload", "value": "caa57a0d7208775ee50b80b88384a83804e8b132229162b88db9a3a57abb7acb", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711787, "uuid": "28c4f13a-6140-4a44-a518-d892da142db9", "comment": "Malware payload", "value": "b458187ee6d9e9bcdafc1059277c3fa306c13f49", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711787, "uuid": "5e6d435b-1f12-4cdb-821c-16a24ca6bdde", "comment": "Malware payload", "value": "262ed8b4ff2c4fa42635508d1b08ccece37718626a95901c3e3a6537b7089790bd9f1450770ee68a66d8d8a5a157310d", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711787, "uuid": "66ee1277-cb70-4e90-90a7-3796775954cc", "value": "T131636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711787, "uuid": "518042a3-9dd9-4721-88ab-eed922937d79", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642711787, "uuid": "c935c063-eaa3-4046-8768-19290181f638", "value": 72329, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642711787, "uuid": "90a1b7f9-9511-4eb0-a9bf-0ec04eaaafb1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711787, "uuid": "01fa6166-fe44-45f8-9be2-6324d80a1ecd", "value": "88b86d8f5161ebd4f12e3c077f5975dd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cf6bf29-7a0d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695728, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695728, "uuid": "8ec68b91-4fae-4f39-8565-ef011302cf96", "comment": "Malware payload", "value": "f14e2b92284c7e5fd36fe428c9be0888", "object_relation": "md5", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695728, "uuid": "25963f53-9aa9-47a9-a1bd-50da334d420f", "comment": "Malware payload", "value": "cb0df0e4d831727acebd186a20194f2a98a792a49a04899dcf056a9fa732e33a", "object_relation": "sha256", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695728, "uuid": "7f879d47-f231-401d-96ca-b379fda8c751", "comment": "Malware payload", "value": "ffd5c1adcfb50e8deb8285e3c8b50fb051fd7737", "object_relation": "sha1", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695728, "uuid": "2ba12928-7849-466c-8e32-3a3c79888993", "comment": "Malware payload", "value": "edb6fddbe2fe8a3dcd41d1132429d8d87a72c8560f0d5ade310d07ccae515d65e376034298d41aec5870ed2cc2a0eb95", "object_relation": "sha3-384", "Tag": [ { "name": "64", "colour": "#6D7DCF", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695728, "uuid": "5f8cd3d4-af66-4ca3-a568-a76a74b37ba7", "value": "T16073292356618A7FD48742FD27EB9A215413F8BF1B23A21DB394FDFD2B099C81D19248", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695728, "uuid": "1766eb09-c888-4f0a-bbaa-a38f71985bca", "value": "1536:w+aDJ2CfqyB7vL/Nt3MIWXYB3G66uxjzLXu0QH98F/nr:w+aDJ2CiylL/NuIWMGsxj3Xu0Qd8F/nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695728, "uuid": "f05e5a1d-3c1a-46e3-bf3d-9d763705095d", "value": 76632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695728, "uuid": "fb066d6c-e53d-43c3-9c25-5b146cdd8fcb", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695728, "uuid": "77ab4fe4-3072-43e4-a92b-4af70e885786", "value": "f14e2b92284c7e5fd36fe428c9be0888", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39bed1f0-7a39-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642714674, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714674, "uuid": "06c74534-167d-45a6-88eb-1109911fe9b7", "comment": "Malware payload", "value": "bee71531732e62c45f0b364a4d412e16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714674, "uuid": "4a930a76-cbeb-4255-a3cc-b3784ed0e20a", "comment": "Malware payload", "value": "cb626d8f9816b658372b2c3902ab6872239f8c102488be8aeeca1cba5bcbe642", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714674, "uuid": "c28969e2-6380-4190-9184-b7d22c00a67d", "comment": "Malware payload", "value": "16bce6f280905515239d068984a3d6b6df1a8b2c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714674, "uuid": "75818742-c803-4e59-8b39-1aba38d1ce36", "comment": "Malware payload", "value": "ef63b80fe86c9f7c7933cab80e88eb5d984a3d1c4973cede87ec34738c558b9b028c677cef0e58e804db19cfe2a846a7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714674, "uuid": "ea348972-6a87-4737-80b9-804402b269b5", "value": "T16A442262BDB72607D88715B208B06A41EC3FD416F740AE547A7FCD8399F65B190A33B8", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714674, "uuid": "819e06a9-dd3f-4a05-adcd-48b97c224556", "value": "acc384cfc66d33262df1bf4ba30ff02d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714674, "uuid": "54ac768b-41e1-4773-b444-b160a8feb1eb", "value": "6144:wBABAdbouCA9dctS6HrFGDrbyyu6vzTr5dNKTToAH6s:wmB0OCW1gDpu6nrcVas", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642714674, "uuid": "89297873-44ab-4d3b-b99f-aadf58439666", "value": 261120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642714674, "uuid": "e657e152-493b-466f-ac9c-b7b18690faa2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714674, "uuid": "e03553da-a4cc-4301-85cd-3055b9e49739", "value": "bee71531732e62c45f0b364a4d412e16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01f85c6b-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1642708567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708567, "uuid": "dd9fb618-f175-4c84-84f1-611d1a290761", "comment": "Malware payload (ArkeiStealer)", "value": "ff83b1518022f4538654e5ed80c8f5ad", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708567, "uuid": "b779b3ad-4f0c-4c10-8a63-0aedf02a60e6", "comment": "Malware payload (ArkeiStealer)", "value": "cb8f3744db75d13ec86fc9ef5b8e0f680a29fd2368f1d991cc0865aa6c7cc89e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708567, "uuid": "8792f3e4-68e2-422b-aa83-e53a9812cb59", "comment": "Malware payload (ArkeiStealer)", "value": "88524949dfcc8130d14d4c607ec716d032f1aa15", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708567, "uuid": "c64f9a41-0b97-4aff-bbc4-e3d8cbfa56e2", "comment": "Malware payload (ArkeiStealer)", "value": "afd02ac47d53af47b6b7a3d15e84fb311c7c614e5675e5de987b5f5ee9c1cbab27972293ee61bc0e8f66dafedb6e9c6f", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708567, "uuid": "745e3f58-291f-416a-805c-d10a44aa33d5", "value": "T17E44C0717A80C432D44722304C2ACFE15ABEFC316EA6964F77A6176EAE323D1552931F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708567, "uuid": "5a91c8de-efcd-4586-8453-29001f3ee094", "value": "29340e6ca7cc3b9eb89af4981d5214eb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708567, "uuid": "8ff4761e-6284-42e1-9fe4-a20352ab2298", "value": "3072:+r8qjPHLu+V4I5V1wwqmeykbOQApNJxauzgal1swCf+25GV6JES8M/h3:+rnTLuuL3w+EApNJgMgIAJES8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708567, "uuid": "c03be02f-d266-4167-9e83-abe866d17d3e", "value": 269312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708567, "uuid": "4ccfc7b5-8f9e-4ebe-b792-1c51ed443fc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708567, "uuid": "a81a9d89-02ff-48a2-9366-8c17a7d0ef93", "value": "ff83b1518022f4538654e5ed80c8f5ad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5678e0ed-79fa-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642687664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687664, "uuid": "1a30e272-8b72-45e9-ab72-870a17b6ec65", "comment": "Malware payload (Heodo)", "value": "8a97d8de11cf90258135065f0f7b4366", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687664, "uuid": "3a556055-19ef-443b-932d-48f61b849db7", "comment": "Malware payload (Heodo)", "value": "cb8ff98fc8e177a504db540af317736d47851af89e06bc763e4e81bb254099ad", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687664, "uuid": "8960fce0-031f-4b26-8de2-1c686424ef95", "comment": "Malware payload (Heodo)", "value": "3806b6a55189ef51bee8e44b476506c41089eb0e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687664, "uuid": "7a2fc4a4-9f6c-4665-a5fd-44165e06a600", "comment": "Malware payload (Heodo)", "value": "681864e59ff3e6beba202c5f9cab1b2bbd15fbee250d994999ed9e463dac65a1726d2fc548047445b11edb88d374a25f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687664, "uuid": "3cb3475a-42c6-44a4-96a5-8d53a3584e46", "value": "T199E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687664, "uuid": "b8e600fc-c60d-4557-b3b4-7df9bd584e45", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642687664, "uuid": "0e208b04-f74f-4112-b18c-d3a1c193e2a6", "value": 144569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642687664, "uuid": "a329b4ed-c773-46c3-8503-7dabb913f121", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687664, "uuid": "8fa9b27f-51e4-46f8-b602-6a542b1706aa", "value": "8a97d8de11cf90258135065f0f7b4366", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bcee102-7a40-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642717764, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642717764, "uuid": "528fd040-d294-47f1-8f2d-63f42287be8d", "comment": "Malware payload", "value": "f8a594d1a3bc4e01dc30e665b29b2199", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642717764, "uuid": "846cdccb-1a17-42e8-b0d1-48fc5e39afe8", "comment": "Malware payload", "value": "cc087101e48ffeece56deba54e6da814a6d35e371396b07cc4e10b121aac9907", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642717764, "uuid": "ae7db801-3e2a-48a0-80f5-72b12bbbb5a1", "comment": "Malware payload", "value": "19907856b753f4f203c6a0f09bb866c48cf2b724", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642717764, "uuid": "440a7e61-56f7-4e00-8465-98c6101da2ea", "comment": "Malware payload", "value": "2e2b718e87d812da3b97de1299193ff927ac7625118f55f6d4d9de8785b905ec1dec1184c4eec1d1701db0664fd31684", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642717764, "uuid": "e92db268-bc90-40b0-9227-cc9e812960b8", "value": "T127636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642717764, "uuid": "1014dbf6-f62b-4f38-a2c1-38a9fc9ad7ad", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642717764, "uuid": "25725cab-7557-4265-89b1-9ad75b71640a", "value": 72844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642717764, "uuid": "f0fa1d30-c1dd-4521-995b-05aca9899788", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642717764, "uuid": "8ddfb640-8de1-421f-80bf-c6330de069e0", "value": "f8a594d1a3bc4e01dc30e665b29b2199", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "303dfabc-7a33-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642712081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642712081, "uuid": "75216332-f912-44a7-b5bc-b8bf992e6706", "comment": "Malware payload (Heodo)", "value": "a609392cd1e2513bf44b11727dbdda9a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642712081, "uuid": "fc817a95-e3e9-4fb3-b95a-b709192eccc6", "comment": "Malware payload (Heodo)", "value": "cc331407b5a5c220e5fd8232ee0c0513e8f29c4c46b683e911ec17c43e001ab0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642712081, "uuid": "155399ab-9b61-417c-9698-b2972b615e43", "comment": "Malware payload (Heodo)", "value": "bf0fdeeb5315313d52497440ae851ee81198f116", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642712081, "uuid": "2ba2f16e-e0f4-4199-88d0-ef2ba3ed6dfc", "comment": "Malware payload (Heodo)", "value": "4ffbac4742d02755d1c57c71ab808b52b742417bc3c526d88f510073150bd846b7a7dd48e959d59bae0e028d079ff3ce", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642712081, "uuid": "c5c988b7-46b3-4e9f-bd81-eac7bedbbab8", "value": "T1B1D4C002B291C035D5BF11B44E666B18A2EDFE905B3985C7D3C87A5F2F31BC2A635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642712081, "uuid": "f81e8eae-fec7-4946-899f-7ccf353bd0ec", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642712081, "uuid": "6f0fba98-91da-46d1-87ad-cad1de50c4a4", "value": "12288:hF8kySLmsbWV5WlvAuyfEgXkvPLEbs2gu1D0iv+9Ne12GBkkQxCej+6IvUDEPwqh:wMmiWV5W5AuyfEgXkvPLEbsGDIfYLQxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642712081, "uuid": "f0675405-fbba-4fc4-bc41-2d87c3e6829b", "value": 651264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642712081, "uuid": "f65d9fb3-6247-4b68-9292-dcb66d9d9217", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642712081, "uuid": "525afffa-1d01-4990-a935-a30ff57069bd", "value": "emotet_exe_e5_cc331407b5a5c220e5fd8232ee0c0513e8f29c4c46b683e911ec17c43e001ab0_2022-01-20__205434.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741d983e-7a2a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642708329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708329, "uuid": "6f9b74ce-f829-4a6e-a0c7-5f0f050f1c0a", "comment": "Malware payload (RedLineStealer)", "value": "5f94440f49b91e669770560dbac3abcf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708329, "uuid": "beb866a0-92c0-4863-91c7-5436af7367fb", "comment": "Malware payload (RedLineStealer)", "value": "ccc5bf47a682c466ea865ccedb31bdf3061ceaa8870ce9b6f09bfbb46600bb59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708329, "uuid": "f81a01cd-ea8a-4743-a4fc-4e8d716ff349", "comment": "Malware payload (RedLineStealer)", "value": "41b38c82c2c50f48be8f6d80b61ec037ee19eb3d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708329, "uuid": "41c9a121-1925-491b-b143-0cd7eeff5b9a", "comment": "Malware payload (RedLineStealer)", "value": "7075c31bd5b5cd386bea2eec07ee82a07c57469b47f7a33ce434a47d61006108f79b82d39ee9aea61eedcb196c674950", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708329, "uuid": "38b50dc7-4dc6-490e-be46-5e4369861a09", "value": "T130D412C1F310DA62C47B923450AA2F562321EC94D9F767373858B13B9AFB183792231B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708329, "uuid": "ee008e08-8432-4a37-a278-c9e438b7ceac", "value": "26f6af71ba905d5411e9904e8ab406ae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708329, "uuid": "1a21c5ed-e8f3-4c79-9f39-b10bedfffc82", "value": "12288:WXFV/X3Xu1scN6GnfbtY6igVc5dSPrKoFWpvS0Mm1Uu9JnOKUeZZacM9VsOJkZo:WXFtH/y60btvigVc5E9wpvS6vacM9Vsa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708329, "uuid": "d1d83a72-3362-421d-a820-ed07ccdebba9", "value": 643680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708329, "uuid": "389def18-6dc7-44d4-92c7-71e8873820c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708329, "uuid": "776651c3-68b2-4b99-ad8f-3b9c473b9075", "value": "5f94440f49b91e669770560dbac3abcf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bab283a8-79d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642672370, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672370, "uuid": "5b9802aa-f33a-41e3-af00-56df702e31ef", "comment": "Malware payload (Mirai)", "value": "4f24d2cc15e3273d9fa688b51a5d9db1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672370, "uuid": "928d9492-0287-4788-841d-917429f13568", "comment": "Malware payload (Mirai)", "value": "ccc88c66491dd6abef0277d61a8bc777bfe6a897c6940435de285ebee03f1196", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672370, "uuid": "1050d8d0-4bc9-4576-94ef-e57e819a0ef3", "comment": "Malware payload (Mirai)", "value": "00936f03d87abcc3455be8ae0aa1bc91d3a03721", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672370, "uuid": "7f940bda-9628-4e9c-aeac-dd173e925d6d", "comment": "Malware payload (Mirai)", "value": "979b553dc0ca2c8892bd9600144d5d56fd452d0b356f9b02c66363761da40752e469fc7285ad6271d6be16c6701ce9c1", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672370, "uuid": "4e98b85e-8d3c-4424-9053-5bf42be6facf", "value": "T1FC647626F60145B2E1580DF1356623D87E99437F9E6626C3E52F49B4FF3281A01FAEE0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672370, "uuid": "338a9080-4596-4721-89ba-e0b7d86a8d88", "value": "6144:kqlrojgbJcMXdZCSpn0UpQKqUgAZ08kjUzpbGG5mP46aQyfPlfKsNb:kqlrKg4jwEG5mP46aDfPlfKsNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672370, "uuid": "0b154a34-81c5-4b09-8a6d-d6b5f7124cea", "value": 312778, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672370, "uuid": "8ae9c916-0724-4f7c-b658-d6bc805ece1a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672370, "uuid": "bb219871-8f53-4d33-9ff5-34aca003c5c8", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc181782-79c4-11ec-9275-42010a9c0029", "comment": "Malware payload (CobaltStrike)", "timestamp": 1642664749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664749, "uuid": "7a75b1fa-5282-4cf8-a019-4b10f4324d47", "comment": "Malware payload (CobaltStrike)", "value": "d6e290500e5fcae7e7d67fc45abaa9cd", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664749, "uuid": "df981cca-e595-4221-a198-935534d5f0c2", "comment": "Malware payload (CobaltStrike)", "value": "cd1c9d25523532f142c9f9b84f26fbb5abb8459c7eee99cf13b3e7f827c9d1a3", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664749, "uuid": "17bfb97e-6323-414f-ab85-198e29f05443", "comment": "Malware payload (CobaltStrike)", "value": "f8b11c77c54b6d0d7017d834bd0708316f577d08", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642664749, "uuid": "3b5262f7-60f3-4be5-9768-866eb6befb0a", "comment": "Malware payload (CobaltStrike)", "value": "6951fd453f1b0b1a2deec08dc66f1532335165fb12f02342aa37cb9f822a0804c3565d90e1b12a0dcd10134d53794b95", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664749, "uuid": "cc1bd76f-4d15-4610-8794-63719499a754", "value": "T1F6540201B5E1EC74D9BD183124B4D3226F7D3A220AE0ADAB3F9615199F341E19B32E36", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664749, "uuid": "85768530-4634-4cb8-9001-7a937797e1ef", "value": "2567c1dbfa2f6c70e88bbb893b7137fc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664749, "uuid": "ebe249ae-adf8-4f13-ae6d-783e33fa51c9", "value": "6144:/2uYE4rpbErgbg5HT21EbXbIcvLFYuE8dJkHKHEESW9c9z:/9GrpbErtF21Yje+dWLElO9z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642664749, "uuid": "304b77fe-8a81-447c-8da6-98f639e83584", "value": 281600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642664749, "uuid": "b5fe7ab6-e814-4ee5-a547-e69ddaa85a09", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642664749, "uuid": "69dc59e4-a1d9-4e0e-827b-2cacade69f69", "value": "Skype.Profiling.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e6e6700-79bf-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642662202, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662202, "uuid": "92e3e02e-d21d-429a-903c-fc066b1b9c7f", "comment": "Malware payload", "value": "c60fbc27cd64f58f26538f791566f9f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662202, "uuid": "3b6aced5-71d7-4f81-ab67-514d6ff5787a", "comment": "Malware payload", "value": "cdebba0435087c146a8e087ef19b45590f4bad98a5a08ae1952816713780d740", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662202, "uuid": "8585a5e2-121d-4aab-b27d-461b732c634d", "comment": "Malware payload", "value": "7ca633022fbdc6d9c71fdaaf102ad83453df64cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642662202, "uuid": "9fb698e7-81ef-4277-a15d-768a45df0df5", "comment": "Malware payload", "value": "83337b0ae469db222be101ec19c344e2974d1ae9433520fe58b6ab8d86f3d0e0932bdb00544042efc942fbfeabf3b946", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662202, "uuid": "b4724a46-f1ed-4876-9c91-a0ea1c97cc13", "value": "T1E11509BC312432DED82BD2319B685D68EFE1787B930B9117A45B21ED891D987CF250B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662202, "uuid": "8752b027-d86a-411f-8fd5-85fdd2db8378", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662202, "uuid": "88dbd54b-41b5-44e5-903a-df4fbc8c1dd1", "value": "12288:6h1nwVGYVs8sBpQxn3jHux6ENHHUs6Vz8rbA5fGc1ic1qIjh3k8U9Boj21ACt1CQ:A18GYVqBp03rux60OKrbQfGcQcUBjAu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642662202, "uuid": "e3cc0fe7-a618-4262-854d-1876cc2b1777", "value": 897536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642662202, "uuid": "dc19ae52-52a5-4846-8a5e-c806864fcdc3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642662202, "uuid": "7825e21a-5b4f-496d-a158-c7ee16b6d9cc", "value": "Invoice & Packing list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "593559f8-79c2-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642663616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663616, "uuid": "c28eccc3-469d-48ea-b15c-6aa791cbef83", "comment": "Malware payload (Heodo)", "value": "5d9f50d3ffa855abe7c109e23106cfe8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663616, "uuid": "bc20745d-d655-40d3-8178-4e61f7e689eb", "comment": "Malware payload (Heodo)", "value": "ceafd90b9d8a1fa4ba9b8f81f1c3b138570c8768b75ac1ef0d3bb126cc6d497c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663616, "uuid": "98f4f260-8458-484d-8366-d5076793ea58", "comment": "Malware payload (Heodo)", "value": "a864bf470f56fd538f4f8a06e2220636159ab528", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663616, "uuid": "084301f2-d092-4d8d-9b8d-811ce7d127ae", "comment": "Malware payload (Heodo)", "value": "bf3c7742883834472a1b780d8f60eb1c64f93a438ef180d5d8c5a3598fee3dde17630adeafb904a184e77b3a9b977905", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663616, "uuid": "473ada51-87b9-4902-a414-49ee1f9c593b", "value": "T15FE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663616, "uuid": "f549d683-5d1e-474e-b525-0a963b801af2", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663616, "uuid": "e4724d73-d013-42a2-9fc0-95254111ad74", "value": 144460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663616, "uuid": "5d49a001-64c3-4440-952b-0c641f8eafd9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663616, "uuid": "c0c9bc94-3937-4c73-9312-a4147996d897", "value": "5d9f50d3ffa855abe7c109e23106cfe8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7391b9c-79bc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642661224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661224, "uuid": "f2c9b883-4ece-40aa-8337-6716493a3661", "comment": "Malware payload (AgentTesla)", "value": "4eb6c107d9596f887aef81a332bf93b6", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661224, "uuid": "b684151b-a646-48b4-bd61-567b9f701252", "comment": "Malware payload (AgentTesla)", "value": "ceb9dd7e12593374447c5243e36299429b6471d930a6131fe646ab4ba7d78e69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661224, "uuid": "534843a2-e1cd-498d-a36d-1db32178ec00", "comment": "Malware payload (AgentTesla)", "value": "be76ab8f328418f6d44859b94812921aae1d1bf8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661224, "uuid": "bcaf5f26-764b-4441-9277-bf73d93b6647", "comment": "Malware payload (AgentTesla)", "value": "fdddb1f6f9c9dccbb446d65f4961779701425448ac8d23391a860359788482dfb2aec1b516c1bec8d2268e023e50ce9d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661224, "uuid": "e053acc6-db9f-4ce6-9345-d70504d14e6b", "value": "T180B42371C6078A5485D7B34F3C16247344AF99E2FE2069D1EBBFE9D398021798A2F760", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661224, "uuid": "f4df31d9-1852-4471-a43e-e96d2829f565", "value": "12288:MfPgc/1CNN72ud/7i/XYRm6wGJBNfvPnWGB:MfPd/1C8XYRm6wUBdvPnWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661224, "uuid": "1e594869-8869-4cde-9c47-eb18e02ab7fd", "value": 510240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661224, "uuid": "1588bceb-ca52-4118-ae9c-7d6f878ac660", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661224, "uuid": "2025a0b6-d991-4df8-889e-782c22da4988", "value": "SOA NOVEMBER 2022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0621bc9e-79dd-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642675073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675073, "uuid": "765038f5-f517-4f81-96b4-85abac085463", "comment": "Malware payload (Mirai)", "value": "aa213378d434c1bf0cf2deb00b469580", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675073, "uuid": "7bc5b612-d229-45c2-a717-f124253cc1e9", "comment": "Malware payload (Mirai)", "value": "cf6c8b7f9fb9c76c00cbfafb160078c4d833929e90e015d5fc54f3a5757e20c9", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675073, "uuid": "3acb7617-3dfd-4ea6-9f9a-58c6fff7431e", "comment": "Malware payload (Mirai)", "value": "cce0990159429eda496bfea25ceff1eb6174b4a4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675073, "uuid": "f80a2d16-03ff-43ba-b6be-b4d211af37c5", "comment": "Malware payload (Mirai)", "value": "2e61e0e60b076318b039807990a39c195f6752fe1e002bf70b4f9043ef96601e02a5b3edbe9462d675690bc15ae6a7b3", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675073, "uuid": "84aab8e1-47c3-4188-898e-7aa78628ba0c", "value": "T12DD2E1BE390240C9D838E035476807586F692F31BB47ED45B8A9D6D3C8965F4B0F97E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675073, "uuid": "bb508b59-4e19-4865-b13f-4bbfe5fa6cb5", "value": "768:kZznvmWXA7ODwg+GAVHIs7aKJKNWq0Rpk8NIpVNL8tkKBwPRnaJgGlzDpbuR1JH:kVnvE+AuzK8NWq0Xk4SbOkKBhVJu9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675073, "uuid": "5313d397-5580-40e6-a57a-81b5e696f17e", "value": 30668, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675073, "uuid": "cc53b999-7f41-4d79-b8fc-36f03448328b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675073, "uuid": "0e40b812-8f18-4aaf-a10b-c9f5b6e80b8e", "value": "Tsunami.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13b86bc4-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665647, "uuid": "4ee71fc2-e3c8-48d3-91e4-c5ff1463e868", "comment": "Malware payload", "value": "22f26a9947c7d3d9203ba453c534badd", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665647, "uuid": "01a24d5a-5e47-48e8-b823-0251fea57f13", "comment": "Malware payload", "value": "cf6e5fc8218b4bd2533806dc360e155e51edba08434d23d80eff6541edfc9402", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665647, "uuid": "71822863-2f8e-4b28-9f0a-2486d4156829", "comment": "Malware payload", "value": "4e2712f6e532e97dd82341cf8b98dc47e12cfb02", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665647, "uuid": "5713ef30-f114-4bab-a0fd-5023a3236424", "comment": "Malware payload", "value": "d161c129b9dcb4d4a81f683df7d9b03a2c8cafa17008ef8935939f865abf6c50039578afc2ec5ef75c55c7cbbdd04c79", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665647, "uuid": "4c21bc9f-75a7-4e3c-9792-daef81261b42", "value": "T124B57D22F2C1C537D0732E38CD5BA3A89529BD501E28954B7BE41E4C5F397817E2A2DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665647, "uuid": "6c188e40-8167-4e0e-afaa-0c284f61fe42", "value": "49152:JRQ9X6XP99EaS563YehmzTOqTPUVZJOYLEA:Y9X6XP8aSYIehya0mOYAA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665647, "uuid": "a425f474-a63e-4593-94b6-fcc811866789", "value": 2341376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665647, "uuid": "655343bb-ca72-4a2e-8b6f-daf0f6f70556", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665647, "uuid": "90a6b76c-8e74-4edc-bf83-e999297e8ce4", "value": "_-atdtpb.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e83376e4-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642676741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676741, "uuid": "d9d555a2-a13f-4463-b3f2-79f91dc68d5d", "comment": "Malware payload (AgentTesla)", "value": "a486245e268190d87362191d87507b44", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676741, "uuid": "8dc6c90b-eb8f-47dc-9542-418e0afd0297", "comment": "Malware payload (AgentTesla)", "value": "cf7395df9dad2533185b30a23e1f49d0ca70eb8f819fb13546677869626ea937", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676741, "uuid": "331a8c67-49a8-4536-8d70-fe6977a59a7a", "comment": "Malware payload (AgentTesla)", "value": "53a529a5db2ef6b8dfcf7e2e8fd8ce7ddf518278", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676741, "uuid": "5da1d0ab-2dec-4d8f-aefd-8ebd77cbc0f3", "comment": "Malware payload (AgentTesla)", "value": "260717f3795321bdb0b14c1544d9bd03d947faac274a637e320d87bafa051418ee9f7a6849303da0b09ed6357ce5f9dc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676741, "uuid": "a0984e56-4cc1-44c5-ad01-7b3f9f0a965b", "value": "T1D994227429F92B26EAF92BF0E935D04287F1AC17B534EB0D5CECA0D94AA2F5005507B7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676741, "uuid": "ff2d0d82-3c19-4783-bf4a-2e6adaada9cf", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676741, "uuid": "e110f2e6-5b69-42c4-a94a-fc6f7dfd08b4", "value": "12288:iqPwRYdAbc0CE5orEvLOu6oTBJk+lfQ7Q7XJXkVjX20e:aYdAbc0CE5AoTB7fQmXNklg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676741, "uuid": "07166f59-55cd-446a-b402-ca63b566be14", "value": 416256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676741, "uuid": "4d3af5f0-c431-4f00-9cb4-33f59bd24d99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676741, "uuid": "ab709318-7226-4334-8347-9be257ee0a9b", "value": "Compra 112519.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a46ea11-7a13-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642698300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698300, "uuid": "6ab8f083-b9bf-4af2-aa2c-8ea5fd88de40", "comment": "Malware payload (Heodo)", "value": "466e42c1ae6b84fd2f4b0bdba17dff9f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698300, "uuid": "5915cf7f-5241-4fbb-a621-bb0213893bb7", "comment": "Malware payload (Heodo)", "value": "d0b7381be82e999bb245ff5a8435d42b89505c02af65718a64a230f2f9549009", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698300, "uuid": "6d34d12f-f835-4b28-8f88-2417c4fdab8d", "comment": "Malware payload (Heodo)", "value": "397d7a07c0e90726e5340205808a97e8a7d16026", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642698300, "uuid": "a67427c2-4b54-4a82-8e97-4b29eeed2bb6", "comment": "Malware payload (Heodo)", "value": "00c08d879e82ee8d32ca93a9856e535fc77f301b2aa1b52a2bbb036894bd4c0179a6741fea2a44bf030bbff53773373b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642698300, "uuid": "369ffa3f-9a89-4cdc-92e7-9b10db310844", "value": "T10FE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642698300, "uuid": "6364624d-5397-4aad-a346-7af50060f7f5", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642698300, "uuid": "915e83c9-1c22-4aae-b9a4-99e11dffd972", "value": 145228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642698300, "uuid": "7de043e6-aac4-41b4-afe1-09241158996c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642698300, "uuid": "c964f253-5e45-4ddc-9435-f4ac098fd37d", "value": "466e42c1ae6b84fd2f4b0bdba17dff9f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7be7a618-79d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642672694, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672694, "uuid": "6336d755-28e0-4fac-b00b-2e5d9ac763d2", "comment": "Malware payload (Gafgyt)", "value": "275ef05cb7a36eb045aab35266115786", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672694, "uuid": "b5e3d139-30d8-44b3-8047-b5d2e85529cc", "comment": "Malware payload (Gafgyt)", "value": "d1447554b7cdd24e3cee6d2077ac9b6f9fd65a5190d01a0572b8e7139ff5e6e7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672694, "uuid": "a591e704-62c6-4456-bf39-abbad7e7bed3", "comment": "Malware payload (Gafgyt)", "value": "54bf59ceaab14693298b6938cf4eed4e74298516", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672694, "uuid": "5f3b2c9c-391b-483a-a9b1-8c367226df5a", "comment": "Malware payload (Gafgyt)", "value": "78b7269e4208b894cb5c8deb1bca6d983ff0b0d27271e5fef14cf8d3b427692868024d7646f5f451ff18838f0971fabf", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672694, "uuid": "c2247b35-ebb6-42ce-8313-cdd53cf743f5", "value": "T16D5329337B174E23C0CA55B145E30332B7B1D64A2CBA879779916EA83F12BC439563E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672694, "uuid": "77a7e3fc-93d8-44d2-b18c-e6e56f5367ae", "value": "768:gNAEZy76m74luIec3h64hJdMWGozfsO+YM5V3FQoY1tOQxPIZzuLV4KbSiUI:eRsGJ1SYM5hUtnxPizui7PI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672694, "uuid": "acf4882a-c0a8-4040-a445-de386865b28a", "value": 63861, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672694, "uuid": "9b3db161-4410-4de5-b085-9a960a4e5773", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672694, "uuid": "a51843ab-d629-4020-ac14-d9b34716ed40", "value": "sparc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09c48634-79d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642670785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670785, "uuid": "fd89d14d-11cb-44a7-8476-c106c4a6753a", "comment": "Malware payload (Mirai)", "value": "ad08fde083be39dd08fbb5540aa3d8af", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670785, "uuid": "6a59cf64-a6fd-454e-939b-e778b5871197", "comment": "Malware payload (Mirai)", "value": "d1959c7f86ff208f75b5c242b78fa5ecea3984062e8af3805c48f2e75597342c", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670785, "uuid": "6e36529f-d737-4355-9cbe-804a2c92608b", "comment": "Malware payload (Mirai)", "value": "25872343a3ba4e7d16e1ed8ffdf7751d5790f7d4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670785, "uuid": "6d3c7919-8c2a-4955-9121-23d7dd23df89", "comment": "Malware payload (Mirai)", "value": "9f3c8668a6ecc546917942800e5a19eb9a378fc0076712b0983422815571a447217d4ecb85cad96635208db9327273d4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670785, "uuid": "69f9b335-bc2f-4cd0-9f0c-249809ae9dba", "value": "T199D3F730E8044B1BC2D227F6A79E469E3F351EA7979733115A387DB02FF27992E25520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670785, "uuid": "8d7670c2-a508-443a-831f-e065f5cc7e69", "value": "3072:+DShVLkDZ6waCAdclybYJOmP46aQyfPluesNb:VhVeZ6zclyboOmP46aQyfPluesNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642670785, "uuid": "78cb8e97-3520-4cc7-bc7f-31cb5d603d4f", "value": 130115, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642670785, "uuid": "fc0499fb-d866-4661-8957-64d6538d948c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670785, "uuid": "57bee52c-3554-4b6d-b2c7-1d0e7944eed3", "value": "armv4l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04004ce7-7a06-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642692679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692679, "uuid": "b9d328ea-72b6-4aa6-ab61-81e3ec83b6ae", "comment": "Malware payload", "value": "9a4ef0169f86641aa99017049de272f5", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692679, "uuid": "be4e30bb-8ec9-4261-b9c9-78de45cd08e7", "comment": "Malware payload", "value": "d21d616f6052e8b62292fcc6d9fd9ee2a3b549c59ca76aa8ef5a96cd163512ac", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692679, "uuid": "274e7a82-9272-485d-9ee6-93888a1a505c", "comment": "Malware payload", "value": "82e1a3868eff88753fe30abedf7c83620aaddd13", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692679, "uuid": "f6e928f6-9191-4307-97ae-0fbe5098fd50", "comment": "Malware payload", "value": "8162ca3f96ec29b9adad0c5f016819305db3c0de8ba7d87afae2bc1f91d253b4fa46ca46cb5de38c6120e1c3d20a2351", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "BazarLoader", "colour": "#4D0DF8", "exportable": true, "hide_tag": false }, { "name": "bin", "colour": "#618E3F", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692679, "uuid": "6b79e0e7-b62b-4109-a25a-7ed6b9b35de5", "value": "T16324CF08B2D90078DD2796748A639507EABB7C216B24AFEF03A54371DD3F3D5113AB62", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692679, "uuid": "6e3f5969-4f5d-4a68-bf1a-20af6584c302", "value": "7c661725970e2285630167e2c43a72e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692679, "uuid": "bd8dcb07-d08d-4cac-80ae-93ab0362f5ec", "value": "6144:VW2ARP1XewB7c6waMtO507a3DXx3FqcZSV:VWdRcwNC1o58afqcZSV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642692679, "uuid": "29503791-73df-424a-a915-bc0dc73aad2f", "value": 219136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642692679, "uuid": "4fdac699-d080-4cdf-8b2c-4e2e4b91bb00", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692679, "uuid": "4fffb21d-c4a2-4deb-8300-2ff130d39ed7", "value": "tpJBFL.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "125a6236-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665645, "uuid": "e6c8cfed-9e11-4598-aeb1-03d0e877affc", "comment": "Malware payload", "value": "7f9c30d846583e8e7aa700215c8f4c78", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665645, "uuid": "52f67fc4-b38a-4864-ba75-3ca8d114827a", "comment": "Malware payload", "value": "d3df410058bd3b770c16f59c27f7e5b536a10ee24bd76ce1d4ba36d9d1c17a70", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665645, "uuid": "9630a5ca-a520-416d-8ba2-da8beb3cc7a2", "comment": "Malware payload", "value": "eefbc611d5dcec648c6bff6c4eb4a64e3734ac26", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665645, "uuid": "dc7fe3ae-1e0f-4d69-9e09-0412791259bf", "comment": "Malware payload", "value": "85a70614576b9463ae106b9d0cdb68621cae3549116aa0e2ec2cc9274cc2beb2895cddeb7fb10d277360f8a8dfdfe44d", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665645, "uuid": "5d20bf5d-10f3-403c-bebe-92c1203812bd", "value": "T1E2A56C22B2D1C537D0776A3CDD5B63999929BD201E28880B7BE41E4C5F3A7807E2D2D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665645, "uuid": "895e4769-facd-48a4-a19b-39928c836311", "value": "49152:cOrh7VxZN94N03I09DZV3ZITPsuXOYLIA:dh7V3NKMfpasiOYMA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665645, "uuid": "363c0e2e-814c-4c8f-85b2-9e49fe515aee", "value": 2087424, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665645, "uuid": "7f666b6d-ce39-4bb7-a109-f4c270aeb558", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665645, "uuid": "c2104e46-27da-4e51-8d95-32fb501ae6ef", "value": "ArchivoEndFacturES.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ef75a8d-79be-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642661962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661962, "uuid": "c7064db1-dc47-4002-b148-aa133ac36717", "comment": "Malware payload (AgentTesla)", "value": "d6976b13476f6b55dfb2b59bf27af3e3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661962, "uuid": "338b9e79-0ba2-4c07-bab6-6596eb431fbb", "comment": "Malware payload (AgentTesla)", "value": "d41e05023a0665c20163862170f5376f9f7eaeb1e3f0d4d888e67cb7038b1188", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661962, "uuid": "125b7b8a-c391-40d6-b47c-7c5596744489", "comment": "Malware payload (AgentTesla)", "value": "18a78e08383f4aaf0e66cd5381b0b6086167161b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661962, "uuid": "072b08f7-c62a-4100-bf11-0a8319f5c936", "comment": "Malware payload (AgentTesla)", "value": "59d9db3685b3c65e733e4762739ab717994ad0a938e6c88174c3d99a3835a7714c0f95bb31e74526a480143a87e43e43", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661962, "uuid": "f48f3f82-6e93-400a-b6c5-597c7b446ea9", "value": "T121040131BA0281BEC6B157791C31C61B7CF1ED901D6CBB812E267B0023F689558F9E3A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661962, "uuid": "82ad1066-15ac-423c-8ee7-910088052ac1", "value": "3072:o0D9C5F0SqCf1NubQegf1/7HObLEGEEMLyb1TZ8syq4lWa7BA+mxysyf0+FZVH:1c0SRtNukey1/jNGEEMWBbk97BV4iL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661962, "uuid": "0989564d-7deb-4bbf-99a0-7c5e739bbec5", "value": 187160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661962, "uuid": "dbd7944b-b8d5-4b6f-9ea6-de360179ba41", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661962, "uuid": "54875b3e-e094-4e09-8a19-5d9385540f04", "value": "ARRIVAL NOTICE AND DOCUMENTS R129724.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e539a404-7a1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642701647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701647, "uuid": "70a6fcaa-fca0-436b-8a79-a12e05ae52c5", "comment": "Malware payload (Heodo)", "value": "9b33ced55ebc37742d3ef19c0073aea6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701647, "uuid": "65c0807f-0826-4c77-9de4-a5ab850d67f2", "comment": "Malware payload (Heodo)", "value": "d4207655ef991d4ba681ab4392dc4c8e5515d69c84127e5c02f4b9cbea44d2cb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701647, "uuid": "8c3a1f18-7ea7-4a40-b691-9034f813db89", "comment": "Malware payload (Heodo)", "value": "cfde27de0f53aed0c4cb1755822c7e78f442fd27", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701647, "uuid": "b9d9adc5-c0ee-46ad-b5ff-cf7572f37416", "comment": "Malware payload (Heodo)", "value": "b4f0ffc790c9a1e11c0e241ccbfa020495c84b2ffc3b404b3b90b9c44bc4e12adafd6b1fdb300e4f9254c129870864ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701647, "uuid": "0e30fe74-c3c6-460b-94de-d40489115c76", "value": "T133C4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701647, "uuid": "354b5385-738f-4af3-bc4f-fbdd3393ad2d", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701647, "uuid": "a82e8916-741b-47d9-a148-b786396ea2f6", "value": "12288:P78OGF+L8/4UUNyrFdMhTq/n4vAzdkPs7:D8Ody4aFdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642701647, "uuid": "c5682833-5a18-4484-ab3d-f0c161b5db88", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642701647, "uuid": "53de83c0-8f38-4857-b4e1-0f9b4fba67af", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701647, "uuid": "10beddd8-0b00-490a-b695-2718e3dde4b9", "value": "9b33ced55ebc37742d3ef19c0073aea6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01c42874-79e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642676784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676784, "uuid": "a357175b-1534-4c45-b325-9f08f3c7fc16", "comment": "Malware payload (Formbook)", "value": "1ddf5f1911be0eef1b4fb3fa34b9d1e8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676784, "uuid": "8974863b-6bf2-425c-9e2b-3a111dea31bc", "comment": "Malware payload (Formbook)", "value": "d621ac2b137b22e260d51f471e800d28a9f6affef1694b6d2ad3e4581526aa12", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676784, "uuid": "1bf9ecf9-bf86-41cf-a158-7a285656afa0", "comment": "Malware payload (Formbook)", "value": "43dc1293b6f92d3d34abd2a9419ac861222c6a73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676784, "uuid": "c3712fa1-901f-4e95-b28f-478efceed2ad", "comment": "Malware payload (Formbook)", "value": "5390fc0f6f812289a6c71c1b609b7942f721d53d64e3c9dd14b1cbc5685b2df4fe9da16bdd7d4f3b3bee9b887eaf4f82", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676784, "uuid": "f4c11b52-24f9-45aa-b79a-64fb8ef36d34", "value": "T1C8B4F04F7A598672CEF04EB8549484A04F796D5F2012C21638FCFEAE35B37C4464E6AB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676784, "uuid": "4cc904de-e1a7-471a-be94-90db3dc136d4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676784, "uuid": "f40d41eb-141e-4ced-b6b7-f856cd43abd1", "value": "12288:mzAK777777777777N7XPjyOds3v4IYam8ghAw12n8McmLR/B2m:kAK777777777777lX7yOdKv4IYam7ht8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676784, "uuid": "4b15c34a-ff41-4ccd-b040-915cc733dcd6", "value": 528384, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676784, "uuid": "2d59919a-ef86-4803-b7f4-037803f75f51", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676784, "uuid": "9ad14020-a171-4678-b504-f235fd633633", "value": "shippment document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46a50b69-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642668739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668739, "uuid": "ae8e4dc3-0835-45d3-8255-9fed614d25fe", "comment": "Malware payload (Smoke Loader)", "value": "82945edb7c6b985a97ea2061a33e84f7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668739, "uuid": "5d5458d9-bb6e-4389-b871-be6d056e665a", "comment": "Malware payload (Smoke Loader)", "value": "d64c8c01766cefa6cc6afda7ec2291fc7d18c59d179bdf90403a76b032b04785", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668739, "uuid": "9be4d1dc-4b6e-45e0-b8cb-bd73317f386a", "comment": "Malware payload (Smoke Loader)", "value": "28917ddd1220216e2e07bbac34c1fb92ab672ab7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668739, "uuid": "b00ec3fe-506d-4f23-88b1-321d84106c99", "comment": "Malware payload (Smoke Loader)", "value": "e651c53be55cf5e2ea748a15bec5d8eb3aa463c060a4d18015c57821aafc99e0cb76b83f441e57958decba29b3b2992c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668739, "uuid": "2f129b9e-537d-4ae7-b807-2121507a0c1a", "value": "T18944AE317680C432C48F163C9829CFA08BBDBC312E75964737A927AA6F752D1562B35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668739, "uuid": "cd7eeb9d-9b5c-481e-b59e-af0fab28d1d6", "value": "b7a0d2a66e86e27ee741e32de65d65f8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668739, "uuid": "75e6fe3f-8cc5-4b6a-961c-20b0edb1740b", "value": "3072:irILebgUU6nac+OK6VTjvD1NA5x2n2hoyVrWjM/h3:irILBUUow+Vb1/2hJVO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668739, "uuid": "584dc7d6-119b-41a1-8318-071ecd0d258f", "value": 256512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668739, "uuid": "766bc6a7-413f-4aa7-927a-83a6df10f181", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668739, "uuid": "32343e09-aef0-4adc-90d3-e3d0eadd901b", "value": "82945edb7c6b985a97ea2061a33e84f7.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2696897c-7a0d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695744, "uuid": "d31ac894-d3a3-4e79-8c1f-c3bc0eb75984", "comment": "Malware payload", "value": "c8c8c35ecc944d6d7987871c4249affa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695744, "uuid": "b90696e8-8594-434b-89aa-566dfee51bb0", "comment": "Malware payload", "value": "d6c233bd2d8e9689d4579f3133d04f609a9731efe2129ae7f41c8fd196c2b50e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695744, "uuid": "ccce2cbe-c8b1-45cd-99fe-ddb7ecb5c564", "comment": "Malware payload", "value": "0ec51b274acd8bccd086843f4f9734abf564f7f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695744, "uuid": "c96aa4a3-e50e-4b45-a790-48077f8504e3", "comment": "Malware payload", "value": "fe18af1e5adef1c8b0b538bd863537f17a707f7e09bdca9bd4a426d74c7400113ab9e4433e5386dbc57c2dd52c90a0b2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695744, "uuid": "4d8ff360-7936-4135-8d7a-765309765e0b", "value": "T1E124CF19B3A14079EC33867886A35A15E97638115770EEEF43284369EF2F3D4663EF60", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695744, "uuid": "12cb9b48-f396-4154-b938-6b4f929811d9", "value": "7c661725970e2285630167e2c43a72e6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695744, "uuid": "1821ee54-f00c-4316-878b-36ae509df28e", "value": "6144:01tu5ycQ6u1zvQ1g0Cc0bwwKJ/Te6OE8:01td/9lc0bETeg8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695744, "uuid": "33e6692c-18d4-42e2-b71a-41af14f8f9bc", "value": 221184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695744, "uuid": "74ddaa6e-c546-437f-96e0-39ede3317b58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695744, "uuid": "12d4783f-22c2-470f-9414-ad38b11646d8", "value": "c8c8c35ecc944d6d7987871c4249affa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4cada075-7a25-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642706116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706116, "uuid": "4bc13b73-baea-437c-b0da-25de569cc0e3", "comment": "Malware payload", "value": "dbf949e4e24be80ccaacd0923e062e2c", "object_relation": "md5", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706116, "uuid": "d4b97fcc-b8b1-4088-a4f9-1e6a6c1c7261", "comment": "Malware payload", "value": "d774ae040f0931fdb0cd07a5e550f98c55b5ff7541086d5a6ea4758ba18340b4", "object_relation": "sha256", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706116, "uuid": "294015f3-cc32-4a68-826b-de59495c0dac", "comment": "Malware payload", "value": "af593680326afe2f497ffb3f6c696dbf0fe0d14f", "object_relation": "sha1", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706116, "uuid": "104a9fc2-e08d-4d89-9e82-277ac5d00573", "comment": "Malware payload", "value": "23249d3b2b2ad5d20195e5560d46304900bd1aa0a9fb3f8a4c670afa6520c34cd3b20637816abfa270f8711fcb8b393a", "object_relation": "sha3-384", "Tag": [ { "name": "PowerShellSMTPKeyLogger", "colour": "#8DE653", "exportable": true, "hide_tag": false }, { "name": "webshell", "colour": "#DEA34F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706116, "uuid": "9b42cfcf-83af-4a2a-b5c8-9f6540d2a5af", "value": "T14D51A71AF847D15C9B79232BDC978962FF1B811B9DA2004C71DDC3491F3080996ACF9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706116, "uuid": "e26ebcbe-a8d3-432f-b125-5d4f759b3008", "value": "48:Axm48iLuDQjvUKmc4TQ7QZE96pAUYRAGqqkS1HoyWKLrj6l1CelkEJmZVOQBozlU:LGhrffvIypvK0elkEYZ85ze", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642706116, "uuid": "b481e926-03f8-40df-aff4-532658d41fbc", "value": 3136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642706116, "uuid": "d6573ed5-27bf-4388-8964-d5a9b28950a5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706116, "uuid": "655c748a-ba16-4d25-bd09-6f8b16c5f7d0", "value": "dg3V3Xtt.posh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b694ff0-7a0a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642694436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694436, "uuid": "d8d007fc-6370-44ac-9da4-44bf1aebdec5", "comment": "Malware payload (Mirai)", "value": "7d0dfea3f7e7c4e0c911de9e2fb3985b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694436, "uuid": "c9a46a5e-461b-4787-aa08-761a02147e66", "comment": "Malware payload (Mirai)", "value": "d989b35ea1f975e70e666aeecf0793c8dd6919e2451f13d28fd6a80456b7e6b7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694436, "uuid": "8523f73f-a934-4045-a1c7-e0d6335111a5", "comment": "Malware payload (Mirai)", "value": "f49718e946c75560528e0f00039ea9beaae2db44", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694436, "uuid": "f9599130-f549-4428-b5fa-afd298bda105", "comment": "Malware payload (Mirai)", "value": "0b585ee9a1b0be59b2e975e408ca5e735fbbd204c310b58f8b577c977ad8dbf3026d91f4df9c3d9f1e0d9739e3662433", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694436, "uuid": "abea18d3-5f13-47cb-9772-4b33272a01e8", "value": "T141C3842E7E12BFBEE668863107F35F70879521D227A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694436, "uuid": "17e07718-7d12-4387-9b17-afa42e2b21d3", "value": "1536:M7je1TMGq+f+AQ2rK7zeXeReXe8V2rK7Ie+u60GAzQj1l72HBePEdWfRZrmW+IFj:Ted0W0MZQHfd6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642694436, "uuid": "e465a847-ef25-47d5-a88f-8bbeb7cfe9e6", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642694436, "uuid": "0b833808-56f5-4c5b-8940-bb3e5c5c4589", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694436, "uuid": "8a7bf75a-bf14-410a-b33d-bff1afaa2fc2", "value": "7d0dfea3f7e7c4e0c911de9e2fb3985b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a221d986-79fd-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1642689079, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689079, "uuid": "0ddc2caa-b6c5-4dbb-8848-13a454205bab", "comment": "Malware payload (BitRAT)", "value": "05536ec1dc249cc4289ce6b092dd9ab3", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "HCrypt", "colour": "#9547C2", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689079, "uuid": "139fcd4e-eab8-48b6-8444-47b79e622130", "comment": "Malware payload (BitRAT)", "value": "d9b46632629c4859fc820c553f63130901419a511003584fd2c0ab468db5e5cc", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "HCrypt", "colour": "#9547C2", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689079, "uuid": "2701d1d6-b046-4ab7-9c88-51f38a5ace47", "comment": "Malware payload (BitRAT)", "value": "2f3b53927e1073e68b62b6ef39e239064975dc2a", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "HCrypt", "colour": "#9547C2", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689079, "uuid": "1aade7dc-f62d-455e-a9d6-0e0b9787220d", "comment": "Malware payload (BitRAT)", "value": "5053e4f734df736e114483488c6c3dbbb3756e1afea4555c71642f42cdc901fd464a249db6e783fff040c8d2bc94ae3f", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "HCrypt", "colour": "#9547C2", "exportable": true, "hide_tag": false }, { "name": "powershell", "colour": "#FE0F82", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689079, "uuid": "ab690f81-8e71-4de5-937f-1c4303166553", "value": "T188F5331C52ADB402434D2A728B5A50F312EE552AB77EFB990FD4B4E0383B5317832F69", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689079, "uuid": "af4b0d09-dde3-4121-9ae5-d5b5d9c4099c", "value": "98304:N04QRRJvwoBsSFHYdqwIpZwpBnvhP8CBSwmQ:N0pRPD7cqwIpZwpBnJdBLmQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689079, "uuid": "06e31880-7947-4b79-baa5-8df32e4322b5", "value": 3435962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689079, "uuid": "003aa92a-e663-41b3-9b97-3df7843908f3", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689079, "uuid": "3cef15dd-2868-4422-8136-f27108fba129", "value": "135.148.74.241_HCrypt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6af3d28-79df-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642676282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676282, "uuid": "d6f9672b-6ec1-4f63-b96c-2abce3b1c60b", "comment": "Malware payload (Formbook)", "value": "82166b846d9a79322fdc33b0e6c82e38", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676282, "uuid": "93442429-e3ca-41a2-b4a1-9848e72cace9", "comment": "Malware payload (Formbook)", "value": "d9e5625f31de54faa7f8ba5210c4f0458cd85966a1c59c2934d4e67f59acc143", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676282, "uuid": "189d7b68-ffd4-44d6-813b-aa2ef15163b4", "comment": "Malware payload (Formbook)", "value": "bb323b30f0cfdfd99e32aeaff13cee6b04a9d4b3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676282, "uuid": "2c8bdf1d-5284-4fbc-93fb-271c6c2f8649", "comment": "Malware payload (Formbook)", "value": "f10aa30771ac8f3928c54beb08669a5190b31a9432a45241c709b764e4abe1c82ed821166b080a442ab3573e56d136b2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676282, "uuid": "0d3b5528-17c5-493e-8b29-f5d9d7060b7c", "value": "T196B2457EF58B0E48AE57D668160A7BA5150DF41C73C440A23BBCDB387A5D91B8B22D3C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676282, "uuid": "9fca24f8-0138-47a1-a8c8-37d42f049b3a", "value": "384:nuonP2URWHzxaiz9SCNDdVkqCItmIAplPDcL81jSFFecI5GkATSo1:RJZCdN7kq9mIAM81jCc35G7m2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676282, "uuid": "1f9ed528-f43f-4b27-88d3-82566765d120", "value": 25396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676282, "uuid": "eb96f1c2-47d6-4671-8e4e-e92d016705b7", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676282, "uuid": "deda52c5-f0f8-4e16-9ae3-e3ba5adebab9", "value": "82166b846d9a79322fdc33b0e6c82e38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "992cda60-7a32-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642711827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711827, "uuid": "2bd3cd77-098f-4a5a-b463-d8941031b239", "comment": "Malware payload", "value": "550160d122f85c9502a7a8e219dc68f3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711827, "uuid": "6910ab66-425a-4344-9620-e97f16679771", "comment": "Malware payload", "value": "da99d68a728c3a14d186c03c30b551914fe57073f231d334be7955131cb5f921", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711827, "uuid": "516bf2ee-533d-4b3d-8b69-4b0e6fbb55f9", "comment": "Malware payload", "value": "fd2833f0eea85cccc795ffe375d1503a0df739bf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642711827, "uuid": "621ce759-5d98-4f89-ad56-01de18db2168", "comment": "Malware payload", "value": "692bc8c9570717a36807c2a8c6268282fcdb063de71c1dce0a730bc35bfdf27b0c38b2e70a11b75a4fae55f52513f09b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711827, "uuid": "efaa710f-3326-4a40-983b-51945ae4dda6", "value": "T1B0A4BFC3142C54DBF96F5573E46355EBB8F03126A38520ABB56BE6F2200162A871FB3D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711827, "uuid": "b196c0c7-20e2-498c-83c1-2c8bd780e229", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711827, "uuid": "ad853ef0-55b3-4dbb-8712-afb91befa46d", "value": "6144:fwhxy7FtFjJHQlXBi3Xl9QZvXtaBh/ZKeTsJfGHZzp31:6gFBMi3f8vdSRKe0eZF31", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642711827, "uuid": "ea842411-43ee-4c32-8b6a-228f4541e753", "value": 469011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642711827, "uuid": "04219fbe-ebe4-4aa7-b39c-31f91e43e331", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642711827, "uuid": "c085cecc-9022-4044-be66-6200d6d9af5f", "value": "550160d122f85c9502a7a8e219dc68f3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "708005db-7a21-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642704458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704458, "uuid": "e6794b15-3708-4b8f-8dee-70913561d07e", "comment": "Malware payload (Heodo)", "value": "04e3d96e933cb3eff66656e001f68ab8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704458, "uuid": "0fe8fc60-5f69-4fa4-ad6f-2cd27d7e0a94", "comment": "Malware payload (Heodo)", "value": "da9d3b84063bde0697546e7a9b3e2ab5f8283698dfb032f76018f28b367146f4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704458, "uuid": "ccd39fe5-376f-4ef1-8816-9a23cb6c8e79", "comment": "Malware payload (Heodo)", "value": "27c4fe4cd975808bcfd17efc213da392f04a2a1d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642704458, "uuid": "0a79eb82-d54e-4977-9da4-ff622b245f85", "comment": "Malware payload (Heodo)", "value": "836cfdd22e34a2cbe889da4b5042c5e00980ab517227b9731434513961faa91b5ca0811e7abccfa8c261642da2dd2c12", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704458, "uuid": "5970efca-bc19-4c53-8f7b-4483d941919f", "value": "T139E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704458, "uuid": "00aaf116-1eac-4955-a337-ccc4575c7ac9", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642704458, "uuid": "76c07bcf-ecaf-4a16-86c7-b9d4229ed0d7", "value": 145476, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642704458, "uuid": "72455dda-e113-4c24-8b20-03a4d7b59e7e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642704458, "uuid": "ac2c76c1-77b8-42a2-b6e7-c77ef64691e2", "value": "04e3d96e933cb3eff66656e001f68ab8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2b775dc-7a0c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695630, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695630, "uuid": "cf9a3864-6399-4157-8218-9abd281eafef", "comment": "Malware payload", "value": "4f20e2e4c1bcfb3ce39242fb732bc71a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695630, "uuid": "6338d5d4-a5df-46bd-969d-9809831c74a0", "comment": "Malware payload", "value": "dab5b9cc29c359aa8e5ae59241d40290048e6dd13e32951c0ae964181b40a5c4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695630, "uuid": "1446b896-83d6-41b8-adda-848869c3fe4a", "comment": "Malware payload", "value": "32a3a18e8ad68a6fbafc4826dbfccec3a4f4eae3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695630, "uuid": "16b2b7df-28b6-41b8-83ef-89c497f46f1c", "comment": "Malware payload", "value": "1f4d952afbadbe7f3aed3755bbb2dd5bb70da0a6302f2a053f825125a10259e8fd109c215a46eee88e56f972883ee4ef", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695630, "uuid": "3ea9638b-9ff8-4ad7-8646-95e19559b8ab", "value": "T1C4050231BF916315C75E8BB48D7DAC1063B8F98A281CCA5E89462DE59338BC29760737", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695630, "uuid": "b69845a8-ce73-4e8c-b8da-3211089ae673", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695630, "uuid": "b3c7ba82-5e9b-467a-b488-ac3ddaba6821", "value": "12288:YwZ019WfXGI9WfXGI9WfXGiiiiE9WfXGd333:YrefXkfXkfXMfXk333", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695630, "uuid": "d7e10d31-ce2f-46c1-bccd-e4157702de91", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695630, "uuid": "4acc7c69-9829-4425-9439-14f9f3c42a86", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695630, "uuid": "9ad7cbfb-2ea1-4c2d-9692-66e62f992395", "value": "Quotation-pdf-scan-copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b603bec-79bd-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642661419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "af21dff0-f92e-4a9e-aec1-91a914649f3f", "comment": "Malware payload (Heodo)", "value": "ce03aea1e7c705c85bcde9b1b8232df5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "cf5982e6-9ca3-47ec-843d-ee0ca79ecc92", "comment": "Malware payload (Heodo)", "value": "dacc2cff22e690c0005db310cdb2e0a820acee97fbf3b265ef5c925a094b1b46", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "4c0afbcb-dc14-4d20-9048-239859b57f51", "comment": "Malware payload (Heodo)", "value": "b032af31ef86090eb8d8ce5673b0e48c7a5e4cb9", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661419, "uuid": "b6ede42d-5cb1-40f0-b0f6-fae3a6aeb756", "comment": "Malware payload (Heodo)", "value": "432ab5c381340c294880b49462b17f58d7a1117a074771cc1dbd069bd5f8d7c434624037c2069971f3d08fd10f6a3390", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "e600398e-4c77-4f3d-97f1-ef56bbf7f19e", "value": "T13BC4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "085a6ec5-f9d0-4d83-9b79-6d38c1dc97c6", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "52406e8c-0fdd-49fc-b93a-5ac98021ba48", "value": "12288:P78OGF+L8/4UUNyrwdMhTq/n4vAzdkPs7:D8Ody4awdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661419, "uuid": "70841b91-c468-4e1d-bb0e-8fcfe368004e", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661419, "uuid": "472cb602-855c-4cf9-9bd6-77bdbe47dfe2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661419, "uuid": "13e5237d-6e3c-4c53-a4cb-8a61c0bbd239", "value": "emotet_exe_e5_dacc2cff22e690c0005db310cdb2e0a820acee97fbf3b265ef5c925a094b1b46_2022-01-20__065011.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e70430d-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674899, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674899, "uuid": "496575e8-1670-4429-a984-84cf01d021d1", "comment": "Malware payload (Mirai)", "value": "30329d829331da7df83dcc75bd74b3b4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674899, "uuid": "9cef85a3-5037-4227-b737-3159e7854ec1", "comment": "Malware payload (Mirai)", "value": "dad123e6e292caa1e08a1c2592034a783516ecdda77c2f0423781a71d13c02f0", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674899, "uuid": "e9909568-9bcd-433e-a66f-e3a8e3f11d41", "comment": "Malware payload (Mirai)", "value": "aa0c5877ed7d5431f90ee9af8be5371043f2e1af", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674899, "uuid": "7ae904cf-33de-4132-9ae2-f71deef6dfc0", "comment": "Malware payload (Mirai)", "value": "372510078099910c28d60bc5c6c57c275603e6d8946b3ffd3cda120ee8acb381b4397432c260d149a25d75d3ecf99256", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674899, "uuid": "5390380d-8ace-48b6-9ee0-289a154aa3ad", "value": "T12BB31845F8408727C3D327BAE78E478D3B36579467DB33116A38BEB42BC17892E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674899, "uuid": "0f55d85b-53b7-44a3-986b-37a4cbd63b47", "value": "3072:MSk+U6m1qW/w8OlPbiRq6AmkZrQAhPDCXFke:U6mgW/1OlPXmkZrQAhPDCXFke", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674899, "uuid": "5aceb407-d218-4fe8-93c1-07b2aa005272", "value": 108417, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674899, "uuid": "b9c98a57-1251-4707-b02d-9d945db6a4fa", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674899, "uuid": "b6945326-f4ad-4b6e-99f2-7b930d655d38", "value": "a-r.m-4.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdffec10-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708883, "uuid": "4f4ef6e3-2654-44a2-8081-e517f49b13d7", "comment": "Malware payload", "value": "b2755fc18ae77bc86322409e82a02753", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708883, "uuid": "4bf83056-0a7c-4fa3-a9ed-e2edfd52f656", "comment": "Malware payload", "value": "db31b258371a7e643cb35cb84798090a00c6c02cd9879f02187cdbba60be1ce3", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708883, "uuid": "6c6a0a27-9a02-4a41-b322-34e73d52444c", "comment": "Malware payload", "value": "ead3a2f08eee305f6d02649a7ec11a8db61b7e44", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708883, "uuid": "0c37a40e-e782-410c-a848-0b9baf7b3a68", "comment": "Malware payload", "value": "9ffc833464c29a245fa9bdbe72c307dcb0045badc11fb4d917ec0697c1945c9ae67c8dced26810a35f87020dcbc7accc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i686", "colour": "#720473", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708883, "uuid": "866b883c-9f7d-4cec-afbf-30cc6d0d3da1", "value": "T1350412A914259AE3D161C63795CE28EA7C96ECC758F45B2ADC683C100332E77ACDCCD6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708883, "uuid": "92921370-de3e-459b-842a-da9bfb358c81", "value": "3072:u+soU7SueKZu0Lt0To0OPZbHcCpRah+pqsa8aCfOdZMHoO5UkwuDLq82o1LhUx7a:u+BzuDI0GuBnE5CJhpDO8fce", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708883, "uuid": "f5b19f47-0e06-4026-a36a-4f721f9f72f3", "value": 179124, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708883, "uuid": "86e5ac22-da5e-4b88-bd0f-d1a59c89c919", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708883, "uuid": "ddbf9d24-8ce3-42d2-a7df-262ccd23e453", "value": "bashirc.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8213c56-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642676768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676768, "uuid": "5e22c409-8a3c-4920-b3ec-925eb4ebe211", "comment": "Malware payload (Formbook)", "value": "d739cc469200886d3fcc91f5ce6354ae", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676768, "uuid": "8b034664-d5f7-43e8-bb03-fc622ebcc669", "comment": "Malware payload (Formbook)", "value": "db4292a065a36387db52c730670be0d03da40883d6d109aa82851123d82699f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676768, "uuid": "86760ae3-ef16-435d-b15f-41c40aea68e9", "comment": "Malware payload (Formbook)", "value": "ecc39f6a838d20cf9cfcb61b2314b45a21b6d3c0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676768, "uuid": "77dec41e-39fb-4567-8da2-eecda7a90810", "comment": "Malware payload (Formbook)", "value": "91a315d035cc664e3374599b306af936f0f78bda0cf425c3a1ef8e497a2b3e3a4803bd870370f59a7c947454905f829e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676768, "uuid": "e1de581a-c8af-430c-9e42-15cd1638b330", "value": "T11884011077F857AFE6FA47F57A22000053BABA532032E35D0D9970DE19B2B818A91F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676768, "uuid": "0f554a07-df04-4279-91f1-a1290d35ea07", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676768, "uuid": "48c20779-fcbd-444d-9f7f-28d0308b9a7b", "value": "6144:j3lcLF3yFnh8TD2xosmV2L1FSpJ7jKvJrykOaZdmltxJ2YwGjlIXHn6O4non+I6Y:bUQnhI2+fVcLSptKvVrmlvIXHn4nLIP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676768, "uuid": "ada5794a-ddc6-4e0c-b9ef-62d642f6dce4", "value": 381440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676768, "uuid": "dd15f42d-1531-4d92-9d0a-dd1d87c47050", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676768, "uuid": "c2221e85-40d6-44be-b3d5-48a00f0f4dee", "value": "ORDER-110416KVA-TEKLiF632010220.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e427228d-79f8-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642687042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687042, "uuid": "0873fd7b-b9e1-4171-b1c4-61703e139a22", "comment": "Malware payload (RedLineStealer)", "value": "adfe0859bc667b7a910684137f303ac4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687042, "uuid": "bc90d403-b5a2-4724-92dc-1b472da18376", "comment": "Malware payload (RedLineStealer)", "value": "db58a1794f9948d2a5f535298d004fde0392acb4bec6ec92be2dd51c467d043f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687042, "uuid": "40597bbf-b2d0-4eac-9079-4df1c2587bbe", "comment": "Malware payload (RedLineStealer)", "value": "db3681655c18d02736f80c52aa2c32848b2dab7f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642687042, "uuid": "1ee6bda8-c068-47a8-94f3-281492ff0e43", "comment": "Malware payload (RedLineStealer)", "value": "36772e68eaaf2afcaae65166a4dd10ae08caf301daadd2a730ced6dc8c40808dfb582ced9a28e562b64e7bf340626389", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687042, "uuid": "3f3b309c-8eb1-413d-b052-a00d77208ff6", "value": "T1625550DC94E45859CFAE03F40DFBE66E987296C553079BE9324E81F06B2218EE53D0B1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687042, "uuid": "2b1fd32c-7b4e-4d34-84cf-1f7ee6a7ee33", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687042, "uuid": "7e0a4bae-48de-4ebe-b62d-68c95c9d6b06", "value": "24576:kUxaQbD7SCCQImHxrlyjm6YKCvkjN0Vb32:kUxBOFQxrly9svkhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642687042, "uuid": "e3f46436-a90a-4cb8-ad34-f6456dfd0bb0", "value": 1335808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642687042, "uuid": "8d7ca2ac-2c2b-4891-ac4a-d4ecfd10ab37", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642687042, "uuid": "d6d928e8-5b77-4f3f-9fd7-e97522ab773a", "value": "adfe0859bc667b7a910684137f303ac4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acff3982-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674924, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674924, "uuid": "cc55ab0f-87d0-4b09-bd66-455d985f240f", "comment": "Malware payload (Mirai)", "value": "b533cdf71770400f56164f6ecc0a2487", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674924, "uuid": "6241aac3-04a9-43fc-8a58-f3b05703523d", "comment": "Malware payload (Mirai)", "value": "dc9de938b154c3881412d986567c426b3e9bf217a5b0fa405b0b3b64e1c7ec6d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674924, "uuid": "399de36c-3986-484a-baa6-9f4102135603", "comment": "Malware payload (Mirai)", "value": "df8dab0505190c11992d951962ad06d13fdf0acf", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674924, "uuid": "67b21266-196f-425c-ae3a-fdac7e166136", "comment": "Malware payload (Mirai)", "value": "c7521df71b9ba1b13724bef2967b22be2aa69685fb8a7b06919dd394f6fd24ef6e4fddd25e3e10a7bdf4fe35cca4c3ee", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674924, "uuid": "54d278c1-190b-4810-9459-e55b8736b636", "value": "T17CA32A44F841872BC3D327BBE78E479D3B36569467DB33116A386EB42BC17C92E29520", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674924, "uuid": "a126888e-7d73-46c8-af8e-33e5a8ed5024", "value": "3072:1Sd+e6mKaGP0NOD3PpShtKmZuqQ4DPwXXtse:C6mxGP0OD3PiKmZuqQ4DPwXXtse", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674924, "uuid": "805e1954-a615-4c1a-b71f-d086c6ba5ec5", "value": 100871, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674924, "uuid": "ca60f2f1-cfc4-46d6-8dbc-d874c7819626", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674924, "uuid": "674a9d7a-1273-44a0-a79d-71f6b579f6ae", "value": "a-r.m-5.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "deac2cd9-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666417, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666417, "uuid": "11d212ff-78ad-42a4-a71b-6a9f51a653b1", "comment": "Malware payload", "value": "a997db4429053e504cd9d4afaab825cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666417, "uuid": "c28d92f2-d97d-4333-b227-c7928c7cbb62", "comment": "Malware payload", "value": "dca68095317df735cbaac8724a3d4af4aa504d1b58e30699388b67ec44a0e5b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666417, "uuid": "32b4fcca-b61b-4a07-bcff-6a3de0f165b6", "comment": "Malware payload", "value": "c0f15b9aaf8876619b9dbe08e429a024d646b867", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666417, "uuid": "c231a458-ac2b-4650-a63f-a6cbf4cc747c", "comment": "Malware payload", "value": "5b66ce89b2cb43dad7a8e80130673ec6e2bb9e4dbbcfe0ce0f105ce8a1814b948a9163bde63d86ed8951319a947c8d44", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666417, "uuid": "7630bacd-76a0-46b2-97fa-21abc93c683a", "value": "T1FFF5339708B7A6F5F9FCC8F41F6B4D82BB1503F478898B64A9DFA53A06D135F2860094", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666417, "uuid": "ddbc7fce-87ae-43fc-900e-268674735ce5", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666417, "uuid": "f4874899-5f46-481f-b482-5c86d970900d", "value": "98304:s+Bv9GFZgNRmbec5k3SZuJrpFST+nbmChzP1sFlx/9t:uF4MKJrqKbduFld", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666417, "uuid": "aa65a231-9721-4ce2-865f-29529de1a050", "value": 3486720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666417, "uuid": "ff3569b1-a942-4f2f-88d1-dd7a4d2d29e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666417, "uuid": "42b12540-5395-4f96-8cf3-42ac76e3f962", "value": "a997db4429053e504cd9d4afaab825cd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e286ab3-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642708614, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708614, "uuid": "c2cce680-dd8b-444c-bbbf-1c6c1c5da243", "comment": "Malware payload (AgentTesla)", "value": "3b490a21fb403005a3428a873ec1a609", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708614, "uuid": "e8dcb110-83b2-4717-bd7f-4f2ae4a9f794", "comment": "Malware payload (AgentTesla)", "value": "dcc30daa103f38a83d8f731cf1d6dccdfd53d20e27b6944fd328cd78149beba8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708614, "uuid": "15e4c5b9-0589-43bc-a337-f90e4cc4d447", "comment": "Malware payload (AgentTesla)", "value": "78cd0932113905d83ba72de3bfb02d3e96a30861", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708614, "uuid": "723f60c7-a8eb-4f53-bb0c-4606d15fe0fd", "comment": "Malware payload (AgentTesla)", "value": "644835e4a5717dfc6e8f672702d64bbc5ef086cc4180a987bb76b34fd390a291cdabf426afee0dd73b27ac4014b13c2a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708614, "uuid": "d8dc8f46-fe85-47f9-bed2-bfd326b621e6", "value": "T133050220BFD25715C78EC7B4DDBC7C6093B8B5872954C72F4986ACE95228BD28360B27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708614, "uuid": "4bdf217f-bb95-4098-9c45-8d92649d39a6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708614, "uuid": "d190aac7-422b-4813-afda-cfd9c824c64c", "value": "12288:PoiiiiE9WfXGd3334jUORpQf0OTk8JKQkJZzwL/5aQ1M:PoxfXk3334QOnVBGHaQ6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708614, "uuid": "be32d288-6199-43de-ba44-b3ae689b65f0", "value": 831488, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708614, "uuid": "ba960490-e662-42c9-94fe-9a59b7fe6ffc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708614, "uuid": "392e845f-c0bc-4574-8dcc-ed4f0528d6de", "value": "3b490a21fb403005a3428a873ec1a609.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "428c8ba0-79d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642670880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670880, "uuid": "6485fddf-0fe3-452e-bccf-331bd45abfac", "comment": "Malware payload (Mirai)", "value": "4065b6385c45c773a2271fdda1cc1802", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670880, "uuid": "c8e440d6-a039-45fd-a4ce-56d444374cb9", "comment": "Malware payload (Mirai)", "value": "dd04b8f8feb67d8d12cd6a602b64756f2480795e3fe343c884789c95a62f45f7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670880, "uuid": "538333b0-8f73-44bd-a8e6-fa8884559853", "comment": "Malware payload (Mirai)", "value": "18c780b4be573169f9e25f89fecc652053230580", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670880, "uuid": "95bd86f2-5b5d-40f9-b458-5e8d83cd97f8", "comment": "Malware payload (Mirai)", "value": "e8cf1c7e6e2e1a09df6fa1746fed66cb56ddc4dab181f0573b9e13b93880343d1e986a6a8fda2f1fa616b7546bf08ca2", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670880, "uuid": "d26e8271-8ec9-416a-b02c-6e3a6a372041", "value": "T1D5B31877A4515FB3C045A5F125BA99320F12AC931B1F1A84763CBAB44B3B4CEB84EF58", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670880, "uuid": "ed4ec9b0-4998-4340-8508-055262ef17ce", "value": "3072:OwNUWqpCgYXlrSyWUfMNYMmH1cuEgv26uN/:OwNjqpC/G8fMNYMmH1cuEgv26uN/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642670880, "uuid": "8b4151bc-08d4-48dd-ab4e-648655efdf7c", "value": 112634, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642670880, "uuid": "61f93644-418c-4f8f-b21d-d38030efc123", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670880, "uuid": "3cf2de9e-f993-49b0-a58e-5a6984340f24", "value": "sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd26d3f4-79cc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642668133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668133, "uuid": "03c6e149-5adc-4fee-ae85-be540e82682d", "comment": "Malware payload (Formbook)", "value": "d7747ddd730e95aa0b1edfe41d1f80b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668133, "uuid": "b5d750a5-723b-4857-b216-0d3524b3fca4", "comment": "Malware payload (Formbook)", "value": "dd4d4174a3dc3aa9f5ebff021eb9e561b6e22197d84d4611c6bd83c6cf9ac875", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668133, "uuid": "2d816521-ecf7-4f90-99e0-1fde6e4bad72", "comment": "Malware payload (Formbook)", "value": "ba38c2652e032e4db4b51efbe70c985f82135cc6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668133, "uuid": "642190e7-992e-402a-9eb0-6da202430a85", "comment": "Malware payload (Formbook)", "value": "83a24a7007d1e186361d4c7f60c14c22925b97ba2661f4119e138915db03c2819e34d767a55b3421b97a7ab95f53da37", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668133, "uuid": "888386e1-2f78-49eb-87eb-b64de7d5238b", "value": "T1158402007BFD675EEAF687F9A036516013797A162126D25D0ECAA0EF1877F82C610B73", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668133, "uuid": "f5fc2833-13b1-4fbc-80bf-442b3d240dc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668133, "uuid": "51edb86f-dc6a-4203-a6ff-bf99ba40db84", "value": "6144:joXDuLF3AU4gsf/mgZdnA0iEolas93rorxonJomqYCdkF+I5TfHtlfxtqsYHUh2W:OQxgHxQZ7pJommWF+QfxtJYk2hp/6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668133, "uuid": "b9712c1c-8814-4f99-a594-b7064067c2f2", "value": 382976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668133, "uuid": "1ce16acd-b5ca-4be8-83e2-7613a6a1fa1e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668133, "uuid": "68307ce6-6945-426d-82a4-d6337debfcc7", "value": "d7747ddd730e95aa0b1edfe41d1f80b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa571bf-7a26-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642706649, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706649, "uuid": "49d0ef2a-10f6-4223-b9e0-3d40da2bd2e2", "comment": "Malware payload", "value": "8fd36b896b1c3b8bae1799bb5068fd64", "object_relation": "md5", "Tag": [ { "name": "WellsFargo", "colour": "#5525A9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706649, "uuid": "6925a7d1-65fa-4603-b0d6-903d2d512cb8", "comment": "Malware payload", "value": "dd5c22d076a6c5e9c22d57ac6f49fc241fe016d797b1383682ee2ee6b529eba8", "object_relation": "sha256", "Tag": [ { "name": "WellsFargo", "colour": "#5525A9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706649, "uuid": "63edbc46-d12f-4833-bfa3-df5f7c37dd54", "comment": "Malware payload", "value": "7023d940dfa21429fcc6211fc63587a5ecfd015c", "object_relation": "sha1", "Tag": [ { "name": "WellsFargo", "colour": "#5525A9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642706649, "uuid": "3b11387f-a3c0-4d3a-b1b8-563f41d3f507", "comment": "Malware payload", "value": "63b765ae19ddb7109ff209025384f9d06b82e76b38ab23fad9dd1ea8709e49d9a2aff5eb29809ee9bbe50aaff155eb59", "object_relation": "sha3-384", "Tag": [ { "name": "WellsFargo", "colour": "#5525A9", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706649, "uuid": "fb219d78-c323-4522-9f85-bf494563d4f7", "value": "T1E4241204B25AD712E1113AB2BDC3A7EA7296FC48CC850317778177EE9C3A4455EA73A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706649, "uuid": "0ce1957d-0c4f-459c-a626-2bfc4cdaccf6", "value": "6144:5yfcjiob83GYigJBx7s5vOfBTc3mTQfsK:Imp83GYiIj7AOftoXf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642706649, "uuid": "17067b9f-af89-4aed-b5a3-e3a50f51610e", "value": 223744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642706649, "uuid": "8316f8a2-08f2-4632-bccf-97e23fdd3a59", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642706649, "uuid": "5ca3128f-b0d5-4322-93b8-1309c8e90819", "value": "Wells Fargo Secure Document.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24ff4ebf-79d9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642673407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673407, "uuid": "49135129-fec2-497e-af0d-042544b2d934", "comment": "Malware payload", "value": "fa155879f85f490ec180c1184de2b51e", "object_relation": "md5", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673407, "uuid": "f1797cd8-cb4e-4654-a646-b05a6d3869d2", "comment": "Malware payload", "value": "dda839584708cdc28f165d0f387a43dbd32b7f56bba0af7c942ee2b751e9ab75", "object_relation": "sha256", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673407, "uuid": "a4d5f878-4ec7-4c8f-80a6-dba54a58f2b5", "comment": "Malware payload", "value": "1fd50a277bd49c3e48a793651789d8877d05763f", "object_relation": "sha1", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642673407, "uuid": "51767c7a-93ea-4b68-a48b-bdc81d6d3ce1", "comment": "Malware payload", "value": "5f5112de4570fbcbd0478a2024d5fd62356100228feed5a6295ca31af971649afefe62590d5837c9fd8ddb887680390a", "object_relation": "sha3-384", "Tag": [ { "name": "ps1", "colour": "#BE684A", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673407, "uuid": "5184b40a-2a00-4fd0-a9f4-d24fc63998ad", "value": "T1FED284213E0EA59686E5F02CC870810BFD6ED27A432144F1F9CD47A5B97643E83BE5E9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673407, "uuid": "c04dfd78-179b-491e-a1e4-cf7c331f8041", "value": "384:rpXzFY5a3Rf/EEap0Me/zFxbf9GGd3pZI4yuwT8OZZ1reghyrGuDTXHGCoC2:hhYkBf/I0Me/dwTXZ1rewyrG0Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642673407, "uuid": "b233139f-1357-4c38-80af-1308573a61ec", "value": 29528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642673407, "uuid": "e90e956d-80df-4aa8-bc28-074caea0ed8f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642673407, "uuid": "b19088ff-1ca0-4ac7-99b5-bafebbaa7fd7", "value": "sysmanager_exe.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9219ba9-79d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642672394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672394, "uuid": "d27d8233-5206-4553-b8cc-3bd3a5b95ccf", "comment": "Malware payload (Mirai)", "value": "089c4ebecc8c3a07c139f992b2f03aa4", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672394, "uuid": "866c95ab-43a1-4230-8aa4-ab030f297710", "comment": "Malware payload (Mirai)", "value": "ddbdcbf6bf277d661a10aa73598d383ab82aeb68a3e42655023af938b1fa0df7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672394, "uuid": "f91bff75-8e36-4b35-ac7f-23f2e0d8be1c", "comment": "Malware payload (Mirai)", "value": "94ba3497418b70a7e48df44056ec8708ce6cc841", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672394, "uuid": "cb43cc24-4f33-4cf7-a26f-ebe2b0ceca0a", "comment": "Malware payload (Mirai)", "value": "a534b4cf1c673d989150d333c4b67922f0fe154c542ce1d2b220f4561ef0de9c69c7eecae6ee31001bf2adf59125c25c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672394, "uuid": "81c5a1cf-e704-405c-a8cd-72394cfa8cf5", "value": "T180545036E70285B2E1580DF1306676D4ADD5437F9C2A1AC3E65B49B4FF3281A01FAEE1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672394, "uuid": "1a8baa09-cc06-46df-a2a7-96a1231c564f", "value": "6144:IMNfNu0FAzYBNMXdZCSpn0UpQKqUgAZ08MjUlNQmmFVcqq0GnDZT:NNfNu/Mj2NQmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672394, "uuid": "e8315e38-1c4b-4d8b-a3c8-0baa55b2bd19", "value": 284389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672394, "uuid": "c7101ab3-301d-4a1c-8afd-5c9673608a8d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672394, "uuid": "4b85e6d9-ec2d-4167-bd68-794a9679540f", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f724a2-7a00-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642690460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690460, "uuid": "e11742ac-d619-4583-9c36-78344aeb63c4", "comment": "Malware payload (SilentBuilder)", "value": "ec5747db6228bd4adeff9cc12a7b14db", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690460, "uuid": "fbdeaa41-030d-4a93-bb47-b66f053ea4b1", "comment": "Malware payload (SilentBuilder)", "value": "ddefd9323bdbdba24723112237dd8654755e8a21e568c38d83b4e2b9849e4b15", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690460, "uuid": "7c1952b8-6234-4fee-8d6f-d39a96ab8a1c", "comment": "Malware payload (SilentBuilder)", "value": "8e6f46c3aee11ced0ab21ead082a8a0a37e3d8b7", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690460, "uuid": "b4ca795f-bac7-4666-b3e0-d2688ad6c5c4", "comment": "Malware payload (SilentBuilder)", "value": "cf087521ea6086375599f9768969551bcce4589198b99d019e7e12fd7d8d169a6058ae4ef2258ff83994e3273560aa05", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690460, "uuid": "1baf7ae0-4164-40dd-a36a-6236c07bbda8", "value": "T101E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690460, "uuid": "514dc654-4aab-4a1d-bc90-d44273515ab3", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642690460, "uuid": "b743a35b-996d-40d2-b689-36a974e4a48e", "value": 145711, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642690460, "uuid": "007dd0ab-bd73-476e-abc5-0eaf8eae721f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690460, "uuid": "f4c08b15-0a84-44d6-87bd-00fb853155c8", "value": "ec5747db6228bd4adeff9cc12a7b14db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ea84574-79db-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1642674390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674390, "uuid": "f8687953-78fb-480c-aa08-bc3a17007e57", "comment": "Malware payload (RemcosRAT)", "value": "afd35e9511ec398191a4027c5db6e5a6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674390, "uuid": "cffdd532-c64a-402f-96a1-9c0c13aae753", "comment": "Malware payload (RemcosRAT)", "value": "ddfc4415217ec461350071b0965a1132ad43472bdc15980da23c46d8f1da188e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674390, "uuid": "d31ab956-0b68-4cbd-8030-39f54b658f03", "comment": "Malware payload (RemcosRAT)", "value": "2e70c2033b5f07ff3ca69ba396080e10b240f810", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674390, "uuid": "39104cf0-bf7b-4267-bf1e-bc67bb0789e7", "comment": "Malware payload (RemcosRAT)", "value": "5db1dbc3b374da633f10118b1bae7b0a77754d8eee35fed6bd4571ec03592d21f264149acf4baf061ba02fde07ee37ff", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674390, "uuid": "22279c4a-76a6-4b5c-85b3-e23882ec2aed", "value": "T1C5156D23F1928432D5271E394C27E7B959297E117E29BA477AD47E0C4F3B2813929EC3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674390, "uuid": "d47a36b5-69e0-4209-b46f-98b88658fcd7", "value": "d571f528db93ab4c8d72c51955dc7b93", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674390, "uuid": "c72243c0-82c7-45d7-840f-8188b9956b4f", "value": "12288:wHFymIc+xnYsoAFlK/st03JMAIliAhojhZBYf2WZsOvVyW7T3bnvwl2:wHeaAFlKYevUBb2yyKT7v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674390, "uuid": "a2c65d3d-da56-4be1-8168-0b99b214ef16", "value": 950272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674390, "uuid": "3b1474a4-8037-4923-94d6-2895e721e57d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674390, "uuid": "d3c5848e-ac3e-4b9d-934c-79637a835a68", "value": "IMG_4100047645799946532.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8418f3-79c6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642665610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665610, "uuid": "4aa2d4fa-600c-4af7-96ef-9134617d159e", "comment": "Malware payload (AgentTesla)", "value": "c38b929e08fbfedfdbbbc21821f12a94", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665610, "uuid": "8ed75e26-be9a-4b26-94bc-2702de5171d4", "comment": "Malware payload (AgentTesla)", "value": "de04a7714147200cc71bb568517f0faefc2a339586dac075004bef8b2ffdc6a5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665610, "uuid": "33a2edb7-59d6-4a84-8d66-91f00b0a839c", "comment": "Malware payload (AgentTesla)", "value": "8545b557eb859ab66ddba25d983a46aab41f2c2b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665610, "uuid": "3de0425a-e956-4dd2-921f-2278c6e35db6", "comment": "Malware payload (AgentTesla)", "value": "10b090cd1da897079d8dbb5b7245d1a9d5234570059b9391c293eaae0c3111401eaa8f0c25b332fce6635f70a877c968", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665610, "uuid": "e4caa701-c717-44e3-8307-18a96e07229a", "value": "T13D82946CD19702A98F859BB8672BAF44028D795DF384E533723C973157D2DBB812683C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665610, "uuid": "f4610c80-12e2-4cad-9f68-712cec186fa9", "value": "384:/m+yUZnQlFeXQFBEezUtBTxGwK15noFYtzwbqW:jyUlo0WQzIwK15n6Ewbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665610, "uuid": "7ff821e0-ca8f-4018-ab52-c5a87b55a023", "value": 18669, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665610, "uuid": "be92098d-a35d-4e3c-931c-88fd2a846248", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665610, "uuid": "6677c221-5fb6-4658-9ef3-2efdc3e07f72", "value": "Shipment Document BL,INV and Packing List Attached.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdc35995-79d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642671087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671087, "uuid": "a6e9d671-0c3b-484b-afb4-92e61b7a06d6", "comment": "Malware payload (Heodo)", "value": "2de7e79ce68400c3b8674d7a8ab91a08", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671087, "uuid": "aed4bf96-b49d-467e-a321-2f4393d386f2", "comment": "Malware payload (Heodo)", "value": "de1d3b5bc0e00ce580cb40785bceca9f084f5661d7db94056af1aa9104ea8d9a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671087, "uuid": "76b001f3-c6f5-47de-9f61-740493ee0cdd", "comment": "Malware payload (Heodo)", "value": "af997f81d505b41b0bfc1cfaf20a6c5f0d54117f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642671087, "uuid": "0ecd6557-5a48-4a99-9bd9-ee41d7580bf0", "comment": "Malware payload (Heodo)", "value": "d0fffb5516658f05f4bed91e9a0c525c3869daac308ac57b2c3a07dfd827f2a4e93abca6fd4ebf9b2fbdd0bc2df8c177", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671087, "uuid": "94ce6c6a-e25e-47c3-9ed8-69033761ad98", "value": "T150C4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671087, "uuid": "f2613589-269d-4f7f-9a28-b777d57a9a34", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671087, "uuid": "6f462709-f98e-4d9e-8a78-e6def4156d3a", "value": "12288:P78OGF+L8/4UUNyrgdMhTq/n4vAzdkPs7:D8Ody4agdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642671087, "uuid": "c4aef321-c65e-41ff-84ac-ac9ddfe5a039", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642671087, "uuid": "da10744d-f0b6-4ccc-9992-aa589789bd72", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642671087, "uuid": "0fb4dafc-ec36-4b56-ab8a-e341ea3d3c28", "value": "fJM1ZSCnlRyQ1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12e81fe8-7a0a-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642694422, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694422, "uuid": "1b69763d-b47c-4d73-a0fd-e4de008b3e47", "comment": "Malware payload (Mirai)", "value": "a0798f3fe3f09d3d65e600d5f8aac13c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694422, "uuid": "65b9f4e5-458b-4345-950d-8a1aac795f9f", "comment": "Malware payload (Mirai)", "value": "df653f5dbf8b46dc11e1d900b89882b51680edee76855cc64ee271b60c624744", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694422, "uuid": "b35189f0-6bcc-4f6c-a343-a9e9a80215c5", "comment": "Malware payload (Mirai)", "value": "55769e68691107eced4963b9ff56ea9c41ed7984", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642694422, "uuid": "4f2364ea-3b72-483a-b77e-c5abc6186862", "comment": "Malware payload (Mirai)", "value": "9afd3a44043110fab06ddbe5928616d6b60955dc48f1b897d2d822453786e7aadc48a83fcd09c3d50cdb0a8812690d78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694422, "uuid": "0d734f58-e1e7-44cb-b9d9-63f231b02bb6", "value": "T198C39417BB618FB7D81FDE33059A8902108DE58A12D96F6BB2B4C92CE74B94F08D3D54", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694422, "uuid": "abb81fae-f587-42cb-a5f9-20107a39a067", "value": "1536:/UHeTxCAms/Y8Zm3lKYA43gMJwSkJ8Epg+DzUh8rmW+IFB1Df11hR/:/UyLqAmgMJM8Ey+Dw8rmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642694422, "uuid": "aab6906e-c45a-44f9-9569-a46cb38aa9a1", "value": 126042, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642694422, "uuid": "26a1cc16-a678-4482-9bf7-5aebaa46a45c", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642694422, "uuid": "af378d85-a854-4f63-9a0a-f11b7745fec7", "value": "a0798f3fe3f09d3d65e600d5f8aac13c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "512ba2a3-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642668757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668757, "uuid": "7095e458-f2f3-45ff-8e8a-06baee182efd", "comment": "Malware payload (AgentTesla)", "value": "a73ff3018541a88e9d458d8c1d0396c2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668757, "uuid": "2d88ec18-4c99-4583-8ba2-24d5f08b9bf5", "comment": "Malware payload (AgentTesla)", "value": "df9e4e2e3d471bed34b84bb14015928f1a9caeb46b55fcc111d384e199099cd4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668757, "uuid": "eedb07db-29c9-40b4-a7e5-7e9134bd936e", "comment": "Malware payload (AgentTesla)", "value": "72040815af27bb89272d70930960d709bb0af513", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668757, "uuid": "871872ef-14b0-4dc0-863d-088565d97241", "comment": "Malware payload (AgentTesla)", "value": "525942ed332788c357576c2516e12993fafd45097dc9bb8347a4f4a09bcfe18d43540d88f956940de59a7fad939212bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668757, "uuid": "d4bde59b-7b48-4e7e-8a0d-3f468cda98ae", "value": "T153A40250BAF9071DDAAB8BF5D615501013BA3E2E20A0D30E9CC934DF25B3B825661FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668757, "uuid": "91920d5f-3c85-498d-a93c-c8ad60c80574", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668757, "uuid": "bdcf2cfb-019e-4da9-ad58-1151d1f508d4", "value": "6144:7tl1LF3wA8a7KjOtCktsWmeRIUAmNrWLyR8nHuaKANnYz9tx9cEpyA7tZCilJEa:hbu1at5m1QNrWLnnHu78nO9T62ffC8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668757, "uuid": "9a1d1861-d162-4bd7-b0e0-9d6ce62b5f8b", "value": 467968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668757, "uuid": "2a7061ee-1d38-4f53-8088-cc324c6b2ffe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668757, "uuid": "4e269a32-a3f8-4966-80e2-a9cfac38e262", "value": "a73ff3018541a88e9d458d8c1d0396c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72c0567e-79d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642672679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672679, "uuid": "681d613b-2a19-4bd6-add4-df81e4b67816", "comment": "Malware payload (Gafgyt)", "value": "5e930999715c74c9a2e3f44dfffbd80e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672679, "uuid": "37278ce1-2ac1-4b29-9127-0571d1e08fb4", "comment": "Malware payload (Gafgyt)", "value": "e059fa665b949d7821112015a063ea4dfa8dccb4d3d25d52b5e3c83f4b9ee188", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672679, "uuid": "01f01924-e0b8-41a5-a2e7-09faae5f4a89", "comment": "Malware payload (Gafgyt)", "value": "6ed63fea4e3a0adce38c63bae9634d084bb489da", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672679, "uuid": "357372c3-ca01-43fc-9142-ec6387763c2b", "comment": "Malware payload (Gafgyt)", "value": "615c258f0041f4383024fdcb9f46af989dad442b82524288838b637844d2821e889cddd83414cd3c57555960b957ae0e", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672679, "uuid": "385b4002-46c0-410d-9088-ecb1afc91a6c", "value": "T110433943771D0B43C06BAAF429F717F087A6BD601AA75284E11DFEC4A332BB46525F64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672679, "uuid": "0ff51582-615b-4910-a296-aeb4c76075bd", "value": "768:kFUvy4nO9oN9B5iPn0xTieCFGBt2wJpISGInSgUT:Yr44oLB5i/05iEBUgpVGISpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672679, "uuid": "71996bf9-e334-4662-8735-4482a78f9bf0", "value": 55218, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672679, "uuid": "ae19c014-985f-4b92-9cfa-1a70ba7ed203", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672679, "uuid": "5b4f35af-93c0-4952-beae-0d7060c1b84e", "value": "powerpc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dbe9609-7a39-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642714680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714680, "uuid": "9041fc84-be3d-4941-b861-8e0d102ce93a", "comment": "Malware payload", "value": "f53af1c2679b7a9ef433ec672c0fa741", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714680, "uuid": "fe9733f2-a4c1-4d07-9c07-886e1c2ff613", "comment": "Malware payload", "value": "e099be7b0c6f692f34ca73c32d72d85e9f0465fcf630dc6d929ff4280496c27b", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714680, "uuid": "b66cbbed-d8c2-4744-86ab-294ce36b08d1", "comment": "Malware payload", "value": "10be90f951ed443cd5f2c0102847fcbefe935434", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714680, "uuid": "3c292684-a2f1-4d20-94c1-7ef1ec7fc216", "comment": "Malware payload", "value": "bf066bb54d38f9a27936988ca0d52cf8a821d5758c838ed7977d321171830b335bf5868f2b698af7741269bf70e65772", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714680, "uuid": "52d60c18-06a4-41d5-a835-e677881142d0", "value": "T1C0636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714680, "uuid": "80249fe9-ea21-4395-a0bb-4aed3a505dcf", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642714680, "uuid": "8ed53f11-d694-4e57-a4db-c0458ae19814", "value": 71927, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642714680, "uuid": "7d048df5-ece6-4f07-b124-e40ce26befb2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714680, "uuid": "e00bce56-b751-499b-a775-bd8b960d9e71", "value": "f53af1c2679b7a9ef433ec672c0fa741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "786db3a8-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642668823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668823, "uuid": "df640ac3-d1d7-431f-83ab-526e7e90fb9f", "comment": "Malware payload (Loki)", "value": "babf854a6db85c78752ab47aba8a6b92", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668823, "uuid": "a46d4676-3fbf-450d-8f65-7578991cf922", "comment": "Malware payload (Loki)", "value": "e09dd7b09e89629f52eb64c2cc62f0dd45224121ca74fe3866f81b9851848a0a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668823, "uuid": "378364b8-14cb-4901-9f8a-fb5437329082", "comment": "Malware payload (Loki)", "value": "f9fc60e0868eece3c0a8a5d7101086573d46a9f6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668823, "uuid": "feafa029-f136-4764-9f33-f06e45447582", "comment": "Malware payload (Loki)", "value": "86bf2a812282ca3e6565b19cdc6ca7bf713da98721edaeab9eda68b14f80b2d4492902895a1682d6daa7282f530c8a18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668823, "uuid": "c045ca01-2edd-4555-a4c6-1e266d635a1b", "value": "T1DD54234A32D1DCEFC4464631723D928EE3F0D30456761A0B63B59F26BA1A4E3A637B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668823, "uuid": "4ef8ea3d-864a-4421-b77b-dc1ac7fa1aed", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668823, "uuid": "3a09f236-1b56-4c38-87df-8ceb1b44a84e", "value": "6144:owiMdK+a3t7dF3EeQjikjdAPFOVC7rJ4pmsENOK+4densA1/a:mMdm3t7f3EeQFjdAPYVCPWpwNOdtnt1y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668823, "uuid": "785e7905-9696-45f9-9caa-3f8be9d8da64", "value": 284222, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668823, "uuid": "8f7c4a67-c303-4cc2-b227-82292486c868", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668823, "uuid": "3cbe575a-28f6-4e31-84fd-efaa715a64f1", "value": "babf854a6db85c78752ab47aba8a6b92", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12d8e5cb-79d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642670800, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670800, "uuid": "b870aedc-f45a-47bc-a889-5bd4e20125ef", "comment": "Malware payload (Mirai)", "value": "b30d7ad7533a3c90f52c623bd997e7df", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670800, "uuid": "39cdac28-be67-4b97-80ca-8d3ff6fa1608", "comment": "Malware payload (Mirai)", "value": "e0ff68e9a9c482bbe0d464d2e643c86b6fc0a6bb80aab8ed648ece85b564460b", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670800, "uuid": "e36b74bd-569d-4a85-9bb9-8daef4d48fcc", "comment": "Malware payload (Mirai)", "value": "5ee1447901af4d4784100cb28e772f65020d63c7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670800, "uuid": "db753a55-3d61-47a2-b012-32eac5c76589", "comment": "Malware payload (Mirai)", "value": "e7afa00ff2b8858978c89e825cd5b74ae3c613cd748b61ff3d5afdf1e574034c48b0170722d272e7df4875c68b7ae7f0", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670800, "uuid": "22bec936-0b55-4597-a77e-ca6b0cbc3c85", "value": "T1E8E31930D4504B17C2D213FAA69E825E3F221FA793D733115B38BAB41FE279E1D69924", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670800, "uuid": "06adb228-15a7-4ece-bb88-38233e4a9ee3", "value": "3072:Z41HOuaGVV3NfHUOjqylzqCw3jkmhxQwoVZUNu:Ze3aGVVdqylzq1jkmhxQwoVZUNu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642670800, "uuid": "1e99c943-cf08-4b50-adfa-c29d6e570442", "value": 143044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642670800, "uuid": "948c09d5-c3ff-47a4-91ae-0d77bbb86a34", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670800, "uuid": "7a0cb320-7416-4ad3-b384-bab1e90141ea", "value": "armv6l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aca81231-79e8-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642680077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680077, "uuid": "2fe852e6-8e91-4f9a-b17d-b48b2bf5258d", "comment": "Malware payload (RedLineStealer)", "value": "c290c1040541f8375f20cb4bea188611", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680077, "uuid": "fe1429a0-7d3e-4dbf-84ca-7e518882e56f", "comment": "Malware payload (RedLineStealer)", "value": "e109085dfb0d7cae33a447c6bbb73ad8b8a20fe06e7f3e06b0e90ac912949428", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680077, "uuid": "2e82d88d-dc40-4f55-9a0c-ef65e54085fe", "comment": "Malware payload (RedLineStealer)", "value": "385ab97210d6a5f7a0b0016ba3e3662e8caa3a5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642680077, "uuid": "923d9309-3b0f-4a08-bbae-5616d866ac1e", "comment": "Malware payload (RedLineStealer)", "value": "c6a97730c6a75675cec5e341c6563246f757e1a26768dc9db2b7530c29d995d8103b3da8011fd8fb641c0ce93f82a34d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680077, "uuid": "98b5da0c-af66-4ab8-8d8b-87781d6d61bc", "value": "T187C63334EAC2CCF1C9264D3A16B0DD11986B6E200E51D61F6BDCB455A9F37A0CFE8E19", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680077, "uuid": "a0cf0bf5-7440-427e-9968-a71cc43d3707", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680077, "uuid": "7fd1866f-dd8a-4a7b-9ff8-8d8b992cf27c", "value": "196608:X7Wp7mxy++Mw/3pf0+HhYu76upBsUZf9xeo21aVQYjmU0b7K9K1buwTyVVYX8u83:LOWyew/3SkD7xBsUZ1Ao2E6/bG96xv+3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642680077, "uuid": "f87c569f-ec98-4923-b9f3-807bb2834990", "value": 12549199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642680077, "uuid": "a616db6b-b392-43c7-8d09-175da91027e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642680077, "uuid": "ae37983b-3504-4560-a86b-3bfc7cc9db52", "value": "c290c1040541f8375f20cb4bea188611", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55e2f5b4-7a19-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642700977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700977, "uuid": "139419d8-451f-413e-9899-3f5f03f1864d", "comment": "Malware payload (Heodo)", "value": "5e20539b78122a38d9bdc8bb1f2a6854", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700977, "uuid": "d912a638-b764-4806-9a97-f984936d4757", "comment": "Malware payload (Heodo)", "value": "e202d02eeb40c6b2bfd8da52e0297679c1a7df39592bba24d12079257a8bdf8a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700977, "uuid": "380f2030-cda2-4011-9c61-f4fdf757d2da", "comment": "Malware payload (Heodo)", "value": "f1a4144745568cafd4170e1268b0519d6b54459f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700977, "uuid": "54e2fa03-fc7e-4da5-a7bf-9ba88878b659", "comment": "Malware payload (Heodo)", "value": "44bafbdaaeb67ea37b7f91f4bb76bfee384868b02cdf8ddbf80e2cd52a6e3acf35a6d599ab0991f2caf2fb4714ae6bcf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700977, "uuid": "d440c8fd-62f7-4522-8b65-56f5e4545297", "value": "T11DE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700977, "uuid": "18d77f77-f507-480f-9550-7bf4a94dd794", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642700977, "uuid": "d488eaea-1a7f-4e9a-ac12-e7d17b1fa273", "value": 144547, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642700977, "uuid": "c9368cc6-ba7d-44b4-b92e-7fad116b4cf9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700977, "uuid": "b614b609-521b-4109-8943-ee1a8af92be4", "value": "5e20539b78122a38d9bdc8bb1f2a6854", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda98b15-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642666416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666416, "uuid": "2aaaca5e-fab6-447f-a685-59b685857730", "comment": "Malware payload (AgentTesla)", "value": "d181a8ef7b9ad35e827b658f60c2e503", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666416, "uuid": "07edf5b7-59b7-40f5-ae7b-557efe824e8e", "comment": "Malware payload (AgentTesla)", "value": "e264d3cbf5138e57f918a46a20330809014918b4dff328272764b84c3dfa4555", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666416, "uuid": "d963224c-ff81-4530-bf4a-bad88d472e3a", "comment": "Malware payload (AgentTesla)", "value": "360e4d55e6ea1c24b0f2888529ef4bb2f2b24500", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666416, "uuid": "570b2a4c-2bcb-47c6-9595-c39c1ab10937", "comment": "Malware payload (AgentTesla)", "value": "489637f2f69fbe874d68da81049d21e1e82537542989848b3cd73e857028522ca946c7b2e71bc038ef120ab92923f684", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666416, "uuid": "fef4e4db-51a6-4f91-9a6f-95bf214d7918", "value": "T1F7E48C9C3650B2DFC95BCA76DEA81C64AA60B477470BD343A45312EDAD4E69BCF010F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666416, "uuid": "c7aedcdb-a33c-4558-bb88-4e7429623c25", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666416, "uuid": "693b3de4-38f4-4b72-bc92-410120e2aada", "value": "12288:yktd7QCw98q+by310yDq6zEuepJVoJhLUg44IF1+7jieyDvbO/S8GH6iy0EhfNI2:ykrQCw9WADqhu8JVoJuI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666416, "uuid": "b4a24b9d-b8f5-4ee4-92de-a14b18c57253", "value": 669184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666416, "uuid": "73811a04-a85d-447c-be5f-62e7772f280f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666416, "uuid": "3c5f35c7-e5bf-4c72-819a-1100bd929e60", "value": "DHL Delivery Invoice AWB 2774038374.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a4aa5f6-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642666303, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666303, "uuid": "6b405afa-97bc-4d15-903b-467208bfbf3c", "comment": "Malware payload (AgentTesla)", "value": "cadf4b70d1be4b278794ac2bd6da9751", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666303, "uuid": "51a7f698-a654-4606-bc25-f572660a5579", "comment": "Malware payload (AgentTesla)", "value": "e2c6f0fb9b6e9bf9337dade3d0b06c33ff9ae745d19f4ce86555973824c3b953", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666303, "uuid": "6a51492b-f6a7-44a3-94be-569b160b3f80", "comment": "Malware payload (AgentTesla)", "value": "69dae6b32b102bc924067cb9046ca02b9e7116a5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666303, "uuid": "cb2111d9-dfcc-49ab-a935-2819b39dee29", "comment": "Malware payload (AgentTesla)", "value": "9b991028df106dd142525017c566d7ee6039d6d88615b91c74c2f66b7beee5b59654c1dae41a7f68d5d07d9e1a1f880f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666303, "uuid": "4b6de42a-693c-4ab3-8762-1f485c1cbb74", "value": "T106A4016543691BE3EA7953FED491E0409BB67D1AA423D60A1CB1F1CD3E32B441A42F2F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666303, "uuid": "aa57f545-c656-457c-b46c-988f115cdb72", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666303, "uuid": "bcb8a193-c008-4edb-926e-7c56ab4bf29a", "value": "12288:QqPw+YdAbc0CddXoHbiQ6xXobL/0FPjwOQlQtpPUWe:LYdAbc0CvoH2BnPjwOQlQtid", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666303, "uuid": "b6d7214c-b0db-499a-a20b-2131a35f237f", "value": 480256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666303, "uuid": "9e03e240-6519-4e49-ace0-e7b93c9e9e9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666303, "uuid": "a908f6af-e41f-4f05-9bfe-d8aa5d55cb45", "value": "New pending review from fedEx delivery notification.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2190ceef-79df-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642675978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675978, "uuid": "69f6aa7b-bc9c-47ba-9658-16f42d114d35", "comment": "Malware payload (AgentTesla)", "value": "979b01cc25cb291611d039133730f1b8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675978, "uuid": "8d49b766-ed77-4a84-b994-be098b60532b", "comment": "Malware payload (AgentTesla)", "value": "e2cdad6a7be7fd1928a0dcfad6c81f2d0b81ca72bbcdf7ada6f1dc11c5f8df9e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675978, "uuid": "2739497b-b0f8-42c9-a6b1-6fa889913412", "comment": "Malware payload (AgentTesla)", "value": "af4b08032a9c56c931294b90d427cd8e57959d55", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675978, "uuid": "dcb11e11-a578-429a-92ec-65f698783912", "comment": "Malware payload (AgentTesla)", "value": "e47dd78c60b3465d58622885b3cd1e54a2ad91260245c08de220bf152afb3bbabc918db78296bd0d1196b1d10e36c67f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675978, "uuid": "87083b97-d005-4638-8b06-ba88f42f75dc", "value": "T1FC068D07F3486EA3D49E1DF720A987617734CB4317479B8F2188A2FC7DA23E09D65299", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675978, "uuid": "a15391fb-46c2-4c1f-9168-e0f9728151a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675978, "uuid": "36dc78f4-2915-401d-8389-35dada67ee1f", "value": "49152:VoxD2KXpM8nkrNWzc5TiRDfGwUrWk7a9ER:mxDfXdkRWznRDf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675978, "uuid": "d5d60ec8-ade3-4022-95cb-c8eb563a481e", "value": 4015616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675978, "uuid": "b4306c6f-94bb-4333-bf69-c12077c7a1e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675978, "uuid": "cfc3fc61-f573-4456-858c-ffcb256af81a", "value": "New Order Requirements 2022.1.20.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bac1fb0-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642665768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665768, "uuid": "747f73b3-ac9e-475c-8520-2a2d8dac6774", "comment": "Malware payload (AgentTesla)", "value": "d8fd89e00f608d87e67cb92591dcec83", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665768, "uuid": "68a2339d-6a59-4971-81ca-71cd74f8090e", "comment": "Malware payload (AgentTesla)", "value": "e2d3a45deac99cca31f19b392e41676dd1bf84897478b7269e2a88773e25b587", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665768, "uuid": "43dad1a0-1fb5-4034-af79-a3bcefe5d59d", "comment": "Malware payload (AgentTesla)", "value": "91be208b03bb2e8c9ec26aae1bf4379fb8e4fc57", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665768, "uuid": "22264a90-8a88-4840-affd-129f83935401", "comment": "Malware payload (AgentTesla)", "value": "39bc70d806d182c05db7a4ef736474a43aa476ab3777f9f41bceb3a9e367aeeed842bfdf8946055c02b4ab92e9443903", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665768, "uuid": "32322c59-573d-4849-bf8c-571df978bb55", "value": "T16D7413046AD07CABF0570370DDBA9F66C773A7112B53209F3BA98FE628630E65224597", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665768, "uuid": "dd49f3f6-d66f-470a-b89f-43799ea4f60b", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665768, "uuid": "b1cb40c1-97a3-4a1b-b77c-e2f0c788694b", "value": "6144:owl3RpyuXRX7R6H9wAHefQ9vjL5V5S0X5GFrpnaJ50P0jb4RqS:Z3RN7R+wAHY+v/D40YF1naJ50P0X4RqS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665768, "uuid": "d0526218-0698-4eb7-a1ff-5dedce45eba6", "value": 339930, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665768, "uuid": "94a63472-78e1-4a0c-b201-b3c35ba237d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665768, "uuid": "e49ed376-a03f-41c0-93f6-19baa5c02b1d", "value": "Halkbank,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7d4203d-79c2-11ec-9275-42010a9c0029", "comment": "Malware payload (GuLoader)", "timestamp": 1642663856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663856, "uuid": "b16124bc-f916-434c-b7f3-073a9c6a4313", "comment": "Malware payload (GuLoader)", "value": "b601abcce9f7c1086f68f428b1d22cf6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663856, "uuid": "44c0f908-3185-4d06-8972-975a2e77014f", "comment": "Malware payload (GuLoader)", "value": "e2e9cbeb22acd0ff38008a0a2ce677b3d640aab24c6383479421b6746647f667", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663856, "uuid": "c45f0d7a-1713-4dd0-a006-3fb2e5af809b", "comment": "Malware payload (GuLoader)", "value": "603f24754af78651e06064c2bb99666428dd6ae9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663856, "uuid": "b631e08d-8df6-4a91-8e6e-de22d4db5d25", "comment": "Malware payload (GuLoader)", "value": "f703fbabbb680828b29158337fae5ffd341c5f05ca6872dda813406fe082994ec11a094f556a34a9e8926958c9d58a3b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663856, "uuid": "d8f9a60f-955d-4983-b672-fe1fbc56733c", "value": "T1780408123240E8D3F42572F0FA137EA45D1BECF0DDA05A2365D6BB6B1A36B87472471A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663856, "uuid": "3193c7f8-75a2-48f3-b18f-59e6c857f7e9", "value": "75728a74b595903606f3235bcb6eecc8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663856, "uuid": "f048fd8c-3bd6-4ff9-a887-9bf94e1c4a98", "value": "3072:94w6p/N1A+miUpYZejLNhegsC/ysQv9QX28fSH:aw6pF1A+7dOJkgsC/yso9QG8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663856, "uuid": "ae19bd24-a72e-4c9d-8eea-a508e52e4d22", "value": 189544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663856, "uuid": "0e6d40e2-43de-4e2e-8c15-32983f3491da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663856, "uuid": "270cf3f1-75e0-40d9-b08c-c17ab8e2765f", "value": "##NUEVA ORDEN DE COMPRA 80107.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f561a3b5-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642676763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676763, "uuid": "2c7780d2-ceec-4dad-8ebb-267bce95af95", "comment": "Malware payload (AgentTesla)", "value": "b7b7b75fd3b5fb0e2347bfbe51007aaf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676763, "uuid": "9c312ab8-d3cc-43d7-93f1-94fcca7c48dc", "comment": "Malware payload (AgentTesla)", "value": "e3adf420fb24e0f9384d44d6cb929f653c04a547d01a7ac7af24132a25f7b38c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676763, "uuid": "ae24635b-8f26-4f58-b389-781c8efb40ab", "comment": "Malware payload (AgentTesla)", "value": "ac1350814913259e23c0033ffd8eafdc956796cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676763, "uuid": "4e24ca8d-834a-442d-a171-6f77b93d94fe", "comment": "Malware payload (AgentTesla)", "value": "f7ae75bcc07b20e9cc65de512c59fae457430beddac4cdd279012081adaf2b7d3a9addc22a4729fc1bcd33704d8fa944", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676763, "uuid": "f94d0821-34c9-4464-804e-cd7899b6e953", "value": "T16CA4F198BAA0B6AEC85FCF7649542C60A7713A1B4307E707910B11DD9B4EBD38F116B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676763, "uuid": "ca04df9a-ebc9-40a9-a6b4-9d7b87913616", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676763, "uuid": "c148e3b0-c439-40ba-bfc3-b5bcb6cf24c5", "value": "12288:KRktYL2Q7J5oYU0HrHC8nNM1dA2o0HAZMokRRRRRERfHsi:MktC2SfU0H7N6A2o0HCrkRRRRRER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676763, "uuid": "e9280bbc-1ed0-4bb9-a2be-f435d56d0b2b", "value": 468480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676763, "uuid": "ff48d58d-12fb-40be-a284-9352155a55d9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676763, "uuid": "7464bc34-afac-42c4-b5ef-37d031abde24", "value": "New Oder 2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5654c94f-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660605, "uuid": "e3442a74-61ce-4bf5-a079-a305bf5d1518", "comment": "Malware payload (RedLineStealer)", "value": "68d99ed77220391cce2716a5e8761158", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660605, "uuid": "445c1b2b-55eb-4b09-abb2-747204c2da3e", "comment": "Malware payload (RedLineStealer)", "value": "e3d47cf720441db8fad6021333ef201927e070bda5e781f5c2bb2f95d2d0b137", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660605, "uuid": "882f13ff-2d85-4dc4-8a05-32aa142868ef", "comment": "Malware payload (RedLineStealer)", "value": "cde01cc0134e376042afa87f0f42ba7c2de568e3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660605, "uuid": "6d38d638-2308-4139-8a88-77523d8c1365", "comment": "Malware payload (RedLineStealer)", "value": "5a60cf1e416e1dc2c641184fb3e479561f9f38df1052d28e44f5125d2a2dfc7a3ce61f6ffbf8c76da67d8e3d7269bc6d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660605, "uuid": "1d01ed2d-0038-4a17-b0fa-0a254d151ddc", "value": "T1A584E0E5B5C0D432C08FD670882ADFA019BDBC7459695A47B3B83B5EBE312D1623621F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660605, "uuid": "d18495f5-cc65-484e-b93e-9a2894d2e98f", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660605, "uuid": "9251816c-ff05-4c2d-871e-4c4b1adb72f6", "value": "6144:YL5LOy2Y0WzJB8T/KxnnNm9/cYRXqReo8i7wHmRL:sT2Y0W1eT/0nnNAc6rmB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660605, "uuid": "a9f3011d-61c0-4e16-8455-ea8bf442bfa5", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660605, "uuid": "7ba6454d-d35d-48b7-b34d-e097ae1b990f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660605, "uuid": "999a2268-6f44-4ab2-9cfa-65eb02102fcf", "value": "68d99ed77220391cce2716a5e8761158.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85200970-7a04-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642692037, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692037, "uuid": "acfd8ad8-73f2-43c6-a14d-67f5875f3ad1", "comment": "Malware payload (Heodo)", "value": "53f30c3407783d620d38c87344426726", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692037, "uuid": "f7ffbb34-5efa-4a27-be56-dabab3203da2", "comment": "Malware payload (Heodo)", "value": "e45ee13aa6c0ded0c339ccfa6f781f0c2e35209d0a7866a4f5bc66bde6e47ecd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692037, "uuid": "c211f9a9-e564-4149-83b4-5ae17b22c47a", "comment": "Malware payload (Heodo)", "value": "c93f4f2d36d3a740a37e4913d177d7bd49da4ffe", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692037, "uuid": "f1aada89-6115-4934-b8a1-0b965007a9ea", "comment": "Malware payload (Heodo)", "value": "d968734059b0edfd607bf80f0243de186b1bc4f037922686beb9b7e0627ba303182e91c6cabc00d7cff44e26a90dfcc5", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692037, "uuid": "05d9f9f5-8c02-4995-b923-b31e534320c2", "value": "T12FA4BF50B552C072D4FE10302928EBAA0DBD7D314FA495EBA7E01E7E8D352D19732A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692037, "uuid": "971bfdcf-abf7-4cbe-bcd5-503002449fc8", "value": "3773ad24a3d7afbf38a113a01a5bf2a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692037, "uuid": "e59d37b6-14d5-4f01-9d22-05f799f26dd0", "value": "6144:Xta0vtmjG1ishZb/3QJkCrpGXtWMJw0iwg/GPAOanDCBPASUA5LtKn32OOW2ynWy:XQLHshZb/gJkCOiwEGPUCWCo2Ol2ynW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642692037, "uuid": "659c31bd-f09f-4f05-b512-c9f4ac4a51ab", "value": 481792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642692037, "uuid": "24c1a1f1-e76b-4e5a-864c-4a027f26dde0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692037, "uuid": "64197b88-ec12-4336-9c82-4b01af7ad832", "value": "emotet_exe_e5_e45ee13aa6c0ded0c339ccfa6f781f0c2e35209d0a7866a4f5bc66bde6e47ecd_2022-01-20__152031.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c492102a-79fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642688707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688707, "uuid": "ec605d5a-7e0f-4ea6-8c53-6cfd71a5a3a3", "comment": "Malware payload (Heodo)", "value": "940d02bede13657e074bdcdb46c18892", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688707, "uuid": "5273f4df-f913-4116-bfa2-2e0cfb196f3f", "comment": "Malware payload (Heodo)", "value": "e4b4b4aeffb795fbbac1cd7bf7465c6fd98c0906401fdb3a90ecca0ce903b3c4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688707, "uuid": "257b5d16-0b85-4555-8c7b-6b6aa5c505e5", "comment": "Malware payload (Heodo)", "value": "58937f378e9d53be618ab06deca8db2c9cf4a173", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688707, "uuid": "f27e6662-f6f9-4894-ae79-ad6d7603bdce", "comment": "Malware payload (Heodo)", "value": "a1cee0a00b37e36e67c19a9cae310142d20fb9b476c436820eb1532861ae0ee890c343206ec0088c85e633228becc18b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsm", "colour": "#6BFEB7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688707, "uuid": "efe636d4-4705-46c7-ae4f-fff8d00c960b", "value": "T14BC3AC0794059FA2C86CD3F9BF0B48D06F01025DE2D539DF28926B57779ABBB0A0D62D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688707, "uuid": "68e123bf-6c0f-42bc-b2f0-4887b8368dd3", "value": "3072:kJXeCEvZ8BnW6X1yVkovrepMA5Q6g2X4inD:yXKh8lWoGk+eCP6DX4G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642688707, "uuid": "f018ecd2-139f-4989-b926-e7335f96befc", "value": 118615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642688707, "uuid": "b6d1ce5e-ece4-41e1-95d3-3ad23b7c4b8c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688707, "uuid": "8589f60a-f707-4f0b-b105-ce6b8fa596be", "value": "stbuiv_9200401.xlsm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d83b45f3-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (Amadey)", "timestamp": 1642660823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660823, "uuid": "72649213-c55a-432e-8511-6445db321803", "comment": "Malware payload (Amadey)", "value": "a16cd8fc4bc778058f08804920be417d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660823, "uuid": "94ff590a-cd10-4d3b-9449-04bb6226fc4d", "comment": "Malware payload (Amadey)", "value": "e554ed2ab8582212bcdb611265a2e223e6463e5f2964ef31885c2106f764c3d3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660823, "uuid": "aa4b66a0-60c1-41ba-ab5d-2119357c2033", "comment": "Malware payload (Amadey)", "value": "6d80c58f9ccc210b3c8ccfe7dab7ad29179d08a0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660823, "uuid": "5f8b2814-8052-4316-b5ed-d074ceaf826b", "comment": "Malware payload (Amadey)", "value": "f53577554d9bd7bdbc355eb99ee64e5906a6261d77b2cef49a347367e7bbeab64c469fe5d83b4caf2919705729e882a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "Amadey", "colour": "#BFD88D", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660823, "uuid": "bdc41965-a930-4339-8d9c-9849f9025920", "value": "T12374D03E3AF0C432C09615314825CFA49AFDF8345A659A4773A83B6EBF712C0966631F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660823, "uuid": "5e528117-738b-40ed-a5cd-48c1d8e3be5c", "value": "b599c41ba6f3d2fcbb28babbce596599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660823, "uuid": "ce21cce8-fbd5-4b58-8a88-0e29e3fb20e8", "value": "6144:Lk5xejVio3tGYd+C2RF4KEt1bjzZkd9tO7Dm7:qxej1tV72RZ6VBkd7gDs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660823, "uuid": "8e635c49-5a52-4bf7-9e99-13d8243ce0e1", "value": 361472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660823, "uuid": "fb8eac8d-174e-4429-8272-85e3b9777551", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660823, "uuid": "cb0be94a-ac28-41c4-ac33-acd51bd8c956", "value": "a16cd8fc4bc778058f08804920be417d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abc1a63e-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666332, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666332, "uuid": "c0da7a3b-386a-42dd-8a89-7cd83b91f639", "comment": "Malware payload", "value": "c50ab3961cdf02fb4b9ee8c7934728a6", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666332, "uuid": "1b1ffe75-7471-48c3-9177-f8bac38bdbfa", "comment": "Malware payload", "value": "e57f1668d964e558f290576cab181d6cf68c3e6e29113fd9b4b8bd89e841ee98", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666332, "uuid": "336fd280-921c-4ee7-b4d7-a155e54b933c", "comment": "Malware payload", "value": "d084995ef323a4105c70c904f0e586a1d46694f1", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666332, "uuid": "f26363d0-923b-45fa-851a-7831305a86ad", "comment": "Malware payload", "value": "3484effc7f69e991c47572d5c630a6fee6994dcbf7ec8ae2bbd29e12280d22b89180ad36fe1cf979ff01998a6f4b9800", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666332, "uuid": "2c8453f1-c483-4206-b2ec-4c0f59cd792a", "value": "T1EE94F1107BFE236BD6F587F4A5A1011123327A592132E70D6EC270EDE976B429A12F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666332, "uuid": "89bdb51a-86f3-4a17-ab4c-cdaaa9caa854", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666332, "uuid": "fc05fe31-6589-4edd-9c07-110293b1dddf", "value": "12288:QQ8r48GinqzF74QXekQwYu1fR/rmUvvNG4:Zg48FQXlnRR/rtf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666332, "uuid": "3dcc601c-8a76-4228-aa98-2ebbffca38f8", "value": 444928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666332, "uuid": "bdf92418-96fe-4edb-be4f-3502f570e78d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666332, "uuid": "667ed9fc-33b3-4ddd-bb8f-b716cf2c70a1", "value": "DHL Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39748107-79c2-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642663563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663563, "uuid": "6affd4b4-ec04-473b-90cd-4dcde8c1c699", "comment": "Malware payload (AgentTesla)", "value": "fd3734b2690c282c2585d9c95973c929", "object_relation": "md5", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663563, "uuid": "65499afb-3c7e-449e-a0a8-7d4475977043", "comment": "Malware payload (AgentTesla)", "value": "e5bf8c9de1a3e86b8193ca22ea15add4d7954e1fe3130f26fee5ecbddf1abac2", "object_relation": "sha256", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663563, "uuid": "cc436b07-dbe1-4afc-83f8-f3519146027d", "comment": "Malware payload (AgentTesla)", "value": "e018905a6ca25ae5fdf2bb4ed827734e1bf86543", "object_relation": "sha1", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663563, "uuid": "49d95e2d-7cd6-43a9-a5b8-d4eb28d6218f", "comment": "Malware payload (AgentTesla)", "value": "b7ec47ce5935af4988e94c78d874efb2c4b24b82b249a643ab05352e5b51bc2244e44a27b76a8538beaf2996853c34e9", "object_relation": "sha3-384", "Tag": [ { "name": "ace", "colour": "#72CEE0", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663563, "uuid": "d087f1d3-22dc-461d-a279-32b040168d57", "value": "T17D94231836E1A72946E1E1217CD82F664CA219F94650D72CE80F6A8EDFC5EDDB307F42", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663563, "uuid": "be97d48e-7aa4-425e-829a-413b3f0c59ad", "value": "6144:UJfV/Jo770A3nSoTd82MZHQ5PG94FEN0QIa0vldKJMau3GuNL7N2st4HPtGXH3:Md/Jod58vHQ5Y4qsldJau3DNLBtQPtuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663563, "uuid": "c886005e-ed7f-4476-bfc9-80bbd8517572", "value": 415443, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663563, "uuid": "c50fcf5d-4d6c-4a7e-aeb8-1f8537e9e78b", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663563, "uuid": "6052aa6a-b560-4757-b3c3-8ef32416a3db", "value": "Receipt.ace", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7461314c-79e3-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642677835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642677835, "uuid": "db622722-c055-4b0f-b018-c2873f5af954", "comment": "Malware payload (AgentTesla)", "value": "ab711ad01a7d6cfc68d78427548c21ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642677835, "uuid": "3877b0f2-5c4c-41e6-aefc-f75c98ccfd73", "comment": "Malware payload (AgentTesla)", "value": "e5dc2ded41828de16c414250b5031b6e4f9760c0a01ce3f9c4032232a429c81b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642677835, "uuid": "c915ea03-8305-4b30-9dd7-35a80c4f9c37", "comment": "Malware payload (AgentTesla)", "value": "063f93f41ab3e54f739f7b7f9f4b34394f73bfed", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642677835, "uuid": "cab24258-47d9-420d-8d6d-87f6395c744f", "comment": "Malware payload (AgentTesla)", "value": "8e588b855af0809b7ad2b1f31fdcc8cacc2b14fdaabbdc7e7a5d279b1e2a51e440f81034deea94d05405903ed0b1f167", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642677835, "uuid": "fe0bb02c-9118-4207-bce5-191296f18676", "value": "T166641275B2D4E5FEF1A62B363CB7EB7AE3BAEB14120446470B445E8D79200C7DB05892", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642677835, "uuid": "275eeb91-f392-4ecf-8361-178d2250e90f", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642677835, "uuid": "a301a447-c5af-45ee-b76f-789ec31992e5", "value": "6144:owI3RwYFg1roKkeoX3WQMtpHzoaYQT9R9qopJuAsZA/aHgkeHPiz3:c3s1CP3WRpHsatFNVT/U+iz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642677835, "uuid": "6a5078db-90a5-4dc7-b30f-f848b0d548f7", "value": 309613, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642677835, "uuid": "0f185ba7-dc8d-43bb-bfd1-922b045f0f3b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642677835, "uuid": "88db16a0-06a6-4d2e-ade5-77aab57fb403", "value": "PO#0020012022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e684bad-79d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642670819, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670819, "uuid": "7c357594-55c3-4443-aed8-63b5dc339b3c", "comment": "Malware payload (Mirai)", "value": "83f9ba5be553663edd4116a0b1aac31a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670819, "uuid": "0a36f272-6ff8-43fb-b63e-bd0112443aa3", "comment": "Malware payload (Mirai)", "value": "e5fcd9c9ae1edaa05d990a79be84360ff78178965ebcce290c3b944d4d5054c5", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670819, "uuid": "6593532e-a05c-466f-9370-7e422e756952", "comment": "Malware payload (Mirai)", "value": "10cc63e53abfef23b84d67625d39c3cd5e132b3e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670819, "uuid": "a5ad44bf-2f27-4f8c-8448-4600465597a0", "comment": "Malware payload (Mirai)", "value": "e0832fa6f26e6318ef547b99ba2263c32695737fcbcf3a838408abbdba5ada6caa2b52dc403c4843f29a22696bb33286", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670819, "uuid": "7c194ca3-a8f9-4746-a618-7704150de296", "value": "T1EDC3F772B804DF66F40AD6B604D38B227E30BFA70E631662B31739669D331D52867F49", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670819, "uuid": "99514b48-103d-4e2f-bdac-9d3edb4a6260", "value": "3072:L+YUpmc5hIof5UM7XgYjykKd2mm/QcuLB126DNb:LwU1of5UMPyk22mm/QcuLB126DNb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642670819, "uuid": "82504a26-fd54-403d-bf06-15558d8e931c", "value": 118319, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642670819, "uuid": "fd4aab98-5088-4027-8185-530c7c1f2d53", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670819, "uuid": "79ed7ea6-16e2-484d-a011-3dd2620e477e", "value": "m68k", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20201f47-7a0d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642695733, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695733, "uuid": "724c150d-f33b-470e-84e3-27469ff59742", "comment": "Malware payload", "value": "ad457836bff1c4e1324d4f0000f359f5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695733, "uuid": "cdfc522b-c63b-48e1-90ea-dc89988eed9c", "comment": "Malware payload", "value": "e65cad9aba2b6f60a79a87da74917e611222639499d94fd6321c911f9b22267d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695733, "uuid": "4d9998d8-9dc4-4bfe-880c-c594b49bfa43", "comment": "Malware payload", "value": "a41be3ff06a346d00e5f1208800147b23db53858", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642695733, "uuid": "9d65f830-45e0-4f6c-b521-2a0074b80630", "comment": "Malware payload", "value": "6f8ff487d45cb25ade0ed5e26b62c4676707ac55a451c62ddbbcd6d38bab6c4f4e4e3b7aaeba7bc0d4ff8c5907446c32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695733, "uuid": "7f6e3c85-3d38-403b-a441-8d34d4513081", "value": "T1EA832B01A9008B17D1C327BEF7DF47483B36AAD997D773056624FEB82B8679D1E26120", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695733, "uuid": "dd1d7ab9-c3d1-4b62-9fc9-261942691f25", "value": "1536:b47W4IworIEY8cKZe3K8O2LvgJ22qEg4d2i4tpfd+cQ/MirQEISQWfmar:D4I2RHgJ2+4tOT/MirQEIFWfmar", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642695733, "uuid": "5a91f2b6-97c0-4421-b302-1fa0d4478e7e", "value": 86771, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642695733, "uuid": "7b2179c5-75e4-4002-8d40-900e369330f0", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642695733, "uuid": "0bb48b07-23a7-4ead-a752-541b84182185", "value": "ad457836bff1c4e1324d4f0000f359f5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0940ff53-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708579, "uuid": "5503fcfe-20c5-4709-ad62-12c83f207460", "comment": "Malware payload", "value": "6f5482d58efd050682c76ca5fc818b66", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708579, "uuid": "d31b0004-63cf-4f97-ad1e-a8b5082e9858", "comment": "Malware payload", "value": "e718fda21871d54c4bade2114a35411b639bee1afe21ef5c5c9a608e72337a9d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708579, "uuid": "76787632-4ee2-4714-b39b-4854c35112e1", "comment": "Malware payload", "value": "032d2dbc7eed43849a28da095fd4940a370a4620", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708579, "uuid": "3c65a407-c6dd-4a5b-8e3d-b6bd1f04bb30", "comment": "Malware payload", "value": "d94e6c2d0c26089593a886c1161eb47664de93c0ac953ec5487774fca9efb0d6caa88c1609edbb20315a805eb6e80cdf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708579, "uuid": "8fd4fb86-f418-4400-999b-ca3e3d9b555e", "value": "T1E4F533AE41876833C1AB7FB0396CA9482B45D2091340EDA072BF0FB65945F9EDE27F51", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708579, "uuid": "2bbb76ff-a198-49b2-916b-c98b3837b64e", "value": "106f3d3e521ab0377bf478b03f3dd87b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708579, "uuid": "37fa96ac-2f5b-4f44-832f-e1e1647d6de5", "value": "98304:qCMo5XJ7V5Kj1qj+HfJ3jDws21WfsFpPYhfCmO:q05ZnKm+RECfsF25", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708579, "uuid": "71afa3ad-7e55-4650-9726-e8cde7c04a9e", "value": 3627520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708579, "uuid": "e7ed5097-9cb7-4be9-85b5-deab3f1047fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708579, "uuid": "d68a8439-4ef0-4887-97df-6f9e83705634", "value": "6f5482d58efd050682c76ca5fc818b66.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57530a43-79ca-11ec-9275-42010a9c0029", "comment": "Malware payload (AZORult)", "timestamp": 1642667049, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667049, "uuid": "04946dda-ab41-4164-92a9-5ed26e952a65", "comment": "Malware payload (AZORult)", "value": "8471e3f62c094086476c95fe3e6c67ab", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667049, "uuid": "0c845b08-487b-4cea-8cf8-925330c89b14", "comment": "Malware payload (AZORult)", "value": "e752bd103a473a433040a6522226aac9cecf8b5a8e6ab59fe386d63a5566b63c", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667049, "uuid": "b0f9dc89-2968-4f88-b252-27026660aab6", "comment": "Malware payload (AZORult)", "value": "f7c7cc77d019abf3ebade7f28a4537ecbbf2e695", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667049, "uuid": "1d34f32d-2868-40c7-af16-7f7c8fc6bce1", "comment": "Malware payload (AZORult)", "value": "e1d1ab99244732e7fe7b263bcc9fabe837714b4bbfe65e2a4c51507fb6e8b013d8c5f04f82834304321f0b59d00a232d", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667049, "uuid": "955a8c3b-6d73-41ec-85ec-527465399ffc", "value": "T1F935A5AD326072DFC867C972DFA81C68EF9078BB831B9207905725AD9A5D857CF140F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667049, "uuid": "c448e18c-7199-4547-b631-538af6e5ce0e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667049, "uuid": "c65b0771-f299-4286-9dca-3ab99e7259e2", "value": "12288:FbOVbOVd1fhiOxxRBsold1Box7acM10g+0fGc1ic16ID9PEdBxd14kWcLKG+wW+M:8V4d15fdBH1BEaD10g+0fGcQcUIyjAz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642667049, "uuid": "9dbe55c5-d2ba-44f8-b35b-1f90c20816af", "value": 1096704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642667049, "uuid": "58a67543-e702-41de-9d3a-0155835f676e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667049, "uuid": "b7709ca8-b2f7-4d46-8053-cbecf6e8cd9b", "value": "PAYMENTT.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "044a8dda-79dd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642675070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675070, "uuid": "7635bc8d-5cb8-4412-a58f-aef5bdc6825e", "comment": "Malware payload", "value": "3a5338d6ada6c607b4275a77f7fb7ebe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675070, "uuid": "d64e3657-4f9b-4db0-a688-defc5cfeb64f", "comment": "Malware payload", "value": "e779c5b687cd61abe25d136ebf09bfe3c5059c1b55cbdf124b33731e3c1a8f60", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675070, "uuid": "02f9b5fc-b0ef-46de-b13d-07d70741b2db", "comment": "Malware payload", "value": "e407512587eb12c237f7bf8999ea9bba591715b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642675070, "uuid": "49a1231b-5781-408d-9b49-9187b8958d58", "comment": "Malware payload", "value": "dfe8d216b8cfbfc1f38edfa83509f4df527106b9a1ff214288756c9a1ccb371df625ee16e1bed893fb4a7e74c683fb4f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675070, "uuid": "54658cb0-7863-46d8-8d2a-3f4da649fc60", "value": "T157C26504BBE90614F1BE4B381DF51706C976F996BD33CE4E0AA9408D1A36F909960FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675070, "uuid": "c1b6734b-5d5e-48c3-9b16-95ce011be228", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675070, "uuid": "fe52deb3-6206-4aeb-80fd-3987a55b7ed0", "value": "384:ztbetQAquu6d+pAsKgnqI1O1r7QDQccsEKtGWBZ/v1b3O8gtVRwvaBljfyR:hbZ6d+pMkmVcPEgLBZ/FO8gzje", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642675070, "uuid": "959c6301-f125-4442-b0b9-de560118aa74", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642675070, "uuid": "23647630-1282-4f7a-82da-07ea4b787705", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642675070, "uuid": "33fc6690-b17f-424e-892c-e235d1e078c5", "value": "gbajzzql.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "abd1f52f-79d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642669768, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669768, "uuid": "06fe1823-e9f8-4b64-a727-e359cf394693", "comment": "Malware payload (Mirai)", "value": "6e715ae8c741c6c943e72fa73031b61a", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669768, "uuid": "97916e36-6758-4028-bdf9-e38ebdcaf199", "comment": "Malware payload (Mirai)", "value": "e78a22e4243cab5fcea93f613c0f76ff5259145ad86a02f940d98b8bc68675bc", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669768, "uuid": "ffc9f7f1-7fea-40fb-8be2-51fd468c5ddd", "comment": "Malware payload (Mirai)", "value": "3ea0b8e91a5ac149d9b770d616c2447b74105a59", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669768, "uuid": "98afbe54-ecf4-4908-9c4e-bc8a55b9bdd2", "comment": "Malware payload (Mirai)", "value": "1446514df67d2ea4122aabc1eb0fe54bbf6909ffc334f94ca68f1cd1b25195150b0312f84f9f06ebb4b6d30e0633c1de", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669768, "uuid": "283db5d3-c225-4c89-9a05-6729a9ae7e4f", "value": "T1B1639D3AE41A99A4C0474634B0E5DE351FA3A9C043272DB6AFE442B61403EBCB55DFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669768, "uuid": "7bfff01d-70c6-4350-983e-1342783063a4", "value": "1536:YaGrdgbyFJxwtHYJ1rMTfqoI/NL/7vCpuh9C/g:Y3ebynxwCHvguh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669768, "uuid": "3aa8f361-7825-454f-8dc3-05a67e851e90", "value": 66964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669768, "uuid": "62a45e42-435e-47b0-964d-0daaf532d507", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669768, "uuid": "970077ff-c627-40ad-86e9-6022265514a0", "value": "gang123isgodloluaintgettingthesebinslikedammwtf.sh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "433c71e6-79ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1642689779, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689779, "uuid": "9400ce3e-48c3-4a71-9b59-25efc435f67a", "comment": "Malware payload (Smoke Loader)", "value": "4dfbe9808fe1bc64c14717fa0188a920", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689779, "uuid": "3ab35141-e96c-475f-abd6-7d011fabd615", "comment": "Malware payload (Smoke Loader)", "value": "e7fd4915a63bc03b41f1dd1141a2c0ba2c3a0d0bdc3c1dbb6fdbd6388b09be74", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689779, "uuid": "fcd13d64-c616-42e6-8e03-e840ff8e0914", "comment": "Malware payload (Smoke Loader)", "value": "32ef01079f339071e9b07288b5f68cbb287862f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689779, "uuid": "da5e1866-e715-41f6-ae3c-02241837154c", "comment": "Malware payload (Smoke Loader)", "value": "557d38a29fef6cb9e5223a29fc98c6408002a5cc3165d8ea1651f370546ee53819ecc3f38d09bca4886ece48a2fa674e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689779, "uuid": "49156130-3281-45ee-bc82-c4f5fb18ad82", "value": "T128449D3276B0D031C097F634485ACFA59F7DBC316A61964333A627AA6F322C1563A35F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689779, "uuid": "d527f987-059f-4cf2-96ba-52a7693bd6cb", "value": "869e638a23c83656faad7512b2575ea6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689779, "uuid": "ecb79288-8bf6-4e6f-a64c-8549f895b968", "value": "3072:3ZDoLkYeUF1Ic5qp2pUZ0Lmhg5eSIQ0pYvM/h3:3BoLkIF1h+cnL70q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689779, "uuid": "7cd6d8db-0d3c-4eee-943b-e905685c494b", "value": 256000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689779, "uuid": "b94457f8-b8d6-437b-8c02-d9938ed9bbff", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689779, "uuid": "a290aab0-3965-42fd-9b70-3a996203a4bd", "value": "4dfbe9808fe1bc64c14717fa0188a920", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "80b93a73-79ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642667119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667119, "uuid": "220ab7f5-fb1b-478e-832d-14ffd76877ad", "comment": "Malware payload (Heodo)", "value": "8fb7d8d6fc15923f82c82182dbc9dddd", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667119, "uuid": "03e1b83f-515b-4098-a9b4-7650fa75665a", "comment": "Malware payload (Heodo)", "value": "e84a54fda45431b84b1de763691efb5baafa31dd714b0533985342b7eb038dc9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667119, "uuid": "c4948a7b-e147-42c8-8ea2-0d5993b2a979", "comment": "Malware payload (Heodo)", "value": "afc666c33bd3cb7ace6164e4f11f638f4ab16df4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667119, "uuid": "9e80e185-2df8-4811-a51f-39e6b27713eb", "comment": "Malware payload (Heodo)", "value": "35f8d07c6d176702dc825b5f6db0671069328c0a94fb897a7047d3089d5e94d5bd5973e7502ec92cc9210a90b358ca06", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667119, "uuid": "fbd98932-0e52-415c-ad2d-2aaa20b3db56", "value": "T177C4AE12F7D1C07AD1AF12356A2A9B9C63B5BD619DF1C20BEFD53A4D5E306428F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667119, "uuid": "a71eac22-8336-4d6f-bc1c-569b26258e67", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667119, "uuid": "47391ef7-53d7-4622-af70-a612480980a0", "value": "6144:5Ig427JC2jW8j6bzhO5vDynHoIoxoJ0CopGEfrfBHEUXZXbej1BC3OBtNCkiFPs7:5D42+8jM8WIIU8GrWIXbeDCxBPs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642667119, "uuid": "0b2335b8-9a51-46a8-99bb-0d5e76ac6fd7", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642667119, "uuid": "7fce5221-70c5-4e79-8297-cddebae65e1c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667119, "uuid": "d78f0ebb-5734-40d7-9abf-c49212eb9ec0", "value": "emotet_exe_e4_e84a54fda45431b84b1de763691efb5baafa31dd714b0533985342b7eb038dc9_2022-01-20__082512.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fa36499-7a3a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642715274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642715274, "uuid": "89b68331-ef90-4788-b1ca-79e05b0ce42d", "comment": "Malware payload", "value": "68172769631a891bc5790feb75823f43", "object_relation": "md5", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642715274, "uuid": "a639b950-a27e-43b9-930b-20e26b14cb62", "comment": "Malware payload", "value": "e8ec7dcf12edf07c6099157c32557f41ebd74ddee6b125d1e34dcc4259dc10a7", "object_relation": "sha256", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642715274, "uuid": "421f5236-f2e0-453f-9b5d-8ec5c45f0b1a", "comment": "Malware payload", "value": "e05ed4dbc6c2eb776c95007f62711c682b10c0c4", "object_relation": "sha1", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642715274, "uuid": "416812a8-539f-4082-b264-e8759808498a", "comment": "Malware payload", "value": "dcbde0f1e574b9969a518dc13b06c492aba800f25bfece61f66df568db97d31576c872805ce9603d4aba6b4378ccf1dc", "object_relation": "sha3-384", "Tag": [ { "name": "xll", "colour": "#EF2985", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642715274, "uuid": "1fb51775-48cf-4ac3-8da4-b7bf3d0b311b", "value": "T13DC48D57F7C7FAB0E6BE827A86B1891C527774520260A78F674072896D23392493DF0F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642715274, "uuid": "16b7d976-8c33-46ec-97d2-dbc99b4a7347", "value": "a31761b5a590c4c499d5f4a347d75c12", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642715274, "uuid": "c31d9369-9a5c-4d93-867b-c7745e01ec09", "value": "12288:1n/zDvGHAykHSzLW/4+8bzbBSreMdtogFK/UqW:5zbGHAzHAjX1/cL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642715274, "uuid": "79955237-941f-4783-8ae7-00075933d2d6", "value": 567808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642715274, "uuid": "9e61e01f-34c6-45ed-b09b-64612b5f33ca", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642715274, "uuid": "17a88540-6a11-46f7-a310-c8a1188190c9", "value": "Payment Notification.xll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "908ec59e-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1642666286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666286, "uuid": "7b530ec8-ecb9-42de-ad7b-134b04053e34", "comment": "Malware payload (STRRAT)", "value": "933553b19f3c64aa937f4e47c85e9a26", "object_relation": "md5", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666286, "uuid": "471f4ae0-3419-4127-9fe6-c08fbb36f800", "comment": "Malware payload (STRRAT)", "value": "e992cda946d860e411815f70c769b4218e073a94fd807b00b384ece0221e740b", "object_relation": "sha256", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666286, "uuid": "6a9c0463-b116-46da-87a4-a3825feac8c3", "comment": "Malware payload (STRRAT)", "value": "0cfc181a36568c6f55f7c9aecf68ede07533a281", "object_relation": "sha1", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666286, "uuid": "2af627b6-a75f-4aee-9acd-769b9060e995", "comment": "Malware payload (STRRAT)", "value": "92379caeca9690bebc4980b4be097b668650110e8805183b2a2ea0098db961cbc6d97c4e4a7290e7767c42da9d1fd226", "object_relation": "sha3-384", "Tag": [ { "name": "jar", "colour": "#3CA094", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666286, "uuid": "bd9bd9f1-3355-4977-a274-a0dc2d103ed6", "value": "T1B693CF2B797BC078D3039833106AA5236A0DD6E9D56E311B22FE08525E34D6E9F176CF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666286, "uuid": "a2c07b3d-9deb-420f-9e27-095a87125f1c", "value": "1536:xV/Q1AD2P1U9QO1+jb9cEanGShPsLna0NpLfmjuTiouhenydHGv9vx0pRHrXXO:xV9D2P1gQ3jMGUPKnDN9fmKTtnykvcLO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666286, "uuid": "50cd504a-5ada-49b4-b80e-6f168daaa1fe", "value": 94791, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666286, "uuid": "b4b9cba5-1638-47b5-880b-4548adc97215", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666286, "uuid": "55143879-1281-47d8-9ff0-00f409190fae", "value": "quote.jar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c84fc9e8-79ce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642668957, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668957, "uuid": "f7b94585-9d9d-4471-936d-33d109c0b05b", "comment": "Malware payload", "value": "0053c15337e50c7c80cb76f2bb7bed71", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668957, "uuid": "9bfb514c-829c-4431-baae-8e34be85b144", "comment": "Malware payload", "value": "ea57d722b53b84f14728427f21022f8e3d809fdc4656513a628ff409c7518b38", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668957, "uuid": "c57f4b9f-8e83-465b-b986-0e803843a0e1", "comment": "Malware payload", "value": "6ade31323f651782538995cad8ca0289e5fa7a32", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668957, "uuid": "f8fb1407-2ad1-4dbb-a5e0-38f8a61c37cd", "comment": "Malware payload", "value": "12552b287895bb276e9453e31724f914c6ed266ff5abaf1885fbcd64d2283d9217aaa11ecad3c412a41d062e02944de3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668957, "uuid": "b2d70633-708d-4e67-9506-bf8ba17e1462", "value": "T14C94AC9D9E384449EC1A3738AF4242A57DC03E717D6988F3A5C52F8B8927310B7D1A7B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668957, "uuid": "2059d34e-feda-4fb5-b6ea-1c5d20a133f5", "value": "ba9a5cfa3a7f3e5fa7ce2c7843d8b18d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668957, "uuid": "899ea5ca-1db1-4b7a-bd14-0740396d1bb6", "value": "6144:5NlQ9DurgkqRlef3I2RYFzTyNsDsZ4xgzhfL4dx/UGszPDpJmeZ9goCwMaz46Dc:5Ne02Hef3IHzTyNVRL0SJmeZ8wpA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668957, "uuid": "9fec9573-7b88-47ae-b5dc-fa63dca972f8", "value": 435081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668957, "uuid": "34806ecf-af74-4bdd-8f03-23625e0b84f3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668957, "uuid": "0b80eb88-3079-43b3-ad9c-58bb667c5e59", "value": "0053c15337e50c7c80cb76f2bb7bed71.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9499c78-79da-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642674139, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674139, "uuid": "0aa2fbbe-05b9-4f87-a937-3d96a435e613", "comment": "Malware payload", "value": "fd5b1d2157cf1e66084227d9cf7a8981", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674139, "uuid": "dd99b9be-dd50-4c22-933a-9515ec287cb2", "comment": "Malware payload", "value": "eb2c73714963a848a949ba482316c7491f7f3c24b45249e332cc817388b16ad4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674139, "uuid": "ada7376b-131c-4dea-8bbe-47be48df19b6", "comment": "Malware payload", "value": "0cdfc3fa0d5ca9fff4744174502bfddf1076b5ce", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674139, "uuid": "26eee77b-bcfa-45e0-bf12-209fd5fae16a", "comment": "Malware payload", "value": "fef792f386a8a74e93b384fdfd2586ee7bdae972080de709f6032e3587fd57e42380a08f69b81ca51181244a3d3a0576", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "test1625092", "colour": "#0CB327", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674139, "uuid": "afe2fca2-97a0-4a93-8f53-5b3fae39a4ce", "value": "T1A9C26404B7E90604F1BE4B385DF517068936B996BD33CE4E0AF9408E5A36F909960FB7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674139, "uuid": "8d4bb9d7-a405-4e33-b6f9-2bf2ee7f3542", "value": "dae02f32a21e03ce65412f6e56942daa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674139, "uuid": "f6761147-dee7-4ba7-98c3-d5f0058a4b64", "value": "384:5tbetQAquu6d+o5zUGM9nQJtGWBZ/v1r3O8ltVRwvaBlqfyW:/bZ6d+oQ0XLBZ/FO8lzqh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674139, "uuid": "b0de4f5e-c6c7-4585-97e2-c9d860323989", "value": 28160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674139, "uuid": "009c29e7-d3fb-4b83-b381-b88662897978", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674139, "uuid": "00e68c1f-7c74-4c97-8904-501f360e13f2", "value": "es2bymbf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5dfc3c9-7a00-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642690428, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690428, "uuid": "f7d7332f-e8a4-475d-8443-bc39e7aef019", "comment": "Malware payload (Heodo)", "value": "425686d7200be2a614e79b0dfc3a49bd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690428, "uuid": "12bb30b9-5a24-455c-b82c-f606faafbed2", "comment": "Malware payload (Heodo)", "value": "eb2f4d9d99c1276b3b2687814ceb4805aa527e17b41fd2b7099d8ac693c2f6b8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690428, "uuid": "0dd59772-fd6e-49d8-9078-2af6854acff9", "comment": "Malware payload (Heodo)", "value": "81c990fbf54435996627aafdceb023248e133b95", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690428, "uuid": "7ee2de4f-237e-4f75-a95a-270113b29b0a", "comment": "Malware payload (Heodo)", "value": "73896a18876f9a9776878c4877c52f19e792e78237640c74cd8ac39ea9188be1f2d65a62adc0bed54a9fd2a68290be5f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690428, "uuid": "ebd92ff5-b5c1-407f-8311-bb4b96fcd3e4", "value": "T15AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690428, "uuid": "9863229a-e6fd-43e4-bd54-67783c63157f", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642690428, "uuid": "5c28682a-7333-4388-a04f-a9685305d496", "value": 145540, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642690428, "uuid": "f0de8f40-dcd5-42e5-985a-a96a07c23401", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690428, "uuid": "c1b5cd84-dccc-4f9d-af9f-f95e19782df7", "value": "097357825070328333.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdd6f87-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674951, "uuid": "2a0bf708-e20d-47ee-be81-9d5a744ab518", "comment": "Malware payload (Mirai)", "value": "6eb56a4bb87735a1c6b79c6d8d0a6f7c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674951, "uuid": "e93f1f74-57b9-4141-b99f-c8ec25158f04", "comment": "Malware payload (Mirai)", "value": "eb6c936f0ee7704a99be4f7b1907de98cd778ae7a0b9a8d051d2e33679141ae7", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674951, "uuid": "82251901-221a-409c-bc22-784860a6abe4", "comment": "Malware payload (Mirai)", "value": "0c278401f862757a82d21cf5a1fe615119241a75", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674951, "uuid": "765e83bb-175c-46c4-92cb-4e6eba4dc6c5", "comment": "Malware payload (Mirai)", "value": "cedb2d94157981194040faff44f0bff3370d17ddff12ecb07887c4957c43fc3860d5e15ce48e8d63af418872d8b0f9cc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674951, "uuid": "bf46f4e4-4b98-4bed-8e50-34f2df84498b", "value": "T1E3C3842E7E12BBBEE668863107F35F70879521D237A19382F26CD6181E7128D1C5FB64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674951, "uuid": "23ff7217-d2a8-4d74-9559-6c70ae354650", "value": "1536:g7je1TYGq+f+A02rKXzeve1eTe8p2rKXIeum9Y0GAzQj1l72HBeGERLWfRZrmW+i:/a1UW0MZQH8B6RZrmW+IFB1Dt1hR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674951, "uuid": "69c8b50d-3c66-45c2-9899-e82be0b5a520", "value": 125962, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674951, "uuid": "19681d95-2fa4-4b0c-9f7f-de957dc1460b", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674951, "uuid": "7013c3c3-9d40-436b-a208-cdf29f7aab50", "value": "m-i.p-s.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "394d7af8-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666569, "uuid": "c972b7c5-093d-41eb-8292-226d4b97c17c", "comment": "Malware payload", "value": "d8fa458192539d848ee7bb171ebed6bd", "object_relation": "md5", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666569, "uuid": "ae4dcf06-6ab6-485d-9347-3b74553106f8", "comment": "Malware payload", "value": "ebadb19c6ab42eb54e57a4d31682f7918630312e9ba77cbebe4efcf046312695", "object_relation": "sha256", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666569, "uuid": "41850c72-9a00-4461-bce1-f28782fe0af0", "comment": "Malware payload", "value": "274ba78aa80b06cf3fd3a17c7f081aa96da4bb4d", "object_relation": "sha1", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666569, "uuid": "5b730d4c-bf26-4e1e-87c8-95035a9b0fb0", "comment": "Malware payload", "value": "1287e90371e0e44eda531466a4da4a454784b559cffec30538a9db72014c5254c6aefb42b885651ce8fb7a41a72d52ea", "object_relation": "sha3-384", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666569, "uuid": "9247f67b-3c2e-49d9-be56-0cc26ce44597", "value": "T1CF0523AD3018324EC65CC8953A68F178F9193B6E141DDA473A61C2826F972CB12FBDF5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666569, "uuid": "8983b3df-b5fa-446b-8d6d-8ea0201a838e", "value": "24576:b+bwISQTxvSSdtME42gNNTvOr0IXA2hlmZJROO:b+dSQTxvS+uE42GNTvOre2hgjR/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666569, "uuid": "1295516e-e599-4b97-8597-a3054807c6ba", "value": 804891, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666569, "uuid": "59469ce6-1dff-46b6-a7c7-c37bf5ddbb0d", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666569, "uuid": "08af439c-33ea-479e-932b-6b1e2f4d04db", "value": "GiftProducts.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7874e57f-79bd-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642661521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661521, "uuid": "8de909ac-e18a-48db-9e52-f8ea54e8ca85", "comment": "Malware payload (RedLineStealer)", "value": "bcdbdc5537d5e526534bde333cec9859", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661521, "uuid": "8ac579e8-c91c-4fc0-8c90-132c994f8618", "comment": "Malware payload (RedLineStealer)", "value": "ebcd87682a64fc4d285a4ea0ff59ec860cfb6ba19c8d2e165b5fe69ca3adbbc5", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661521, "uuid": "4c3253d8-7b00-4f4f-b9dc-fbef1273d5eb", "comment": "Malware payload (RedLineStealer)", "value": "e119ea982571e06ac9690254b103efcb999691e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642661521, "uuid": "59079be2-3827-47af-a2b6-608c4d858bda", "comment": "Malware payload (RedLineStealer)", "value": "8372ecf7aa374a3527299ae6765a96e29b1809961d38becf4f9aac269ef0d66b53adfda9b9997d0eeae74d490b98b282", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661521, "uuid": "da1233c8-f83f-4c6a-9992-8e00a3ff34c6", "value": "T1B684E0327580D433C4865A308466CFA01ABDBC712A6D4643F3AC3B6DAF626F1657A71F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661521, "uuid": "6a59ba48-1545-414a-a408-3ed1f7b917ec", "value": "140966036910a5f510e2a5a7cba50e06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661521, "uuid": "cf5b05cc-fcb1-4f91-b3d8-302300bb432c", "value": "6144:bQRLpc2YP6u2pxdgtN5XEe8q9WKjgzoEQlTn:0u2YP5cWP6e/CoHN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642661521, "uuid": "f39770b2-156c-4058-b472-1be289d818c4", "value": 404992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642661521, "uuid": "6250ef56-1fb3-4a6b-9708-daec549bd254", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642661521, "uuid": "40918336-edf2-4874-958e-87d76e8944b8", "value": "bcdbdc5537d5e526534bde333cec9859.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb532136-7a01-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1642690947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690947, "uuid": "4679a563-1f91-4f1c-a1c8-dfe4a73e2a1e", "comment": "Malware payload (SilentBuilder)", "value": "931115c61b4d94a11d75fe201059e1a3", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690947, "uuid": "7c6165c3-7e54-4db3-b1a6-d68e928af2f9", "comment": "Malware payload (SilentBuilder)", "value": "ec7b717fed554ec4124d956ab43c4ec1f2c66cc692ed85b9956bdaf9c4914085", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690947, "uuid": "641f41a8-52b4-4c6f-af89-00e2dfe0624b", "comment": "Malware payload (SilentBuilder)", "value": "8a9f86bb55f2d56621d3554de60f9bdd44a561bc", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690947, "uuid": "842477da-05f1-41e9-b306-88e1a3243f2f", "comment": "Malware payload (SilentBuilder)", "value": "d04fb453af5c7736d5f24809a63fbeb5603e8c273f9c82fdcefb8bc973ba987d0ff1e43b3b7986823773ba83275b3193", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690947, "uuid": "fef89259-18ab-4f14-9a92-fc97c8545506", "value": "T10AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690947, "uuid": "5d02706b-0b71-4cdb-a903-4b71e81b11f7", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642690947, "uuid": "6f24afba-6b4f-46c9-9489-79f8e9dff0d1", "value": 146211, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642690947, "uuid": "08d1e733-454c-4b02-bea5-629b2af4b530", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690947, "uuid": "4516c06c-603b-4c71-8a60-0a52ef2f2b75", "value": "931115c61b4d94a11d75fe201059e1a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7c57316-79f1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642683935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683935, "uuid": "3f2f6f75-f58d-498f-8fbf-9a30b6dbb597", "comment": "Malware payload", "value": "2486b4e371ea32c5df24f703bded4891", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683935, "uuid": "95fbcc09-a6c9-4769-bb70-e317ea2494d4", "comment": "Malware payload", "value": "ed5f595d2ca9c27ebd9a0b61d60bf37588fe6f3d52a1d242d7c77e7dca2ff434", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683935, "uuid": "2dac49d5-72a9-4c98-8d20-e3946ff9268d", "comment": "Malware payload", "value": "1f5d9107a3676c1b3a4ff6da26cb0552bd24148d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683935, "uuid": "9f58408e-248c-47ca-b43e-6e26ddc2f09b", "comment": "Malware payload", "value": "cf1ae41369ad1aa4c15bff09ee8c8240266359e8d3a3837a917e282140fe4e55f63352363836bf3451453af5a71461f6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683935, "uuid": "cc05529b-3feb-4783-ad6a-2520779839c4", "value": "T12326331EAD5F20F1EB92F6777ABE609ACE73250793FA5117034925DEC3862912C8F109", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683935, "uuid": "8e7ca9f9-e0b8-4bb9-97a7-fc2d5f7f61c9", "value": "b8ba55866bfe7b49b97c43084c1885db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683935, "uuid": "de058740-929e-4d70-9c4e-b2f28cf102cb", "value": "98304:MOZ6wq/DHyRc/UJ/Kq9X1MwKlLsNQ93rm5sebiotdE:MOZ6f/j419f6LlZdCLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642683935, "uuid": "2d572c00-b0c7-491a-984a-9b0d9510a304", "value": 4802015, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642683935, "uuid": "13050a51-4a1d-4f76-bb05-364c768d4b05", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683935, "uuid": "171d050b-e436-4867-af99-327db712e688", "value": "2486b4e371ea32c5df24f703bded4891.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcaeb91a-79c1-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642663354, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663354, "uuid": "7d8d3fac-dcaa-42a1-953b-793d8f6186e2", "comment": "Malware payload (RedLineStealer)", "value": "fdfac6c35560bad83adfeda7bb5e024a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663354, "uuid": "1c847d24-0356-4e1b-b613-4c77e4e591d1", "comment": "Malware payload (RedLineStealer)", "value": "ed699fa052ccc691ef9bd36b034dbb76a83a0f3d6aa1a4a1456e781b46292015", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663354, "uuid": "47a7e050-c26d-426b-bdcd-1539c44490a9", "comment": "Malware payload (RedLineStealer)", "value": "40a725c8a882cfe46a9a83c6d0339b3b4cce3d5b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663354, "uuid": "e162ad51-ec7a-4e51-aa80-842573384abb", "comment": "Malware payload (RedLineStealer)", "value": "3d8bd2abc909fff7cb92761e0040ab1fb8f12c5549d69aff00d0eb6d558bc9ad25facfeb58d65acfec8c4eabddb21505", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663354, "uuid": "54fce2e5-1b51-438d-8a84-ae5180c25b34", "value": "T16584E0317580E833C0865A304825CFE05DBDBC7019A51A87B7A9FB6EAE722D2527735F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663354, "uuid": "effdde23-583d-4793-bb93-8f276cc8ebf7", "value": "125adc129c50285a2cd4524417d3fdd8", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663354, "uuid": "97979406-30f4-4d79-a73f-0d972d264a33", "value": "6144:mctHLfa2YowevMX1hqt3TUZTRpp8zaVtSSsAyQWl:mc1+2YoDvMX1Io9RpphtSSsJl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663354, "uuid": "a46b10aa-270c-4e86-a27c-29fea7198e05", "value": 405504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663354, "uuid": "43ff1677-abd9-47b8-92f8-8a78b5c077a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663354, "uuid": "81c11e80-7266-4e1f-acaa-588283c4eb18", "value": "fdfac6c35560bad83adfeda7bb5e024a.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9918e76-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674945, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674945, "uuid": "c3f2d4d2-bd63-4ce6-afa9-777c10291204", "comment": "Malware payload (Mirai)", "value": "2df95f631975996d840b9c418ac6f024", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674945, "uuid": "2c24de68-70d3-474f-8d88-ca84c02df13a", "comment": "Malware payload (Mirai)", "value": "edb41ba396207e61305939b08f7f513b45f2296aa9a84f20224184dd6431d8be", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674945, "uuid": "31a37c95-91cf-4055-a999-958e35713fb9", "comment": "Malware payload (Mirai)", "value": "705221336feb3e7d19b6da6a545ea0f5cb7fea7b", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674945, "uuid": "c59c8ef7-3d32-4bb5-80c3-4e14db0bfa6e", "comment": "Malware payload (Mirai)", "value": "784f02c00903ea30b5146a7e4f3e7c549f7e9dcd443ce5f2c9c7bc47b06c284d85117a594646c439c797de025aafcb59", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674945, "uuid": "98b15250-3a33-4365-9956-e5521d5ae7ea", "value": "T127F33A05E6408B17C1E2277AE6CF824D33339B94A3DB33159938ABF43FC27995E26915", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674945, "uuid": "eea86265-aeec-4072-a01f-fa259cb0487d", "value": "3072:f1g2iIFdVzqKA7Y6ISag0/RUqnyLRM/9lzNmFwfBxKQodn:tg2VFdVzBA7fISaneqnydM/9/mFwfBxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674945, "uuid": "a1c88ab8-dbd6-4995-bb70-dc087462a8cc", "value": 159896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674945, "uuid": "2447526e-4130-4e02-b1dc-d24cdbfba8b5", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674945, "uuid": "693f0406-0971-4b19-877f-0b3520cc4ad3", "value": "m-6.8-k.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05e79826-7a02-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642690964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690964, "uuid": "bd0c3553-a533-4ae6-af7e-a43e5090fe47", "comment": "Malware payload (Heodo)", "value": "81f0a7a1ad8bf108c2648af767e77fcd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690964, "uuid": "497829b8-581e-445a-8223-8aaa46c25209", "comment": "Malware payload (Heodo)", "value": "edefd18d0580d8d25297bcddc843c3478c20f650b124224460ca9ae267529878", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690964, "uuid": "6389c0e0-0de2-49e2-9736-6756607899ef", "comment": "Malware payload (Heodo)", "value": "9575d97617b4d5b9c22f5d2a0fbfbd3de1ad3de4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690964, "uuid": "4e2b725e-e79d-4b35-b749-27d0ee045548", "comment": "Malware payload (Heodo)", "value": "16f95ceacee40aa5a594e0d167f315302475340a07a85b5faa09c2d3e9f21853802d1b63034998da4f8504d44e20aa63", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690964, "uuid": "affbda8c-e899-41c1-b011-3f1d4909c6b8", "value": "T1DEE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690964, "uuid": "0631d09c-15a0-4389-b462-741a22e84da0", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642690964, "uuid": "260daae4-134a-44c6-a5c7-213783805f4b", "value": 145479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642690964, "uuid": "718befc7-78b5-4e2a-b568-28e47747a598", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690964, "uuid": "52154051-39e9-4de9-95c5-0f286f7f2c19", "value": "81f0a7a1ad8bf108c2648af767e77fcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98269433-7a06-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642692928, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692928, "uuid": "76b76800-eb3f-4ae1-8ba0-045517e34ca3", "comment": "Malware payload (Heodo)", "value": "740c3a1122de26f6c318e1a14c0b44cf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692928, "uuid": "63000561-d575-4127-8195-eac1679e7f58", "comment": "Malware payload (Heodo)", "value": "ee212ba040e6857e56a3e2e8be38c52d0501f8a315b6c9599c63aa1490cd5ac3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692928, "uuid": "69fb259c-55c0-4f1f-b9ff-eb779e91b592", "comment": "Malware payload (Heodo)", "value": "35f1fc2bd5b76ba2510f23efa6002e94415fb035", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692928, "uuid": "caab8122-db45-424d-845b-3a3fab89f8fe", "comment": "Malware payload (Heodo)", "value": "8f2a9c5b14eb0f0167d9e2b57b8eebbc8beeb7ef97389d3047072e53495f256782cf48318c5c6ed892ef88afa4e9bbc8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692928, "uuid": "3d0eb7b7-8aef-4660-9a03-230cd7943c53", "value": "T14AE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692928, "uuid": "1892bef3-a714-4b78-8691-4627db063866", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642692928, "uuid": "458eb220-e476-4393-91ea-db6cf65407bc", "value": 146358, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642692928, "uuid": "69543a4b-7998-45f3-8f07-e6cd69286431", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692928, "uuid": "3301b313-6ad2-448a-a13f-a7a92d6ee68f", "value": "740c3a1122de26f6c318e1a14c0b44cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a44b504-7a19-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642700984, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700984, "uuid": "0f012ff1-0847-467c-9ec2-37b38c4080ca", "comment": "Malware payload (Heodo)", "value": "f32c33d6e014f38bebbea3f0aa4e5bd7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700984, "uuid": "7b4eb5a1-39df-4c56-9e46-c7bcd4999f29", "comment": "Malware payload (Heodo)", "value": "ef652aef2549e1e0337141515b14928db5627d9d942201e9d99089edc0082b0d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700984, "uuid": "107fcd67-9f0f-4378-aad0-d21da4108196", "comment": "Malware payload (Heodo)", "value": "9d680f78a68752b8fb15117be0f11723c0cf2a02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642700984, "uuid": "e8112748-42e1-4642-8e2e-1369f9454ee8", "comment": "Malware payload (Heodo)", "value": "1182721562d9cdf0719368ee0c3ef90a79f30ff7a746d6f605e3c89ded91b76550fc356474bbad330f833c64a03f4497", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700984, "uuid": "802b1381-c3e4-41f3-a2fe-1995d5b8f81d", "value": "T12BC4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700984, "uuid": "6e7cadf5-64f0-47f0-afe9-0561a4dda185", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700984, "uuid": "d9ddb9bb-71c8-4c42-b41f-31215530c8be", "value": "12288:P78OGF+L8/4UUNyrqdMhTq/n4vAzdkPs7:D8Ody4aqdbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642700984, "uuid": "aa7c9433-4bc7-48a5-b2a9-d05fae5984c1", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642700984, "uuid": "899e56af-224b-4a09-b693-b5268d724113", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642700984, "uuid": "a3ec3920-f353-4279-a230-25ec577160be", "value": "f32c33d6e014f38bebbea3f0aa4e5bd7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03091d0f-79e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642676786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676786, "uuid": "2b4f0782-4f27-4599-96fe-d007831fff28", "comment": "Malware payload (Formbook)", "value": "aefc9702ff5d6d9064ec8e5ea82e4870", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676786, "uuid": "e821f0d3-69c1-442d-b315-62ec956ebcc1", "comment": "Malware payload (Formbook)", "value": "ef986fa9ac50432d1fc1be8e0ace872cbf28cf51d967d6d35647aa3f77acf94e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676786, "uuid": "ae5a3e3c-d781-4cb0-b8cf-7b93f03d6ea9", "comment": "Malware payload (Formbook)", "value": "716ad70dc07a6b7d3c46209de8627bf3f3535361", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676786, "uuid": "95305a40-0484-4330-ab1f-634b48f55f8b", "comment": "Malware payload (Formbook)", "value": "c4557c5f4862e540da4e0ffbaf7cf483060a909f9b9f67faee3634c751260d2a3163eeb3a11ac67018748fd30751f225", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676786, "uuid": "50cca781-c52b-427e-a6a3-09f5a2ceecd0", "value": "T1CF54126B6AC5C817C22712780E369234577AF3233B13086B87D85F677A513D78A9D2D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676786, "uuid": "afe3aafb-b178-4647-b7b8-d37aac5df2c7", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676786, "uuid": "24c7e220-f9cd-4708-ba9e-a618f9e1da1a", "value": "6144:owhC2vv8n3uVdvsbCsO++T0c+i/ibsqolR6ckj4sv2kfHhEZqh:Q2s3L7+TGxbsqoX6ckj4JMh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676786, "uuid": "aa6dd83c-fcd0-4a77-9c88-d91196e0a11e", "value": 304451, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676786, "uuid": "93f0ec5d-7259-4e9d-b818-2e49c65b24e5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676786, "uuid": "1d32199b-e481-4ea1-8853-d176213522fa", "value": "SKM-973116391_PDF.pif", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57ea223-79d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642672388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672388, "uuid": "429f7bc8-1d35-4102-9614-38dbc3ddc014", "comment": "Malware payload (Mirai)", "value": "c08e8ad8e5a3e4e2bef2765325c3c17b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672388, "uuid": "ee2ccbab-4a50-4444-b574-da5dd26b8b89", "comment": "Malware payload (Mirai)", "value": "f0187fe208d1f121f9d09be447e415cec1f27f789d632fdcf760e78fe26dd097", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672388, "uuid": "c0e589c9-2ae9-4e6c-976c-c12e34374bfa", "comment": "Malware payload (Mirai)", "value": "8eb4970bfb8173b32688f2265694de2a026609ae", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672388, "uuid": "7cc95cd6-42f1-4ac7-a854-17b4d55420c0", "comment": "Malware payload (Mirai)", "value": "33d751d69020422a5d2937b11614103fba59db330fc7e40fff2d50e6ab4a998d6eb516bcaae4726b288f011f3fab890c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672388, "uuid": "51868730-c490-4fc2-ba53-a56bc51b2a34", "value": "T1FF544132E74185B2F1180CF134667794ADD6877B9C2A1AC3E65E49B5FF3280A01F6EE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672388, "uuid": "8b4b578e-020a-45e6-8d14-1c3b9c8ab2c3", "value": "6144:RGFPgE1cQjWOMXdZCSpn0UpQKqUgAZ08MjUyDmmFVcqq0GnDZT:CPx1bXjRDmmFVcqq0GnDZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672388, "uuid": "514e8792-2864-46c2-83ef-f18369b2cba9", "value": 284389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672388, "uuid": "0f614fc1-e3f7-48ae-a031-44880dcf1f7e", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672388, "uuid": "a70f07c8-701d-49f5-bc1b-d56f7ec67118", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "560d7b52-7a45-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642719875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642719875, "uuid": "b4de420b-74cf-466f-a331-8078f4f0f5fb", "comment": "Malware payload", "value": "ef8d87099d9cd8f996f887e282572845", "object_relation": "md5", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642719875, "uuid": "897b4fc5-2fe1-4aa7-b45a-f8b58e867855", "comment": "Malware payload", "value": "f0589b8808bb3a0c95faf63a4ce880ec2494cc4a88cd487d509bc8fc78b24123", "object_relation": "sha256", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642719875, "uuid": "67ec7584-2639-431c-801a-32dc6cd07827", "comment": "Malware payload", "value": "bf244ba90c503ee3d4467d7cbb97995b3aac2439", "object_relation": "sha1", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642719875, "uuid": "0140920d-3094-4505-9580-18476bb5c600", "comment": "Malware payload", "value": "cfbc3d683265221590ca54bdae0091acff2c5962d9c50d3cc4a0303651e671cd58583d954677442ee9c0089876cc4b8f", "object_relation": "sha3-384", "Tag": [ { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642719875, "uuid": "77b8c63b-5dac-4721-96f5-0938d0a747a7", "value": "T19E636CA7B78299EADA0483394DB643C5B717EC104F9A43C73694F7346EB49F08D9324A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642719875, "uuid": "1ba7cacd-2583-41a2-99c8-3ed2871a3ab7", "value": "1536:bpEk3hbdlylKsgqopeJBWhZFGkE+cL2NdA8eXZiozeOgXVZKyaZpvyR1kZkJvU+:bCk3hbdlylKsgqopeJBWhZFGkE+cL2Nr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642719875, "uuid": "fb3aea62-3428-4616-911a-02e040d7a2cd", "value": 71970, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642719875, "uuid": "54301904-7c8e-4f5e-b837-b5009efee576", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642719875, "uuid": "2c54da36-834e-431e-99b8-ec5059aa2e23", "value": "ef8d87099d9cd8f996f887e282572845", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93c356f7-7a06-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642692920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692920, "uuid": "34ac4d36-a037-4bae-bc14-f048f2f31592", "comment": "Malware payload", "value": "f43a30b1cd1fbe69a2a7ad2ae4a9a70f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "moonbounce", "colour": "#3A5BE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692920, "uuid": "7380ad43-b740-4199-86ee-c93511433002", "comment": "Malware payload", "value": "f0b6c73ee9bd2cee5b0ef10f65386ad1312f01227551cc99ef9997df2372d272", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "moonbounce", "colour": "#3A5BE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692920, "uuid": "eb008cef-e712-4655-a31b-22b377fda8df", "comment": "Malware payload", "value": "0571abe5132604dc55a398c1ae00c95b8955b7e7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "moonbounce", "colour": "#3A5BE6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692920, "uuid": "18f7daf3-5591-475c-98cd-c2519868e241", "comment": "Malware payload", "value": "29a57b5d33aa08ecc8dca9c00315d7dbd081406bf1c22cfbe6636d5cf9841955d3be96ead4f1ab067576e219672cb277", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "moonbounce", "colour": "#3A5BE6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692920, "uuid": "248e257d-06cc-4818-a66d-166083d7ced1", "value": "T1AA64AE04B3B98072D1AA4B7449279E31B53BF940D7F4925A3F8CD6AEAF523409A34377", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692920, "uuid": "064a1bbf-53a8-4c54-8820-5cc385b6a330", "value": "c4e6282ffd1ffa097fd4cb2b076f2dae", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692920, "uuid": "0e14d570-4a23-4ccd-9c1f-dcecd0bbd668", "value": "1536:i3jMcAxNrQu/vX8vSjZPXYacSkksIMLez3:UYciJMvePC6z3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642692920, "uuid": "48973ba0-45de-49f3-ae9a-476440b25ce2", "value": 320272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642692920, "uuid": "86df0e0c-bf64-4d83-bdac-97df80c1d37e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692920, "uuid": "577ab8fd-b207-4b2a-bff1-17417763adbd", "value": "f0b6c73ee9bd2cee5b0ef10f65386ad1312f01227551cc99ef9997df2372d272", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8b6695d-7a3d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642716712, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716712, "uuid": "9935c139-5cae-4125-8c25-70463d6a770f", "comment": "Malware payload", "value": "8587d207b72b7b6942ca0eccc143867e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716712, "uuid": "8ad30b08-b4fb-412d-a578-4a47321c683c", "comment": "Malware payload", "value": "f0e17800999abe79c1a0fea6d899b33133ab7f15b3c685459f9c4f30b03363b7", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716712, "uuid": "72993f53-5700-4e54-8c90-1c477356f815", "comment": "Malware payload", "value": "ac3a041dafec80152a30bfcfb6bc899d973050a6", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642716712, "uuid": "d991090f-d800-401e-b626-9e726559da7b", "comment": "Malware payload", "value": "a01fa539591f5bbd22cec9f88825be42f598549fe9fb62beea9122fc16092e806568d08a1ab07512ab5174ce3dbab16a", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716712, "uuid": "0f513d5f-1545-43d4-9867-4d891542ec64", "value": "T1CB41D8027BF8050CF1F36B829BBBA4704E3AFD754628D94D1649561E0DF2B494862F73", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716712, "uuid": "1893774a-e2e5-4bd2-a8a0-28fc81ee4b3d", "value": "48:obSbUVANlnV7JgtfWJ1hjsUBHKooF2vmV62DOPDgbVKy173RjhchU+v54mWxFfk4:obSbUVANlnVVgtfG1hjsuHKoosXUOrgl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642716712, "uuid": "5f960c4a-3769-497f-861c-7014be34becd", "value": 2028, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642716712, "uuid": "d10302cd-ae1c-44c4-a009-63ee6e1de343", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642716712, "uuid": "4dfc3174-f225-48ac-bc15-f46aeec2a8e7", "value": "irpdxpwr.ps1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1f1353a-79cc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642668114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668114, "uuid": "50266e61-4468-43c5-8cc2-0a75b1e2e457", "comment": "Malware payload (AgentTesla)", "value": "fd06b5dc5c376345737ac45639e22ad2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668114, "uuid": "3f86a667-d35b-40c5-8734-4cdd27514fe8", "comment": "Malware payload (AgentTesla)", "value": "f107328838d13ba85a74bd505c943daec0b0a226c800ae7d4107ef81cbee8215", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668114, "uuid": "308f3c24-cf71-49a1-8933-62d095939d3b", "comment": "Malware payload (AgentTesla)", "value": "870b2dad9f2532b6f355737a0094e45534276092", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642668114, "uuid": "83d48e2a-39d6-4a60-8952-bcf7b3bace7d", "comment": "Malware payload (AgentTesla)", "value": "718c45d32dc1f709a221734d517d450493b90e2536abba98fc1324ef3a5fc544a262872fd4caf74b5a4f7ddc584260d6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668114, "uuid": "56da5cc4-1d81-4d63-b551-963b5d7c3c4c", "value": "T10C44128A6351C6E9C4310AF2ED4FC7E09B750D919C5286E7B9A0BFBF3F331189641266", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668114, "uuid": "5c43d622-956a-46a6-bfc7-7274534384e8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668114, "uuid": "fb7bcf6b-48f5-41aa-b67e-c7fc3fb9fe9d", "value": "3072:7F9NW4JCtsulCxwh81znndePWAWyPlG4dWJva0fMGR0zN6ahkcPlAEw0p7Tu8PSL:5Mtsjwh0nde+gQJv1k11w0p7T1qe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642668114, "uuid": "cc8f7902-6dab-4e77-b6f2-b234b10972e3", "value": 259072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642668114, "uuid": "0fcd0f8f-e741-4a83-865e-154338bddf03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642668114, "uuid": "dd0dc966-b183-409a-bc7f-0db5404ed0d7", "value": "Pesan produk .doc.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16923148-79d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642670806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670806, "uuid": "470b9323-59a2-465b-b84e-4a3051b6b9bd", "comment": "Malware payload (Mirai)", "value": "31745aa0036c2ddb33368adcae5e431c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670806, "uuid": "f361e298-a515-411c-9ed0-170fce00f42a", "comment": "Malware payload (Mirai)", "value": "f1836e0c6a0b3e7beee9493b35bd601b802b1541ad5bd5d592c33a79abf5cb59", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670806, "uuid": "7a4d4b3c-acb5-48f6-b30c-214318d15b55", "comment": "Malware payload (Mirai)", "value": "2adf5b06fe33ee0a88b7f23d37f81089904a8637", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670806, "uuid": "c0a23d6e-b066-41e5-8af3-64661e8769c7", "comment": "Malware payload (Mirai)", "value": "7f06128439b9afc151f0f40bb841ed54cc2716a606fe9f5c642ea36aebd243d737172058c046c1f649b7ece4dc1e14d7", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670806, "uuid": "a7534000-89fa-48a8-92e7-184b2731e262", "value": "T10CA30731A641C973D14305F211A7DB620D32FEBB1A6AAA96E36D3CB0DE360C1B561E5C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670806, "uuid": "e2dbeeb0-e28d-4283-8690-99da63508fe1", "value": "3072:gjtwgA6UlYzZveohR9kIEFfdGZmmFVcqq0G27ZT:gjhzt3mIEFfAmmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642670806, "uuid": "d7b2fc14-9476-4f5c-8709-53b66108325c", "value": 100267, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642670806, "uuid": "e24b0ec1-4381-450f-8731-16e0bd51e70f", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670806, "uuid": "bc864e40-1ebe-4960-be71-60fa575a03f4", "value": "i586", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfda8781-7a37-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642714093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "d5a1d93f-9d1f-4098-9a15-25088e8e8d9a", "comment": "Malware payload", "value": "4f0616e55da06d0db5fa7aa4d1b2f193", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "2ce70fe5-bd8e-4df3-bd73-a95be7ec7ea0", "comment": "Malware payload", "value": "f2897b4cb599993a1245ae4689eec351064df7c725bcbe5c1453210a263597f9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "117dce42-5bba-444d-b134-f7cc401dd104", "comment": "Malware payload", "value": "2b60dcbce708bd519b37238501130765ad439ecf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "816105fb-97a9-41eb-94c0-51f6a1de37c8", "comment": "Malware payload", "value": "98ea90b6132380e4059e9dc63f6acf132b9234314faa14bd85d2a84c8edc93e13a6040859846d367d03458542bc1a62b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "161c94fb-d38e-4d0b-90e9-4428f90fa3e4", "value": "T169D4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "fdae745f-bf77-4b28-9e5a-2200a35ba713", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "414b783e-e75a-4324-9a81-75d4a927c5e3", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NhG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYDvVnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642714093, "uuid": "e3da9967-7c92-427d-9cde-e9e3d3dbad84", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642714093, "uuid": "dc159c49-3534-436c-858b-809e8ec48ac6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "4613dd65-eb64-4fdc-bc38-8447778497f2", "value": "emotet_exe_e4_f2897b4cb599993a1245ae4689eec351064df7c725bcbe5c1453210a263597f9_2022-01-20__212805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21d9a6d-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1642666343, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666343, "uuid": "f6d9c981-e0a9-463e-9144-cd6416b005d5", "comment": "Malware payload (SnakeKeylogger)", "value": "5e3492467638f1b58b450d6cd316744c", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666343, "uuid": "61a1931b-de0e-4db0-8dad-f6b778720544", "comment": "Malware payload (SnakeKeylogger)", "value": "f2a224c514f49ca2f17c6aee38fdf8d61516ff9f68dd3d335b3e5850c6b5a8e1", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666343, "uuid": "96c72c67-d7b3-4103-a022-98cfdfb5afd4", "comment": "Malware payload (SnakeKeylogger)", "value": "eb3289c5d981c7bdb1166eb647115ba0536f8b07", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666343, "uuid": "c2da8e54-777f-4918-ad71-8c8dedcbd570", "comment": "Malware payload (SnakeKeylogger)", "value": "9c3302c12524b76ab3017b7561e595e11f0f496c6e8d072d0dec78de1a96a20cac5c93686efce093e54e2b111f03bf72", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666343, "uuid": "25f419d1-4c39-4de7-bba0-94ecf5979872", "value": "T1B67401147BFA2B5DD9FE87F4B170011057B9395A2622C34D0D4E60DE29B6FC28692B3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666343, "uuid": "a34570e6-b6bc-4b5f-b77c-2717abca4fb2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666343, "uuid": "b00afef1-f50a-45a8-b1b2-650090b8a074", "value": "6144:pEVtrtLF33kzUJ/qUd53rUWDLcAMcCi5RKJcHLIdBxhT8TZkPEizPeAD3W7OwgK1:W3RsUJC853goMhiiJgIBRZz5DmlgMs0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666343, "uuid": "200872c4-3afa-435f-8ef3-64317b015e08", "value": 360160, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666343, "uuid": "8be8ab67-249c-492e-81f2-04a621f320bb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666343, "uuid": "f6713ac4-544e-421b-87c8-61defb94a000", "value": "DHL AWB#68625.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11524f19-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642665643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665643, "uuid": "b1d77889-80f3-4956-927c-87de2d57ddd8", "comment": "Malware payload", "value": "855d73376265c7a53b4b1ae4e19b5d71", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665643, "uuid": "6cec8428-1c99-4e46-b1dd-d3cba2512c50", "comment": "Malware payload", "value": "f2bfc1267af0c1a6d465c7ef9f8f659db84b9cf1b745bba9c4f601a14ad8df60", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665643, "uuid": "64a0c372-c64c-475a-abe9-c7c1324a40de", "comment": "Malware payload", "value": "81a0dba75a0ced872f9cfa8604056857c5bbf8e7", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665643, "uuid": "59421646-4f82-450c-a76b-f7043a2f73bb", "comment": "Malware payload", "value": "3d1bad6e5c471832bc586164b14a43d8519e4aa429ce7ee93f3351b2213a1f6f572d5deb5b0e7fb8b3ffb1c31ca6e2dd", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665643, "uuid": "f69d29e8-e276-4ba8-b5b3-08602608ee8b", "value": "T1B0B56D22F2C1C537D0732A3CCD5BA3A89539BD501E28954B7BE82E4C5F397817D2A297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665643, "uuid": "67297809-d591-4c97-bddf-e4bb7f9404b3", "value": "49152:pOyInKrJ+BVKoKgOtehmlzJH+TPUNZ39OYTEA:FInKrJIKo1Ieh814iOY4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665643, "uuid": "97094998-ce82-405f-9227-41f18ca70b6d", "value": 2432512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665643, "uuid": "7213e634-d2e3-4341-aaed-f4aea38e50da", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665643, "uuid": "32efa62d-dded-456a-afc7-8cfd1e8a37d0", "value": "Contrato_owkg721004.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0ed96f0-7a00-11ec-9275-42010a9c0029", "comment": "Malware payload (BitRAT)", "timestamp": 1642690392, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690392, "uuid": "a51fff7d-8893-47ab-a349-e91ca21e2380", "comment": "Malware payload (BitRAT)", "value": "37f9dc388fedc16b308acaadc34c2054", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690392, "uuid": "2bf6a5e2-dac1-4286-aa39-2b9960f863f5", "comment": "Malware payload (BitRAT)", "value": "f30cba9be2a7cf581939e7e7b958d5e0554265a685b3473947bf2c26679995d3", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690392, "uuid": "5829131e-1124-45aa-a002-99ed9a50d61b", "comment": "Malware payload (BitRAT)", "value": "25c936c0b399b82ad39363f6237fd5db13369bda", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690392, "uuid": "44055040-a69d-4e2f-831e-94e17e1f6fd4", "comment": "Malware payload (BitRAT)", "value": "2750dc4b4a01b53ee623fd253d6971a296460bf9259b0cf3a41f85fd5ac52df878ed9d16056f9a09df03fcd361b56026", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "hta", "colour": "#0DC599", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690392, "uuid": "3d161c70-fa18-484b-b665-f21a896243f8", "value": "T18D610D5DECA10A0CD226F437FA1AF3E4D3C55DA35269B8E41E9E7080626CA6DE44F5C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690392, "uuid": "3c6a2914-c446-451c-ad15-b5d57425ad1c", "value": "96:oadh1XsgdPeJdPxdP8dPudP/QdPfGj7dP2zRk/dPKQqdPgwj1P9SEnfcqjCUpYNE:oadhZsgdPmdPxdP8dPudP/QdPfKdP2y8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642690392, "uuid": "b221e4e1-6ef1-4d4a-91a4-b31ff9d84303", "value": 3450, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642690392, "uuid": "387350df-2d4c-4434-b125-39071ee007cc", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690392, "uuid": "650d4d57-abff-4ec7-845f-2111a8fba071", "value": "PS1.hta", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0f43d73a-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666069, "uuid": "e5250d64-f43e-46c3-9db0-ada4e7899d4c", "comment": "Malware payload", "value": "59f150e895a66c4b082f814e775d67b6", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666069, "uuid": "9dee2a7a-babd-413b-9e33-68b0add2ae63", "comment": "Malware payload", "value": "f326585c94c68c1922c2a1628f3aa159f444e9dade785963dfb28df51f97d69d", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666069, "uuid": "3689f975-b5d6-42ed-850e-109410514e0c", "comment": "Malware payload", "value": "cc3e2844a9cd9cb995200e1a67e61f89b32414a4", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666069, "uuid": "90223dab-cd3e-47ac-926f-e5f86ae21e72", "comment": "Malware payload", "value": "d8726eb8be45878572d07004c2f73e587813e2f055ad7559fceafdf15f7a4fff6a70838949d5174d7556f72abc06475d", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666069, "uuid": "373655b4-9d0e-4f35-bd1b-85de70a47011", "value": "T1A2157CDCA940A1EDD865E2797ABA2CDA83E1A71FE04163CD7A4D73015B72B40C3DCA74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666069, "uuid": "73d507e0-379e-43ff-970f-9fdd8b6c7837", "value": "3072:EfZa9ffe9k9ansv1eNspNOg26S62JEqK0k9vHGIFDhxBrwuMkdtKM3vMqaMGDup+:EfZaX9dIxaMqaMGap/Eg5UnaSTBd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666069, "uuid": "3158697e-bad9-47cd-b00f-badf811104b3", "value": 911873, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666069, "uuid": "bfa41eb3-9bf0-4437-9abd-e3ab449de50f", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666069, "uuid": "f498c704-9178-4498-999c-4a82a71ea950", "value": "Proof of payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e5e756f-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708669, "uuid": "39b354fd-ad25-426a-ba1b-5444bf2a5db0", "comment": "Malware payload", "value": "fb091a12d3d01c4687b287f01e4eb431", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708669, "uuid": "03b5fd89-6bb7-45e7-87e7-40f5ca2f1400", "comment": "Malware payload", "value": "f327fe2573f33f82ad94c2741f9959ae37d4a1067555340e0b5eb83f611985fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708669, "uuid": "31b695ee-9c5b-4700-83f2-1504e13fc1da", "comment": "Malware payload", "value": "2135d1042aed497c7661f3f31082396e5ed026e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708669, "uuid": "6797e1ae-123e-48b2-8162-85dad8f03d42", "comment": "Malware payload", "value": "18443c10a84ae26f5521451f8566b4ddf1aea19b00d6c360ff28ab505b56d9fbdc6100f353494d580ebac6d12721b11c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708669, "uuid": "c72c2793-08fa-407d-b1c8-928fa481ac10", "value": "T1EAD272A849E99E41E62D57FC8095500683F820222283F7592FD7F0F17A777B2CD8999F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708669, "uuid": "35a03f5f-4802-46ab-b2e0-8c8a2b4c705d", "value": "384:E6q9BwRPvthehnKdUqVxIfaMJ9QAIGQm9ealcFXRa4fZ4M3ReVYM:E62mRzyLqVxWaMJDIimFzhDRM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708669, "uuid": "52f2ba0e-91b8-4583-99f3-d7101a26a985", "value": 28630, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708669, "uuid": "1b677ac1-c2b6-430e-befd-b38bb97ec71c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708669, "uuid": "14c9e5fc-3780-4a00-8e8c-035fcaa6cda8", "value": "fb091a12d3d01c4687b287f01e4eb431.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8621ba60-79ef-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642683019, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683019, "uuid": "ee69733c-7d42-4603-8ef2-aa9f10a54654", "comment": "Malware payload (Formbook)", "value": "e8a631a5f817a781c79e440512d2c8ac", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683019, "uuid": "51c52a8d-df7f-42b6-b0ab-fdc967dc72b7", "comment": "Malware payload (Formbook)", "value": "f3357b612532add1f2945cc41daf5c8304215d8c8fae2bc3bd8b99ccceed0d4b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683019, "uuid": "12b79c42-ae54-4302-81ab-a44e1d2713a3", "comment": "Malware payload (Formbook)", "value": "67966b6db2c407a048451a71ea747ebc5a8dc2e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642683019, "uuid": "d0badcdf-007d-4d7c-b4c6-beee44cffb02", "comment": "Malware payload (Formbook)", "value": "1b0171eb2b22693b46bd8b544dc80a26fee4801882cbae9d2f0549756038df8c32c405440dd8f5f8e91814783229bb42", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683019, "uuid": "6ef4235f-2baf-464f-8f48-6230039097de", "value": "T19654120331C2ECE7C5A706311BBBE795F2BAF6065AD5256BA76C0FAF6410AC254372C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683019, "uuid": "5e99e68b-f707-407c-a6d9-b9ed6e025b02", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683019, "uuid": "612c1528-38f3-4f7a-b66a-0ce8cbe94cb0", "value": "6144:owkTD3283NLC1ez64mD4qu8JWO8mWV22awm1Cbv3:Y3R3NLCwz69D4nG+RVCwfbv3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642683019, "uuid": "2234c279-749e-4828-8c6b-b6bbdc85caa1", "value": 281744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642683019, "uuid": "590c8ef7-1565-4bb5-9b7f-64df4d1dddfc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642683019, "uuid": "397ac6cc-2c27-43dd-bf5e-d6b3950157e4", "value": "Payment_copy788013612.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a83ebecd-79ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642689948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689948, "uuid": "494cd8f5-e07f-4ba7-8cfa-7a9610e40d50", "comment": "Malware payload (Formbook)", "value": "dbabc716d0d0f38b9d6379b50015b090", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689948, "uuid": "2656de6f-43c2-47c7-b3d0-70ee40ebd035", "comment": "Malware payload (Formbook)", "value": "f35d6b59e5c6b9210397fdb1df7f285d06ac5576378b2dfbcf1fb23627d667c9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689948, "uuid": "2765352c-9fa0-4e15-abcb-ad1c8bc98f04", "comment": "Malware payload (Formbook)", "value": "b9b67f54a644c109538a7b39b014e23401d94f47", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689948, "uuid": "c1b486e0-0c3f-4de3-8c87-68df8c423e3c", "comment": "Malware payload (Formbook)", "value": "742a6216f36548fd8979c629a5bcf999144bfb1f0908c045b2c3f2b4a2d156479d24571006cb55d778879b4d688626f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689948, "uuid": "8eeccd60-5899-426f-afd1-cf18a95e983f", "value": "T18584022477FA332ED5BE87F4B6224208137579463922D71D0D86B0EE0A76F929252B37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689948, "uuid": "875b4014-4e53-4921-ae7d-80f36ce87b4b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689948, "uuid": "f50bca90-81fd-418a-b305-4603a4634a9c", "value": "6144:qaqGlNLF3r2JQe5YZdhxkgXw5fjKlpkRRlLaooaSfdWnK1XydFywcyH18n/yvyc7:FfPhFKLAkRf7AfdU6XdyV8/c5+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689948, "uuid": "a188ec30-a53d-4ed9-a12c-b8f10aec5ac6", "value": 400896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689948, "uuid": "6aaa3d86-1fe8-4ce8-b1cb-f902f7c3d95b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689948, "uuid": "945680d8-93da-47a0-b416-bf9d07f4b210", "value": "Payment Advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb9a1255-79dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642674975, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674975, "uuid": "088e8160-e44e-4ad0-a1c1-6a819f8fd6b4", "comment": "Malware payload (Mirai)", "value": "6b7f1c6d536ccb6c72e575f7761812ae", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674975, "uuid": "cf73d591-21f0-4f53-b8d4-95282bfa81fb", "comment": "Malware payload (Mirai)", "value": "f45a440be6117845360ed0f83f21a5862bd411623fc306b169d5837128c3ff76", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674975, "uuid": "83272b4e-ee98-4d7b-891b-a3572186fe54", "comment": "Malware payload (Mirai)", "value": "aecbb7004fd4e1584c40839550e82b3c68294092", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642674975, "uuid": "1df269a5-ba44-4f23-9528-b1a86502fe59", "comment": "Malware payload (Mirai)", "value": "56d253b246702503e0230986a7c994028ed738f52c89005c62458e139c9b66936ab81655f77b98a80fa881994a819c27", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674975, "uuid": "44b71865-bc02-4cc0-854e-482be84856b4", "value": "T1C3833B01E643C6B3CC8307B2029BAE661931BDAA5E2A9F49F31D7DF4AB128C47116F55", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674975, "uuid": "01dccb02-8431-4d6e-b8de-55d35897946f", "value": "1536:qr5b1ZU4d3J6lreu5r4hWj8LgGDloRmF+wVOz+sXcfW7k:wb1ZU4ZJ6liuq0YMGoRmEwVOz+ucfW7k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642674975, "uuid": "ffd2bf5b-9025-4310-aa8e-54bbd01edc7a", "value": 84999, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642674975, "uuid": "c3abc55a-1c1d-46ee-83e3-19f9556f9bd9", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642674975, "uuid": "a4ce388e-7221-453c-95c9-4b622b932481", "value": "x-3.2-.Sakura", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c368261a-79ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642689994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689994, "uuid": "91eeade9-c102-48a3-953a-3a2bf188c898", "comment": "Malware payload (Heodo)", "value": "d03cfd5461c8746eb20439acaed6c71d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689994, "uuid": "3531625b-708f-4e93-8fff-11c6eddf39eb", "comment": "Malware payload (Heodo)", "value": "f52f03cb94b222c5feffb3c6b07bfebc90c8653f913fe06f27d60a15cd65a9f4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689994, "uuid": "878107bc-18da-458f-95b4-732cfa3baba1", "comment": "Malware payload (Heodo)", "value": "dc5b78cd19245ff529729ff59aeee01742f6e79c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642689994, "uuid": "850f60cd-a744-48a8-b149-b6e8f483ee98", "comment": "Malware payload (Heodo)", "value": "1320f22663fd9b170be661703703e57a89e34ede3836aa01043756fbf68a42a93af63d79b4667daa0ae42b1cbb5ca6a1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689994, "uuid": "0793cc49-2bef-4a69-98d4-8d88436ecf66", "value": "T1EAE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689994, "uuid": "ed8b8074-1d66-4fca-a1f6-9be6fd58402c", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642689994, "uuid": "3a2d958c-3ec7-4836-86de-17eea9f140a3", "value": 145536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642689994, "uuid": "a0f4d673-7ae8-427c-9de7-9efbe3ac05b0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642689994, "uuid": "3dce71fc-c6c1-4082-8556-299dcb9ab928", "value": "INF_1002019752277798147440.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94c72b59-79f5-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1642685621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685621, "uuid": "6567525e-43bb-4f6a-b237-d903e0f0e8c7", "comment": "Malware payload (AveMariaRAT)", "value": "c37bea908edda365783e46b788c5694b", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685621, "uuid": "c802c1fc-f761-4ef1-ab76-e84cb555886b", "comment": "Malware payload (AveMariaRAT)", "value": "f5470946f64f03f46feaea77ef7bca4b0f13d5513a5d8d1a9dfc5be2cd6ba5ff", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685621, "uuid": "7fcbb918-ed9b-4828-b40a-c0b258696967", "comment": "Malware payload (AveMariaRAT)", "value": "bc32a9af3b31389416a645e358c2a0d2c7f3df6c", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642685621, "uuid": "276a7f98-0797-4ca3-b5bb-b169598ece35", "comment": "Malware payload (AveMariaRAT)", "value": "e5762ee45b0324e5c4a3c44d98ef35eb4c3d460e2957067f8f49338d2113add0d65d80b1562a22344c38867f5f90b2a6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "uue", "colour": "#208DA2", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685621, "uuid": "3478969c-65c8-4e5a-a34e-5315ce397e59", "value": "T16DC2E1B547DF8967526E835B72E9B1721F0C25C013BF6BA0535C8E8D4B95E2C8636CC2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685621, "uuid": "77aff7ab-0923-41e5-99d9-6875b5efcfc6", "value": "384:2d3AYwnpSn/yMzlkx2I9PlaGqrN2rHjnLQL+iKoZBfCCVXlBx0gTlTWSizBt5:2d3Gu/yMInKGq5WDLQLqUlvXXxXBa1zB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642685621, "uuid": "bb0b6fcd-47fe-4454-a20c-38a7a431d385", "value": 27228, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642685621, "uuid": "969a0f25-b2e2-412b-a107-2c0c68d835b2", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642685621, "uuid": "23c98aa7-a13b-4ebd-8cb6-1f782d214c19", "value": "303770598415doc.uue", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a34c0d38-79d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642669754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669754, "uuid": "2ccd91cf-e309-4b10-a36e-743a2f1dfff2", "comment": "Malware payload (Mirai)", "value": "da31e3ccac68193bdd3a8b10015c3129", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669754, "uuid": "53fe1ee6-73f8-4c34-8b2d-0c50b3b62e27", "comment": "Malware payload (Mirai)", "value": "f600f22557664eaafcc08bf015690987494f7f3103580a634961f09aef352fe2", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669754, "uuid": "97a8d6be-e4b5-4221-aed2-c8ebd761d8ef", "comment": "Malware payload (Mirai)", "value": "beed8be8ebb0cfc60d19eab86f1d057071b2a4e1", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669754, "uuid": "3252750a-44e9-4019-9eb1-2f75e9dbe189", "comment": "Malware payload (Mirai)", "value": "40c92b8f67e04aac6b2a3ed5971110a8a16cebec97aa56fcf8d03f23a4b5ba8327011a72e8428e343a8a4267e0e08c4d", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669754, "uuid": "2f7ed5ee-c5d2-49c5-9ef9-dbfd8c1611f4", "value": "T18393A51A7E258FBCF799863507B78E22965837C62BF1C141E19CEA015EB024E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669754, "uuid": "65c7e630-82fa-4f35-8787-b6b2317224df", "value": "1536:AKzqmzfphPukFhyx2XgHw3eFz0HDDZ5KHZXvEY2QPSn:AKqYhueXWw3eFwHp5KHZXvEzIm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669754, "uuid": "c07c2d54-fdd7-49e0-9b9d-2261c7176a06", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669754, "uuid": "d6de213b-0f07-4631-a136-198050054a50", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669754, "uuid": "a77a2eed-0072-4bf2-bf9d-c2b2ff8cc8f4", "value": "gang123isgodloluaintgettingthesebinslikedammwtf.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc34306e-79ff-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642690089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690089, "uuid": "663d3fa9-8b39-41a2-9e7a-77bef7aa736f", "comment": "Malware payload (AgentTesla)", "value": "6c9615401f7b3e7032082a86d99ca342", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690089, "uuid": "04c3ed2e-09f6-4826-830e-799195764eeb", "comment": "Malware payload (AgentTesla)", "value": "f687b7b49c0e1a404fcb75f1519afe90b2777be63611de9e95d37e4f41c62a37", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690089, "uuid": "a40f2be9-e1f4-4b49-a81e-38fe8f9a7965", "comment": "Malware payload (AgentTesla)", "value": "eb44c2d2c772282c80d058a92a4707820979a403", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642690089, "uuid": "8da8e152-0d3f-4386-bdd1-a2e9ade89187", "comment": "Malware payload (AgentTesla)", "value": "e53a570375b39d082680b5be3bc96e00e5e2a01c8f0d5ee57aec030c79a41ecd6b4d15e68c3b98d5e27b1b598fbb08bb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690089, "uuid": "45ee064e-ba2a-48d8-be52-05a49842d2ee", "value": "T109A41219B7F9272DD5EA8BF46662010053B6391E3066C35D4E96B0DE2A7BF824312F37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690089, "uuid": "80bd474b-1926-46cc-bd31-83016c615ddb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690089, "uuid": "b5cd913d-266a-4bbc-8f4f-d39cdf48b12e", "value": "12288:ckwlZ3aVWc/peUrXxnManSkTMrSnl1RKQu:clpaVWIpeUrXisHnnR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642690089, "uuid": "2c214750-3dbd-426c-a655-6911d93d665f", "value": 452608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642690089, "uuid": "e6b259fe-c5f2-4850-8a8c-fa78ef53c33c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642690089, "uuid": "bfd08598-e4b8-472b-83da-f72648614f80", "value": "damianozx.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfd7ac94-7a37-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642714093, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "7cc95cd8-f294-487c-a710-5331061b1bd6", "comment": "Malware payload (Heodo)", "value": "dc31827edc0a96cc854c5b5d0fd78542", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "d9f51b47-c6f3-4570-b6e2-281764c233d6", "comment": "Malware payload (Heodo)", "value": "f7110c0b5c2f9e623197ac23dddd3962c79fbdb4465da875b244205817b46a2e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "58125cb2-4636-4e1f-af41-40ebdf8bac60", "comment": "Malware payload (Heodo)", "value": "81e76ab9da0c21f4947f59800bfc59d670133863", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642714093, "uuid": "4c91d91f-f772-4138-8850-59228708c6c1", "comment": "Malware payload (Heodo)", "value": "e9b04a3cf73b51011117c5deab024ede0ebccb4ec612b2b72f94baaec4231b1b28b01daea21bec869adef7e6b048e989", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "e2716591-0b2f-4998-841a-68d4a0ef45a6", "value": "T124D4BF02B2D1C036C5AF11B08E76AB08A2EDFE905B7985DBD7847D5F1E31BC26635B06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "7b641123-35d9-4f45-a8f7-b21cc334a621", "value": "42bfc936e90bcc6f5b01541917ef37a4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "f47c7a2f-f6da-44a4-a362-e915bb2fd5b8", "value": "12288:Td0saabmsb61ZuV3ZGuyfEgXkvPLEbsWrxD8iP29pi9NKG1DjsgqXXvhhcwEPwqh:68mi61ZuRZGuyfEgXkvPLEbsODYD8Vnm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642714093, "uuid": "a2f9cb9d-451c-4658-b9fc-6d43af57dbb0", "value": 638976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642714093, "uuid": "44f965e9-43ca-449d-a557-17f03916929c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642714093, "uuid": "316f86b8-9c42-4187-8dcc-6ad3b9128f97", "value": "emotet_exe_e4_f7110c0b5c2f9e623197ac23dddd3962c79fbdb4465da875b244205817b46a2e_2022-01-20__212805.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "132fdfd9-7a23-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642705160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705160, "uuid": "fff04d81-4076-40df-adae-985de14c8d6b", "comment": "Malware payload", "value": "c02158d0b5e72c7a937d6f100206ee1c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705160, "uuid": "888d2fc6-463b-435a-a882-c6fd70c8e567", "comment": "Malware payload", "value": "f7dc504f541e65fef528a41400da51b64e9d327ef3de9f57346fe17356ee55e6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705160, "uuid": "002bf900-2dce-4a05-b017-1053c741f53e", "comment": "Malware payload", "value": "8781d642fbaeedcb1fc9bf38ab7f135a0a00b087", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642705160, "uuid": "0d880869-e079-463c-96c8-e2e548b327dc", "comment": "Malware payload", "value": "0a5d8e42bf67e91336059c06ab43cbf75c8f2b15c11ece5f9c979da47f1377648653e6dfcd033f54a51d1baeb30402ff", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642705160, "uuid": "98bd66fe-5d56-4319-a321-39bc12e4de16", "value": "T193855C31E244F085ECA600BAB4A662F2547D297067C048FFE7C5AA9959E77C3E334E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642705160, "uuid": "044fc1c3-8b28-47f3-8708-f1bf10a26891", "value": "a2f81054fe505c70379285ad8919cf02", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642705160, "uuid": "a50991bd-11a6-4f14-bd0c-b24c59db9e9b", "value": "49152:Jf7nn759dl5VD8Ey4FxPUoUrV/7E4v8l3yE4fOcMFy+TfJ:Jjnn759M34FxP4jXv8l3yEBcG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642705160, "uuid": "3531139c-2361-436e-b7ec-8dac1ee08e6e", "value": 1801216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642705160, "uuid": "e081459c-3df6-4105-b2f7-2530c3279546", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642705160, "uuid": "a7839edc-b756-47ec-a0a8-094764f09d62", "value": "PL_client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81027129-79ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642667119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667119, "uuid": "d5cca425-d840-4b4f-bd2b-5a6454ac4436", "comment": "Malware payload (Heodo)", "value": "6d084fc7752ecae17a57ca32fb1e43c5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667119, "uuid": "d4307c14-2f2b-46e7-89c3-3f12d5252517", "comment": "Malware payload (Heodo)", "value": "f7e69220b56e2e3337841bec99f0c3193adcb7114528df45edea9a1d75a4c9f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667119, "uuid": "5e572110-3358-4d8e-a783-e36e8e2f6eda", "comment": "Malware payload (Heodo)", "value": "f2627ea3e2eed13a180f6740fd18cfaf325dad9a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642667119, "uuid": "9bb3ff06-f0ff-406d-850e-2a050bb8a998", "comment": "Malware payload (Heodo)", "value": "8f8bdfb74713a021456045f71b7d4b036525c10d3c32d510401c4c51d7e94a33df75ffbd06e23ed243e2f60bdf7cb82e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667119, "uuid": "645a8b40-b0bc-4f46-b23e-3abb1d965195", "value": "T151C4AE12F7D1C07AD1AF12356A2A9B9C63B5BD619DF1C20BEFD53A4D5E306428F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667119, "uuid": "36bce2e6-1417-4536-8d07-628f37d8c775", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667119, "uuid": "951a4d3a-3606-487f-ab4b-1f5f5349c914", "value": "6144:5Ig427JC2jW8j6bzhO5vDynHoIoxoJ0CopGEfr/BHEUXZXbej1BC3OBtNCkiFPs7:5D42+8jM8WIIU8Gr2IXbeDCxBPs7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642667119, "uuid": "744137c8-e939-4ba3-bb5d-27b53ef59053", "value": 561152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642667119, "uuid": "2f654f2d-59d0-4973-ac34-fa29bccb01e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642667119, "uuid": "0b528b59-26ee-4c5b-8e1c-3d4f47e9b7f5", "value": "emotet_exe_e4_f7e69220b56e2e3337841bec99f0c3193adcb7114528df45edea9a1d75a4c9f7_2022-01-20__082513.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90ec27c7-79fc-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642688621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688621, "uuid": "65f8f408-c550-443b-9b17-c489e26c78f6", "comment": "Malware payload (RedLineStealer)", "value": "ccbfbdc7e7f53dd8ba4538f39e2b2ce2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688621, "uuid": "b4767e00-05e4-4856-8fbd-f7bab87aff99", "comment": "Malware payload (RedLineStealer)", "value": "f7f1c4893b8a4604cd9c7d98e03a599eaa0a723aca55ef3f176cb4feab85bea5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688621, "uuid": "178e280b-426e-4ecc-88ce-c4afee173c82", "comment": "Malware payload (RedLineStealer)", "value": "c2a88b613ba279d613796b0d56ed3520f1c82fc0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642688621, "uuid": "46bbc66d-874a-41ab-ba4d-645bfa96d687", "comment": "Malware payload (RedLineStealer)", "value": "ae272b073ae1f9c80c2bc0e44aa549287c98680527e6e4356818fbd78425796ed8b54ff537e816200fab802735c71334", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688621, "uuid": "6835a741-5fec-4dfd-a3ac-5fa588b77782", "value": "T13384E0313A90DC31C55656308866CFA05FBDBC3229A19AC773A427DAAF313D1667B24F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688621, "uuid": "5a3ec27c-9e7c-4317-8e5b-8976bdaf1fb6", "value": "897a5806e5491100f466efd56d26d7cd", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688621, "uuid": "826bb0e9-f79f-4e65-9d5d-2f4caf376741", "value": "6144:I2qgyLYbPZT6qYJ8uTRkeiajkOpYHsIUSLx5Wx61Oj:IFsPZTHYJlmkgOpJSux6sj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642688621, "uuid": "840ea763-5ebb-4ff0-9e4b-a88bab5dcc41", "value": 398336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642688621, "uuid": "397d33cc-f3f3-49cb-9170-8396b2b854bc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642688621, "uuid": "a6b7e6bd-b7f1-4a45-8aab-126c59a7d9c8", "value": "ccbfbdc7e7f53dd8ba4538f39e2b2ce2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab1d10c5-79e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Gozi)", "timestamp": 1642676639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676639, "uuid": "40195b51-5ba2-49db-987a-b786fc963d1c", "comment": "Malware payload (Gozi)", "value": "7dfb20c4318a1045a3745e8ca507ce78", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676639, "uuid": "5e554657-6089-4d46-81df-2b98832d37ef", "comment": "Malware payload (Gozi)", "value": "f8090b2dea01886cdf4b8c69e924e6f92717d3d19e1927aba61fda5b5b80898a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676639, "uuid": "1417a21d-eb6d-4118-966a-51b11b423838", "comment": "Malware payload (Gozi)", "value": "e85b218a1ee6ec3be0ec69eaccd62671766561ea", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642676639, "uuid": "2a45f1b7-5896-4adf-a67a-b536a9bad39f", "comment": "Malware payload (Gozi)", "value": "3401bc09ee30b8d9aacc5f9ec5c2a1c4a38678f162f9c93997e4ec6fbdcb948e24bbec76e87a6ef46fa3bea5afa3fbe9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Gozi", "colour": "#8A56C9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676639, "uuid": "861f7288-05af-42d2-b5f2-c95f7093dc5f", "value": "T196347E6AE2A50A95FDBBD5B9CD93C717D7F238091A64D34F13B0CA965F43321B218382", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676639, "uuid": "8cbcf575-5baa-453b-a3cf-56b21b7c884e", "value": "6144:HPMtglXNWOg0SbrhI8exPofnrWWJE4RX:HP1hI02rO8exgvrWWJh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642676639, "uuid": "f8ee5442-5d39-4558-96fc-87752e50e23f", "value": 248320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642676639, "uuid": "09aae54f-4cbc-4fc1-baff-2bbc3768afe6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642676639, "uuid": "8ac7bdf0-66ac-463a-9a85-9be161715edf", "value": "24ff7d60000.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6723f7fa-79f7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642686403, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686403, "uuid": "b543fce9-f0ac-46b0-9734-64c2d6faf924", "comment": "Malware payload (Heodo)", "value": "c49f3c2af3a254c4ff41d43c29ee3b8d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686403, "uuid": "2dc565d7-a274-488f-aa34-f5cd61cc56f0", "comment": "Malware payload (Heodo)", "value": "f8746c0e7d492357a8f30e424870c4fce49699d165260610a62360668541035a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686403, "uuid": "3f0c8e32-214d-4bf9-8a9c-1d07c650a86d", "comment": "Malware payload (Heodo)", "value": "a7db7d7a9179a63426bd4712a36ee9016f8ad5c5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642686403, "uuid": "860ac854-ed45-4520-9ee5-0e25160f3406", "comment": "Malware payload (Heodo)", "value": "b745a26b4c870afe1f8b6c976293f047fc593f697ff893b5978b350d67edee6ecfb9da856076d39dd633c89c30ea1e40", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686403, "uuid": "c84ba98d-cd22-490b-b361-21e93e30f6aa", "value": "T1EAE36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686403, "uuid": "911aa3f8-c4ac-4308-9103-b9006297d4e3", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642686403, "uuid": "022021a8-859f-4761-858c-a591e6f18627", "value": 144651, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642686403, "uuid": "64a1c75a-7949-4fb7-9a97-2ca0f531b7bf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642686403, "uuid": "26c65a8d-7009-4949-8950-506a0904ffcb", "value": "c49f3c2af3a254c4ff41d43c29ee3b8d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ed6f43f-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (BazaLoader)", "timestamp": 1642665746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665746, "uuid": "a77247f4-66ce-4372-8a4f-913735f88cc9", "comment": "Malware payload (BazaLoader)", "value": "e476534e17521b823794d3cc338da3e5", "object_relation": "md5", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665746, "uuid": "0c3b2c2d-4c2e-4507-90fe-42572a92e771", "comment": "Malware payload (BazaLoader)", "value": "f983a109d3d2856794352c36289e6f34f0f55420acfdc196ec9c75095eb79c90", "object_relation": "sha256", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665746, "uuid": "ba800b1b-f808-4c7c-8701-cea3f51c8133", "comment": "Malware payload (BazaLoader)", "value": "f26daa812ee01d3c5b6cb3412248107ad5b8253d", "object_relation": "sha1", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665746, "uuid": "5d553ce2-4238-4548-8671-6d28124ae2d6", "comment": "Malware payload (BazaLoader)", "value": "f68a43026588f8be92f6fdb2c7f7f0fa4404f8819f07dd93b92574fbab21400dd58394ea4efe389c28f519e071985618", "object_relation": "sha3-384", "Tag": [ { "name": "BazaLoader", "colour": "#16B619", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665746, "uuid": "33869cf0-f7cb-4aa8-8174-c8761d33f869", "value": "T19185FE43180C819F9867D77421671D97EEB87E47F2C84E1ED1E428B84AEBDA674CA04F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665746, "uuid": "bfcaaaf9-3312-4a4f-b618-778a02a4f425", "value": "f30f2b5b65c947eccbf132b668fe3257", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665746, "uuid": "74e44469-7534-4653-af16-88dde37a97fe", "value": "24576:Na1QHwgJMrQqj/wAc6QORNx2nAjwkaQm0GV9igWwlnwXQBwfalj21X4GtZ+FdnZ8:7H5qloBMd8A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665746, "uuid": "06b0d384-36e1-484d-8f85-ed54cb0dbba4", "value": 1816064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665746, "uuid": "3d5c2cc9-2549-4220-8950-d199a59c77b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665746, "uuid": "8a2d3677-3899-436a-a87d-027ea69f57ae", "value": "e476534e17521b823794d3cc338da3e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d0f31e4-79d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1642672669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672669, "uuid": "da5d8a54-5ca8-4697-83ab-17f593ac81d2", "comment": "Malware payload (Gafgyt)", "value": "fd468c0ba62be7135efbccd814d0074b", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672669, "uuid": "ee0b9027-db91-48e6-ad32-a6ae6ec3206b", "comment": "Malware payload (Gafgyt)", "value": "f9d0146914b7ec8c386a822ea03ce9541d2b0191ad17c9573fd5f7afdbf25632", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672669, "uuid": "90901f7b-e8a9-44bb-8739-c81fbb03b0dd", "comment": "Malware payload (Gafgyt)", "value": "01101d2e2e012ad90e58cd603c029d34b8b2b6ab", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642672669, "uuid": "2d3d931b-40ad-4174-9385-a4007bb92cb5", "comment": "Malware payload (Gafgyt)", "value": "eb5d0ed3521f896aa393dfc86c4da4560364dec80b43db719f05024de4441f276779a32b57606079a1169f9d0633d172", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672669, "uuid": "e5ba057f-05e7-4499-b798-ecadb599246c", "value": "T11263B8253A61EBFFD66D82300BF34B3043D565962AA1934AF26CEB5C1F7128C1C5E7A4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672669, "uuid": "7717a165-7d2a-49e3-9055-faccdf4d7fa0", "value": "768:b0i7xZNHfB/s0ztx9DxY1ym3+eS0HInL5gxvhVXSL9Z:b0AZNHi0nV3eS0HJkhZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642672669, "uuid": "fdc1f542-74e7-4031-9e81-7b6fcb1d7dbe", "value": 73379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642672669, "uuid": "c657b93c-6db5-40ce-bd60-a27da2b18778", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642672669, "uuid": "e10a8cdf-df27-422f-8096-1ff1743cc106", "value": "mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e2c36fc-79c7-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1642665665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665665, "uuid": "d36d4746-ec6d-4771-80f4-5a4f725cb193", "comment": "Malware payload (RemcosRAT)", "value": "fca42a128d1fa4dc6c4bc1b3ad20073c", "object_relation": "md5", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665665, "uuid": "46e6793c-1ad1-4d11-b92b-cf08972a9660", "comment": "Malware payload (RemcosRAT)", "value": "fa85ff58a7096ce445dd3f85f42296fae71a363c0a80e435fb6dfa49e31cdf3f", "object_relation": "sha256", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665665, "uuid": "d3fd4e2d-0f0c-4e7e-94fb-2670d58019e0", "comment": "Malware payload (RemcosRAT)", "value": "42d4090991964f727cc346eb2f611ce151757bd5", "object_relation": "sha1", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642665665, "uuid": "b80b9887-2f44-4a5c-8a22-059fa7e9e092", "comment": "Malware payload (RemcosRAT)", "value": "a5234249fcd7fef8ffd0c4b55f2b6c59b9df86fef588355239c8bf09da3b0b337389c9de4eeb0a85c8df623661409c22", "object_relation": "sha3-384", "Tag": [ { "name": "COVID-19", "colour": "#079746", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665665, "uuid": "88b7bff7-3710-42bb-9fdb-f64b15d99373", "value": "T124628DD4C16B08DDD31CA4B3E28428CC921E3B51E09FE6092690DC57797F0DA665E6CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665665, "uuid": "b7b5cff6-c930-41de-b174-dce96db96c37", "value": "192:yyakVJbAi8HaLAThlsCW2sCt41mHZsfkU7mF1gSOX9vtQfAQTolTmg5jeHBUlJUE:yyakrAgpCeC4mHSHaqxXbmej9plmE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642665665, "uuid": "f5d6fd2d-ad95-4559-a40f-dfd0b974e803", "value": 15281, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642665665, "uuid": "e598c1ba-81cb-437f-9dda-3b20b26475d6", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642665665, "uuid": "0f4d5be9-d0da-4bdf-ac5a-135a5840eb1f", "value": "Soft Corporate Offer Ref.\u2116 010921-KPCR And Brochure for GG COVID-19 PCR 2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fd42986-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666231, "uuid": "56665cb4-09a8-4f96-abec-65e41d3653ef", "comment": "Malware payload", "value": "57e166647a5e839490b3774546a5658b", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666231, "uuid": "bc966c95-2da2-4651-b3fd-f637554dfc0f", "comment": "Malware payload", "value": "fb66e136194f964f4ae3e78203c54b030fae671ea6bfbc3da75c1b21446ba2b5", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666231, "uuid": "efc0a6b3-687d-41a8-9424-7d80c3d76ed9", "comment": "Malware payload", "value": "4f4cd373765e13fb034a5ce8ae24c28d9b993e9c", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666231, "uuid": "f56f7cad-b0a6-4a30-bccb-f8a23f620d45", "comment": "Malware payload", "value": "f432451c244aff44df14e61eab6bb9d8c4fb7f9b8458865d15e29b022330a6b76b352da708f7056837c9b4bd26f11380", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666231, "uuid": "3d10d567-86da-471f-9f0f-4edc7e11f96b", "value": "T177F4D2DCA900E4EED825E27976BA3CDA93E4620BD14163CC798D73015BB6B90C3DDA74", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666231, "uuid": "10832141-6560-48f7-8ee7-6dd94aa71877", "value": "3072:EfZa9fk2piDWPH36FAZi9RNj2H9nx+eOZOcz1RXe7ydP7VgL6zwm/Hfw:EfZaR8jFfHSHiJvbffw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666231, "uuid": "f2e4b05e-6c01-42d0-8a72-3e66d1ba7d20", "value": 726196, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666231, "uuid": "02b2d490-8c4d-452e-b85e-9f47194cec5c", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666231, "uuid": "635adc0c-c0f9-42b1-b180-c5df59e85980", "value": "order_receipt .js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6750a6-79cf-11ec-9275-42010a9c0029", "comment": "Malware payload (Socelars)", "timestamp": 1642669344, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669344, "uuid": "9565f863-c26f-4913-a831-fc037a1a5d8d", "comment": "Malware payload (Socelars)", "value": "537785745d6a7f64c328cba2f108dadd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669344, "uuid": "64a638bd-ca5d-4733-a903-c717668cb8b5", "comment": "Malware payload (Socelars)", "value": "fb89844cd87ec661a01f216523dd01ee0076667923abcaa14319ed515b85f48d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669344, "uuid": "4cd980f3-6b8e-4442-b7f5-56b55b903b1e", "comment": "Malware payload (Socelars)", "value": "eddc92d12a4afb0d648ef9645913a53542fbe4e8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642669344, "uuid": "111abb09-6e8d-462c-922a-1cba9bcca33b", "comment": "Malware payload (Socelars)", "value": "27dcf1f096f8ee73dfa4133a6193d460ba29a57cff3d46abe9ab2d4f5b107eb54ed8e4ce62f2cf9cce1060423708fbb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Socelars", "colour": "#22908D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669344, "uuid": "a0fd3683-f720-4048-88d8-0b8d82edb6c6", "value": "T123658E11F642A036E8E300B2C1FF96FE8D286E21431854D7E3C47D6ABA715E33A36657", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669344, "uuid": "65870795-0b6e-4e35-a752-65c5e8f1c656", "value": "d69e4c13e25f0ad622344ac56118c0df", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669344, "uuid": "a5f4de1a-479a-4d5a-91f0-bd60746bc33e", "value": "24576:jETpNoFKAfIL0AffU/WbTPxb5wWThCfTCMeno7iCXBtuR:WpwSyeGmMReno7iCx0R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642669344, "uuid": "e19c5fb9-50f9-4086-a7c5-0747c00a8f08", "value": 1490432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642669344, "uuid": "6e6b995c-d476-4c07-a213-4f384bd986ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642669344, "uuid": "9b0a383b-406b-4625-8cbf-d2365dd65896", "value": "537785745d6a7f64c328cba2f108dadd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0bde4ac-7a2b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642708887, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708887, "uuid": "10b81e0a-e7fe-460f-a997-8ead8467e581", "comment": "Malware payload", "value": "9e935bedb7801200b407febdb793951e", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708887, "uuid": "c2a383a0-6e13-45f2-8e56-3fdd33ba68bd", "comment": "Malware payload", "value": "fc46525f37cc3f2a7e43d83dc5dd48ff8f7a456148e615cb9f592e6976635c1d", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708887, "uuid": "75f73437-9880-493d-ac03-264253fd78d5", "comment": "Malware payload", "value": "2fa404fc9d397b0edc8aaa66f1dd3907152b0962", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642708887, "uuid": "677421df-91b7-4331-8fff-a4aacef7f01a", "comment": "Malware payload", "value": "8ea3b3909530269f529581385dd8672e7c1e902717fd6032f9b13860802b6ac969284dd8332f90927c4eb85cc0c480b4", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "x86_64", "colour": "#DD69A1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708887, "uuid": "55621cfb-8ea4-4df7-a060-34b8890d2960", "value": "T1AC04230736B4B62DF80628EF82134B88DEE5E55C58FA9441FEB2B0CD961E5DA4BC0CD1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708887, "uuid": "d6074b42-80ac-401e-aa77-e7f8b0f6b6a7", "value": "3072:L9AiIwTeuLi9TLJ2eymb9Nsb4nWpBqjvxThmKmgPmLJbm/PhnFkw1Y6XIPbE:L9Ah9Tgeymb9qb4nWHuCmHhnF7YXPg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642708887, "uuid": "8f64d6df-619c-4fb4-96ef-3e3671ef41a9", "value": 188716, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642708887, "uuid": "b535c16f-bc2d-44eb-a802-4eb4179fc0ab", "value": "application/x-sharedlib", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642708887, "uuid": "49114522-2b9d-4fba-a493-759e15f13d3a", "value": "bashirc.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d98cfa7-7a0e-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642696292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696292, "uuid": "0ddf5bc6-089b-4d58-b15b-282f7a5cd911", "comment": "Malware payload", "value": "9b4f4fd8cd252b630d54edb6412f0a6b", "object_relation": "md5", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696292, "uuid": "37348897-cf79-49ca-9f21-3f028b2970fd", "comment": "Malware payload", "value": "fcecc2062f817d0be6641716e6e17101bb1564c77c9afc12f975ab449ba52693", "object_relation": "sha256", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696292, "uuid": "f5a23194-2ecd-447e-ae7e-bdeb14ce8ad0", "comment": "Malware payload", "value": "d7a13f6ea259f95d7f07e6b59190d7ac83661043", "object_relation": "sha1", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642696292, "uuid": "1123ba2f-3e5e-434a-a6a7-80eaba7e8d09", "comment": "Malware payload", "value": "0939ab6eb7cfd86e22cda5d4ee3a7a2fb625353443b86e2284866550fffdd391c7f3c9f3fe045e1206e39bfd65517807", "object_relation": "sha3-384", "Tag": [ { "name": "ppt", "colour": "#A64DF1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696292, "uuid": "5601fc45-0aef-4b65-bcd0-81477e31226e", "value": "T1F983E3043380D532E0675A328DE7D6DC6335FCA2BE51472B32D9731F2E7A5A2AE16394", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696292, "uuid": "a8c505bf-f94f-4f88-9d15-e5392d00a093", "value": "384:bQgc5dRkc7Ct3cq02FxfdAYi2wrC5D5Glkd5zkPEwK3MKINW1vtclFo39D:kLQcWt3cq0OxfaYyrCvwK8KINytcjo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642696292, "uuid": "3630d37b-3363-444c-8537-c0320d57cf19", "value": 80896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642696292, "uuid": "072540a6-99ab-402f-a006-f4ef0139cc15", "value": "application/vnd.ms-powerpoint", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642696292, "uuid": "0246d884-590c-44d8-9286-a49966554c7e", "value": "PO NR. 102.ppa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ed72e29-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642660566, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660566, "uuid": "e095eb46-264a-4ea9-a52a-ed4b6396c555", "comment": "Malware payload (RedLineStealer)", "value": "07119e98a4dcec3abe4004a4415ea60e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660566, "uuid": "a2c23fc0-5f2f-4071-8ef6-9cf01474690e", "comment": "Malware payload (RedLineStealer)", "value": "fe21c6c1d3ae6dfcc4b1e2be99905e4ec9d1249aeb39d5723e54b849784867e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660566, "uuid": "edbe29b8-9470-464f-8645-050741ebb330", "comment": "Malware payload (RedLineStealer)", "value": "74c71192c081ab99251e7d2192caa37149027568", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660566, "uuid": "87f82dec-d8ba-4f44-bfe0-859904e19724", "comment": "Malware payload (RedLineStealer)", "value": "476152e152378767958fb32a2f7b1abcdfdda78cd7eff07e1e7331209e7d1c854f173432ceaeb00988171f5c7104758e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660566, "uuid": "78a0bfa0-2f06-44ee-9c26-bb749c4bb3d8", "value": "T16F94E0213AA0C433C4C626314829CFA56A7DF8707A64764373A8377E7F71A81B6A535F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660566, "uuid": "8ec02fcf-7357-4b46-9e6c-f626b994f7a9", "value": "b599c41ba6f3d2fcbb28babbce596599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660566, "uuid": "66985522-0a5c-44a6-b8ed-48dca889814b", "value": "6144:qXiNJgxctw7auswKZnKxm53rYPvOvCgEvUBQtuuBNrhUGfD64oAIZ:ZHgxct2aoKhmq3rYP2v3I1hUcOnlZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660566, "uuid": "0b72db90-c59d-47e5-a0b8-dbce3ab98030", "value": 418816, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660566, "uuid": "e270f74c-3d84-408e-876c-5fbbf4f134d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660566, "uuid": "9edc68da-9cf2-4fee-9a59-ef206dcdfa67", "value": "07119e98a4dcec3abe4004a4415ea60e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11abd085-79c3-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1642663926, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663926, "uuid": "812c9f7b-4345-4250-87bb-aa49782f17c9", "comment": "Malware payload (RedLineStealer)", "value": "cefffb266c88dbfbceb6544b755b517f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663926, "uuid": "f8d8bba1-14d2-49b9-ae29-c549f9e84c76", "comment": "Malware payload (RedLineStealer)", "value": "fe3820ae1da9b861638dc2070d08e82b8ee26a35e18823d61591d27bb08cf7f1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663926, "uuid": "3a5287a6-5364-4de5-865e-4985a702dfd2", "comment": "Malware payload (RedLineStealer)", "value": "5a9e5915fc6f06abf2688f08d6507fd02c301463", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642663926, "uuid": "f1970193-981d-47d7-8a41-799ab8b54fe4", "comment": "Malware payload (RedLineStealer)", "value": "dec1a8e8d70d8d80026ee6916a1e7e18dc7c1f45b270b0db96eadd1d58575a35f13b323abf982575687e799d1840888a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663926, "uuid": "55c20fd6-3433-4ddd-92b3-5800625a6931", "value": "T16394E0307990D432C0966631881ACFB69F7DB8315A64998F73A83B6ABF713C0667531F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663926, "uuid": "227a8cd6-d280-426e-b1cc-f1ef88a0d3ae", "value": "b599c41ba6f3d2fcbb28babbce596599", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663926, "uuid": "f8321cd1-fd24-4516-b1eb-08df1668e243", "value": "6144:dcNHbxc/YWq5TAdrjnTOrFZrnUftms1Jy/1t98PCcB9nmH:Otbxc/Y7BoTI/DUw/T98Pg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642663926, "uuid": "980f9265-de36-4da1-a50b-2f105e996020", "value": 418304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642663926, "uuid": "9a6194fe-bd82-4985-a537-53e36aaa3427", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642663926, "uuid": "ba1f3dea-751a-4e8b-9dc4-ca4b284c0e70", "value": "fe3820ae1da9b861638dc2070d08e82b8ee26a35e1882.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e9432314-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642666435, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666435, "uuid": "c4d7d03d-1eef-43bc-a7e5-92a186efb20f", "comment": "Malware payload (Formbook)", "value": "c1079a1d576dc77ff31e1bac7f1fbb56", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666435, "uuid": "0ddf9c27-b51f-410d-8ca0-b2dd5e6d28ed", "comment": "Malware payload (Formbook)", "value": "fe89695eea43cb30b74859db4063f1d079d86287503dc58e8778cff14828011c", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666435, "uuid": "fc8ac8c2-f7ef-4605-8bdd-484c6965f298", "comment": "Malware payload (Formbook)", "value": "25be936b461e5ae097d12cf4a186d9d595486fea", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666435, "uuid": "87fb865f-ff99-4cbb-b930-ac086bf6e835", "comment": "Malware payload (Formbook)", "value": "8fbe47a60bbf4aecbe1b872abdbc3c0cfd9ad29f7d5bbb51af536c3415835f00ca5c389b0b1cb739460aa15fdd27293c", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666435, "uuid": "5633f149-2308-49ef-871d-2fa7a5d34f60", "value": "T19F9401640BE9C314EAAE57BCE8B5045003B5F2163513F74D2BC5F0EA3E63B958A5236B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666435, "uuid": "8b86df8c-9a61-4eb2-bc4d-eb648e85cea9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666435, "uuid": "7d295477-3e2b-400a-887f-ac70f9ed0480", "value": "12288:4KQ1LP83WduuFuvLc8bSj0pplcVTc7Nffj:MLP8OTFuvkgnlcW71fj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666435, "uuid": "f4b7d1ee-9988-4463-a528-9cd11e203f28", "value": 438272, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666435, "uuid": "b0cb57a0-2b2c-4f76-b238-702084881a24", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666435, "uuid": "16978646-0e0a-4522-aa36-43ee2a927fe2", "value": "DHL SHIPMENT PARCEL.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee7e5807-7a1a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642701663, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701663, "uuid": "e4137ca7-81b0-41da-8a8d-f0cb5f2f839a", "comment": "Malware payload (Heodo)", "value": "e37c00930db212b18a7e022f4486b730", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701663, "uuid": "a0ae9925-0ccb-44ab-bbc1-f19d5ca04d24", "comment": "Malware payload (Heodo)", "value": "fecb3fedea08421b805397890facad635b2a3027fd05e73288110fae5bbcce65", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701663, "uuid": "89cee0b9-ae32-4f07-8ef9-646b9222f93a", "comment": "Malware payload (Heodo)", "value": "74c231a3c5f440567e995baadf817fba152c2df8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701663, "uuid": "061138a3-43f1-4a37-bd30-7e3c1b2118bd", "comment": "Malware payload (Heodo)", "value": "dd9ecc7cf1eb4a1031a034d0cd211f02deb9b3aaaa51f051751fd48e0272b525fd51b2e1e82e3edde3e0556accebee14", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701663, "uuid": "4411d70b-3346-4b3c-bcda-4da2324b610f", "value": "T113C4AE12F7D5C07AC0AE12356A2A9B9C63B6BD51DDF1C217EFD53A4D5E34A028F24322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701663, "uuid": "c15e2da6-4641-4692-9ae9-ff920b5e1ee9", "value": "883fcc468f82171d3a7cd0480cf7c8d0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701663, "uuid": "47873ec8-f984-42bb-9327-09258ededad8", "value": "12288:P78OGF+L8/4UUNyrndMhTq/n4vAzdkPs7:D8Ody4andbkii", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642701663, "uuid": "ffd747de-03b6-407a-aece-97453c0b0d1d", "value": 573440, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642701663, "uuid": "a3e6df20-0939-4568-9d7d-eb446078e191", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701663, "uuid": "f2efed6b-bb85-45b7-b026-042f2b41075c", "value": "e37c00930db212b18a7e022f4486b730", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "822160b2-79bb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642660679, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660679, "uuid": "56a9dd1c-cbac-4f36-8fae-c397a1427423", "comment": "Malware payload", "value": "6ada8d7a242fce84a44a3d5055454964", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660679, "uuid": "9331a7c6-d78c-4584-a45a-696961202c4f", "comment": "Malware payload", "value": "fee353c1f1b2aac0584d1750d97758959aa0433819f99451ae1d08fc771e9f28", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660679, "uuid": "93469436-93e3-4a8d-a90a-7e4afa1c7c03", "comment": "Malware payload", "value": "88336f296504263d39639b3220f37fa630e9d287", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642660679, "uuid": "f59310ab-3730-430a-9f23-3d6eb90c4250", "comment": "Malware payload", "value": "41562949077eff44e261028c60ea9eaf88c67f15e64105fecd7a0f5bae978f6bd4ee15d7a3a1b07ee8926dba4e891ca0", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660679, "uuid": "38e083c8-45c2-48f6-98f5-5a42f5226e83", "value": "T14B02A8B805BC0192EE03DA711A7AFD7101E2F29BC6C75B60379DFDB007A63626524746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660679, "uuid": "4b392dfa-1a03-428f-b837-fa4d5c5bbdf2", "value": "96:AyBuvrwxa18oYhMtjcIwvZRMvMflnh/0r2IevD0BwE00QLtz10:AyuMkaSjcIwhRIMnVk9uT0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642660679, "uuid": "41ab3b06-f079-45b6-aabe-aace9c0643d9", "value": 8793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642660679, "uuid": "fb57588f-68f7-4c91-8eb3-9dbaf1806be3", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642660679, "uuid": "46e20d57-41f6-4072-9147-730e9776e47c", "value": "6ada8d7a242fce84a44a3d5055454964", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b51e5ff-79d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1642670814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670814, "uuid": "5cbb302a-398f-46da-a4a6-0533880f55d2", "comment": "Malware payload (Mirai)", "value": "c41d7e3b45662e24991334920a55b60c", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670814, "uuid": "077e65fd-ff60-4b9d-8db7-8da0bac69ff5", "comment": "Malware payload (Mirai)", "value": "fee542d24e73950b88f81a50b3776ea933c3ae725d89860456da4b282db3d6e4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670814, "uuid": "dd61e205-f6ff-4101-804f-76fd0546453b", "comment": "Malware payload (Mirai)", "value": "1455807d843f8608f52670c0020eaec8a467785f", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642670814, "uuid": "1206f864-b015-4ab1-b95f-7914890420df", "comment": "Malware payload (Mirai)", "value": "899822c2474aaf211bc9e353639626874280fb1caef48c09eacf434fb355d13935e01834b1e5d887cc12ba668f2e44fc", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670814, "uuid": "d39c0b8b-9b88-42c1-8130-c79e331e4172", "value": "T181A3F972E642CA72C44306F102A79A6B0D21BE7B0A3A5E86F31C3DB49F334C97555F59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670814, "uuid": "32b1c964-0cf0-40ea-9b1b-2f7156c538bf", "value": "3072:SOGAEtZoGZKWl6u4YTnbHqbimmFVcqq0G27ZT:SqEtZ755nbHqbimmFVcqq0G27ZT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642670814, "uuid": "7c3ccb2a-60d4-47bc-ada2-3be7b0a2b1b1", "value": 104139, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642670814, "uuid": "3307af97-25af-4722-b258-c472860d28e2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642670814, "uuid": "199acc80-5a7b-433c-955c-de0fa1f4460e", "value": "i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1b4517f-79c8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1642666369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666369, "uuid": "e1313e5e-2e63-43a6-a779-d6b7f1c60cf0", "comment": "Malware payload (AgentTesla)", "value": "3e6350008194580e4d9f3d45578603da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666369, "uuid": "e4dc9f78-34a9-4700-850b-50d3cfcf74b9", "comment": "Malware payload (AgentTesla)", "value": "fef299131ceb20e13a5c9b4fac695249a7ea8b41fc94338aa81be033a4ec36ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666369, "uuid": "12914acc-8533-4f57-9db4-cb9f7b39b77e", "comment": "Malware payload (AgentTesla)", "value": "b2ac7c0ffc438417939a2861063a05a5dfb701e7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666369, "uuid": "7992e1f0-8f15-4f5d-a2ee-6608f720850c", "comment": "Malware payload (AgentTesla)", "value": "bc6c6ff3c7e338bd9aabe26007ec1595e00fc67003bcbdd6da8ee92d3950fc2eebf5f306ca0c7fd609566e3986c1668b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666369, "uuid": "84e282f1-db04-4047-bf09-17cb7fd59fd5", "value": "T128A40164FBFA1719E5DA83F56411147063F5FA2A2032D36E0DD9B0EE1472B8AD202B77", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666369, "uuid": "e9282911-023e-4faf-b865-e831828e6063", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666369, "uuid": "0cbd0f88-e7eb-4072-a921-0eeb90c5c241", "value": "12288:eTb6IWFVpTAJk9N9UFDYMQIrc73TeNRisi0bT2Lo0vYHukvi6i:o6IWLC+OFcMzrtVlPIAq6i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666369, "uuid": "8cfd4ceb-e801-4d6c-a9f2-f30e0a59481d", "value": 453632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666369, "uuid": "b285a388-3a5e-4399-b9f0-44a4bc198553", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666369, "uuid": "e8dc4ef2-817c-446d-93a7-ed5f1fc1acf3", "value": "DHL_Jan 2022 at 1.70_80BZ290_JPG.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9da6f393-7a06-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1642692937, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692937, "uuid": "f9a31c2a-4a85-4440-bd59-cf05829a3226", "comment": "Malware payload (Formbook)", "value": "91902eebab537cac19144070d3c1e5e2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692937, "uuid": "d898fb46-a981-4090-b0b2-918fa015871d", "comment": "Malware payload (Formbook)", "value": "ff7bd7299367f7e43c9c44fcd0f47a2a7f5b0529046b74ff6dc9c23c4bc71e86", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692937, "uuid": "41a5e389-d2f3-411c-adff-5b786689d003", "comment": "Malware payload (Formbook)", "value": "218bf26b2944d097c610e54ff026dca302341427", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642692937, "uuid": "1459abf9-be05-495c-9d76-4df8821a5b67", "comment": "Malware payload (Formbook)", "value": "deb8414f79a1b58e5580aa1201ee5cec9ca2c8ac3e353725423386ef970a3232fed2aad5f57cd7f42ba9ed472b0ab3f2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692937, "uuid": "66337259-2ce5-4feb-a8ce-aa7f08d7b9bb", "value": "T195452362F7C80BAAD7B716BC14E6CE24937053309807E70EEF9635D6A94EEE1D563204", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692937, "uuid": "f0f3c10a-24d8-4a15-a4eb-cec8d75b4a38", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692937, "uuid": "6f17d282-60c8-473f-bc52-8bcb497c1c34", "value": "6144:6tcvO66djUh8ekwCM4V0Qdn5hdVM9qO7FPqyjDGBzo5DUb64I0r6TB530rnu+rsb:6aDGzCqCIZoDf1IhpdxnspY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642692937, "uuid": "d77cb955-c531-460a-9f0f-5cd3b04345ec", "value": 1211904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642692937, "uuid": "759aee1c-901f-4958-a1a7-ad6e0ffe4cb0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642692937, "uuid": "aab58bb8-5900-4b6c-bc33-c1dfa1e63907", "value": "91902eebab537cac19144070d3c1e5e2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1637bd87-79c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1642666510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666510, "uuid": "f7b30cc2-aa39-4bfe-8681-8b24dd7a903c", "comment": "Malware payload", "value": "b1475bdbe04659e62f3c94bfb4571394", "object_relation": "md5", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666510, "uuid": "ba5a10fd-c913-4987-9e64-5414680d9012", "comment": "Malware payload", "value": "ff987e40e87262801b7080624fdcb6d3392b4ad4fca2ef8412c37be7ba3ed63f", "object_relation": "sha256", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666510, "uuid": "71b7335f-c4ff-4ca4-8feb-45792282c9cf", "comment": "Malware payload", "value": "cf1538bc0c3c391d8a66fc8035a15a4f3f2c4517", "object_relation": "sha1", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642666510, "uuid": "417299aa-dd4e-4593-a903-69de5adc636a", "comment": "Malware payload", "value": "14ab8e37a74d4cb9b0d0154b46cd052a85791e758e07b7674f12fb75ac2c55c7e56d5b266ed325177a5679317efa1ba0", "object_relation": "sha3-384", "Tag": [ { "name": "oceanlotus", "colour": "#858921", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666510, "uuid": "2158ee95-400a-4ded-a93f-633400d90098", "value": "T13E2533D814809FDCFC9EC0F5AA579CEC7D88213793BF5A997661D18297A02308B513BE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666510, "uuid": "6d152b2c-a44c-4157-b70a-b3aa2bdc2a5c", "value": "24576:GHoysJdghLRUWzZMp7+VXgxDAck5nnxVrBOCW70TZ3GKlETl:GHSK4CVXgxAnrrsCTxGNp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642666510, "uuid": "6068c50e-bd11-4af6-b444-ec040776c96b", "value": 974964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642666510, "uuid": "c3da5031-da55-4383-aa18-c4aee568e6fb", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642666510, "uuid": "072b3c75-a60b-4efb-84f3-7c859d7b6bcb", "value": "CV.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "649f7fe4-7a19-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1642701002, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701002, "uuid": "ddf450bf-4cbd-4a23-9804-cedbe3560a32", "comment": "Malware payload (Heodo)", "value": "949ea21cf4218738e33029e292d1b539", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701002, "uuid": "fa572ba4-8009-4d2e-85f3-5cbc47a23184", "comment": "Malware payload (Heodo)", "value": "fff3ac0f2ce35babb7cf736ec26a8374c8babd255489994937c41a8c005e5b46", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701002, "uuid": "e4f80087-c091-4df6-a40f-b998fdbfc999", "comment": "Malware payload (Heodo)", "value": "54f401cd4d16e7983dd32898c5ab14cee55d37a9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642701002, "uuid": "2f157237-37d4-4394-bcc7-e2b1a2ffb915", "comment": "Malware payload (Heodo)", "value": "bd040db06fc33561fc7ff1937209d55ca176a387c4c6c18647621beefe931a475931ec9dd5367540dbc39933b40866b4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "excel", "colour": "#D01EF5", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701002, "uuid": "186e49d8-3d13-4e98-89f4-ada2c2390e64", "value": "T129E36C0361459F86C84883B86FD74690DF12ED3DDA922BCF21867B173B79EA14D0A53E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701002, "uuid": "9814d6a1-6c39-464f-9c58-d5154c33dcce", "value": "3072:4Rk3hbdlylKsgqopeJBWhZFGkE+cL2NdAlhEvN8B/W6X1yxYovrepMUdQ6gSz4iq:Qk3hbdlylKsgqopeJBWhZFVE+W2NdAli", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642701002, "uuid": "f19c7dff-fe0f-4ff1-80ce-d5b35fb4d285", "value": 145378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642701002, "uuid": "da44502d-5f09-4653-b4a9-d0d131c53575", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642701002, "uuid": "8e6b9fd3-ad81-42c8-a131-0266027ad208", "value": "949ea21cf4218738e33029e292d1b539", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267e1ea7-7a10-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1642697032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697032, "uuid": "c67cbb35-3c93-421a-b1b4-49ab3349615d", "comment": "Malware payload (Loki)", "value": "3553730092aed51702858b9ba64f0ab3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697032, "uuid": "3929c513-5d67-4521-891b-b74d9874a49a", "comment": "Malware payload (Loki)", "value": "fffbbdd6e74f9c941142bf664be3eadaed24626e0a2c33dc7f9bb6ba6707e57a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697032, "uuid": "ae1cbef7-6de0-4336-9451-0bf9ba3a99d6", "comment": "Malware payload (Loki)", "value": "3adf8943bcc6692b82f5c25d21f040cf182427ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1642697032, "uuid": "8adaa87b-57bf-4334-90a1-e00b28cbba3f", "comment": "Malware payload (Loki)", "value": "41a1235ae9c30d4e8c116466a7b997b20f4fed01eec9dfa9de3b4f7fd35c96b09f202d7ad3f2020c3c31df47ca77cfe0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697032, "uuid": "2cb5751c-b7c7-4268-9414-4a37302cddcc", "value": "T1DA143A23A504A1BEF24ABDB56C6EBB842419FD7D0502583BBDC46B7C5533293B09873B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697032, "uuid": "b639a227-f423-4a26-802a-3d39b327ff9c", "value": "49b15580bd181e45d4d97bbfb270c139", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697032, "uuid": "e3b492b8-c671-4d5c-a825-e85ada75ed1a", "value": "1536:jlShcwgFE8Yjv/kt5orRjIUoeCtwzKFrtDyt6YGCNnQFoo1LSfi3t:Wcwg0vMt5orRjZlCtlJyt6/QXoaut", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1642697032, "uuid": "6f65000d-9822-44db-992a-14d574b7c838", "value": 202408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1642697032, "uuid": "dccc40b1-49b0-4ba8-911b-f2d48245c49f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1642697032, "uuid": "25393345-9145-4edf-8147-cfc411122ce4", "value": "3553730092aed51702858b9ba64f0ab3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }