{ "Event": { "published": true, "date": "2022-04-29", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-04-29", "timestamp": 1651276982, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f076edf3-4cc6-4c35-b39c-fbb598da657e", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6eeceddf-c80d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651272056, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272056, "uuid": "e144a634-e19d-4411-852a-4bb7cf297bc4", "comment": "Malware payload (Mirai)", "value": "398b1e059ab32d2a4a1af041f2288652", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272056, "uuid": "72aa2762-d89f-42b1-b38e-6352e48f9e0a", "comment": "Malware payload (Mirai)", "value": "00614bf5490554dddf273f2b0545452d22d2f5c34b10af7b95e301774d4962e7", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272056, "uuid": "44f2f944-be79-48c9-9ded-f9292c738240", "comment": "Malware payload (Mirai)", "value": "fa2885d82a889b88d58d3b74c12a042fff59b916", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272056, "uuid": "30600dcf-bd45-43c2-9f9e-1642665e9b23", "comment": "Malware payload (Mirai)", "value": "cd1ba09178a9cfd8232fbc574451787247f6ddab51d9706ee0ace75297541659889ccc5de8c006a2ee663676e360941b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272056, "uuid": "fe375a99-bd40-4202-9994-de14bf967f1e", "value": "T1F2D2D0D08ACEEC96D1D05A71D639DA87234A6F3C92D775B8D920AE38DE4000D6DFE146", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272056, "uuid": "a3e4a4ca-f892-4826-9bb7-7d4802b084df", "value": "768:kvTTBUuEiTrVzaONa1aG8KA7syI7lSVGU0Q3UZo:4TBUupzaONpL7nIgo9U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651272056, "uuid": "1171cb57-bf6c-4e0f-8a16-f9c55e7cc417", "value": 28352, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651272056, "uuid": "a8a8cfeb-ece7-4ab4-a4ad-91a27c7b883c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272056, "uuid": "5ea4277b-ac81-43ef-882f-65372e85ce04", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "905685fd-c787-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651214559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214559, "uuid": "7746f032-ae24-4003-85ae-fae34ae81c4e", "comment": "Malware payload (AgentTesla)", "value": "1bd960bc26c31c517af4aa09aa28f78d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214559, "uuid": "9df7e4d0-ff00-43b6-bbce-b32f2064ebdc", "comment": "Malware payload (AgentTesla)", "value": "00a4ef65d9908697c225bc1222cad197a8765dca56732512fc74c35cab607994", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214559, "uuid": "6abf2d38-1a19-4d76-a337-61a98f543f92", "comment": "Malware payload (AgentTesla)", "value": "581ef7c76379b0d34caaa2a2c6fe4529ad6127c2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214559, "uuid": "96c25b77-2690-4e73-af7b-cd15cd1506ed", "comment": "Malware payload (AgentTesla)", "value": "4fbfe73eebc8e19c29c6fed0559d2d9267cb63379fc4de634ae3b0b4fd353c3318a23660899e016d32b38a9516f16530", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214559, "uuid": "c08e23e7-387a-4e9e-9517-b09f07dbd060", "value": "T17AE4025662821F88D4112379C1C60B42D3B7E035A6B167DF7F2DFC099FA398EE412B1A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214559, "uuid": "f0200a49-fe88-4004-9b45-094cb687f442", "value": "6144:bEdCkS+KkKgD/uGSxtJ7Rmt66CjUlKhf0YVz28v6tO7A8SWx:gS9wD/uGSl4t66Ch8YN0tO7A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651214559, "uuid": "d75656a7-abbd-4df2-9a85-5ef3f2b00dca", "value": 684032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651214559, "uuid": "62c7f25a-bd55-43c3-8738-3c5481a28b7c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214559, "uuid": "81614a0e-3142-49e7-bb16-34aa186da13c", "value": "Purchase Order.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45d7a1e9-c7c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651241063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241063, "uuid": "89b9dbef-52a2-4a0a-ba3c-899e802ccfd1", "comment": "Malware payload (Heodo)", "value": "3e5d2fa22bbde7ce9169b9e2a16ad915", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241063, "uuid": "22e3b721-1448-4f98-8a32-4d9eb3727967", "comment": "Malware payload (Heodo)", "value": "00b42a9e91043a4e33f63fa3df38b7325c4665dc6cedac4540fda3db790e9a72", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241063, "uuid": "3a74ba79-cd2b-45a2-b8a0-6fced13cfbcc", "comment": "Malware payload (Heodo)", "value": "9ed70431d219e1115699e91ad9a3be0a4cf3173d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241063, "uuid": "e8f16d5b-1149-4cc8-89d4-e3aee0b442e9", "comment": "Malware payload (Heodo)", "value": "a11600e0cf5654e2c51f1c948b7a320fe3acdda36957954fb4870726ba96bdcf1c586a5ac31e68ded240d46f3c7479e5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241063, "uuid": "c39c4443-b446-4ec1-9cdb-e46e1ce4d302", "value": "T15AC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241063, "uuid": "864030df-eee4-486e-a4f5-94066c0b454d", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241063, "uuid": "41530e48-ebc0-491b-b0dd-ce1ba4d55abc", "value": "6144:JhZ02GdOOgPYZKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfWKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651241063, "uuid": "41708552-fe82-4c00-af2d-2b4ac242b4c8", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651241063, "uuid": "3dc326e9-071e-458e-a07c-ed73395a6b21", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241063, "uuid": "a36de957-e6e5-43c2-8573-4451585c2845", "value": "3e5d2fa22bbde7ce9169b9e2a16ad915", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5349151d-c77e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651210591, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651210591, "uuid": "f418869d-a221-46d7-a784-23bc29ab2688", "comment": "Malware payload (Formbook)", "value": "dcdf4b826fc07339b1fcecf6442c2943", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651210591, "uuid": "1a3e372f-edc6-4d17-be15-1b6fa806b15f", "comment": "Malware payload (Formbook)", "value": "00d086794b0b9ed430180b595734faa55317c0b09b632e767f30824de16f0692", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651210591, "uuid": "e05247f6-b886-42d2-8197-1085b8b0c429", "comment": "Malware payload (Formbook)", "value": "d21cb4a2856d90f3a08ccd929bc3eb4812c2f29f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651210591, "uuid": "db348d74-b029-41bc-9c02-2007e840052d", "comment": "Malware payload (Formbook)", "value": "374ffbc8dc2fe2e26259ad0d67533679818599169943db6e1d58b0b71c90a2268fe0a2f429e16a869faf7071af80b3f0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651210591, "uuid": "21dba24f-c8b1-4eba-b08f-779ee1524997", "value": "T10FD3C7596833C115EDA2CAB8B544E8704757FF20D18A477328E9FFCB74F4A370A2964A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651210591, "uuid": "61afc633-6e93-4a28-91c8-6937c9622fee", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651210591, "uuid": "bb274236-24e1-4fa4-b851-bfad90532593", "value": "1536:PNS5UFaMb801UWCfEKCZY3PsF3mNE+DO2:PNS5UFaMb80UQZw0H+DO2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651210591, "uuid": "d81cbc98-a9f2-4de5-9634-969ff3d63309", "value": 133632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651210591, "uuid": "6327a6dd-4701-4612-b53a-b8fd18a3ce16", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651210591, "uuid": "aa8a4afe-4dea-48b4-b417-b63c58eaa80f", "value": "New order_27.04.2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e2533c91-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651215556, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215556, "uuid": "4391e4d0-0550-4eee-b9a4-d5d9ddf0d0f1", "comment": "Malware payload (Loki)", "value": "8a0e83995997a4156ea04f3a96510cdd", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215556, "uuid": "6548c128-5d9f-44da-9712-ef592aabc0e6", "comment": "Malware payload (Loki)", "value": "00dc2e3aafd8a6253c6bfc0a447de630b65986773fc28b452254373401615c54", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215556, "uuid": "77bfa169-ac1f-4b64-a43b-64540f9f05f3", "comment": "Malware payload (Loki)", "value": "a812ede99886da3e8f7c08b6cdca30d369cd064b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215556, "uuid": "47bef24a-b1da-42b8-80c7-1c97bd778b6e", "comment": "Malware payload (Loki)", "value": "0253b3550d2ddf7cd2f7e868dd1e526fbd3db8d665e176a0162bef051f6f4435643715616d5b4a71b0eedf2133a11b21", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215556, "uuid": "d1ab7539-746f-4a97-8629-6fb848365851", "value": "T19C93E11B6820E95FD867A3335719DA8715790EA4F9FD090B713F332ACA37A99462033D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215556, "uuid": "1bff966e-a5fd-45fe-9c0f-565d9e2af6dc", "value": "1536:dpDOlMrN0fGtKGhwxRA9PU1RBVYmIDxL1PU6SEPO4WfYmHl+fvajWXyYP9:dY+0fwKG5e/BVYmIFL1PtHPCYmHl+Xy0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215556, "uuid": "e52bd75f-3fca-4df9-9ab2-aed4de7ffbe6", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215556, "uuid": "ae3e13c2-35d6-44c5-a6cb-51c82bff41f8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215556, "uuid": "08d3f0d0-bb0c-4ef4-ae0e-dcb46c79a099", "value": "bank slip.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf3610a3-c79e-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651224543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224543, "uuid": "c3bd0298-15da-4c28-aaab-9ce294a9edcb", "comment": "Malware payload", "value": "5f1372adef414b72df4ee1e06cd342c8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224543, "uuid": "c822495e-41a1-477a-acfd-b3aaa182940a", "comment": "Malware payload", "value": "00f905a621a5237b54974c1f0033ee38a970f2a2eebbb9bf562e2eaf6701d744", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224543, "uuid": "562c39cf-b6f5-40d7-92ea-d87b7df7af9f", "comment": "Malware payload", "value": "9854ad86b40435ac1052c9a649fb485b3f77c82b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224543, "uuid": "a0efe536-91d2-4d7c-a13b-fc24b3ca4ca0", "comment": "Malware payload", "value": "581a00332c6f19bdfaf10d47b549c826cbe6dcfe9701225bd2604fb1b9166a31bca4ed90604e90a3a2a20b7df5ce1a1f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224543, "uuid": "d99bd254-dd34-43fa-aadf-35f79f0d0605", "value": "T179C6F012F7E1C079E5970272863687B96976F721432480C772CC2F6E6F30AE1AA3575B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224543, "uuid": "bcebc4f7-4588-4a7e-9a65-24c4827ae4c4", "value": "ddfecf8efd72d35a3d91937a399b056b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224543, "uuid": "e8b79637-5ffc-41fc-97ff-164c639c2c54", "value": "393216:Je1c0CICeoIR+bmrfX+A5mteDM64lCT3PRzWFIvNfHU4Bwmc1M9v:c5CbeoIEUiOpXRUG4M9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651224543, "uuid": "a6e09943-6bc0-4855-aac6-452c61c688ed", "value": 12599976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651224543, "uuid": "7a907440-30e6-4b08-b378-2d7f9d5347f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224543, "uuid": "6e8d4b66-360f-4e43-97c8-0e4da950dee4", "value": "skylarinst-wins(106.75.252.137_80).dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01724c6e-c803-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267577, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267577, "uuid": "ce3e6bda-be30-4eaa-b72c-87be5f01070b", "comment": "Malware payload (Mirai)", "value": "f9d7b14b72cc12807d34424130551f0e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267577, "uuid": "7fd336ec-dfe8-4539-bd61-7b815b290e22", "comment": "Malware payload (Mirai)", "value": "01073c7e2c83e64bed4b921c8834f3608e099cce43eca3f702ad64e9103972c3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267577, "uuid": "8149dbab-20db-471c-95ca-55e3874cb150", "comment": "Malware payload (Mirai)", "value": "4d5c5565a4c7da5b0a780d6c9b6e0125ac2f6649", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267577, "uuid": "b7344660-39c5-4c3c-92b5-37cb0fdc6ac7", "comment": "Malware payload (Mirai)", "value": "304f19ee7bd0414189d5231b37c823922409a4750c7d8606ae3de8594ae8b2edcbb3a960108ee6c42522cc87b5f69f7d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267577, "uuid": "435136f7-596b-49c8-ad9a-1676ed1bc313", "value": "T19EC33A46FA418B53C4D51B7AFAAF41493322E798D3DB730689186FF43F8666E0E63601", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267577, "uuid": "225f167d-e2e8-4e90-b29d-de813f223620", "value": "3072:SJkHK8uzHYhlKgZPqRJd7qNl7h1+b2L8M/91ce/:skHK8uz4hlVPqRJd2NAb2wM/91ce/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267577, "uuid": "916d426a-d490-4dc5-af73-d188adf7e561", "value": 128096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267577, "uuid": "1eba03c5-0dd0-4b15-868f-0282346d45a6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267577, "uuid": "531decc9-f29e-4164-891e-40e87ed93444", "value": "f9d7b14b72cc12807d34424130551f0e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11deae6e-c776-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651207046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651207046, "uuid": "90b5714a-5f17-46be-bb97-443a81e465d4", "comment": "Malware payload (Formbook)", "value": "2b0846ad491c37f637cb3cc76c889dc9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651207046, "uuid": "d0a467fa-fd44-4b65-8572-5a3d7679ac23", "comment": "Malware payload (Formbook)", "value": "0157b0a6c0681b2980c75d5942bdc49263afa260223d4cfa1246eeb26d85fbb6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651207046, "uuid": "6bf73597-98c4-4ffe-a288-3ac07bff2799", "comment": "Malware payload (Formbook)", "value": "e1b192b262120a12d4deadaf662999e2d34e5b77", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651207046, "uuid": "de4d83b8-9823-4c27-b9f0-3c6c29254bbe", "comment": "Malware payload (Formbook)", "value": "49bf7d079502868f869c5db9246668bd431bffab3a3d5a52a1a85356edef2a5015fd408e051af381152cb3e9403a84ae", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651207046, "uuid": "3207205e-97f6-4b6c-8012-f3847de0f11d", "value": "T12D14026476F4CA67E5A346321D368B339FFAA6021458524B37907F593C322C1DD0EB26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651207046, "uuid": "d7c0c09d-e838-4737-bb63-96785b6db6e0", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651207046, "uuid": "f6898258-3776-44f0-ab38-032eba7d3c01", "value": "3072:l1NjcVVnLpPunbXidtEL5tUbhyuUMkNhdrkinbysbs/5unPGSsvZ9lewTvYI74D4:HNeZmydUrqwuRqd3bs/5+uTRv6D2UL1e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651207046, "uuid": "1e67b0a9-5196-4e6e-a7b2-9247901e30d5", "value": 196334, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651207046, "uuid": "a15af89f-7604-4606-bad8-881db8432014", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651207046, "uuid": "099b34f1-73d7-42cd-8565-440f793a2719", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce1c10f7-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651215522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215522, "uuid": "a6eb9768-674e-4bad-bed8-e683ab7ff637", "comment": "Malware payload", "value": "75912c582b96af76e153d7c758833994", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215522, "uuid": "31c7ac72-7d0b-4e96-b481-926471c23498", "comment": "Malware payload", "value": "015ac5c92581720a1a3a040520f68136c71f98419d118261bebfb1b413382e8f", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215522, "uuid": "34680b66-aa89-4cc8-9275-909af17ae86e", "comment": "Malware payload", "value": "e51142d74442bb68c93c1c459b60abcaec02bc7b", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215522, "uuid": "5ebc8609-bced-4042-aba6-38ceba0408ab", "comment": "Malware payload", "value": "d94b8f5004d56e9069e10f86d4529e6ba76204da8846ee672097ec7fa7371c6978e9ad361e2b05da32f5dbe8a30a1fb1", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215522, "uuid": "530b691c-133f-4b50-9c84-0794970908fb", "value": "T1FD366D22B284653EC46B1A3A4A37AB68993F7B713A22CC5717F41C4C4F356413A3E75B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215522, "uuid": "08d83ce6-a8d5-4b97-89c7-79dd62b88377", "value": "98304:f4fyG707n7dAz4OfQ6tw9UlqA6RiyGOYAA:fcj7EnRAz4r6tw9UlqA6syG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215522, "uuid": "f6be5fb3-5b09-4c62-aaad-57d3e79363e9", "value": 5294080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215522, "uuid": "a311b741-16c3-4fec-a251-008d3cc4cc6d", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215522, "uuid": "d6a6645b-c7af-431b-84ce-f74d70dda0d9", "value": "Archivo.Endesa.FactsFecha2904V3.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a7789d-c79f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651224749, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224749, "uuid": "5995e951-70cd-404d-8ce2-a524ad535e9e", "comment": "Malware payload (AveMariaRAT)", "value": "ab0ddfae3704e8009014363b33be8b9a", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224749, "uuid": "af7ea848-1bfe-4e1e-9444-544a95253052", "comment": "Malware payload (AveMariaRAT)", "value": "01ddd4c4061b03095de0504ad3ece8b47918682c023945f2bd7444474d1113ce", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224749, "uuid": "4a6823e9-0557-469c-8416-dd41d5589424", "comment": "Malware payload (AveMariaRAT)", "value": "a5dc809aad50a3abe21e9596a812484d0b1eef0f", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224749, "uuid": "1f90402d-e642-4e34-bac3-3ba428dd1044", "comment": "Malware payload (AveMariaRAT)", "value": "dd56944163759e0f2bb37e059f05662f936359058ff0e0abc642c8ce05ed012563ecf0d6fd9a0d6a21cb619f34d6db48", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224749, "uuid": "4b91d57b-de05-4d6d-8e9a-b94f0e58c94b", "value": "T173C2FA00797D5723CFA54BF056D19211AF3DB79A3021E76E4CC7E5CA19E2B818682E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224749, "uuid": "5374597d-7feb-4c04-8b0f-8a690519a875", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224749, "uuid": "62958bdc-3e0d-4ee1-b30a-aefe42a14d74", "value": "384:MXh665Ck1c+PnoGvVihEs8wvTpfS/jstxEibrm+w1PAoSKtD/HRN7VrNlRGWJX:SA8SK+p5WP5xtDvVUWJX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651224749, "uuid": "4eab3929-9d60-42ef-956a-80a48e251328", "value": 26544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651224749, "uuid": "be8ff600-b48b-41af-b86a-1aaf6c2a5871", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224749, "uuid": "2b431893-6bd8-4632-8ce6-94178fa01e0f", "value": "JJHHFDJKJDFIER.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3a28e1ef-c7a1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651225582, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225582, "uuid": "004e18e1-b774-4c26-8193-d44ab36470a7", "comment": "Malware payload", "value": "a8001a41ff346c73057091dc3809b3b9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225582, "uuid": "16f2b59f-1ab3-4e2c-a7e6-93369b096667", "comment": "Malware payload", "value": "027820bd0febb36d9cf5c639005984bbf682096921773f81e548ede62f4e8248", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225582, "uuid": "9e8555fd-2c0f-42bb-8d0a-0530199f3b26", "comment": "Malware payload", "value": "a2d0a634a682b6a57df3157432713e0c9a912034", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225582, "uuid": "a0c45256-70ba-4e86-ae5e-6cfbb6d53233", "comment": "Malware payload", "value": "8fe6a183df0e3c2dda35106cb7d27fcad047840e25a044718cbbc05f6f7758377637ee5b56eaf871b6ea769e21ca1768", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225582, "uuid": "b054594b-f09f-4dbc-99d2-e3aca7ce6466", "value": "T118A10734074C0D43E68688FA9061BFA7152BF667E0C72EC1337EEAB10F631601A39181", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225582, "uuid": "f3910e31-4be4-4a37-920e-344d61a90d27", "value": "96:5T2VtBagTWneUpzX/os/NvM1VEr4stKNkdbw0o3S9vDrCDI4jCxeZCfDJ:5ofKnlzXRMLGSs2C9reUaHeN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651225582, "uuid": "24822bbe-13d3-4e7e-a793-8babc8811f5b", "value": 4897, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651225582, "uuid": "14e2a417-c035-41ab-aa3b-c4bea26c96fa", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225582, "uuid": "6a936315-fd69-4eb7-85a2-938d9888ebb3", "value": "PO301148.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f460d02-c794-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651220141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220141, "uuid": "edb08ba8-cd5a-481a-b2d6-b65e6d085c7a", "comment": "Malware payload (Heodo)", "value": "1fd1b2e3b6198e1d144bfa04b2faaf9c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220141, "uuid": "294a7a82-520f-40d6-828d-b17811e93a83", "comment": "Malware payload (Heodo)", "value": "02a4bef9c62df51132de16469dfd42be497b238639163e807f276992da0fdd61", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220141, "uuid": "1391f27d-b3d5-46e6-98e7-bbddd0d30797", "comment": "Malware payload (Heodo)", "value": "6c49b2232d23b7afd8dac6c1ef56c35fae9ea2f6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220141, "uuid": "154701e5-578b-42ac-a0f7-5d9d66a84083", "comment": "Malware payload (Heodo)", "value": "946025070b684ede3d33f41c2d2944f71a7fbdb0621d2a2544e0f089d1233da9d6d931dbf506aa2f4fde0a1db26354a5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220141, "uuid": "b6b2a46a-b285-4ec4-8c9e-88d88034eb22", "value": "T160515E282DEA6218E6F7EF7059EC7685DFA675A2B9524A5D0082070E4922600FD91F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220141, "uuid": "840d2e1d-c1c8-44fa-adb8-96a13b15c93a", "value": "24:8kJ/ByUq+fONk9AuRIZJiXRF4+gQo/uIH/y1XyHgbHo/umVlncIEjaem9dRGObpQ:8mWx6Xj03ugtHU+uccIx/cC/N4ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651220141, "uuid": "d25279ca-b046-45e1-a722-c420ad632849", "value": 2454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651220141, "uuid": "2406281c-1eb3-410c-a1a8-b8b30cf9617b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220141, "uuid": "31190b8e-8c27-45be-83d0-99d78927efaf", "value": "RFY-010422 DGSP-290422.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e49664de-c7ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651236605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236605, "uuid": "2a65e5ef-3e22-4bec-b4f8-385c6f3ea2c4", "comment": "Malware payload (Mirai)", "value": "de21e6c5f3ba755569229b45a5ef215a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236605, "uuid": "d5210e64-1ac4-4586-887d-d61712925346", "comment": "Malware payload (Mirai)", "value": "03e6f09bbb61920fe39c8fadcbba554eb60aabd75e15aad200fa33f84b4e6234", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236605, "uuid": "920005c5-ab65-4a23-8305-c7f8c8f95065", "comment": "Malware payload (Mirai)", "value": "478df7d9e72529ad37f8503cafb978b09bf05003", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236605, "uuid": "e2af2cd5-82b5-476b-aba4-9d4e9f50bb60", "comment": "Malware payload (Mirai)", "value": "c1fd6cb5df4b6a36a44e4ceb76723fc26424d4f3e6841f04050098b995849dab8e2bfe279967adfdc470210c0c012a78", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236605, "uuid": "08026fe3-3f72-48e8-99f2-f3946c941a2e", "value": "T1CE533956B9818B13C6D052B7FB6E42CC372613A8D2EF73039D256F21378792B0E67651", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236605, "uuid": "ea5b6f53-d329-4100-a47c-8157eff77396", "value": "1536:KQyrPvh1pJm6vohVlnUS+UuLb4shev3C:3y3mVpUSa8t3C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651236605, "uuid": "16f97cdc-c19e-4b56-9d41-ae1e6abf4a95", "value": 63792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651236605, "uuid": "eb2e1f4c-3302-4bfe-b363-021d6ac27b98", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236605, "uuid": "cabe419b-c3f0-4b87-8101-cda4ab6e7f6f", "value": "Cronarm-20220429-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9a0aa6e-c802-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267510, "uuid": "b804c8d7-b24e-4371-9105-370eb6cefc19", "comment": "Malware payload (Mirai)", "value": "1565aef0e534f38be32b81a0e6fa3bec", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267510, "uuid": "50a49d36-65dc-4bf1-943e-939c139b6f15", "comment": "Malware payload (Mirai)", "value": "0427b7d73c86363aea85b23b22a52add6d78a9efa7d5b30ca74fa5d78b705fbf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267510, "uuid": "07fc6206-f447-4734-8e2c-626bf2049dec", "comment": "Malware payload (Mirai)", "value": "f32c0f0bfec5416b34e9cc8e7decdb5235d8c0f0", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267510, "uuid": "20305776-1372-4ea2-bb19-6d5d0a1c7100", "comment": "Malware payload (Mirai)", "value": "869921e57856f05e5f2704a134cc64216d92568231746335cce723343ef5ab7600d12541fb05be1cfc7f196c7cfad667", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267510, "uuid": "716c478a-de92-4229-867f-6dfdebb91118", "value": "T12243382579BA3E13C0D4A4BE16B34F15B2E0377E30A4C62EBC721F9DEB50950664B6B1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267510, "uuid": "cea689e7-e961-4b2b-9c41-f64432a5319a", "value": "768:BZoDGT9zOq9yaf7luDysHqf4zB+g2J+7vlGvpO+PpBYA2y:BZ8GT9zOSyaf7luDBKf4H9gp0Vy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267510, "uuid": "a9a6bb6c-82b4-44d0-8c22-866fbb1b8584", "value": 58604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267510, "uuid": "b2ce19d6-6dc8-44b0-8f03-045ceb9ff46c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267510, "uuid": "6cd95ed3-7032-41f9-9cf8-729bbafff2d7", "value": "1565aef0e534f38be32b81a0e6fa3bec", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "640aa67c-c770-11ec-8e58-42010a9c0032", "comment": "Malware payload (Triusor)", "timestamp": 1651204607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204607, "uuid": "21ca8850-9538-4661-b557-b0467f73a73f", "comment": "Malware payload (Triusor)", "value": "eda3ebdf7cceaee09fd40cfa5e77c4ec", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204607, "uuid": "428acee3-68cc-49ea-b316-4564644cd46e", "comment": "Malware payload (Triusor)", "value": "04a69a6eb5ed9ae92faad5cb6aced1f20306ac3da5e128409b3c15f2ba28f71a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204607, "uuid": "4f0c4359-51f9-4cdd-b81b-e15c3d48a1e4", "comment": "Malware payload (Triusor)", "value": "eeedded4056161a51cd035f64fa83ba69a484a06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204607, "uuid": "206539b6-f5f7-4ec3-adc9-8e130597b578", "comment": "Malware payload (Triusor)", "value": "4662ac9d01416ff51f9492be059687a6d193e6ce9f4e958c493c3adc69857a330f102c1a819368f9f93cba7567816df7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204607, "uuid": "d56fd59f-6951-42d6-aa75-ac6e7f23a48d", "value": "T197C3B091E344D897E99B26F6583ADD212167BE7E8478491E208D36394BF334220F7E1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204607, "uuid": "bff90980-000d-4b24-8711-57c81c3d6267", "value": "12a30b523ac71a3cbe9145c89400dd7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204607, "uuid": "f12c42d0-f3cb-44e1-89cd-22f36710c476", "value": "768:73fLHq+v4tiiiii5vWMoZ/56lVbYuGGaql3ti7sHMTtNIBQJbvRJcvnyNQC+NaHb:7LHvv4a3pfYRPigjcgZDTUoAVj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651204607, "uuid": "45c03d9f-7e76-4f90-ba99-1f1b50514a49", "value": 120320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651204607, "uuid": "3e2dedd0-02bd-4bd0-a241-441371b25157", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204607, "uuid": "f7a0f26e-2bb7-431a-a880-ea98def7ef23", "value": "anger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b2dddd7-c759-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651194633, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651194633, "uuid": "5dba9c95-6ae7-4d68-b6eb-b5a8d99186a9", "comment": "Malware payload (AgentTesla)", "value": "a0c50b824dc9a135d7747010008ae73e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651194633, "uuid": "d651a9e4-1e3a-443d-910a-66ac253ef469", "comment": "Malware payload (AgentTesla)", "value": "052e0c7aca7de7964208266fd6fc808d0d673f03ed3e6329e92ca06ec8a92a5d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651194633, "uuid": "3c29344c-ac7e-47a4-bf6e-3d0b355a35f4", "comment": "Malware payload (AgentTesla)", "value": "b3e70bc7ec999dee8b835439c31a68d0f9dbcba5", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651194633, "uuid": "29209e0d-cb11-4e43-8c6f-65406cf21b5f", "comment": "Malware payload (AgentTesla)", "value": "c9753abc026585d9847ed6a12e43cb03a6c154006fbc2b6054dfb64b8baf72487dfda532281622ce9fb4f705778c2aab", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651194633, "uuid": "6f18466f-81a1-4ef4-b9f6-ca681883f061", "value": "T19EB4AEE836809AE3CE66D97F13ED5F9121F012768535F7436F5063E00693ABF2A25AC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651194633, "uuid": "f10f5fab-2934-4e99-936a-57756f53fa8b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651194633, "uuid": "c9a7fca5-5826-4054-9c13-d8e68c96eee8", "value": "12288:+Pce+j8AzmLY9ZkYaiXJ7ola9YjCF68pwn4BbSnG7tSf:1e+j88mLYckJ7h9RMn4ZSnGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651194633, "uuid": "90260274-5e58-4aa1-8f00-bea5fb2fd710", "value": 539136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651194633, "uuid": "253eaeaa-c62b-431c-a002-6384b319968d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651194633, "uuid": "e9947ab6-3515-4a40-af64-a866f57eb556", "value": "SHIPPING VESSEL ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95bc2af7-c764-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651199536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651199536, "uuid": "a756f7a1-ca5b-42f8-a979-920786bbf5c2", "comment": "Malware payload (AgentTesla)", "value": "4b905dea215d68cd059ff2f13b48fac7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651199536, "uuid": "a59c3acd-abfe-472a-8289-a17894f8d741", "comment": "Malware payload (AgentTesla)", "value": "05b4516569076ea725c009654ed08e6dbcf40f4fba32572f3d5070b5cbb270b2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651199536, "uuid": "48fa3f8f-db20-41f9-9fd9-9ec3a7d4b2ee", "comment": "Malware payload (AgentTesla)", "value": "6b46bafba9ed396dbce1ab0b7cd2eef262bfd562", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651199536, "uuid": "a17c16c3-3013-42fa-9a53-57ad3e34360f", "comment": "Malware payload (AgentTesla)", "value": "dba3bb1ab3f6e56f096fe12045c483d87e8cbf69cf69db1846ff9cb9b33cd4e0ef44167e6661780c90b9e56f5e2c6f52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651199536, "uuid": "22aa4ec2-3bf5-4588-863a-92d5194cccf0", "value": "T149B4BDE832859AE3CE66D83B07EC5F9111F052728535F7436F9063F00693ABF6A25AC5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651199536, "uuid": "e404a7c9-655e-45ba-bece-3a8dc002f137", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651199536, "uuid": "1eb3e739-7d5b-4469-9460-d3c70959db57", "value": "6144:EF3X88YROiPjQ07lzxBcYZbJZTp5ARaMOEg5lir9t/jgcJfan+OjDq+z9CLVFOMv:EFbDi80pz5Z175A8BTijjgkfcG7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651199536, "uuid": "94fe4757-4535-470d-a104-c0a2524ffa91", "value": 532992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651199536, "uuid": "c468422e-e716-420d-8f2f-d8a818a749ff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651199536, "uuid": "4af4e322-979c-44c5-8751-d5e77bf89549", "value": "REMMITANCE ADVISE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6c1b364-c7cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651244313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244313, "uuid": "8d9cb83e-3e10-46a6-9f69-26caf46b6581", "comment": "Malware payload (AgentTesla)", "value": "0d52e84438e79cdc06da0a120e2489cc", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244313, "uuid": "6016c6ad-3b9f-4046-b113-c39e972e16b4", "comment": "Malware payload (AgentTesla)", "value": "0603d63127ab35c0b3f89522ee78c76ef56ae7b82a6f26dc11b01ace73c6dd62", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244313, "uuid": "a7aaca29-fd98-4659-bdd5-2477e83121b9", "comment": "Malware payload (AgentTesla)", "value": "197e7bb8a5a14d01c68b940752de8a0c4837c9a1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244313, "uuid": "9ef9b396-3a79-435e-8744-79791bbbd5e6", "comment": "Malware payload (AgentTesla)", "value": "22d5da37bf7910589b76f5afd68de7131f9999f305d5ddd54ca57edcc0a1bbd692cc8b6e8a21314dba98583b0cda31c9", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244313, "uuid": "8ba93890-f35b-429b-b095-67b0fcb1c20f", "value": "T144E4E110F77ADB12D2EA5733C4DA410487B4EA03F012EB4F6AD662C50D0779BAC52B9B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244313, "uuid": "680c7736-bcf5-4113-a602-5ca6b349c2d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244313, "uuid": "d43319d5-77a4-476f-880d-89f3b857bced", "value": "12288:xQVHl0RxLWJevdV/VVfsE7WkJxdTYmRtmQRTwF/Ac5FmeyT:yHSRtQw1VfsZkfdMmRtczyT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651244313, "uuid": "74595fe1-4365-4a09-9cf0-8fc132874b76", "value": 665088, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651244313, "uuid": "3dd32867-48c1-4750-a98c-b318c038fe01", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244313, "uuid": "e0a4e3be-11ea-4c1b-957a-8ab0096980f2", "value": "Swift Copy..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92691a6e-c7be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651238185, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238185, "uuid": "d939b719-dc90-4e46-a790-566d435b2f65", "comment": "Malware payload (Mirai)", "value": "015f23467a6c7636774a19d9c65168ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238185, "uuid": "604da0b0-aa49-4e2a-88c7-4ebadbe42da9", "comment": "Malware payload (Mirai)", "value": "0615fd73dee1e3c3fa28e75159da9dc7326c522fcf240888c5be6dff5fb7724a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238185, "uuid": "c3f38544-7265-43a0-8d98-6a0398ca6ab8", "comment": "Malware payload (Mirai)", "value": "2e2f60ffe63841a37895fe602ec9b08469c32c55", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238185, "uuid": "70e89a9a-6bcb-40f2-ac98-01faba3d2f48", "comment": "Malware payload (Mirai)", "value": "adde1964c5f3f2c9a608999d3de13b3acb5b24894ce9c14473f19cb80b1c4f5dfab83c06e78fb5f37ddf5e9cc09933e8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238185, "uuid": "325bcd4e-5508-4589-89ec-5dac8679111f", "value": "T146C2E02A53B7E2E2E9354937F35EC2457B950DBC42BB7226C1D0DFE8DAD000A14F6612", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238185, "uuid": "9523c3f9-3e96-4c48-905e-5eb47f5c8cc8", "value": "384:9+0K3ccejsacBZZT5YvCLMStV1zbArc/QJP/9pa94URWheEmVlSbvhymdGUop5hH:Q0K3c3XM5w+VQc/6C7Qheevs3UozN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238185, "uuid": "f5bbf6c2-909c-4fa5-a80e-296655c6776d", "value": 27464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238185, "uuid": "26e12a00-1fcf-4f90-93b6-332d5358ff6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238185, "uuid": "e4c1aa51-91f5-4f24-a4ad-f8dbf7417ad7", "value": "015f23467a6c7636774a19d9c65168ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "701aba6a-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651232544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232544, "uuid": "ac0161f0-8084-4643-8667-aefa6b4ad70c", "comment": "Malware payload (Heodo)", "value": "a2ad47b5cfdb0c26af9c673589e584f2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232544, "uuid": "4012fdfd-2af6-4163-ab53-4fa6f18b2133", "comment": "Malware payload (Heodo)", "value": "063b9a81603575561d1e7c82255a39bd6457a48798344353ac6842537550d540", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232544, "uuid": "8ff3fefe-483d-4102-9bba-f5073c048bef", "comment": "Malware payload (Heodo)", "value": "5d0c1bd2a41a9a56fc6ac42b8037e6f3edbbe399", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232544, "uuid": "b1b743c4-cae1-4ef7-b9a0-0292056ba62e", "comment": "Malware payload (Heodo)", "value": "5917a21cb091327bfb04500c10e3447a7378f986a5d2b1078fa3b0358127e9204156606f94937f96fd6b753be2112429", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232544, "uuid": "d94e8efa-631e-4209-ae33-e401324c2c4c", "value": "T17DC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232544, "uuid": "aeb87518-4f18-40e9-9b5a-02b28dea6452", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232544, "uuid": "18c9d036-dc87-453f-a9b7-a4bb066495bb", "value": "6144:JhZ02GdOOgPYfKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfkKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232544, "uuid": "a88cc4db-2a93-4e67-ba22-484b067eadfc", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232544, "uuid": "b5b6a7f5-615c-4964-aee7-cc13f513de7f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232544, "uuid": "f572e349-5cfd-472e-9119-f1ac5bb397e0", "value": "a2ad47b5cfdb0c26af9c673589e584f2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60832923-c751-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651191286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651191286, "uuid": "21e156f1-edfe-4e7f-867d-c2bae3fe3c45", "comment": "Malware payload (AgentTesla)", "value": "d59b74fa373ede3c6a9c67cdd75d10bb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651191286, "uuid": "747b2268-853b-43f4-8a31-c032d80a9acf", "comment": "Malware payload (AgentTesla)", "value": "067dd60ae53b394713004e52b952daff0db9a9725d059cd2b779f0a30c7dce6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651191286, "uuid": "8c30bd99-6a32-42af-81a2-2482e0b5452c", "comment": "Malware payload (AgentTesla)", "value": "168c4b8219afcbd25b9e19aa199e2c2a4ba342ea", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651191286, "uuid": "766edd17-45fe-41c0-a7cb-1ab480479693", "comment": "Malware payload (AgentTesla)", "value": "59667efaf99ba2438016e3c24575a17ac8ce1921dfbb1a22f0d4c6b747c074352a4c24c28f95c8ce84e9ad453ce09f18", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651191286, "uuid": "89c21e43-85a2-4a36-9b15-2d4f3fedeec3", "value": "T159C41249939D8712EF6BCBFD96343A1583F438163116EFDA4CC1B5E90A2A7D00994FA3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651191286, "uuid": "ecf03f15-6d9c-4cd7-946b-af7230174746", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651191286, "uuid": "f38f9d23-d171-4b02-94f4-84225bb515f8", "value": "12288:yLWJeGsR7JaEkTg1/lruYUSBAzpNHYRm/uZVE5S2zW4V4:WQOZsGdqxSOzpNH/yEW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651191286, "uuid": "ab7fb3fe-7e1a-4125-9b38-1f7c929305a5", "value": 571392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651191286, "uuid": "ac26728e-595e-4e04-a56c-d04694a1d613", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651191286, "uuid": "81b0ea05-a9a3-44fb-9d1e-5822329826fc", "value": "d59b74fa373ede3c6a9c67cdd75d10bb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "848273c7-c786-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651214110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214110, "uuid": "94da5e57-f22c-45cd-8023-75bb0e6d87f5", "comment": "Malware payload (AgentTesla)", "value": "03fb969fc042a2a3facb412d14a5b181", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214110, "uuid": "e82f8425-146f-4ad0-ba0d-bbc32096ec91", "comment": "Malware payload (AgentTesla)", "value": "0781563793d33503140a19bdf4d9f9a0f97a7d538a697746705b86f00fe7c2ea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214110, "uuid": "f23df39f-45e4-40a9-910b-a3916ba97dee", "comment": "Malware payload (AgentTesla)", "value": "c2d74f7450b5a3e3c5439fb58ca39028dd7c1c93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214110, "uuid": "3a3d23a8-fc20-4efb-a6c1-040d13d52431", "comment": "Malware payload (AgentTesla)", "value": "037589cc62e548b637cbe8664418f300ce6eb4159e22074da49cc71bbc1e5d8dffd7476813bfef83499c5b30d4b7a6e7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214110, "uuid": "dbd77669-b204-4187-93c2-739359d0090e", "value": "T1D7B42368549F71FC460418E26FE41C419570DA13BC3BCEAF4A319999FE706BF97CA488", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214110, "uuid": "22bf7ced-9050-478c-8e58-d52e6f640969", "value": "12288:q4ohLLVJGF9dptqAdU6HKvhQxY/igeKob7K:+JsbM6HKvhQxYKgO7K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651214110, "uuid": "301f222b-1c85-4a14-94e9-43e1ee5dfcc8", "value": 498624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651214110, "uuid": "81644082-5b5d-400a-ba9d-7d69ea13b559", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214110, "uuid": "f50e10f6-38c2-4662-ae10-ebdfdf5dc8d0", "value": "invoice.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69b8c6ee-c7cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651244130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244130, "uuid": "8bf6fc6b-ae8e-4516-b5ca-165971ef0fef", "comment": "Malware payload (Formbook)", "value": "be5ed5de4ccf08100a614d7b8e1b09ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244130, "uuid": "c0c9163c-a130-4134-9b87-45da06b71dc6", "comment": "Malware payload (Formbook)", "value": "07a39c11c0881de44b81e5b192d41d29c3dd8135884d65474aa765d11eaeb7cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244130, "uuid": "73fc051d-0156-47ac-bfdf-575cd4c09cb0", "comment": "Malware payload (Formbook)", "value": "8750cb46cdf1360740a27458718c3031b3230f56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244130, "uuid": "de1b65b6-3376-4672-a2e0-5fe977f15eef", "comment": "Malware payload (Formbook)", "value": "0abf814142617942774c3bc13898dbfe304467704b7af1b64f81573a5fdbb82c89fcb23ee501585175ea65cc65044e2b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244130, "uuid": "04de96c7-dbc4-4ce7-baaa-1767f9415ae2", "value": "T16A234B06EE89C0A2E6D1067DDD92F5E4463CBD2EEC13D60B2585BE067EFD2C34EA1161", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244130, "uuid": "a5224965-7286-4de7-9df8-3a3ae86c76fd", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244130, "uuid": "13fbc045-5f37-4865-86a9-ab6d0b3f761c", "value": "768:7uxHjtMX2fqdhAxYwH/9gB6uRdEtGH4g5sk5:78MkXxT2B6mGc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651244130, "uuid": "982a7fad-492e-4005-b83d-2b05e1c42bad", "value": 49664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651244130, "uuid": "b07beb47-e30b-4f3f-aca8-60e8b44fc4da", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244130, "uuid": "094ec21a-a7e6-4370-bfe2-30aa107775aa", "value": "be5ed5de4ccf08100a614d7b8e1b09ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29f0a885-c787-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651214387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214387, "uuid": "188fe30d-cbcb-49db-82cf-fad04967a30e", "comment": "Malware payload (AgentTesla)", "value": "6be9f5760694f751a0f0f5ceaf895bbe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214387, "uuid": "8a923c02-1c7f-42e5-b2b3-fa692c93859e", "comment": "Malware payload (AgentTesla)", "value": "08978f1d94347f9782d17a2249ee4d416c38c3f060ea0e0c59be4327f73eb3e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214387, "uuid": "1b36efe8-6669-402b-8413-1fed044f2f24", "comment": "Malware payload (AgentTesla)", "value": "df3235ce9335a89bee74248aceee015a46a289b6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214387, "uuid": "f3e3a792-91b8-44b7-90f5-e74a5e374127", "comment": "Malware payload (AgentTesla)", "value": "d1df3d6c7a75477f3cbaaab10773a41b1eda8e865478bc45aa790d1897d2637ffcbe2ea1470fda384a090049dc2d64f5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214387, "uuid": "3c6758f1-852e-4e3a-abf2-f9a941e3594d", "value": "T1479423528E020347FD9C28F153E056A562A60754EF5BE218D4E04CFC2E9DBE6DB28C9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214387, "uuid": "59bf4269-ab5f-4a1a-94d1-e03d46e626d9", "value": "6144:LGvwHvStGZ4ueS52lfjoc4iDkHsVoYvP1xrbEy0ts3kn31ut5mjhqHYSz5m0hx0:LswPSF+Y7+NeomP/HEzwudgD5fhx0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651214387, "uuid": "2c2a0f60-4095-4fd7-a9ee-a850e0b17311", "value": 413366, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651214387, "uuid": "33656e47-0025-4dcd-8c58-b811079f7010", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214387, "uuid": "9708ce63-32fd-4fc1-bd5d-7531dbf6678d", "value": "CURRENT DEBIT NOTE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "182a80bb-c788-11ec-8e58-42010a9c0032", "comment": "Malware payload (NetWire)", "timestamp": 1651214787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214787, "uuid": "8f989535-f56b-463c-8b2c-dbae0008ebf3", "comment": "Malware payload (NetWire)", "value": "f7b76212492733e6d2dacb7503a2f701", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214787, "uuid": "267381e9-10aa-42c4-9f15-bcd8aa0603d6", "comment": "Malware payload (NetWire)", "value": "08e407eed6d689e26bfb4adeacf823082371f050312a8dd13ca66ad10a9e52e9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214787, "uuid": "0c794773-b152-4065-92f9-eaa30ab299f4", "comment": "Malware payload (NetWire)", "value": "4591aa59d9fb0a96cbe0794433d9516bd3a04630", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214787, "uuid": "94a7dd64-8817-4c47-88d2-1a51b35699c2", "comment": "Malware payload (NetWire)", "value": "e1179e8be71911f868c7f160c0e20a7d85a5a5bfccd6918f253903357ffba3997c744798270a069fceccd9b26416b7fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NetWire", "colour": "#B4CCC0", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214787, "uuid": "3fc326bf-3dd8-41ef-bbf8-03695b2232f1", "value": "T187D4120823DC9F53C5FE87FDA122D6019734962AB0A7F38A1BD571E92C7A3D00629797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214787, "uuid": "9afd0d63-3d43-4884-93fc-96e886f8914b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214787, "uuid": "c5e7db9c-bd5f-4aa9-8f28-d2e935102d1d", "value": "6144:naT79hK78eM43AH9z+pe8O9U0eS5L4Vbp4rCUWbVlqPgo3+W/eWsmNELLS0d9s72:RG9MSI44bZriQ9QzaIQTHTVLV0k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651214787, "uuid": "1e74e075-953f-4044-b36a-19390f59d717", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651214787, "uuid": "2b73ad4d-9d1c-4852-a245-cff1561bd8b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214787, "uuid": "1c6cd34e-a62f-4c2a-8dbd-81a7cd7ff3f4", "value": "INV9004433.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "055abe8c-c801-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651266725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266725, "uuid": "813fded5-3543-420d-8991-dd285de9a757", "comment": "Malware payload (Mirai)", "value": "de493816c6f797813e31c99648a318db", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266725, "uuid": "d7c63957-ebe8-4151-9210-bb3564ca383e", "comment": "Malware payload (Mirai)", "value": "0953f8e8d242927cf262e58be45a8949933a73239ceee33122b325bc8f297f52", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266725, "uuid": "ef9fe094-0975-4aca-8ace-c3dafda8b678", "comment": "Malware payload (Mirai)", "value": "4e3bf2f28889cd23f16470ff63cd469766bb71bb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266725, "uuid": "13cdcc89-ce95-4361-9389-e43e2e89ff98", "comment": "Malware payload (Mirai)", "value": "ac24ae6059a87e1180e4a061edd10e6511e152e8780ba661276649b391a4a5d711eba756737942fb8d2686dfd2e0a7d5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266725, "uuid": "1bdb25ff-14b8-4a60-b6d6-147b4b17b246", "value": "T1EB533A99B4038E3CF98BE5BD84150E09B92123D951931B2766EEFCD37D331A49E12F86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266725, "uuid": "b796cce3-0aba-48a2-9138-845d81320b9f", "value": "768:Qea3/DEigvY/szyeCl7uV0IlQQF3CpgFHHrP0ouz8/8vahP7whgfXa/PQoVhNJ:QrSg/szyeC8FlVFLP0hz8/2Uwhgfq/Pn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651266725, "uuid": "4aaf6492-79b1-492b-9a5b-94991846b80c", "value": 66564, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651266725, "uuid": "00f092fa-67b3-4628-98bf-92a375e8c40a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266725, "uuid": "e6b8ead9-d5e2-46c4-9510-096d45339fa3", "value": "de493816c6f797813e31c99648a318db", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d3a55f7-c782-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651212433, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212433, "uuid": "ca48a942-78fc-4d69-86e7-2863a86059f7", "comment": "Malware payload (Loki)", "value": "945761fa342ae8058f88f5029ba0bfb2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212433, "uuid": "7cfb44ab-e8af-4393-a2dc-12fb8dc011ae", "comment": "Malware payload (Loki)", "value": "0a9b74a0db8605e07a7583814a6c794ecb48a8533a7379515051952820e440ba", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212433, "uuid": "253b8935-037a-41ff-bead-70e3949a573e", "comment": "Malware payload (Loki)", "value": "e8b6a30e1bd8145717bb2c47156ddc1d159ba106", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212433, "uuid": "51d95db1-0dad-4c9a-a7f0-b94eca837390", "comment": "Malware payload (Loki)", "value": "c215f4f8fff70dc95baba6690486e79fda48fc517bb44e8f819b66dd461f8799ac4d1b340f704643bece14b772be1750", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212433, "uuid": "9ea05a5c-4990-4c86-a190-e665a65a3904", "value": "T136A4021333B0D261C8AEEB7664E5184B83F4C153660DAA9D1923A1FB59B0390375FB9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212433, "uuid": "0483d538-010e-4eb0-abc5-5dd84535464b", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212433, "uuid": "522ad5ce-12bb-4580-beb6-bfade655acc5", "value": "12288:aKW5aFb8SzS2UisZVXfksb6OXJ1JRF8imoNFWAYtv/h:hJ2TdBD6OX2imeWBdh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651212433, "uuid": "b3e1c884-e4a1-4181-b70c-aa31989fee96", "value": 463872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651212433, "uuid": "c66fef9c-623d-4be6-8eac-989f1223500f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212433, "uuid": "4159ba3d-1103-4f49-b6be-62402b15cd49", "value": "Purchase Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ddd1cbe4-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651215548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215548, "uuid": "414a8fb1-7a08-494e-9fc8-ddfb9e59e8ef", "comment": "Malware payload (Loki)", "value": "e890ff9f059be221293d875782447cd6", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215548, "uuid": "baa90bb1-fe36-43da-af77-e692500c1ad7", "comment": "Malware payload (Loki)", "value": "0abe39fabc4b171adbe20573a200ac4d6d89e95e2b186efea2f0d4d623081980", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215548, "uuid": "c3f21bcd-ade5-4402-b294-d0ade925af0f", "comment": "Malware payload (Loki)", "value": "803cb26396e82ff5e6237cd7cea5649bb1b673ca", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215548, "uuid": "df3ae8b5-8e77-48c4-93c0-c66573ab927b", "comment": "Malware payload (Loki)", "value": "19c3bff45943c56436be37f464980e75ae5db7b83016569c0e4b1a247be37775ebde0c68c611476d1561083ff542d466", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215548, "uuid": "397bde98-d157-4f69-ae6a-92ac8715a2fb", "value": "T1D793F1B8311C0A04D6EBEE782B96BF21936C1C124DD04EAB73D43B718FB4C6A5E59527", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215548, "uuid": "f4a07574-434c-4c5d-ac76-2269cc3d2228", "value": "1536:5tJuvfasCT7gvmjQaHr2BhTFdczHmoX+uRcdH9MiL05FC39piwCOMOqljWqxcUIu:5tobALQ02voHmal2aF+oBXPIM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215548, "uuid": "1ebbbf8a-bad1-4886-a959-86b0a4187e16", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215548, "uuid": "a3711cc2-6a7a-47dd-8fe2-bc3f6c192012", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215548, "uuid": "1191b3d1-58ed-4e23-a2f0-41efb928013e", "value": "ref PO-DLP-0176.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa147a05-c7b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651235353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235353, "uuid": "5dee8576-2788-41be-9f66-bd55c90e32e2", "comment": "Malware payload (Mirai)", "value": "f1a1de52352ae51aaeb6ee053c3b1de1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235353, "uuid": "8481cc01-a06a-4f4a-8c66-4fd1c89e1f0d", "comment": "Malware payload (Mirai)", "value": "0aeee3db936302cda75f5b6a0c5e9a925db7b68907276dc3c4230dbaecc3b307", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235353, "uuid": "4d36f164-fcd6-455b-9ffb-2f20526847a8", "comment": "Malware payload (Mirai)", "value": "02a960f604f080863dacf0fe72b23fc7296ad5fb", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235353, "uuid": "2f96128d-555b-48ce-923b-eb7c8c3ed04b", "comment": "Malware payload (Mirai)", "value": "9e6102c7c3ce234d8c5dc1be7e8a8ac31b3843f69957439507e73c03912bbba1d92d27bb96a93a46aebcf8bfad45ef81", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235353, "uuid": "1de7da49-0bab-46bb-8be6-afdeb77e0656", "value": "T1D333F861B8936A1BC6D0237ABAAE558D332063E8D2CF3217CD601B147BDA51F0D67F52", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235353, "uuid": "486b267f-3fbb-4b24-8f00-4aacd89ae367", "value": "1536:VvmyehDi86b9vUwmkaqXDBnww6Ioh+kWI1:VvmyehmYVw6hhT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651235353, "uuid": "cbab80c5-d968-4fc6-88e4-2b7e547b938c", "value": 54648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651235353, "uuid": "8dbeaf7e-4865-425d-828a-ce4824a8e69a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235353, "uuid": "6ff75861-d60c-47c0-8f70-5c19ea0d1925", "value": "f1a1de52352ae51aaeb6ee053c3b1de1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf15344-c7a8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651228725, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228725, "uuid": "8beda961-9c70-4a00-a02f-0e9bb89b0739", "comment": "Malware payload", "value": "9b520817de28d7b5f427e3dda88028a0", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228725, "uuid": "74361711-13a2-47d0-bc9d-aae982f63ea1", "comment": "Malware payload", "value": "0af8b2d74efa0d23f12b04984c7079a9723835c1b2d3e5961118e95158188163", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228725, "uuid": "962643b6-3b79-4944-b4d7-ab5f5e1a0b58", "comment": "Malware payload", "value": "3f121953142223d1add7479fe6c3552d4dcf1d0a", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228725, "uuid": "d667d7d5-3edb-4d2f-8690-c4a017dcfaa1", "comment": "Malware payload", "value": "f5ef6ba995590857e87d9a7c4c20631716eb4d08087a7698e20c73f73f1075b64b6008d73b671abbd53934311e320ff3", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228725, "uuid": "5ede3bca-1dc8-49c1-acbd-677b80d7ef01", "value": "T160D5E02075339E36EAA305B28EBBD55D562CAC8903D534DB93C8E85F0A349E12F35C5E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228725, "uuid": "d633adf7-df12-4303-bc52-9f1de07c2392", "value": "49152:Auq4dJ0yTRzz/z4H+xaJuU39Y+3n0R9E:Auq4L7FHaJPf0Ra", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651228725, "uuid": "6d23190d-b17b-4faa-81c5-164cd5f7ea38", "value": 2883584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651228725, "uuid": "dde4d1a7-a10e-4a5e-8de8-63d038e1798c", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228725, "uuid": "7001f327-6f5a-4e5f-a3a2-18d7b59ebb54", "value": "voice_message02100.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afa659fa-c785-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651213753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213753, "uuid": "8524a527-40c8-4851-99fb-d90a456f0f4d", "comment": "Malware payload (AgentTesla)", "value": "cf0e79f03be95bf2e6557927dd55194f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213753, "uuid": "dc5a3c81-5211-4087-a0d4-e1a86f115e17", "comment": "Malware payload (AgentTesla)", "value": "0b5cc920ce0f8526727ee9422416b77d52697821bc2ff12096a7bbff782cd0ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213753, "uuid": "1c019494-cc88-41b8-a37c-127f57c0d594", "comment": "Malware payload (AgentTesla)", "value": "cec41e28416eceb63b6fd5ba6fc390c35b2b1d04", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213753, "uuid": "77b8c4a0-755c-432d-846c-6f58922fd05c", "comment": "Malware payload (AgentTesla)", "value": "2dfa301a29c94f5c9920bcc9aaf23ddcaedb4e637f8a9211c57192892a30a9b703a6ea5dd00268878fbc7ce52d968aa7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213753, "uuid": "c707597b-fb07-470b-97d0-03eeca1cca06", "value": "T1BD05AEE57A0C9EF3CD3C9D366A874E211BA21AB65111F36B0787B3FB258321796274C4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213753, "uuid": "0f6d3be7-8d21-4c58-b535-536a0bc0462e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213753, "uuid": "f37cbc84-2d1e-4b5a-a2fd-8204b50a5062", "value": "12288:/rKm4/8b5W7fc6/yGDz96DpVmz1UMLEle6gG7tli2fCDMwzAu:Om4ppDz96C63etGbicEX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651213753, "uuid": "fa9f1ef4-bde2-4489-8279-1f4f4d01ecfc", "value": 828928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651213753, "uuid": "b497472f-7baf-401e-b8cf-9211230ffb8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213753, "uuid": "b6a59b01-670d-4cbd-9530-9c8adf57f3fb", "value": "typical COA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2c05f5a-c7cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651244306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244306, "uuid": "a53e1876-d08f-42db-8cf2-51d9ac0952bb", "comment": "Malware payload (AgentTesla)", "value": "fd8dd661c4babdb9ed5bb41ccdae68b5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r16", "colour": "#C18C8A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244306, "uuid": "34228f16-9485-4248-9c52-0bf9ef90e6c6", "comment": "Malware payload (AgentTesla)", "value": "0c56429d768cb74252319ee95ecfe1016db3b1b9281b8748b5e1a4aa132e7d79", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r16", "colour": "#C18C8A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244306, "uuid": "56b93cff-dbcd-4b52-a044-248b24d302a3", "comment": "Malware payload (AgentTesla)", "value": "59210c3179f16d19e2366380a83b37ff26a525bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r16", "colour": "#C18C8A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244306, "uuid": "ccbcac7c-37b6-479a-8c29-ecbd1f9a8340", "comment": "Malware payload (AgentTesla)", "value": "bed319e2a41ea5b6d671b395ff0da74128588859acd9a0b66f61ac6237305bd4ad91b6718d36a09f4fb15f8f55485f8f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r16", "colour": "#C18C8A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244306, "uuid": "e52699bd-6400-41c1-a388-4e6408cabee7", "value": "T197C423D468FE9D3868A41E9901069723C1B76E5FD23A92D480CBB5CFDCDB46CAD849F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244306, "uuid": "c725a5c5-98df-4d34-8537-6ad961e87518", "value": "12288:K9FvfiK0uhNzdSNAgnnZEyemcuxSBsaAB/TsHPJExuLXuaC7XQUPKZ:K9VsoLSNAgnnZ9eduEBsaABrsvsGXua5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651244306, "uuid": "3e6ed174-e3dc-4388-bd65-fa80bae77da0", "value": 566643, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651244306, "uuid": "1ac86bb7-7cfe-44b8-aba9-e9d383e5bf3b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244306, "uuid": "1826362d-5e7f-495d-b80a-bf62dd224cfd", "value": "Swift Copy.r16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451b59b6-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651217869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217869, "uuid": "a51c2f26-e0fa-4dd7-adba-dbff7fbe7c75", "comment": "Malware payload (Loki)", "value": "bb25292fda542dbf3ed91f6c712c03ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217869, "uuid": "fbdb2ba4-c8de-4329-a6e8-691b5175fe1f", "comment": "Malware payload (Loki)", "value": "0d6d7d75d3a6c6e0a77b7fa40aa7782013a5493e35b2d7022fc8671b4343620f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217869, "uuid": "cd64e726-042d-4628-8a6b-a8d89ee3024d", "comment": "Malware payload (Loki)", "value": "44511163409bd5953291219bb0c030c01f62fd72", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217869, "uuid": "040b44ef-7671-496f-97d4-8fef7e840c1e", "comment": "Malware payload (Loki)", "value": "853c636386c31bb324afc81c77d55be7df1af7dc527c52ad6d2c4baa68e64e7f3c3bc5be81896e0a387601edf4e2d77a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217869, "uuid": "4606e795-b107-4150-8c76-27a0c204b126", "value": "T1ACC3F12573E4C867E4F3033009368B669BFE6A0511B84B0F8754EF4D3A667C1D91EB96", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217869, "uuid": "3341b0e8-32ce-4865-927d-d9cc7ea1b92e", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217869, "uuid": "02f0e1cb-e574-4fa0-b74d-10ed973f0872", "value": "3072:l1NjcVVnLpPunbqRH3wYksMpJtsrBsT5uAo/jwIs1H:HNeZmeXwYSsrCYx/YH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217869, "uuid": "d933b10b-3ee5-4723-bda6-64317add217a", "value": 126282, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217869, "uuid": "00bd843f-26d9-4f04-8ca1-34a4239e3743", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217869, "uuid": "26b17c52-0c31-4156-a1e8-ab0602aae1e6", "value": "bb25292fda542dbf3ed91f6c712c03ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e45275cc-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651215559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215559, "uuid": "6bcd81a0-34b6-4e98-8b5f-fc099ea256d5", "comment": "Malware payload", "value": "40c71582e72f77f2f09e4048b6a2b13e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215559, "uuid": "ab7a7b5d-3c3d-4dfa-9e81-f7aa5e501fc2", "comment": "Malware payload", "value": "0eab57e78e8ff83c1f71920f798eb4227edfd3d2a2789d753e2bb74bb6f58e1e", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215559, "uuid": "38fd4e3f-3d97-452b-95ea-e5652573c661", "comment": "Malware payload", "value": "800c0592aff6a9e9a6bf868b21a2f62d517fdf3f", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215559, "uuid": "fdcdd1f5-18f9-4d53-814a-6a2db8836393", "comment": "Malware payload", "value": "16c527e6cdf1121d2e22814f0974f604ec1eba8d12cdf87ca7fcf80e6756f3c19fe3fe0aef1eb20f98e9f4b7bf7f398c", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215559, "uuid": "59441bfd-18f7-4016-820d-da4a7f361b6d", "value": "T17693E0CEA3275900D6A3E2F14B59B59C4B3DFFA26F3B906A6C86334EC478D548E4111E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215559, "uuid": "3f7db6e4-fc0b-4d37-92e8-89335a00666f", "value": "1536:Mu/+z80gusItzZ8Gfq7y+tgvKpjmB9LPuZBolwSajdjc3iVhp+5YIc24z:MuReRdmG1lUjA9roBFZ6yp+R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215559, "uuid": "31d0ac81-ee5f-414c-bdd4-36d28ad57079", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215559, "uuid": "c4e0c126-398d-4852-b1b0-880b611df395", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215559, "uuid": "c9f379ed-8dc1-4905-bf5d-b16b29cb13d5", "value": "DHL EXPRESS.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "68db7a5b-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651232532, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232532, "uuid": "0dbb71f6-ee81-4e25-a19f-2456e19da8fc", "comment": "Malware payload (Heodo)", "value": "0c323c0028eed18dc2ff538dcd39ba41", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232532, "uuid": "a1fd835e-6fe7-4488-9277-823d4194bef8", "comment": "Malware payload (Heodo)", "value": "0ebad09536d0d49fbcc6ed83e1b4f882af7fd07d52497c40d58e71ccfa247ad2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232532, "uuid": "ce131601-8010-4334-a643-55423cc76d47", "comment": "Malware payload (Heodo)", "value": "cbe86702224e5ccf9e9c640de4f718d134595b04", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232532, "uuid": "b0968b5e-d62c-48af-9f67-44ac82c2f524", "comment": "Malware payload (Heodo)", "value": "530c47ec4b7702076fc2e4265ec0fdd5c14dc284c6c0c4c098039108102d7636dc39edc4e6b39b7ecb1b11a56e111d94", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232532, "uuid": "7d4ad768-b508-431d-9063-da11b5daa31b", "value": "T110C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232532, "uuid": "a5bb1005-41be-4f01-9bfd-e9b950509f95", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232532, "uuid": "284a41e3-5505-44f2-9959-2440fdd55df0", "value": "6144:JhZ02GdOOgPYwKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFffKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232532, "uuid": "f4f9feb3-b899-40a3-9a25-f6951217e9f5", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232532, "uuid": "1220c457-28b9-43e5-a453-f8e1b7ff8a32", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232532, "uuid": "7dd2e682-beb6-441c-85f3-2dde9d3b3a28", "value": "0c323c0028eed18dc2ff538dcd39ba41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fb5090c-c75c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651195902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651195902, "uuid": "21c0d8b7-ed65-4dbc-9cdd-c01fda0771ee", "comment": "Malware payload (Formbook)", "value": "1c0176dd692632d368c9367aa1634cd6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651195902, "uuid": "0b0ee120-8dc5-40bf-b8e0-179f114f0e05", "comment": "Malware payload (Formbook)", "value": "0fb85406722c1e8b39d424d99f276fbd32a457e01008dd284ed0c5e373f070a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651195902, "uuid": "b5ddafbd-e6cf-4818-b686-15c4222834c3", "comment": "Malware payload (Formbook)", "value": "9739da4023c383d80d5607ed7f49a6a4c31123c3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651195902, "uuid": "f0ba66a8-7b30-45cb-96dd-db01ed2f533a", "comment": "Malware payload (Formbook)", "value": "dffa5235a35f5e34000365b0c931149bdd3af5de7b32f3dbd503a5b6335083d89e269bcd71f5dc9b308e55d811361c77", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651195902, "uuid": "c6391dd5-8b3c-4a89-822e-5269e1d96799", "value": "T13BC41248F7BC9712EA7F4BFDB924331547B07A2A6152DF9E8CC164E909367E28400E97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651195902, "uuid": "e0c79848-367b-4818-bd7b-0feaf7c35aab", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651195902, "uuid": "c1f36691-d8a7-45a5-a2ef-5131f5fb3ca0", "value": "12288:KLWJe8dZjzkujViygqEYQNyUt+DUDaQjrbvDm:OQ/DjzkujARDNP+DUWQvH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651195902, "uuid": "3167101a-f605-40bf-818e-8ffa76d5abb2", "value": 560128, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651195902, "uuid": "e0cdcd69-4803-4e6a-ba97-94623a046b74", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651195902, "uuid": "92fb1f87-3233-43fd-8f6c-2d75be8d4aad", "value": "QUOTE 11354321.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc78d591-c788-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651215063, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215063, "uuid": "5bcfae7b-5f0a-442f-98c2-65482317d29a", "comment": "Malware payload (Heodo)", "value": "11aa4b7c31ea97dd6e79d645ad0e2274", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215063, "uuid": "075ea26b-95c6-456f-95e9-1ec28e4b4676", "comment": "Malware payload (Heodo)", "value": "0fc1d099252f1bc11c677283890d3fa37bf20749afb2912a7e2a8d1c1979c1fc", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215063, "uuid": "a39cd5fd-c9bf-4687-877b-354848538c97", "comment": "Malware payload (Heodo)", "value": "b333a36cfca31679b6d4b5b0d5f0109566245a4d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215063, "uuid": "26f5abf4-cc97-4855-bd82-bc75bce0c01e", "comment": "Malware payload (Heodo)", "value": "f5897138b171985abff96a048fddc2f6ba90c6d9eb8bab31b0b920d00c610b2305d12ddb264602137cc52083483d64af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215063, "uuid": "c82085cd-bb99-485a-baad-1290ceee8a23", "value": "T1E2B4CF017AD2C433E0BA063C4AA7A7941BFDBC52AAB5D34FAF803ACD5D315858935763", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215063, "uuid": "5e12ce00-9453-4bcf-87ef-a01ef060ccbf", "value": "60acb5dbeebc778b5879492b3afca208", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215063, "uuid": "bd4fdb8b-94c8-459e-af57-53e78e136826", "value": "6144:aH0RW81UplEIb6hRAOf6DXyhCra8VCtS08OB8xS4GE/mFCo3QkgqbqATxqdK/J:tFpMOfeihCraeuiS4zCCo3QkvqA8d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215063, "uuid": "fd7f13c9-7ed5-4b56-a2d9-654991c56151", "value": 507904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215063, "uuid": "0897827b-3985-41af-955e-828126913067", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215063, "uuid": "18384d12-4abb-41c0-91c4-1bd98dd22ad3", "value": "emotet_exe_e5_3304119cd7491a64d4a56d4c033e654a4655e6bcebc695a9009478bd9b5c7ece_2022-04-29__065049.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9af8407-c7af-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651231782, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231782, "uuid": "63ec3f5e-cb26-4136-b3af-f708a8728bd7", "comment": "Malware payload (Heodo)", "value": "bf296560be097e6d98702fc00864808b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231782, "uuid": "335eb02c-be4e-42ee-87db-df725d3206a5", "comment": "Malware payload (Heodo)", "value": "10603f7d9791aedaaf8b25a4abfa96d2fe3eeae9bb62e6965aa6aa3731751875", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231782, "uuid": "e7947d48-45bd-4957-a156-fcf7f3c81c6c", "comment": "Malware payload (Heodo)", "value": "3bd63901e24fcef359257799af47206bfefd06b5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231782, "uuid": "e89e162a-f33f-4fff-ad2e-10d2316594eb", "comment": "Malware payload (Heodo)", "value": "76390012e4e9a60a30d9b79326a5b41fba5129f6cd3cdc0880fc693c3b13462b8de0629a17ca040f28b98880855a8af9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231782, "uuid": "abe464e9-a5d8-46a8-a150-1b3e80faceef", "value": "T1D1C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231782, "uuid": "4ad85738-c42f-4c4e-906e-820356113778", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231782, "uuid": "41112327-ffb2-47d8-8465-fe99c1929128", "value": "6144:JhZ02GdOOgPYlKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfSKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651231782, "uuid": "20dcee8d-f37d-460f-afa8-5a5c69e80d85", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651231782, "uuid": "91c0cd23-fb8f-4ebd-b1fa-489066bed34f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231782, "uuid": "a41c04d8-78be-47d6-a3e2-e7011f1ff3a0", "value": "bf296560be097e6d98702fc00864808b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "709bc216-c80d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651272059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272059, "uuid": "7bb5a75c-a07c-4d8c-ba61-fd7be8c40c37", "comment": "Malware payload (Mirai)", "value": "a261549267c94c80120dc51af6e520db", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272059, "uuid": "bcf76e1e-4f05-4ba4-95b8-5c72bf02e4ec", "comment": "Malware payload (Mirai)", "value": "10cdcd7aaa3c1b43f0fc03494d8cc9e77f30e9ca7b901f1aa6802c2a9f574774", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272059, "uuid": "abad5505-3648-40fc-bdfd-c3cd58c13f58", "comment": "Malware payload (Mirai)", "value": "622a4e3670120c4f11cd540d307e553e0560e1d9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272059, "uuid": "0104e5f5-eaef-4307-800c-aacd52245cb2", "comment": "Malware payload (Mirai)", "value": "d5b5c2598e452774aca00c4f28a201f2e560c4ee31d0bb77f225899562ba1da976064ce8b2827783ba9a9966168167f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272059, "uuid": "ecb7faac-cd76-4475-a53d-d78a1fdb4548", "value": "T1C143F1609924D4B6FAD0287BE17E72835B4137D9A0B47CD707080FDCBF99A111B6C6AE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272059, "uuid": "14344c42-5d6a-4d4b-ad08-cb81d38fcf14", "value": "1536:W8H27xwfpvkF9u9m1rVqzWzoF7GnerHNGJ16Xvt:WA27kFkF9u6kS27JrHNq16/t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651272059, "uuid": "d672962d-c5e1-4f24-9317-ebede693e89d", "value": 56636, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651272059, "uuid": "519059bd-ac1d-4420-b6a6-4b00a0efe144", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272059, "uuid": "fa32cc10-c04b-4b93-982a-8e165544a437", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c290212-c7be-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651238148, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238148, "uuid": "e8737125-717a-46c1-80e5-588c2d750c46", "comment": "Malware payload (RedLineStealer)", "value": "16364729ecd41b3468831a4402744e1d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238148, "uuid": "eb9b6913-193f-42e3-b11b-3eeaeca1f747", "comment": "Malware payload (RedLineStealer)", "value": "1141b4f27e63cbdbf4833141d4e3b8d5466ea601c3b84e99cbb87248fd574aab", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238148, "uuid": "7315d89c-9d57-4f43-88d9-3eac5294a0ed", "comment": "Malware payload (RedLineStealer)", "value": "e3ed58d24f89f1c4b3e31224e6c7429e38a502bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238148, "uuid": "f1ced594-0388-454c-9e4f-e14f83d98f45", "comment": "Malware payload (RedLineStealer)", "value": "ae1c216f7ff26cc775622c95f4ed794cee5f952737bea52ff74f5327bc2e80bbe7b25fe3e802a7216c80079531f95525", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238148, "uuid": "54f0b312-ceea-4086-8686-31c06c86cfe4", "value": "T15A84BF10BBA0D03DE1B316F4B9B982A8753EBDA19B3151CB22C63ADE5A346D0DD74307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238148, "uuid": "87dea4cd-6837-48ad-9071-76f5907eebdd", "value": "afc01618e0df309805fa06d056c565e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238148, "uuid": "f568cdd9-2441-4d27-b10d-5c95a6374375", "value": "6144:sFXhHY/zWItCw0ccO5PyuGg6GlJHGy5M7Q9VY0k7xhiaeENF1lCfbRKB:sFxQzW8v0HO5Phn3mCM7OOnlh2En1+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238148, "uuid": "63a4067f-ecfc-4df6-b2e7-3496d39e4e5e", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238148, "uuid": "45f1166b-5ea4-41bd-9fb0-1d94ad53fed2", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238148, "uuid": "231349fc-3a70-4642-9d0e-5980525892ea", "value": "16364729ecd41b3468831a4402744e1d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3361e9e-c7ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651236603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236603, "uuid": "d79d3ea0-489f-4fcc-a522-949698b2774e", "comment": "Malware payload (Mirai)", "value": "4ce975a791f9716ce63a7d655d7f69b6", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236603, "uuid": "51dcf4f3-6b4e-42ea-bc3b-4363d621077b", "comment": "Malware payload (Mirai)", "value": "127029880f7a6026cc122a1b12ea8e2379ca52792b6ff4108df698afd676fa53", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236603, "uuid": "f497b541-5d0d-4317-9d28-580c752f259a", "comment": "Malware payload (Mirai)", "value": "a6c0e8ddfa5292e0e9929ad7ea1602de62184548", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236603, "uuid": "88b45508-6072-48d8-8874-ee532fad3c0f", "comment": "Malware payload (Mirai)", "value": "46fcdc295ba92c0c7a58417fc3f054d980d6149f2bb0e6b558dd82bd43d37565302a7db37ace8b3e8ceb9abc02e5d875", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236603, "uuid": "9fea2a43-2674-4156-bc63-629516edccd4", "value": "T1AF336BC4D6C3D5F6EC52057221B7AB778733F56A2069EB86D3D8982BED12602E21734C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236603, "uuid": "98c17682-c5e1-47e6-84d3-194a9b7db318", "value": "1536:A1sZgVgqSo6T4vx9L/HgaDTU4GzCvHaUeSE:EVgqSozbL/HfTBGzK6Uk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651236603, "uuid": "aa607535-0c73-4aab-ba98-4a9d25280d50", "value": 54576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651236603, "uuid": "414f6313-4ead-4abc-a000-ea5647a5f8d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236603, "uuid": "6dc9417f-34f3-43a9-a715-9cb13a32d5b6", "value": "Cronx86-20220429-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8fbf0a1-c7c9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651243055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243055, "uuid": "2289ef06-2dc4-4080-ac02-1628ac9aa058", "comment": "Malware payload (Quakbot)", "value": "81710a9362fcb6c823f80e6a6337caf8", "object_relation": "md5", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243055, "uuid": "e2a45db1-a25b-4c03-9129-5388dd432897", "comment": "Malware payload (Quakbot)", "value": "12e7f31e65a9d419fb74127640773bcb777ea1cac8444797333798ae4731d773", "object_relation": "sha256", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243055, "uuid": "05b90e97-f011-4604-b689-b25e2e97926f", "comment": "Malware payload (Quakbot)", "value": "2b0809ea423e4762b6b37a100190fed081ecbf6c", "object_relation": "sha1", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243055, "uuid": "c6ad4459-f1f8-4233-9c45-afd4c42b8d69", "comment": "Malware payload (Quakbot)", "value": "49f164c5de8633443a3d738b1d59b02d2d28de88ea3acfbf4ff14470295dba384b28506895c97ca74310c12adfb9e33c", "object_relation": "sha3-384", "Tag": [ { "name": "AA", "colour": "#6339E1", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "ta577", "colour": "#2FEF4D", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243055, "uuid": "4376cf5d-b585-4325-bd66-9d7e13376d92", "value": "T13BF423BA68CE2468414C66678B530A62F1F1E4BE074EEAB10C417D7DA9E7305D1FB06B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243055, "uuid": "466c005a-edc4-4fec-8a3c-6e6465b2578d", "value": "12288:pk3I00dZUGqKjZITjawy3TW3SsVQFqHfLc/Tq0okjPtjw1GmCHIlQfKpMGZoh:II1zzjZK2wwTWiSQYHTc/e0eLqIEKqGG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651243055, "uuid": "18c5dec5-8a97-4c8d-bfc7-837e2e6bebb5", "value": 786374, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651243055, "uuid": "80f34509-d015-4e13-b01e-f361d843b32a", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243055, "uuid": "1b524b7d-1945-4f74-9471-1c8488f1b75f", "value": "A_855542111.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b965089-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651232590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232590, "uuid": "67ee6711-c645-49fc-8a38-9c235c7ecaf1", "comment": "Malware payload (Heodo)", "value": "89de406adfa54ed22f2c31400a330194", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232590, "uuid": "9ea9ae14-6327-4bf1-a10b-fb09e3073283", "comment": "Malware payload (Heodo)", "value": "1318c662cb12883ab366e8b1381a7954ca25974e3d69dd1d6858b1f71389def6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232590, "uuid": "db6fe3a0-d336-42ee-b73f-c31168db16cb", "comment": "Malware payload (Heodo)", "value": "7c4294089f6f08abe63146f516dea8410ab5461f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232590, "uuid": "57e23707-39ad-4a1b-befd-165881dd03a7", "comment": "Malware payload (Heodo)", "value": "57aa629e13cc961bc56cd157e8f320da76e7c535e9c5a0ae28b1b8efc175761e40c89c19efaa9d6bf1ad5faa68fd6840", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232590, "uuid": "7b768ffc-ab10-44bf-a112-4123f2b42260", "value": "T1D5C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232590, "uuid": "23dbfbcd-6260-44eb-be21-e59a7d4439fe", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232590, "uuid": "36339b70-6dd4-4b9f-bcc8-dc5eb6bca905", "value": "6144:JhZ02GdOOgPYeKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfBKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232590, "uuid": "07bc3430-beab-4259-9a85-390495b3b6d4", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232590, "uuid": "c4657caa-714b-4397-842d-3aa41f80bb1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232590, "uuid": "d8f85410-dc64-4694-8c23-6e74f5a0f69e", "value": "89de406adfa54ed22f2c31400a330194", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b75e3df-c780-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651211410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211410, "uuid": "949ca714-39f2-4055-aa22-0acdbe2b60de", "comment": "Malware payload (Mirai)", "value": "84a12c5f914578efd5968d7edc1ca476", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211410, "uuid": "4c309527-912b-4c1a-9b4d-2795c043e1ca", "comment": "Malware payload (Mirai)", "value": "1362967118cb4faebea5c8e09ed75d8b191c4fbb63b861f99660070bbaaf93e5", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211410, "uuid": "0535269f-1253-48a6-a69d-e257ec03e858", "comment": "Malware payload (Mirai)", "value": "03d09d02ae31d933b0c74d810d82afd49c82c616", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211410, "uuid": "1b36fc62-60c5-4623-8ab1-55e156188416", "comment": "Malware payload (Mirai)", "value": "98697a15d5991b7a12900343c407d1a53f6cba0fe0c6a73267a2474e41ee84deae7f3704540fef337604610e008b83a8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211410, "uuid": "9915bc8d-3452-4994-814b-57879023fb32", "value": "T17D3317C17583F9F5E811457C307BEB765E77F03AA03AEE9BD7D49833A841A02920629D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211410, "uuid": "42fff363-ec12-4f12-be4a-ad2daaeba35c", "value": "1536:1M9zO39ul8ah+d++yqzoPPsdTYGBfmaIzKHsa:wO3I+aod++yooPMTgaoKHH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651211410, "uuid": "a578fe22-5f8f-40f9-9e98-f2c06e89c749", "value": 50844, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651211410, "uuid": "75f7455a-5ee5-4cd9-96d5-703a2a3be5a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211410, "uuid": "2246572f-164e-4e8a-8225-e74dcf0f7a06", "value": "phantom.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "81a60432-c7a4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651226990, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226990, "uuid": "73a7c61f-da0e-44e5-8760-6093af557868", "comment": "Malware payload (AgentTesla)", "value": "9239a06714ef0f2b243ae019555ffe2b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226990, "uuid": "9d1b8e08-880d-4fa8-9e4f-3406f93e9185", "comment": "Malware payload (AgentTesla)", "value": "13669f4977802630b84c33c778c32394fa385b28b454c68ef14086499b5e7b58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226990, "uuid": "c2bc5cd0-2642-4a4e-9de7-142a776fad77", "comment": "Malware payload (AgentTesla)", "value": "f1761fc60adf2d23f7dc1dbe44cc388125026bb0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226990, "uuid": "0ac17e21-bbdf-46c8-99ce-a4fd891b6cf5", "comment": "Malware payload (AgentTesla)", "value": "bd74a119410b2fa86161ee56c2dccd93ea10357f499e73e5823b31ee20c6ab0399bb7bafa5f3947c25d5ed708aba16b2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226990, "uuid": "3ccf0825-3fb0-4e90-8c2a-8004e1c1d19b", "value": "T1A1B423C3DCF968BB490EA5DDCD077BC0C178B0949199E30065AF4869C2B99E8E8DD31B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226990, "uuid": "62f0c268-cc4d-4d59-a2b7-1bf95ca2cb06", "value": "12288:uUlJxbeCs9ON4teFZtmAJP6738ktAx3aio9A5:l6Cs9Oo5o6rtxiou5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651226990, "uuid": "e87ca3a3-669f-4fb4-893c-e5c8bf74fd3b", "value": 495561, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651226990, "uuid": "1b60a650-8db7-4655-85a0-0ad1d1157bf6", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226990, "uuid": "13d2f485-c2aa-4c92-9ada-7cf8ffc3180a", "value": "+ REQUEST FOR PURCHEST ORDER #578929.GZ", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "744a148b-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651215371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215371, "uuid": "910c2c99-635a-430f-a81c-9cda8eff9d95", "comment": "Malware payload (AgentTesla)", "value": "f12d4656d8f62fef5b8e905d1709fd36", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215371, "uuid": "f1891885-3de9-45df-be9a-a1959dd11883", "comment": "Malware payload (AgentTesla)", "value": "14993e0604ce8e0b7948b6abaca355a91af97fbcb528c25bc1e804561cddd327", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215371, "uuid": "cb052a06-910d-49fd-ae06-11fa37208e89", "comment": "Malware payload (AgentTesla)", "value": "c98fdbd68cb56dd31f7178f0024a800f1c655dbe", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215371, "uuid": "414dccc6-8b06-453b-91de-50d4f2106c7e", "comment": "Malware payload (AgentTesla)", "value": "e654602bc28791c398b78dff23cb3ef5f7afad15e00aa2d30119ad14af32a9df4da3d54b00baa1ce2a6b6f848b30513d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215371, "uuid": "018c6045-6a81-48d7-9e5e-155daadcb010", "value": "T1D0942361913ADACB425FC4F1F61CB7D83134D45B6ED2C2211464FFA6C6AD0CA6C366AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215371, "uuid": "78dc651d-3b23-4cdb-9e7c-19bbbf8bcf9a", "value": "12288:W9UAZnOoJhtOud4x/mS7PCHHxfC7jrGFvajKhIH:W+AZxjhGumcf2jNj8IH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215371, "uuid": "67028351-713b-4f04-b987-8a3bf135b78f", "value": 433309, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215371, "uuid": "8c35fe1c-b016-45a3-a462-6eb2b9b9aa21", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215371, "uuid": "2b14eecd-e7cf-4f98-a164-3d0feddc9f17", "value": "No. TIM-0372022e-I003.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e329927-c7c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651240997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240997, "uuid": "950189b0-49f2-43e7-b144-803ac352de43", "comment": "Malware payload (Formbook)", "value": "c9cfb1bbf6ba3a2e961eb78672726a6c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240997, "uuid": "fb2b92bc-0f28-478d-80bb-3d87f89cd827", "comment": "Malware payload (Formbook)", "value": "155ab96f02d69f15cac959ccb3a7fb55a3992c32c457e81f943700b1b8707b15", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240997, "uuid": "8c04eb83-5a34-4df8-8870-265dcb4482f3", "comment": "Malware payload (Formbook)", "value": "c05959cd021d4db6ee657cd6f3e4ca165755b15f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240997, "uuid": "62a101cb-a64a-4e38-bbe4-bf4e89f97127", "comment": "Malware payload (Formbook)", "value": "88852cfbc61a58c924692478ff0bb814d02b9d53ea3a7b1f91af6a0aff58d9986a0190c26543b298efdc5525801c9232", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false }, { "name": "ZiraatBank", "colour": "#99749B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240997, "uuid": "7fec1c92-fd5a-436a-8bc3-68f1f23dd514", "value": "T1E224126DB379E4ABD0A613330CBD6329ABF8A4110175438B5710BECE7BA13C1955DF92", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240997, "uuid": "643f187f-66b2-4e28-99da-573845f41634", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240997, "uuid": "8e3b29af-f4cd-4166-9299-760e5a1c3d92", "value": "6144:HNeZms3447OJvvD6bE3C5saAXlUIxDtEUM3:HNlsP7tw3xtXtEx3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240997, "uuid": "21c65975-ad00-4b67-82f7-c265ee12dd41", "value": 218600, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240997, "uuid": "b56b6981-719b-4994-8aee-aabebdb853cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240997, "uuid": "3d4330bd-f543-45fd-a1b0-102ed0f34d26", "value": "Ziraat Bankasi Swift Mesaji.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff727061-c79a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651222906, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222906, "uuid": "39d9fa90-a673-432c-9283-3470b6e26bcb", "comment": "Malware payload (Heodo)", "value": "7792a00d59c94fc387105265b920208b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222906, "uuid": "b593b249-9fe2-4117-9476-9be534824edc", "comment": "Malware payload (Heodo)", "value": "159b093f2260935ab7d042a44495391a4dcaf99eaaf26cb43a5ec5dd0dbe51d9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222906, "uuid": "df9400a0-caa2-4ea6-a36d-bb9f8c1e80e5", "comment": "Malware payload (Heodo)", "value": "8824cf33a3187ab522a79535c8bc76a2d4722002", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222906, "uuid": "b4e7ea8e-3de9-4297-86bb-ce3623a581ff", "comment": "Malware payload (Heodo)", "value": "6b6c79a56074f32288953f1c9e6d7e4c176e8069c4f5288cda0da6658f9dc990324c93f5c253111da193c06fb077dd20", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222906, "uuid": "72ec2fe9-025f-4ddb-bafc-3b8e31d46ed7", "value": "T128514D282EEA2218F5F3DF7159ED7595DBBAB962B912494D00C2470D4921600FD91F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222906, "uuid": "9093493a-7dc7-433d-92f9-c37787bfe235", "value": "48:8mBE9QqTW96Xj03ugtHU+uccIx/cC/N4ab:8mBOG96Ne9D/N4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651222906, "uuid": "d8f97c3c-9b38-4a46-adf4-60b5c9a29ac4", "value": 2454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651222906, "uuid": "e92c4fd5-3b59-498b-847f-70a914babee9", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222906, "uuid": "5438a540-7f63-4df6-bfbb-19ce88fd06df", "value": "list_75885598.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d27045-c785-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651213815, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213815, "uuid": "b63db7bf-4507-4073-8f08-47f72b8b9bea", "comment": "Malware payload", "value": "5bf815b4ed7ea7adeb1f0356e4fa9015", "object_relation": "md5", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213815, "uuid": "675a17b0-aea9-41e6-a4d5-5972cf7d47bf", "comment": "Malware payload", "value": "15dbf250a6fea8e71feb620431690fe74a105fa2e69c6d1f067ec6150671d643", "object_relation": "sha256", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213815, "uuid": "7bef6d41-414e-4abe-8680-b9b4bc277c6b", "comment": "Malware payload", "value": "94fdae9a3707cea93f3a445421a452f9e3d4daf2", "object_relation": "sha1", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213815, "uuid": "c6775e4e-a2fe-4501-8d28-f44641ac25b2", "comment": "Malware payload", "value": "8ee2dbb10780af2bed550050ccdcf094df2c974629b144fc4bea49858379115dfc7f8db98a09e40df266463081a5704f", "object_relation": "sha3-384", "Tag": [ { "name": "rtf", "colour": "#F0EC83", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213815, "uuid": "96cdb9fe-3208-4d99-9b51-c88a66588425", "value": "T1E424D9B4684F0872C309DC1E28A87645AE79FEE374C1557223AFE434CF9AAF29EC4541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213815, "uuid": "8597e47b-07ee-4c91-afce-7fababc66c5a", "value": "1536:iWDjhdpPGNnlr/giUrEEDN6ARfayQnaSxdzFz76mAg5eeVhMDw5wfL7:izorLcAjgdzFtr5RDAw5wfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651213815, "uuid": "b1aab52a-cbb5-4ece-8cc0-9dc52085040a", "value": 222818, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651213815, "uuid": "7bdfcaae-86e3-4c5c-a49e-75e3c52c94f6", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213815, "uuid": "8cb931f7-b214-4f1e-9dfa-ea22dd884988", "value": "Order Specification.doc__.rtf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db7a3e96-c7dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651251193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251193, "uuid": "01f918c1-e4ce-4a81-a1aa-f74d1c05c38e", "comment": "Malware payload (Quakbot)", "value": "4205b1a6cf17d06ad97a437967aed3d9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251193, "uuid": "020b0c50-22a0-42c2-a075-fcba251845ba", "comment": "Malware payload (Quakbot)", "value": "1674cf65a340aa6498dc3b601cff926ece41dcffa84a4702b89aa1a4c6961257", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251193, "uuid": "b57d8374-a966-4e9c-8e65-db457b2ffcc5", "comment": "Malware payload (Quakbot)", "value": "53921554c0e067ed98130387614fbf73d9d8a8a6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251193, "uuid": "68cd9811-f5ea-4e50-b73f-1635ec0f46c3", "comment": "Malware payload (Quakbot)", "value": "bb9212cd54c45081e9471abfb8c469401a06a8bb412e8556165677a9bbf40bb9f23837b5c25cb59cbc6c297a32aabc50", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251193, "uuid": "10eb1a6f-fb0a-4046-8b66-6f1ab3988364", "value": "T18735AD71E39145BBC1733E789C3AB299BC297C101D78C4CA6BDC0F4D4B2AA5267613A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251193, "uuid": "8d5490e1-ad32-4a62-baa1-b6ed1f43ac45", "value": "f5965aa7635eaf08e77b609502ff5e9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251193, "uuid": "6717ea96-e677-428c-be34-ff4ea1875109", "value": "24576:UmfEXFuca6UTUqybkX0YuSw7zMYQ0a4lFb2:UmMu60UfYXXuSoWx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651251193, "uuid": "d645b212-534d-4e75-9143-97a614248391", "value": 1161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651251193, "uuid": "959dc3a4-9f39-4a18-97cd-f35357e718ce", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251193, "uuid": "433b9705-216f-47f8-8508-e2323e0ff976", "value": "44680.5787951389.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2463665-c7fe-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651265780, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651265780, "uuid": "33dcdeac-9104-4a6c-a92a-8b4ff5b2dc3b", "comment": "Malware payload", "value": "a45679bdcf30f068032bd37a194fa175", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651265780, "uuid": "0eb90176-f6a2-4d12-8f10-5b5cf55858cf", "comment": "Malware payload", "value": "16beb1ae2de2974ccc2371d9f619f492295e590abb65d3102e362c8ec27f2bbb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651265780, "uuid": "b22e7b0e-e2e8-4668-af84-68db543a2e17", "comment": "Malware payload", "value": "f23fd98f28bb0b482f0aae028172e11536e4688c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651265780, "uuid": "c60777b7-7dc4-4f2b-8ef8-9f988a0aa958", "comment": "Malware payload", "value": "80f21eb6e107c21ba888cdc2865f7bf54d845b9bdeefb5f568c79322d679d74ebae3886252387e56700a66648c1f35f9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "keylogger", "colour": "#66C828", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651265780, "uuid": "90423c40-5cea-4e13-858f-92cfc3154c7f", "value": "T17C220981BBE88775DD7927B698F747501570E2055C73C9AF1898111E3EA72410FC3BB6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651265780, "uuid": "f0b7fda0-7be9-4e20-b384-e6eb54f81e99", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651265780, "uuid": "a825f2f2-46a0-4e15-a6d9-227ee18345eb", "value": "192:mStmcuq6QIDxi4maEYbRzmEsLkugv5JHTeeJYHcwY7fazItxEEi:mStlF6QmE9rUhVsLe5perYyAEE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651265780, "uuid": "1365dfb8-ca75-4de4-af8d-4ad3ba6af531", "value": 10752, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651265780, "uuid": "8eaf0fb1-5bd9-4c79-81b6-735855ecc62d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651265780, "uuid": "f69746fc-0de3-4d8d-9298-bfabc3ff4ee0", "value": "Keylogger.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7fc1be28-c769-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651201647, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651201647, "uuid": "807933e7-cb4e-4235-a7e9-a2c5baf331a6", "comment": "Malware payload (Heodo)", "value": "06e0f7265d55d9f3184b71dfa8609077", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651201647, "uuid": "c6075e24-918a-4f6f-8cb8-23813d688261", "comment": "Malware payload (Heodo)", "value": "17833bff2f99c494bc8acd734ebf7ddda6ab4241341a7d5b11fde34aa0a1853d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651201647, "uuid": "748acd73-5d3b-4a1a-acb8-c2671f851ca2", "comment": "Malware payload (Heodo)", "value": "4bc9ab74b23e5b2220f0d9617897c9f8d8c810ef", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651201647, "uuid": "5c0e8cc6-ac29-4059-9f62-2d09a9ef5567", "comment": "Malware payload (Heodo)", "value": "95a57f843538a613e62987c53ccfd7c61837411607c84a49805ef1310fd35c38ac8fad0e53dac281aad633c0d59e3406", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651201647, "uuid": "aaffdf15-49a0-4c2e-84d6-e0168571f363", "value": "T156517E283DDA6218EAF3EF7159EC7595CFA6B562F9125A4D00C2070D4921600FD91F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651201647, "uuid": "b1ea924d-7053-4aab-93a7-b9d1ceefbfd6", "value": "48:8mKkS0N26Xj03ugtHU+uccIx/cC/N4ab:8mK30k6Ne9D/N4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651201647, "uuid": "8c2333a5-f021-4b16-b0cb-e784450b1a24", "value": 2454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651201647, "uuid": "5875cd30-9ed9-4515-a9d0-e33f5db975c1", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651201647, "uuid": "d5b85e04-13ff-472b-9ad3-3ad938c2357f", "value": "emo.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89be6d03-c7dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651251055, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251055, "uuid": "defdabbc-34aa-46de-9261-4b2ed693bec9", "comment": "Malware payload (RedLineStealer)", "value": "00fa25332fdebbd8e3ba10d5625ba9f0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251055, "uuid": "9209c2dc-5ac5-44c5-b9f8-04541e1a8bba", "comment": "Malware payload (RedLineStealer)", "value": "17b1c5b3159381a33a4cb389d7324ceecb3ecf904d51e4c4a52526d75084d987", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251055, "uuid": "d2304d46-1eb4-452c-ac9f-4def99eba6ae", "comment": "Malware payload (RedLineStealer)", "value": "2dd26c40d7f643522546af8340455955246be12b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251055, "uuid": "59bd807b-077b-4df6-bea0-9cbd75a0b6cf", "comment": "Malware payload (RedLineStealer)", "value": "111fb6fb306bd5c514842b31ab4b647c9e118ebe84f17806fb4664b5891756ba155a654acc8c52f82ac7ed14db60fd6b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251055, "uuid": "c840012a-b468-4e2f-bc8d-f5b88ed70c1c", "value": "T13384CF10BBA0D03DE1B316F4797993A8793A7DA15B2455CB62C52BEF1A346E0EC7430B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251055, "uuid": "454c4aa2-e434-45f4-b032-598e767e3f24", "value": "a3f6b8bc7b7cc42168607a2de14454ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251055, "uuid": "0d2ce6b4-84ff-44ff-b7a6-aac93a603a1f", "value": "12288:9WuLfTOn87iNVZi6fjqfWJmfzUzIZ5aP:9B7mVVwwwQU2P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651251055, "uuid": "2e0f8f71-9a00-4def-ab1b-48a84dffa346", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651251055, "uuid": "3be2adc5-9c79-43e4-9b1b-cd67d9a0b18f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251055, "uuid": "a8b72255-90ef-4c33-9c78-293d10937513", "value": "00fa25332fdebbd8e3ba10d5625ba9f0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a29c95cd-c7af-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651231770, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231770, "uuid": "bca11200-d7e6-4b60-9c23-81fd2c092b36", "comment": "Malware payload (Heodo)", "value": "ca023e1aeb79ed2db8f730983efd74c1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231770, "uuid": "0e180784-97c5-4bad-a467-cd8dd9b81d2b", "comment": "Malware payload (Heodo)", "value": "1859ae65da059efad607647b199f835aba0ef8f2f021332752ed34f877087de9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231770, "uuid": "266485d7-8b43-4217-9c60-21ff10fd81b4", "comment": "Malware payload (Heodo)", "value": "1af8b5dbdb7e4a27082308220079e3b76e242b52", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231770, "uuid": "b0ed9929-727f-43b2-9b78-cad8ef214dff", "comment": "Malware payload (Heodo)", "value": "fd324fbba97479b5ccd523b5b3b36df9ac7fa80335c8d5859090fc7f1860c12423f5410b009f7264d36af95b17600df3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231770, "uuid": "8e975691-bb0e-4f85-b7ad-e1ce42c17b2d", "value": "T1A3C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231770, "uuid": "d4334922-ba0a-49a0-8571-9ade83ccc947", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231770, "uuid": "13f38b10-99ec-4a28-81ea-e833cf9ee1ed", "value": "6144:JhZ02GdOOgPYRKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfSKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651231770, "uuid": "8d2898f1-6a25-443b-a3d4-3a86e3c1c9e4", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651231770, "uuid": "e60a9d6d-fc2f-4c04-a1f7-c386424c75a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231770, "uuid": "3f0766a8-c6d8-4701-b056-abfc384a736f", "value": "ca023e1aeb79ed2db8f730983efd74c1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76800849-c7ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651236420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236420, "uuid": "cb3579be-b71a-4b09-a085-bfc3ca559869", "comment": "Malware payload (AgentTesla)", "value": "25f95e4d8ef11f60d3eb97ce8b7bcbf9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236420, "uuid": "2977588c-bd64-42d9-8280-f05ea022873b", "comment": "Malware payload (AgentTesla)", "value": "1888652541a3eda3f0390387c6706f18aaec5c5acbcde06113ecaf4a093afc56", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236420, "uuid": "3a6e460c-d3a2-4993-885c-52352c1f7bc5", "comment": "Malware payload (AgentTesla)", "value": "2f3bdd8f8910d3e20ae2fae6f4958701a96f26bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236420, "uuid": "a4289c51-561b-460e-b0bf-22422347ad67", "comment": "Malware payload (AgentTesla)", "value": "474cb4d88fad349cb13d5c64fb3acec9bf4221f5f56d518f2da0c4eea0475a01e1b2e21b5b5756d8a7998cae6e99c601", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236420, "uuid": "9fa01acc-ed74-44d9-abe2-ac84a91cc539", "value": "T11D942317E4DC279056B11B372F8AA3F56935E21FD7A037E5852FC38A691DE68080C86E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236420, "uuid": "c57b21d6-2b1b-4249-85e6-454b59f7a9c4", "value": "6144:sK2BRtOIi4EMWT7J91ToeSfK2WaGoqAREJQxRiLsPJxcQFbd0tKdVfupaUlyJs:sKMRt/i4t6TZSfxlGaWqXd3BOaUlyy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651236420, "uuid": "50a6dd72-ebe6-412f-9a98-b775d9eac630", "value": 420952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651236420, "uuid": "efed169c-04e4-4b79-9d2e-174a79033558", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236420, "uuid": "fa33cadc-414b-468f-bc6f-3d6efd18c8da", "value": "DEBIT NOTE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fefe7dc8-c7e5-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651255118, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651255118, "uuid": "7013734d-bc21-4c08-a6b4-a48c72b790bd", "comment": "Malware payload (RedLineStealer)", "value": "1facb61b2f90b99e43b5b05e71160ec8", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flapjack", "colour": "#D0AAC3", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651255118, "uuid": "c82f0c62-91fa-4bb1-a585-9024c5a6a9e1", "comment": "Malware payload (RedLineStealer)", "value": "189871a37d4dc8849f801e42ea1b8d09167cba5fd9d0b2dadafd002ff99e33ee", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flapjack", "colour": "#D0AAC3", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651255118, "uuid": "d6badb08-5f99-4579-a75b-093cee261d7b", "comment": "Malware payload (RedLineStealer)", "value": "1a58e82a8a4d82478ba18674fb5918f4b117c6a3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flapjack", "colour": "#D0AAC3", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651255118, "uuid": "bc95771b-9948-46a8-a85d-c242a63e39e6", "comment": "Malware payload (RedLineStealer)", "value": "0e76a1fc689aab6a8f9859d4d772e7e204c7b648e8c01e3b228566902c04fdcca8a7c554715e4ff181ecfd1c129b173f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Flapjack", "colour": "#D0AAC3", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false }, { "name": "stealer", "colour": "#CABE3B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651255118, "uuid": "549ffb4a-e583-42d6-a43a-500a7a2824f0", "value": "T14AB32B6973DD5624E5FF8EB079B111D046F0E5927C02D79F4EC4B4DA0E22B80EA22BB1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651255118, "uuid": "7e8e35ff-e2e5-49dd-b862-be3b3ee87c26", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651255118, "uuid": "d59fc218-19d8-4b65-b88b-bbb97218d600", "value": "1536:hRx5kCrPQ2IxAacGZ5dCnPtt8xsD/ETLKYQfcHjH2wv2WbuZNoxjVEA+0wuei6m1:QCrPQhlwVD/qLKYQfcHjWK91GA+hM1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651255118, "uuid": "8d53aebb-7fc3-46c5-982f-b7becb1234a9", "value": 108544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651255118, "uuid": "90ed48d6-bca6-4433-acbf-c3c0a1f98bf0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651255118, "uuid": "9f90db5a-339e-4bd9-ada5-134d5fe83802", "value": "nplv4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6bd6ccf-c802-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267559, "uuid": "3dd2e54e-3228-488a-a050-8297b0d295fb", "comment": "Malware payload (Mirai)", "value": "f7cefb8029804c70e73e111e5e7e12b0", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267559, "uuid": "d43dc60f-1c77-4177-9ee9-6f2dfca3f66b", "comment": "Malware payload (Mirai)", "value": "18f3620907f3b403a009a210a6f814ebb415d1c351447b83db4c94dc7082c050", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267559, "uuid": "6891b3e1-7203-4d93-beac-82fd3a98cd84", "comment": "Malware payload (Mirai)", "value": "432ab415394bca21e9bddecd66cacee3bf1ec3c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267559, "uuid": "af7b19b7-84ea-404b-aba0-0f331dc8cdc5", "comment": "Malware payload (Mirai)", "value": "fca2d1315bea4ed7b76c258b530ebfc0ff39285d413fd6cf41b6a7ffc755b0a6c88c4a8aed33da54b298c6d3a23d4af2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267559, "uuid": "3df8637d-f676-4ea0-a8e0-3110350ce11a", "value": "T169B3D5067F711FFBE8AFDC374AA91B45288D581A21A83B79B634D458F20B65F05E3870", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267559, "uuid": "b9bb6d7d-14f8-4e2c-9c57-3283dc60e5fa", "value": "1536:58Hnoqzc/Tuha5QW6Mu4NNx5oMo0U+8led70X5QyYqelFlbA:GIqo/TxeWJw0UbetWKl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267559, "uuid": "5c787cab-ef42-4890-9326-c92f1056035c", "value": 111240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267559, "uuid": "ba9662a1-0b1e-4e21-b9f8-93457e3a0eb7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267559, "uuid": "394c1d85-0170-4725-94eb-bb097efb5792", "value": "f7cefb8029804c70e73e111e5e7e12b0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d47a01ee-c7aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651229706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229706, "uuid": "93747a1d-c48a-4539-9558-142487eb71dd", "comment": "Malware payload (Heodo)", "value": "fe65d60caf3b4ebd598189630766a8a0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229706, "uuid": "ad4a5c8b-ce40-44f0-a737-a57555f675a6", "comment": "Malware payload (Heodo)", "value": "199cfedd9c46a1862845cee1746e71d7c23eb72b7ddd4ad090fc1f89d6f1b70c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229706, "uuid": "efbf7ac2-d0ff-43dd-8a9a-1f8625bb0f7c", "comment": "Malware payload (Heodo)", "value": "c3ee756c81f418766b3a96e426a00ea0e3119fb5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229706, "uuid": "f1660603-b26b-410c-a698-1897dd640eb3", "comment": "Malware payload (Heodo)", "value": "efc3bed4fd748a70c7b55cb0abf52b10062e0477ce5ec7e8155ad1b61a134edd2b56f9c0c89f624fd5db555d693b0d7d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229706, "uuid": "8286d9d8-3a94-4ac0-85b9-e760dd2b2e58", "value": "T162C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229706, "uuid": "850026e8-3c84-4dc1-bd46-eaa2b1eef451", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229706, "uuid": "09c3b08a-ad43-4388-9692-80b3c98b19e3", "value": "6144:JhZ02GdOOgPY1KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfWKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651229706, "uuid": "5d2157b5-2de2-4f22-9189-a74e58acfd88", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651229706, "uuid": "9759d1a9-f7cc-4954-aaf4-ec4217fe4a41", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229706, "uuid": "f0532536-3cbe-4ac3-b4d4-e3016eedae66", "value": "KEZav4SdwTRVuUo.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60308691-c7a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651229081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229081, "uuid": "f8b9975d-c89c-44ca-880c-fec4818be574", "comment": "Malware payload (AgentTesla)", "value": "5e8ddce6c99dd58ab18a80e2f44c0e80", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229081, "uuid": "1b412152-ec90-440a-9174-cf4b9341e7bf", "comment": "Malware payload (AgentTesla)", "value": "1a2072c927411d88afe3f90782ecaeaa219a35d96f79f986ef027de29dcdbe0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229081, "uuid": "ab0aad17-65a6-46e4-9e1c-434fe665cd15", "comment": "Malware payload (AgentTesla)", "value": "413b781f4b7a3b3d63e831bfc5d7aa8e7662f6a4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229081, "uuid": "b9bb005d-0c2e-4f66-8b82-3f52799e7f81", "comment": "Malware payload (AgentTesla)", "value": "f63750faf032c14f93303828e827b03b57c5d0a540d08cbae36e8ca528ff838b4b6ff995b160f4b8af6020205676c5d0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229081, "uuid": "f46fefbe-65c8-4959-a389-c6eb6a9394d2", "value": "T101D4ADFC71817DDED40BCAB999687C60627170B39ACBD612523711888F9DFE29E101EB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229081, "uuid": "d532be3e-83ff-437d-9212-4a9e5b6ed994", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229081, "uuid": "8a2fc5c1-2b86-4525-b8d3-6ac5364e9acf", "value": "12288:f5JBzum/NT0dBiclM+qZLcxOBiBkv2kg22YG5m0j3AbHy+Kn:f3Q4MdM+bfg9gU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651229081, "uuid": "e04bfb57-35d7-46c5-b31c-6c497d72d8b3", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651229081, "uuid": "930e4246-bf44-4ee7-8661-0e40295a49e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229081, "uuid": "37ee61db-12b5-4128-beca-a0409551b67a", "value": "Cotizaci\u00f3n_Prysmian Group..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3144e120-c7ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651243176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243176, "uuid": "fb4c58a3-ef83-4599-97a4-2695333ab543", "comment": "Malware payload (Formbook)", "value": "827474099bfcd00925c35c17cfcbe2c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243176, "uuid": "30d6a0dc-5ed9-4749-a4a5-84fae8f162ec", "comment": "Malware payload (Formbook)", "value": "1a2b06d9313d1317f16483b27f97bb569dffa8e22c1eddd25fe753a92146543b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243176, "uuid": "c02f6d85-ad66-42bf-846a-f9b3ea03c2a6", "comment": "Malware payload (Formbook)", "value": "9e3099b600ec216cce43eb8718c979ff24f86254", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243176, "uuid": "4f122c12-c097-4d3e-bdb7-8ae3adc6bf3c", "comment": "Malware payload (Formbook)", "value": "ff58591f9171c87dffe81da726ed04ee5dc6d900cee21f4cd416a7559d49d82e8d67ea4ec3f0a48bde3371a675b7ed80", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243176, "uuid": "de15a0a9-b14c-466c-9c6f-c4cc8872ee28", "value": "T1052412A47964C1F3C46506339E39971AFEFED61630A8862F27606B1D3D26380CE0E797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243176, "uuid": "dbaae1a9-14ad-4101-ba69-fa021cc3029f", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243176, "uuid": "edfa3718-556b-45e6-a1be-cedb7ad43491", "value": "6144:HNeZmdZhnfbDgpZmk0t3nFrHZyX/0vfsjBt6e+:HNld3TMpZmk0t3Frj3sjOt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651243176, "uuid": "bb27a1fa-5336-4217-a175-e3a3473af7ef", "value": 219332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651243176, "uuid": "de8d869c-c744-4a97-b5f9-f335772b6fa9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243176, "uuid": "442f9fe3-6119-4c1c-9364-0d435c0673c2", "value": "PL12040_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8c47365-c7b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651234867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234867, "uuid": "a0523611-cc4c-4d58-a66c-27310d7b984b", "comment": "Malware payload (Mirai)", "value": "694781b8dd5994e2498494c253fd9d8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234867, "uuid": "67e83f14-6736-4b28-b9d4-f70ede63d8b1", "comment": "Malware payload (Mirai)", "value": "1ac169210f22b8a1cf1b0ad0a8fbf6d3dc82f859ff8681df3493882a31f4894f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234867, "uuid": "b0873061-20a6-45c3-9bb4-3269bce8bf14", "comment": "Malware payload (Mirai)", "value": "183cbe87fa7e717828e1302a7f502129ccc5f112", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234867, "uuid": "638e6670-e0fc-4921-ad25-d4025cd31282", "comment": "Malware payload (Mirai)", "value": "a4d4272b9424e5ba7b4e3293e2331a7f80ce7e5205d8f2d55bd2b2f3b0a7b324c164682387d06678934f7f47df65aa0b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234867, "uuid": "752b202a-d8f1-451c-bd82-d14cfa6a75f2", "value": "T14493A51A7E258FBCF799863507B78E22965837C62BF1C141E19CEA015E7024E741FF98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234867, "uuid": "3e5370a4-6eed-4699-ab15-ffd4c8d95454", "value": "1536:AKzqmzfphPukFhyx2XgHw3eFz0HDDZ5KHZXvEY2QP7a:AKqYhueXWw3eFwHp5KHZXvEzI+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651234867, "uuid": "30b10f4d-fd28-4625-883f-3705f5d5781c", "value": 93472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651234867, "uuid": "afbba4af-c2e6-4fe5-9b29-9f116fc69905", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234867, "uuid": "5298e8c5-9be9-4cfb-961d-9afabd4a3c11", "value": "694781b8dd5994e2498494c253fd9d8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "038a4a02-c7a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651225060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225060, "uuid": "c57fe9e4-35fa-46f3-bdae-a82a5360396a", "comment": "Malware payload (AgentTesla)", "value": "ec8204337466c69ac110474024b1e950", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225060, "uuid": "041da4b1-91ee-4452-8912-9adccce18118", "comment": "Malware payload (AgentTesla)", "value": "1ad4c3719f359a2baa47e8392dacef2c340247eb0f1e18a74b6cb17a58f37aca", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225060, "uuid": "8185fe7d-bc6f-49df-be52-a17c379c1b67", "comment": "Malware payload (AgentTesla)", "value": "5ced6201795f2a1520fa804c142e2f5711d2454b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225060, "uuid": "53ea7e53-5699-4a90-b29f-d18d7553d740", "comment": "Malware payload (AgentTesla)", "value": "4d03e4a8c6a29456dd318fc08822645e87df2306fa4373f45b003620705c5de8713d606d62d662d2f2a0c3690859251d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225060, "uuid": "742fa447-5881-4b7f-8ae1-cfee67414245", "value": "T191E4BE677509DE0AC578B9F55210AD9001A59E9FA0B2E2F45CB133B464F22C3FE913EE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225060, "uuid": "f0033fd9-c944-4d1a-ace7-404e152ff604", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225060, "uuid": "de099673-0f39-4616-96b5-4877c9666cd9", "value": "12288:gT6La2sbAYH2faxl59MhC0Hf1mWT1Z6FkDkYTM3:pLa7bARfax5cn/1mWT1wFikYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651225060, "uuid": "f3132195-7b5c-4bfe-a14f-0067cbb67383", "value": 718336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651225060, "uuid": "5948f297-c19f-4321-be64-d980d5673dab", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225060, "uuid": "7314c48b-5a8d-4aea-b415-b5a7be750c68", "value": "Advice_.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47d15c52-c77d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651210143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651210143, "uuid": "c2daac73-1320-4b71-8442-d6b41477aac1", "comment": "Malware payload (Quakbot)", "value": "c16b1c7f74e32785b9e38fbb3b0a792d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651210143, "uuid": "a4a7ebf3-3fd7-4a90-85d2-aecbf6d11e64", "comment": "Malware payload (Quakbot)", "value": "1cf95f5c7ccd1135761d62d675a466b7abbaa2327cc5a967582ca049b684c6c0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651210143, "uuid": "20ac1918-3083-4982-960b-7d69b3e185ee", "comment": "Malware payload (Quakbot)", "value": "7d29f69623ec9faad699dca6e96c52fcd92199a2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651210143, "uuid": "77f2304e-5d4f-4cd6-8f0b-ae1b6f87963d", "comment": "Malware payload (Quakbot)", "value": "c7037245d158c49dbd4560b9f2dcfa2b08320bb9336517ec44a9454bdd0d6e0b29507c572ce268037d67ffb939f25ebb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651210143, "uuid": "d723e3d1-2a6d-441f-8f98-ee8d97b2bce8", "value": "T10D55BFF876047DE6E66F567BDE96ACDC03B6272289CBA4CD406477C305A3376EE02805", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651210143, "uuid": "105f7197-34b0-4ff6-9351-e33fff423149", "value": "24576:C5VHfbQzpWQUskSW4KdyLvCfZsykSbglpKK2w/StDCCgnLX+He+ps2r0amD6OFuY:C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651210143, "uuid": "aa889783-7af7-4c25-bd96-a464c202fae5", "value": 1314304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651210143, "uuid": "a50d2fd8-d2a8-4c71-95b6-0636c3f3d81d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651210143, "uuid": "f9aac17b-2392-469b-86d9-97ee63e47827", "value": "1.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9aeab02f-c7c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651239058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239058, "uuid": "d1b9e999-dcf4-4574-80e9-56aeef5348e3", "comment": "Malware payload (RedLineStealer)", "value": "f23ecda9199e3d900e8cdc93b8add64d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239058, "uuid": "a778be9f-1435-4b6a-83af-5a2245cd0291", "comment": "Malware payload (RedLineStealer)", "value": "1e63faec84a2e3752ddd8ef71f9879546b12102ed5373db0dd59353016a35367", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239058, "uuid": "73e498df-c031-4aea-afcb-db88efd71bb7", "comment": "Malware payload (RedLineStealer)", "value": "365edb8f666408b9d673f8bddb26a0d1c51e5115", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239058, "uuid": "ff646723-5bcb-410f-8214-ffec63786934", "comment": "Malware payload (RedLineStealer)", "value": "0e9994b5dc878722cff727341ad0aa86442dcf114ffaf9299277668ae6573a7ebb14f534deadf77b72f21994654aae45", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239058, "uuid": "2bda52a2-e2ce-40c1-a1dc-98cfc126eda2", "value": "T19884BE40BBA0D039E1B716F0B979D2A8A53EBDA19B3551C722D53BDE1A342D0ECB4707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239058, "uuid": "115118f3-5965-4fe7-b2f6-3fe761fbeaea", "value": "afc01618e0df309805fa06d056c565e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239058, "uuid": "683ca45d-538d-442f-8838-7169f4f622d1", "value": "12288:qGhFgwwlN1Ou19NmOuNheYFZ8QrKszJgqw:qiqC6mrNheKWQrz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651239058, "uuid": "80fb9505-f640-478f-bf01-682b65f3fd2d", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651239058, "uuid": "867d98ea-5ad5-4a28-9881-967c46fe7615", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239058, "uuid": "3562b9f3-aa4e-48a4-8de0-930cce27037f", "value": "f23ecda9199e3d900e8cdc93b8add64d.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05659894-c79e-11ec-8e58-42010a9c0032", "comment": "Malware payload (CobaltStrike)", "timestamp": 1651224205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224205, "uuid": "7a220d1a-4cfe-4ac4-885b-6e9ed376c5e4", "comment": "Malware payload (CobaltStrike)", "value": "5e2e4f2ceef24b29f2c306504fc25ec2", "object_relation": "md5", "Tag": [ { "name": "23-227-190-216", "colour": "#EEDEF5", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224205, "uuid": "3eff6287-fb73-4664-977a-0042c5bfe0ff", "comment": "Malware payload (CobaltStrike)", "value": "1ef237c8ad139698d3be05ed5a74842392590fe68e80d39e65915d7fc29faabb", "object_relation": "sha256", "Tag": [ { "name": "23-227-190-216", "colour": "#EEDEF5", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224205, "uuid": "8ec41eac-7a39-4665-9148-c2994ab98de5", "comment": "Malware payload (CobaltStrike)", "value": "e5bd101e6ebac41c82a3113cbaee9415d5ea4a5a", "object_relation": "sha1", "Tag": [ { "name": "23-227-190-216", "colour": "#EEDEF5", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224205, "uuid": "8581c035-7aae-4f64-b438-103065cf3c13", "comment": "Malware payload (CobaltStrike)", "value": "afac34641d61a549e3a754fbc82380ebdfa136166661e1be9e8bc1f80fb075c771d98e3ad91b8ea6c5bd67a1f6884fd6", "object_relation": "sha3-384", "Tag": [ { "name": "23-227-190-216", "colour": "#EEDEF5", "exportable": true, "hide_tag": false }, { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224205, "uuid": "a32bc18c-9bff-425c-91fe-402a6110dfe6", "value": "T19184D112A5B900EFF2366338E6A35D204FB2B85DD5B4D76E1B940D1B9E133D04C6BB22", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224205, "uuid": "a9ab664e-64c3-4adf-b72d-dcee61d968fc", "value": "1735102c82d38c2877a8af0b2d9f60fa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224205, "uuid": "aacb0a1f-796f-457e-b38d-0f9a382475d7", "value": "6144:JiPR7yox0qMzPTIQdBM0xo2a3RShs/VaquemZSbYKoT1BJVELJaEKdUf:JYyox0F4eC13RSoaPeHbRoTjE1aZU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651224205, "uuid": "866245cd-5fd9-4390-bd94-c273cac41a2a", "value": 379392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651224205, "uuid": "fc68e37d-d1f8-44cb-8a4d-2801aa054b29", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224205, "uuid": "a276f4cc-6109-4175-bbd9-768cb952651b", "value": "IQV9QYIxHtX.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73254d8f-c7bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651236844, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236844, "uuid": "2a6094eb-4660-4d38-be3d-2677e7aa932c", "comment": "Malware payload (AgentTesla)", "value": "bc5dd01d839fabeeeea53f342bb0797c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236844, "uuid": "c79ded00-01c0-4f69-96b0-f2a03325a047", "comment": "Malware payload (AgentTesla)", "value": "205f7d3e62666e2d5c6a07ff1c0c1fc23fe8076fb3e7b04ded4fc1286ac263d5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236844, "uuid": "fb48b08e-de56-4ee3-8a4d-69de548c406a", "comment": "Malware payload (AgentTesla)", "value": "baf508ff3e9c02d0743b70fd9e9a73b2bf8f31a9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236844, "uuid": "e34b1000-a9bc-4714-9448-d8f0df2811e7", "comment": "Malware payload (AgentTesla)", "value": "c055974f2c48e8968e05ec0f95912774b7040a20860b9f08a9c2052fcbb92cabe3ea2f383d46b724dcbe6cebd13e032a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236844, "uuid": "ca4723ea-70d4-4c05-a994-bb44a5250d9f", "value": "T19E942317E4DC17905AB11B372F8AA3F56935E21FE7A037F5852FC38A591DE68080C86E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236844, "uuid": "5f5e328e-3818-4ebd-8e65-7f138c776b7b", "value": "6144:bK2BRtOIi4EMWT7J91ToeSfK2WaGoqAREJQxRiLsPJxcQFbd0tKdVfupaUlyJP:bKMRt/i4t6TZSfxlGaWqXd3BOaUlyN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651236844, "uuid": "db796878-50b2-4f54-b37c-a085bd133202", "value": 420974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651236844, "uuid": "114f5ae8-285d-4a07-9f0f-9779d6b2a629", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236844, "uuid": "63a912ef-4970-44be-8fe3-c3a05259184c", "value": "ASEAN SHIPPING ADVICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af7dc6fd-c7ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651243388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243388, "uuid": "d9cdbece-e747-4ab4-a88e-085d909bb395", "comment": "Malware payload (Formbook)", "value": "356db04c1bb91dab8c31ed90ca6bfd31", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243388, "uuid": "ff0e1977-21ac-4525-91b7-447c6c24a1a8", "comment": "Malware payload (Formbook)", "value": "215ca89a5e16fa806b6a9193ef6958f2741f9a022571703a278a6ebe23372539", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243388, "uuid": "49074e98-aacb-40c9-bcda-02706e17756d", "comment": "Malware payload (Formbook)", "value": "842983de29f2ff36887224b1c294750befcc9a54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243388, "uuid": "0babbd00-f45d-4f31-9d28-ef732e51556f", "comment": "Malware payload (Formbook)", "value": "ce7f5e128416e75d64377c689d0cd4ff08aefae6a626b80d69301d5cf72e41b174e6b8aa9f833ff98d8712bfb539c17e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243388, "uuid": "771a752b-4b0e-479c-bbfd-6e86e7cfdbc5", "value": "T1FDD4AEE1314C8AE3CE76597606DF8F7113E38A265122F7239BC377F2254261BEA57284", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243388, "uuid": "a70b5ef3-d87e-4eab-9bdf-f95ec5eec347", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243388, "uuid": "4551afd3-a676-4214-9212-a6772770aec3", "value": "12288:oE1BwGGiBtUq4PTysM4hgz9uceH7HvWpoUQFZxING7tj:0iBH4LPSolxwG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651243388, "uuid": "d9bc56f6-4e66-4ec4-b1b2-e356c014eb02", "value": 609792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651243388, "uuid": "ab7c6c1a-e7d0-4c32-b9d1-859f1a1514d3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243388, "uuid": "22170377-def5-4079-8fd7-79f11cbc319f", "value": "356db04c1bb91dab8c31ed90ca6bfd31", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "454ee50c-c7da-11ec-8e58-42010a9c0032", "comment": "Malware payload (BitRAT)", "timestamp": 1651250082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250082, "uuid": "c9d9512c-4f44-47ab-9309-6ba3293fd2be", "comment": "Malware payload (BitRAT)", "value": "5581e3fd94ed7333eccfba3a327215a9", "object_relation": "md5", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250082, "uuid": "ed084cd6-8942-4e88-8949-4b2241396c1c", "comment": "Malware payload (BitRAT)", "value": "2235bf5d07be95e008a1d32e76c3ddff1c2d4fd4ad437e251e5134a70e134958", "object_relation": "sha256", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250082, "uuid": "ed36948a-79ac-462b-a74d-7b812c094348", "comment": "Malware payload (BitRAT)", "value": "b5ef188ba7740971996319da04253677a039b5e4", "object_relation": "sha1", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250082, "uuid": "aa1b1aea-cf33-4ae4-ad8f-9573df549be0", "comment": "Malware payload (BitRAT)", "value": "1be7d03642d0d2170a98d687ae3aec890788c5ddc8e9aaefd7f87861d86cd6eb799e943fc3d28177b9d90e4965c7b641", "object_relation": "sha3-384", "Tag": [ { "name": "BitRAT", "colour": "#52156C", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250082, "uuid": "426693c4-6f83-458d-9c26-c0e02530971a", "value": "T1556194D944ADF6BE9618DA4B5B82FC197F9843FFEB69702B346004EE41486C050392C7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250082, "uuid": "2ee6edd5-bb40-4ae9-8a29-694fc4e88156", "value": "48:MQdPlmCjQjFZ8pA80zcqvqi0coVkBFd/jABaemyNpUfhQhPc+X72XZ8YElGIkp:MMwAKFOpA8m0Bg7ABK62oc+CXyYrII", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651250082, "uuid": "193fd74f-3add-4f4c-98df-ba85340ecb0c", "value": 3378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651250082, "uuid": "33d0c753-ce9f-4908-96fe-b7d99ac2b8b8", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250082, "uuid": "295ef4f6-31ad-4fdb-a424-4bac3bafbb35", "value": "CHECK_28.VBS", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7252f7ec-c80d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651272061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272061, "uuid": "b8b369f7-6cf3-4b97-b0ff-5c17cde076ac", "comment": "Malware payload (Mirai)", "value": "2a03fd3af0cdb66ec858647904bfa64d", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272061, "uuid": "6eaf9a98-43a8-493a-9394-6f9967628c4e", "comment": "Malware payload (Mirai)", "value": "2290bf7117aff878140240f47434231629639d277c2e0e6fd2ad09d0d67218a6", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272061, "uuid": "09719ded-c383-45f2-bd8b-ef69d7f1e167", "comment": "Malware payload (Mirai)", "value": "35a48cd59930ee7c4769817e96bfb567c9945aba", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272061, "uuid": "cb4a298d-7ad2-46d6-940d-7514db5264fc", "comment": "Malware payload (Mirai)", "value": "70824f235dfbce66fdb2a247bd1c6577160bf712703d9a5dac0edbc2a240fd1269d06b5277746954160b60909ab3cdeb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272061, "uuid": "041ca08c-ed51-44e2-b7d6-50754708781a", "value": "T1B6E2E02DD1DC819AEC9AC0BE06836FD59F360F63CB137405DA44D1D35A4A4BDB0A2ED9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272061, "uuid": "95b0eba8-fd76-4cad-b5ec-b6701735518f", "value": "768:dV0OIiW4nJl5qmtW048WsgxvwvKdJgGlzDpUYs7:dHWIqmtWaWsglwvK3VqYI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651272061, "uuid": "42036baf-7c4b-4c4f-a256-a7ae0df5f55e", "value": 33192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651272061, "uuid": "dbf7338c-74cb-4204-99eb-6982cca13a1b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272061, "uuid": "33b59c1c-342e-49f4-be03-16a750f34d3e", "value": "db0fa4b8db0333367e9bda3ab68b8042.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e682427d-c7a3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651226730, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226730, "uuid": "cdd9e2b0-6e7c-48e1-94da-8e6ced66238d", "comment": "Malware payload (AgentTesla)", "value": "6986a30ba3effb8ee3d58f4b18485850", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226730, "uuid": "92102bef-2a2b-4cdb-89af-54e29f0e4974", "comment": "Malware payload (AgentTesla)", "value": "24d7f6c65451c7c972b4b8874c7da6d460261fa4bcac7c132e46c0e6b9c34d39", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226730, "uuid": "8abe2417-3bc9-4d39-a156-7d1920fc2d5e", "comment": "Malware payload (AgentTesla)", "value": "2a3b3bf5e9dc15c02a266e1fa5425f0c9a3cca1d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226730, "uuid": "acffe18e-96bb-407f-a54f-415a3b92d4b8", "comment": "Malware payload (AgentTesla)", "value": "00d3322b653775c18d97239be8bc096edc615efb7b91eef908a8c40cce701d165e71c8b71a37434046ea8f8e3b9b0bfc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226730, "uuid": "552bd16a-a57d-49af-83ae-d0930e78d7f9", "value": "T15684230470009CB8F2A13F6F0761818DF6E55A1BF28BF262C24A85AF756645F47638D7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226730, "uuid": "94b89218-e700-4207-a1bc-2111b8dc31fa", "value": "6144:m6mr6m0/b12CYNq2ZJQdygHqZRb70Bf0bra1aySxw3rwkrqbtJJU61u/:m6md0j1zHqZp70J0POafcrBrqK61c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651226730, "uuid": "006b5696-162d-4156-b714-472659f6f921", "value": 393922, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651226730, "uuid": "f8427389-6dbb-495e-a7b7-a98f2623bcb4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226730, "uuid": "1fdd0def-3732-4be6-9831-a689b275f3de", "value": "DEBIT NOTE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47704fb3-c790-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651218302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218302, "uuid": "9c435e28-05e1-49c0-864d-6859d417a86b", "comment": "Malware payload (Heodo)", "value": "918e4b7441929b456b54ae8eadbc5fc8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218302, "uuid": "a438253c-90a6-4b42-8208-b61e26f24474", "comment": "Malware payload (Heodo)", "value": "24efce38fc117ce94d1bfb219e9ae86746d98f1bd4ccda3c8c164ef249184080", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218302, "uuid": "6a1a282d-1d05-4c13-85f3-fcf0ec50c847", "comment": "Malware payload (Heodo)", "value": "2d872d11a6378a7b280b32f960ec6f74f652ebad", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218302, "uuid": "750cb1a6-fe6a-45d6-983f-659eb806dbd6", "comment": "Malware payload (Heodo)", "value": "7e7babc6ca0667b38f105f51f8f024d4f96a49153fd5391dad5121257f09df1e519fd23493c4662bb247689bebea6d54", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218302, "uuid": "00b6d544-b6e4-4178-a501-05d5bd9cfcdb", "value": "T140C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218302, "uuid": "3aea5c18-4de4-4400-9c94-8bdeed63da9d", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218302, "uuid": "39f11dcd-e025-402e-b99d-2604f59b0927", "value": "6144:JhZ02GdOOgPYDKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfkKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651218302, "uuid": "5067eac8-64eb-4e14-9e43-3d9947026df6", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651218302, "uuid": "a2bfe9b6-473a-4e22-a35e-ede614509f5e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218302, "uuid": "7765a344-fcae-4d0e-a8fe-93002a35068b", "value": "s8ax8xr6X4quT2SywbDxVYt6Qgh5G.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8439f280-c782-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651212391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212391, "uuid": "0b2d6a0d-23e1-4a92-9b5a-befad5180a16", "comment": "Malware payload (AgentTesla)", "value": "add8e964a595d7af30f02783943c3a00", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212391, "uuid": "ef8dbc65-92e5-4b26-be9e-d2d00607abff", "comment": "Malware payload (AgentTesla)", "value": "24f6485539bc5d700d17ec8d629827ea80dfae2eb2189e872f4b8ae0e7f1d66f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212391, "uuid": "6b792e76-408c-4889-83d5-9fa6d9d847ef", "comment": "Malware payload (AgentTesla)", "value": "ebc70fc28a0e5e7610a2b4485666250f5bc79093", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212391, "uuid": "f8024702-50fa-46f1-99d7-24e5055a3952", "comment": "Malware payload (AgentTesla)", "value": "2eb997068a736e4a77501d41ca22c58a7527912754e99183357f9f9da10a3b9a3af1e3519c9b94e1810c8153783bd6f3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212391, "uuid": "e738ccbe-685e-493a-b447-f9466da19ad5", "value": "T12E942306AB8D7D8EB35AD88D167FDB223F2049CA68A4CC15A7AA3B42FD5541341CF317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212391, "uuid": "acb4104a-a9ba-445e-bdf7-c3c595bd53a8", "value": "12288:S7J3BhPxEzvXXLqpl5400SQcUfg9aYvtih7pHTYQBk5l:oHPaz/XLqpl5bQcUfg9J1ihRz2l", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651212391, "uuid": "43c9a88b-6bc9-4391-afac-74932aa6a512", "value": 443262, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651212391, "uuid": "ea4f30cc-4cd3-4e63-a9e7-9a6a5dabf0d4", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212391, "uuid": "ab914607-5059-461b-bf5e-f6d1233b707d", "value": "SEALOGISTICS DEBIT NOTE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41032ce-c7ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651230484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230484, "uuid": "de816d64-3bb8-4634-a387-0f2cac619c15", "comment": "Malware payload (AgentTesla)", "value": "cad4f4c74205ce055894dc243874ffea", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230484, "uuid": "6570eab2-0bb4-45f7-8e2d-aa358b73d7c9", "comment": "Malware payload (AgentTesla)", "value": "25c24ec799565f1689d8812953888b00b1c0aa4c38a5bc5e8b11703f6303e6f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230484, "uuid": "3a81e903-4aaa-4723-b50f-bb36455f5764", "comment": "Malware payload (AgentTesla)", "value": "81e21ea7016bf1d182d962009ab7b4511cf4ca7e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230484, "uuid": "80e71b70-8bc6-448f-8b6a-2c922b5badb9", "comment": "Malware payload (AgentTesla)", "value": "fdc3000fec06f501e4cda34f6d2d4f900d182188c7085442a7e65f4637bf6006b3613d41f5cb2ac2f6f45f4a49b176b4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230484, "uuid": "0b7311c1-3774-42a3-9783-385169f9419e", "value": "T1947423D1D74F76A44E17832E789D16CC4ECAABE688812DE525BC5C3835E26DEC112ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230484, "uuid": "256a120b-8721-4107-83b6-4f2ec314e3da", "value": "6144:WHbZJEm6BezKNGKAnafevzTf5XWhE912QlY9+uOEPAhms4w3iaB2zCR+l:GJEpezCGnQeLVXW6qQlY9pOEPteiaB2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230484, "uuid": "eb1b0a37-eed3-4794-8c94-fd99c70eddd0", "value": 369399, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230484, "uuid": "e6a742f0-3ee6-4d10-b623-977e5ff44e7d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230484, "uuid": "9a5f1528-ed2f-43a3-afbd-da4a7c7164ba", "value": "PO-120220052.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d9e1268-c80d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651272054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272054, "uuid": "45975f66-fcb0-4749-98bc-9e8ed13b04e8", "comment": "Malware payload (Mirai)", "value": "856fd25e79078eea6cdd876c6d10271a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272054, "uuid": "a37a30d4-6adc-4431-8cf7-5184375bb72e", "comment": "Malware payload (Mirai)", "value": "2619bdbb8f171e20e35042542ef9465364029467da1061557c56013ed3011dd1", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272054, "uuid": "2b34c565-eff3-4fa2-93b3-a2812884604a", "comment": "Malware payload (Mirai)", "value": "898e842b0b6fdaf55abf0b42e60c5e3ce08d7885", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272054, "uuid": "99651949-c099-4b86-b93d-a074c54636b7", "comment": "Malware payload (Mirai)", "value": "550fe2788aa923a6c5957177e1269ec9a3abc46eca4d1acde1def3cd306ee0bc9654b3b8e88b3155032e36e8c804c61d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272054, "uuid": "04720f80-6398-4871-be28-aa72c47ca95a", "value": "T179E2E1D2E25E8BD5C1E5D53E2CEF4C1B1849E13C484DA0F365C850A44D97F90BFBA2A2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272054, "uuid": "880e09a2-4fbb-49e2-9c33-82fef01225fc", "value": "768:e9S3LhKZVurLPNXmLkPFH7ZE8CFJQQ2xqs18nbcuyD7UVyqR:e9Sb4ZUrLNakPFVEWQ2xF8nouy8sqR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651272054, "uuid": "22f7e4fd-99d6-4f53-bf74-57670253dbd8", "value": 32032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651272054, "uuid": "44257469-06c9-43d7-814a-0a255021af9d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272054, "uuid": "50254ccb-12e9-4cc0-a89d-2bbac61db751", "value": "db0fa4b8db0333367e9bda3ab68b8042.x86_64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d5599c1-c7ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651230875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230875, "uuid": "f3cd5bb7-f96d-48d5-87ca-a6f5bde04cd4", "comment": "Malware payload (AgentTesla)", "value": "cb2d993097f294e6fc2c7c5b3d50d001", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230875, "uuid": "646731cb-6817-4c74-8ed2-f3d86088504b", "comment": "Malware payload (AgentTesla)", "value": "2673fbe0bb8384f65082a4ab3093b736a8a874e645ea20c56c02f9c76d5bc363", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230875, "uuid": "b1b40d1c-b45e-4e82-b7e8-196cfa62b466", "comment": "Malware payload (AgentTesla)", "value": "7cc73afb3377bea5185d3a8c62813c29dca47459", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230875, "uuid": "9fdcf1fb-aedd-40a1-a597-a0875357e9b5", "comment": "Malware payload (AgentTesla)", "value": "b77b1c688ceac735a52ebedc10df52ae9f12bea9781016f0932de775b6043e2c2c30ab4358ad6db37867a60f3e59bd5c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230875, "uuid": "98710fa3-fd45-4c55-ae86-a03e3e37ddb7", "value": "T1E3A4236B85C0EF3AEABFC50FC8E43166A935547169AD1102B44520FE1F98CB643AED4E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230875, "uuid": "4f708b02-33b6-41be-876f-69795e5e809c", "value": "12288:dz+knrEsPii3O+pPpNJOMQexeZpGAK39xb1Jj18UDTF:xvNiavJOMrxspGAEb1JBxDTF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230875, "uuid": "47f98056-f010-4bdd-9280-d18d8e68989f", "value": 490496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230875, "uuid": "6ff1273f-0d2c-4e3c-b22b-7a64e56b1b5b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230875, "uuid": "359f1081-5949-4742-8269-45d5e3b55d91", "value": "PAYMENT ADVICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a1642b-c7b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651235364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235364, "uuid": "7be078b8-888b-43d6-b550-01c407ffcf17", "comment": "Malware payload (Mirai)", "value": "983e3e48c0cfdcc96a26ebc8f21e4ab2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235364, "uuid": "bced92b6-1be9-4b6e-85eb-32fc889b1212", "comment": "Malware payload (Mirai)", "value": "2710a01e91881fc2629e21149ce6aca3d7f6e8dc270e66bd79ac7c4903c08ccd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235364, "uuid": "8e7ab892-0d06-46ff-aa92-c986d39cb791", "comment": "Malware payload (Mirai)", "value": "412c411fd351ca53df0cfd4bf978651491a129f1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235364, "uuid": "d7b81996-4b92-451b-8952-2edb1ebbb35e", "comment": "Malware payload (Mirai)", "value": "7b884f23f0d6663bb612fe7c35c455a6f9d305788f4c6a42142a9d00d78d5476a19ac4d5febc3a8a08eab63a0bdeb4fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235364, "uuid": "834c44f6-a8f2-40db-ae1b-6c14f6962a50", "value": "T160639D36E41A99A4C0424634B0E5DE351FA3A9C043272DB6AFE442B61403EBCF55DFF9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235364, "uuid": "d81cbcb3-53d5-4cc8-8e0e-faf704ca26a8", "value": "1536:YaGrdgbyFJxwtHYJ1rMTfqoI/NL/7vCpuh9C/1:Y3ebynxwCHvguh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651235364, "uuid": "a8032e0d-e5eb-44b5-ad49-16987eace894", "value": 66964, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651235364, "uuid": "0de0811e-60b0-434f-aabb-8b152c679d1f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235364, "uuid": "b5ccc86f-f43a-49f7-9db1-ae5eb5409345", "value": "983e3e48c0cfdcc96a26ebc8f21e4ab2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb13e29-c7ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651230396, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230396, "uuid": "bd64c46c-95ed-4cd8-ae5f-a7e7551d8c03", "comment": "Malware payload (Formbook)", "value": "1091008fea385d2c7b3aa566b5a9ae06", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230396, "uuid": "a9799a83-d5af-4a44-b3d7-5acfec1af997", "comment": "Malware payload (Formbook)", "value": "27a433b16039ce35be9ca7acd69d810d6f78c145d1df5677a797f7304d98a92a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230396, "uuid": "b6e47b68-153d-41e0-8a85-7159929a83a1", "comment": "Malware payload (Formbook)", "value": "84590c5024bc56c46f451fabec4569642b13ebfa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230396, "uuid": "b039ad74-1e30-4df3-8185-17b9b8071b98", "comment": "Malware payload (Formbook)", "value": "705b60f51ca8f388ac4d474d4dad58c4c4d8e1adb4934124bc96dca2409e9f4a1159699424e2c0be98d645e53192ed9a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230396, "uuid": "a1999c20-7fc7-4697-b1c4-50fffdd92e54", "value": "T1ED94E141FA18CA9BD96A15315976CBE659B02D1D8BA0196F330DFB2F74B2313410FB2E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230396, "uuid": "d527fc8d-5a01-4e17-a71e-0b9403f97b4a", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230396, "uuid": "3cc89e06-8a9a-41c6-87a7-253fe0f5c638", "value": "6144:pNeZp4OCY0UYQ0M1hbMpAYIINS6d9Em1dYoIqSCYSnVL9UU8RAsD9:pNS4OCoqMzbMpAzI9ECqCYy9NMF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230396, "uuid": "358fe989-2c21-473a-b2b0-8d703993cf2c", "value": 414467, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230396, "uuid": "0d54faed-3d2a-4208-926d-f690e8138b8e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230396, "uuid": "db6f8265-8772-4f31-a14b-0a61c49f4245", "value": "ScanXcopy________________________________________________________________________________________________________________________________________________________________________________.scr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e782c4-c7ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1651230517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230517, "uuid": "5aa7aa37-f182-4487-a2f8-745a43abc21d", "comment": "Malware payload (SilentBuilder)", "value": "e474d2903ba89eb6b42a7fc3efac0c8f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230517, "uuid": "91b37670-fb72-4131-b942-8d98888aa4d1", "comment": "Malware payload (SilentBuilder)", "value": "280344b75960e45bd191e408e15b677cc07fb72897289040fd72c7e48bf1d43e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230517, "uuid": "dc16323e-ab25-4efb-a7f9-4b7df3c4e368", "comment": "Malware payload (SilentBuilder)", "value": "7d9cff00c1d3a5e2b7fb6ce633f15a06ab406ae9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230517, "uuid": "007507fc-7c97-42f7-82b7-3a23a077e7ab", "comment": "Malware payload (SilentBuilder)", "value": "36ceecbba9c72f894e4dd486da501788025f12e0d424f552646628d5408633bc4ed00e7cdc257e36c3c0f9f4b538533a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230517, "uuid": "dc55a875-6dcb-4388-9f9e-d680c2654700", "value": "T138633B47B589B46AE916CB3D4C974F95B613EC104B960B83BB09B3597FBE9B04E0310B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230517, "uuid": "e4481a7e-0fcf-4346-ad63-24389842c0d1", "value": "1536:5+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgZYW/ESKQHS1yXJFaGqEEc:kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230517, "uuid": "e5f19eb2-4bb9-4329-8e00-792a42cf2347", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230517, "uuid": "55eb66f5-51ea-4798-b6d2-9a543fe86df1", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230517, "uuid": "758c8634-7ffc-4848-ab82-47895a7e991e", "value": "T-ONLINE RechnungsDetails_2022_04_3001826994.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70d65060-c7bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1651237270, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237270, "uuid": "5e35d929-c653-4547-83fc-ad4a428e6dce", "comment": "Malware payload (NanoCore)", "value": "9503399258d5e0b06e8f907eaca0ae3f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237270, "uuid": "e34a7ecc-8eb0-4d6f-b3ba-d222ae6e274e", "comment": "Malware payload (NanoCore)", "value": "2839c32588132ccc1bfa64810b81a1728a84bd17b4cc47d5223e540433c225fe", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237270, "uuid": "d9557b9a-b6ea-4300-90e4-efa5de421d76", "comment": "Malware payload (NanoCore)", "value": "14dc0406e188440063a94ecce80ecfbf7dcbe385", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237270, "uuid": "986a76fc-929b-43f5-af5c-5cdfcfc42e85", "comment": "Malware payload (NanoCore)", "value": "23d69fbb5c346d7d6bfe856e8bad818ae86745f841647c39585a91416294a37b02f463fb691a4b978e67bc55f54d120e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237270, "uuid": "e6883db1-8504-4888-8eb0-98231f1bd0b4", "value": "T1DAC4F12CBBFBCA22D3FD0737C0DA59040771A649A123E74F3ACE1AA559073A60E85757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237270, "uuid": "25867110-f6db-4c1b-a8f3-1b80bb394ea4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237270, "uuid": "0cf5c33b-cd8d-441e-a6f6-ba0c4051c6c4", "value": "12288:XqjfvC3Kgww4CQxVA67nrnNU9JOHfbEH73NKw0a2IlGDn73t7LSRXc/dk:X3LcCkhrNU9J2D6NKL73t7LSdU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651237270, "uuid": "72e233b9-f1d5-4db4-b7d0-d46d5a2104a0", "value": 572416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651237270, "uuid": "2980fc36-99ee-4d3f-9670-aa7135977a9f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237270, "uuid": "3eb88574-4ffa-4744-a03e-330b400b9652", "value": "FYI.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05f13f2b-c799-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651222058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222058, "uuid": "b9dbb63c-b3cb-4a28-a5e5-67b8053dcc9c", "comment": "Malware payload", "value": "23699799f496b8e872d05f19d2b397f8", "object_relation": "md5", "Tag": [ { "name": "Gimmick", "colour": "#71235E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222058, "uuid": "117fc62b-082c-43a9-83d3-723c86f9ccb3", "comment": "Malware payload", "value": "2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f", "object_relation": "sha256", "Tag": [ { "name": "Gimmick", "colour": "#71235E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222058, "uuid": "6cbf8959-e34a-4539-bf45-3c76f42a0032", "comment": "Malware payload", "value": "fe3a3e65b86d2b07654f9a6104c8cb392c88b7e8", "object_relation": "sha1", "Tag": [ { "name": "Gimmick", "colour": "#71235E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222058, "uuid": "268b143a-2b48-4aff-b252-1238a49c1d7f", "comment": "Malware payload", "value": "ffc1bc7b55717a0663f6a858af7b2ce2744d7ff27b5721be9d93e9bfcf5fcc963f78f8982252990e33cb6a9348847814", "object_relation": "sha3-384", "Tag": [ { "name": "Gimmick", "colour": "#71235E", "exportable": true, "hide_tag": false }, { "name": "machO", "colour": "#E5244F", "exportable": true, "hide_tag": false }, { "name": "macOS", "colour": "#C636B5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222058, "uuid": "3ff6a941-96c4-41d6-abed-729a16bf5699", "value": "T119F439171E2C1C05D0C6707E0DAA8742525FFDA29B31E3BA3E61411EBFEBDF1661621A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222058, "uuid": "a51674f0-f292-4a5a-a83e-56f1f102d330", "value": "6144:0RDkTCDC628O+i5Npv56/SfQ7WXIRPeTqiKjBAaIeuLkN04b1Z2O/a0csN2oGA8s:q5o657MOPhKCuo64b//nPpA/OGg2Y5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651222058, "uuid": "08413ed1-107d-4363-9c37-a97c375477bf", "value": 730896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651222058, "uuid": "06b7bef8-6199-41ba-a055-c84c1c717954", "value": "application/x-mach-binary", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222058, "uuid": "a2159cc4-6cd6-4291-af9c-102605191b6e", "value": "2a9296ac999e78f6c0bee8aca8bfa4d4638aa30d9c8ccc65124b1cbfc9caab5f.mlwr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "267be995-c7a3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651226408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226408, "uuid": "57311a59-f0ab-4ffe-af7a-045ab7afef84", "comment": "Malware payload (Mirai)", "value": "60ed81a4264e8fff131cc862ddd95b60", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226408, "uuid": "41faca3a-18d2-4975-bfdd-0ecb90464f59", "comment": "Malware payload (Mirai)", "value": "2ad013cd46c115cd2ea6fc6796e31782238a55e5f7daff6ae719379585bf241d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226408, "uuid": "7e6b2c1d-6bb9-44eb-9143-0f63e952fcfc", "comment": "Malware payload (Mirai)", "value": "79d3d26cda70648d327e681ab2d78ad5af3955e5", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226408, "uuid": "6a7f80bc-e6c6-4d96-9cc8-93d881cc65ad", "comment": "Malware payload (Mirai)", "value": "7d4936a47f0d3721e8b3409e1cdc019c4433bbf39f9115ec402b73f170517bedca3eb6563c67b444ed4c093d05ff9187", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226408, "uuid": "e2974709-30e3-4ac2-975c-9533e32fb12a", "value": "T141B2D011BEAD1DE2E6744C33DB5C8383A30703BAD0DD614015265A28DDCE93A21E7AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226408, "uuid": "ea739460-d2af-4ebf-8c27-5b215acce3e2", "value": "768:79MhmNhHXqPpY5IpXetXpsIifmqZs3Uozs:79QmNhHXqxRpXgXpUfKzs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651226408, "uuid": "02d1af3a-87b5-40d8-8ef4-a4bf034eabec", "value": 24648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651226408, "uuid": "27de5ad9-b991-44c4-93ed-c5eb411cb19a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226408, "uuid": "88333f13-b916-4655-9779-09ff654b184a", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47a5b687-c76e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651203700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651203700, "uuid": "f3e95be9-aaf9-4842-84ab-c9f9f6bd9448", "comment": "Malware payload (AgentTesla)", "value": "e2f2210f1d525804d4d60326ff5b19ca", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651203700, "uuid": "4678eba7-8d45-45e8-b929-f7682525bd07", "comment": "Malware payload (AgentTesla)", "value": "2b073c55bb3106d12ec9644558ff1f636b749a9cb7df4d8f9ac5f3c1ef6d6757", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651203700, "uuid": "8cd1b56d-c469-41d0-8212-35b8484b244a", "comment": "Malware payload (AgentTesla)", "value": "827653bb43fcbc3a3d19d01ed160b64c3cac0a99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651203700, "uuid": "99a011ef-1066-4751-b731-615d61c067bb", "comment": "Malware payload (AgentTesla)", "value": "758663fd8490efaddd7d389536568a5a2c66bad536a748afb10bcbcda624e78cf013712114f21353ce4e62e83bdfbab3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651203700, "uuid": "b11d07bb-a08b-4302-812c-33bc8daa07e0", "value": "T1D7E4BF853B909A63E82F7B7549FB8BB427B1ED40AB420B6F1284B50C2E732516D435DF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651203700, "uuid": "866baeb9-6118-4f58-a993-03c3a2e20926", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651203700, "uuid": "314ecebf-0452-4ae6-9f7e-ebc2e42224da", "value": "12288:2N2bJJ9Qv0efEaDV229yWNqNrWvltTm76cU:2N2bJJGv0oEIk2EOnis", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651203700, "uuid": "5f31b00c-bfa3-4507-8569-17e310a10fd7", "value": 699296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651203700, "uuid": "1704455b-ed3a-429c-ae5b-a086a254920b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651203700, "uuid": "334abd2c-6d54-4743-9dba-cb05b4a5b798", "value": "SKM_C33501911075103.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da33c281-c7ab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651230145, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230145, "uuid": "3c0fb8ea-5368-4491-b1f9-9ed3dad48503", "comment": "Malware payload (Heodo)", "value": "95f47dd58df3e8d47fc82f275452d60b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230145, "uuid": "cbf98e3a-2d3e-4da3-8a3b-4a4a0addd69d", "comment": "Malware payload (Heodo)", "value": "2cf960a3f134422dbf74faeeb816989f92ce72d4ab9b8c007fc1e57927887398", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230145, "uuid": "fffb0c53-d8ba-4460-9efc-4cec496e3b0d", "comment": "Malware payload (Heodo)", "value": "6eb68655256a665661e7e6ca6415ec696e8acd78", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230145, "uuid": "ccd6c8c5-d21a-4cc7-8ff3-a5477f1f7e35", "comment": "Malware payload (Heodo)", "value": "bb548df4106e7ce53880b939aa536de420087b31c1478aeb5c1fd873f40f16071d8de018804b172e0c3f61d1d593d6f5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230145, "uuid": "a6e286c2-9b80-4f0b-810f-9bd291ba64de", "value": "T1AEC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230145, "uuid": "a06ffdb3-9142-49bd-92d8-91ef7288ee10", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230145, "uuid": "a9e0a5d5-7110-4ae8-afb5-cf2049edde45", "value": "6144:JhZ02GdOOgPYuKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfxKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230145, "uuid": "323a2366-bb07-481e-a481-561500793f79", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230145, "uuid": "b6e8fa52-36c2-49ca-8f50-0823d84e78cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230145, "uuid": "22142d64-bf79-4be7-b64b-e2790a70da2d", "value": "gizLPZAjhC688nJmelphS71htVAQDnZk.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61fd83d5-c74f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651190430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190430, "uuid": "e1312e6e-8232-4959-96d0-0fef6e516cf5", "comment": "Malware payload (Heodo)", "value": "aed23600a772a291fd8e27fd8d428d1d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190430, "uuid": "99356209-644e-4b41-9481-d4bb91a14274", "comment": "Malware payload (Heodo)", "value": "2d76656481fb682445fa685c3da45d1acb5dc2ecd0ebfe50496a897cc1c43bf8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190430, "uuid": "ed768023-8be3-4104-9004-fd067c6aa7c2", "comment": "Malware payload (Heodo)", "value": "c05821fabda07bbc94326d90384580f69ec53667", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190430, "uuid": "fae4fae7-eda8-4837-a0cd-85d4cd1fb5b1", "comment": "Malware payload (Heodo)", "value": "00d6224c2e46c2dad268e8dca28f26b53c90af2045eae91691807df13fb558b8aac30d34ea79bfdb4e4c2a79b724e8d0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190430, "uuid": "d3349f37-a183-4027-bcae-ff7c706ed4bd", "value": "T173C4AD0BF7BC88A7D162E57984239B8AE7B2BC114771D35B4760572A3F333A05D2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190430, "uuid": "6f7e4566-7700-4d4b-a5ec-3b1b01b67716", "value": "1134f6be519e9c35b5478dccf9efcfc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190430, "uuid": "461c72e3-2527-45fb-8933-74a852fbda9e", "value": "12288:FX18uCYMUhDfWKN/QduUaQkhS+W/uczzIEudy7JMv9:MuCcVNI8mMSLjQE0mJMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651190430, "uuid": "60a9ea96-871a-4faf-945b-b17004711d98", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651190430, "uuid": "0933ee54-7208-400b-b139-b17cea932490", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190430, "uuid": "35a2b04d-392b-43b7-bc4a-6b63e359e262", "value": "emotet_exe_e4_2d76656481fb682445fa685c3da45d1acb5dc2ecd0ebfe50496a897cc1c43bf8_2022-04-29__000009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87436aca-c753-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651192210, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192210, "uuid": "37313bf2-1e0e-4f1f-879b-a265efa96c52", "comment": "Malware payload (Heodo)", "value": "52a9ccd0099961b6cf9ab0dcd43ba3c2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192210, "uuid": "b14cac4f-9502-497b-95b3-312ed47d8d11", "comment": "Malware payload (Heodo)", "value": "2d9823540a5d79250c33313f80ffed691368a2c5c13f7e8994aa8ea471bfc438", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192210, "uuid": "6f206446-cdf1-4013-9769-a8d1e3134c2e", "comment": "Malware payload (Heodo)", "value": "285a1a64ba8ea86b2ef80cc36d271547187eb70f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192210, "uuid": "8a5d1573-5d2d-4115-b56a-8cce28a1c48c", "comment": "Malware payload (Heodo)", "value": "20d3c2dd0f4e9cd553b64ab436acc750e9c69c8f8af02a0cee2c270ab93383e0668ba4e6cef1a582f448802e52f03d2a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192210, "uuid": "134d7887-15a6-49d2-b435-af52f3720681", "value": "T1D4943A0173C390F0C657A534840FD525ACB7B87C6B19857EB28BA26F4BE78D09A346F9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192210, "uuid": "83f5c9cb-d09a-403a-8e5c-0cdc28f828ec", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192210, "uuid": "6be686d2-b656-4e8d-b4cd-59e8f11f42f5", "value": "6144:S5uok8qcKhyMlSXVKfKGS4Tp3wb8iZ7B1yarhX7ArkqBoEimFmzUM090/Do:S54yM33d3q3Z7BogcreNmF+U/9v", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651192210, "uuid": "9ccfc6f0-8075-46c5-93c9-57b406fa9af8", "value": 437320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651192210, "uuid": "a82e12a3-b2f2-4119-887b-125379db7347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192210, "uuid": "eebfe39d-9719-4427-ab08-1c37697502ac", "value": "emotet_exe_e5_2d9823540a5d79250c33313f80ffed691368a2c5c13f7e8994aa8ea471bfc438_2022-04-29__003003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8d5cb35-c7ab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651230089, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230089, "uuid": "b114efb4-1219-42f4-990f-f9f7477befaa", "comment": "Malware payload (Heodo)", "value": "af8c236e4429026e46656214448d3f5c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230089, "uuid": "63d24608-d2d2-4368-a439-9942fde861cf", "comment": "Malware payload (Heodo)", "value": "2dbd2f822f9cfd213c2288739f1b6deb5f902209db777702f7cc9aa055a0e224", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230089, "uuid": "83f2c01f-9d3b-4fe6-9e0e-33fa09add255", "comment": "Malware payload (Heodo)", "value": "4f2d4f048296abf6820edb64c6758b07f6f4ea96", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230089, "uuid": "de365737-3a4b-45ce-849a-78aa92028dc6", "comment": "Malware payload (Heodo)", "value": "91092753c82c5e9ff7d420e1710ab127b936912c29b4e58d72fba149ce80012117760402b820b3f5adc60fd7764238e9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230089, "uuid": "2443b3bc-e6cf-4441-8a71-37f7ec74e1f4", "value": "T115C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230089, "uuid": "44a89871-45f1-453b-b2cf-193e605ebf54", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230089, "uuid": "3b05ac43-7620-4264-b8e5-fe3dc1aec5e1", "value": "6144:JhZ02GdOOgPYhKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfOKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230089, "uuid": "081a8d6d-2fb1-4d76-8ba2-c6015daefbeb", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230089, "uuid": "c7c06f31-6086-484a-8a8f-9ce3d64abf77", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230089, "uuid": "9e523b79-afb4-47ca-93df-acbe8b18c99e", "value": "GeKRJukM1bk7VYl9v.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f3987f-c74f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651190430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190430, "uuid": "af297087-a1c3-461a-8e37-fea33db6dde4", "comment": "Malware payload (Heodo)", "value": "181d571a8db3a857bac5b1cde479a63a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190430, "uuid": "1ffb2f63-4457-45ac-943c-cde1fe0986de", "comment": "Malware payload (Heodo)", "value": "2fb90f41c0921062d9da38d80ac26b0ff755e6e84f528986cf65e31c7fa146f8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190430, "uuid": "77e362c9-e68c-434e-868e-ee18ba63ec42", "comment": "Malware payload (Heodo)", "value": "589b44d0f4ae6dfdb86a3378827e4746f86895a0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190430, "uuid": "b6ac2c95-00bd-433d-83ed-758e828bd8dd", "comment": "Malware payload (Heodo)", "value": "78139731772c549d8a85bfa0199885f834d8282a52edc7d58abc8127132c9906325b2497683ae1a3c64ed73de870db0f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190430, "uuid": "2080fc89-ecf6-468d-b404-970b7f7b70af", "value": "T1F4C4AD0BF7BC88A7D162E57984239B8AE7B2BC114771D35B4760572A3F333A05D2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190430, "uuid": "bd92a2c2-7a49-47ca-a2f8-1ed3df5d9def", "value": "1134f6be519e9c35b5478dccf9efcfc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190430, "uuid": "882927d7-416f-44a0-b8ba-0409d0c44140", "value": "12288:FX18uCYMUhDfWKN/QdSUaQkhS+W/uczzIEudy7JMv9:MuCcVNIomMSLjQE0mJMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651190430, "uuid": "40b4c6fc-4e51-4927-8fff-f8f751ced3ee", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651190430, "uuid": "7c6b6ceb-e374-4c79-9177-ad25c12142d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190430, "uuid": "97a83db1-fa7f-4f40-b61f-3a54d1199ee8", "value": "emotet_exe_e4_2fb90f41c0921062d9da38d80ac26b0ff755e6e84f528986cf65e31c7fa146f8_2022-04-29__000009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1945d9b-c7df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651252384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252384, "uuid": "322a52fe-c12c-4dcb-8675-7250d4444642", "comment": "Malware payload (Quakbot)", "value": "0c33862801d7a13de76736fbc12254f5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252384, "uuid": "c6e89079-8499-419a-8129-e322f67e94cc", "comment": "Malware payload (Quakbot)", "value": "30caf9fa3362bba65ff1ecfee5db81fdb7a5285f94f37bd0a1963cfa11e5f363", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252384, "uuid": "90301290-9cf6-4444-989a-0a13795631bf", "comment": "Malware payload (Quakbot)", "value": "a4aafab1cccf1f824bf174945c5c6fd6daa3a883", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252384, "uuid": "806b7b18-2381-42d1-acae-62ef34957cbe", "comment": "Malware payload (Quakbot)", "value": "520502cd98e75fd445f848f5be8ce28b9cbd0da41733beea9b89a66532eac36584d494f20ea3c5a0937eb00fdbdf5923", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252384, "uuid": "b1485077-8797-4837-9d31-669c09be23aa", "value": "T15C35AD71E39145BBC1733E789C3AB299BC297C101D78C4CA6BDC0F4D4B2AA5267613A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252384, "uuid": "5ffc3240-3df7-4ee2-a5c1-106e374ac778", "value": "f5965aa7635eaf08e77b609502ff5e9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252384, "uuid": "0daad4e1-8b6c-4ca4-a52f-df72d7369aa5", "value": "24576:UmfEXFuca6U0UKybkX0YuSw7zMYQ0a4lFb2:UmMu63UPYXXuSoWx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651252384, "uuid": "1780173a-ce9c-4c3d-8cab-7c7cb438f217", "value": 1161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651252384, "uuid": "5cd7f01a-d75c-4cba-9882-b99b9abac1c0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252384, "uuid": "dd28d8ea-8988-4576-aa27-4172895f73db", "value": "30caf9fa3362bba65ff1ecfee5db81fdb7a5285f94f37bd0a1963cfa11e5f363", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235e319b-c7ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651244871, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244871, "uuid": "b79545e5-f808-4e0e-a532-01096430420a", "comment": "Malware payload (AgentTesla)", "value": "4c0ce58bef6713afd18620e4142e70f8", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244871, "uuid": "79ba273c-3651-430f-a4b3-106c10341501", "comment": "Malware payload (AgentTesla)", "value": "318fcadfe9e9819e48dd8f4c12a21b0a1240f1059e78ac117551b38df7e68476", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244871, "uuid": "bb1ac63d-8772-4bd3-be7d-d013c4562335", "comment": "Malware payload (AgentTesla)", "value": "ca4c983d5f96dc93a68fc43fd6bec7f34a32eaf5", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244871, "uuid": "6d00260e-ee77-456d-9602-efe6c4d291e1", "comment": "Malware payload (AgentTesla)", "value": "dbc7a4f057a98a517f401ce47111b57dfd880c1ff71dc79d78fa9534dfcef4f20cf166253e690f589ec7209901ebc415", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244871, "uuid": "593aea42-0e77-4999-a15f-a261f8f90af3", "value": "T1D7C423418E22A33B60C7EF962DDB331AD0E9DE7D51442CF864DB4154B897EBA4A7042F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244871, "uuid": "af734a56-a51f-4705-9682-9a3f29ea2796", "value": "12288:/Q1OrsAaRHnywd8empakJTM1he8kJpdU0pm8JeJ0Fz:pJah1xoalh0p5UJez", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651244871, "uuid": "e5eae3a6-5f27-4f70-8d8f-a95050367054", "value": 570772, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651244871, "uuid": "5bb2a3df-84aa-4661-98fa-ef5947499c17", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244871, "uuid": "1f9b62b6-2d33-40e6-a8c3-af458639829b", "value": "Quote - SIn06 - 02.pdf.7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0733e60a-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651215188, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215188, "uuid": "6f27e20c-b19a-4f5d-b6ce-84efe9c569f6", "comment": "Malware payload", "value": "84aa6461b504b15ef3db76ce4da9749d", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215188, "uuid": "c195f4bc-f26b-4466-ad34-a26982bc42a5", "comment": "Malware payload", "value": "3223a4a133fe5b15fb4ecbb31cf05585cbbcab2ccbf8f47e4721327ee4994688", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215188, "uuid": "653f2cd5-e71b-4f3a-8766-80e8713f53d1", "comment": "Malware payload", "value": "66dcb35b5bc819b49a5d44010bd3c0d25622a70c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215188, "uuid": "39c59138-4b63-43f3-966a-72e2a21b5074", "comment": "Malware payload", "value": "78c3f3e181956ff9b1abc3b06fa20f0b9a71b4eda13693d4a32c835a64ba156cc4f4a408b33727682de4e24f2369f140", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215188, "uuid": "998e9978-197d-4684-8de5-87e3c628049c", "value": "T176341228B613C9F9D86897B04DC4DA87FF6AFD41EE1B5C073245B39CD8348828A57B25", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215188, "uuid": "c9a145cc-7bf1-4f63-8144-e9d45709adf4", "value": "3072:T6y3OghXwjRuutQigH770sWTFBVPjzf4kxeTZq+w+M9dlGamzzzqH6xSTWQ:Th+w6paH7ABbhf4O2u38VyH68z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215188, "uuid": "e07732f5-06e6-4577-a0d5-5f90902e3123", "value": 237056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215188, "uuid": "0dd2a9da-bcf6-4253-926d-ea19b9efa257", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215188, "uuid": "c984b563-1fc1-4474-8e96-212707dda911", "value": "PNC_Remittance Advice_4282022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e9aca8-c7d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651246586, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246586, "uuid": "bb402222-115a-4384-9af0-690c3b96c6fc", "comment": "Malware payload (Heodo)", "value": "c35a3b3a93252f7239a92c86274c5937", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246586, "uuid": "1723e169-bc90-4c74-9d78-8f0a9c697997", "comment": "Malware payload (Heodo)", "value": "323e10a70f17d7ce5bc82539f62b1b8abeae6c88217df381e169a8224f2d7f7a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246586, "uuid": "3dce5b64-85cc-4203-9803-9e169b523465", "comment": "Malware payload (Heodo)", "value": "2ad467cd267525501f39bbc2dedc19416e3b5442", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246586, "uuid": "c30908d3-58fd-426f-8b0b-5ee6ede18a03", "comment": "Malware payload (Heodo)", "value": "4a16b80065b60ec12e2892c21964fcd950a0a21ec715c8d3435ac52c8e375a8557a574c0136232ff815ea24db95ce547", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246586, "uuid": "e217c005-f9ab-496e-8acc-d02e78610390", "value": "T104C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246586, "uuid": "d8e9a0ec-5b88-45c6-93d1-46a0b57d998f", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246586, "uuid": "756a3cc2-19e1-4ee5-8c02-689e7e63eaf8", "value": "6144:JhZ02GdOOgPYMKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfnKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651246586, "uuid": "bb5c1db9-707d-49c9-928f-786bd128c834", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651246586, "uuid": "6cc772ba-f47f-4800-9a11-464d83571491", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246586, "uuid": "c0d80f4f-4347-4fb5-8ae4-1e1ffc82281b", "value": "c35a3b3a93252f7239a92c86274c5937", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cba4a67d-c7c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Smoke Loader)", "timestamp": 1651240858, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240858, "uuid": "94831d32-f705-4df0-b602-a36d698644c4", "comment": "Malware payload (Smoke Loader)", "value": "47ca60828c6a4b0315fecb40c45b1982", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240858, "uuid": "f49133e9-b0a4-4017-b17e-afd6bd111bdb", "comment": "Malware payload (Smoke Loader)", "value": "341e35a8df3430a417986d0853f1f250d04ec980dcbaf1908291b411277a3fde", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240858, "uuid": "c1f27b8f-1692-4458-97ed-44bb42f8b6b5", "comment": "Malware payload (Smoke Loader)", "value": "8927400e1e8764bf46fa1430bc758bbb146d6c5d", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240858, "uuid": "c785204c-0e98-41a2-a68d-2d3bd47d35d3", "comment": "Malware payload (Smoke Loader)", "value": "5c086d027005ab6c84eaf01f7313c31431a269f57f5f1630de9f1f317f647e5aad043d87261a9fdc5ccf0c22152b27ec", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240858, "uuid": "7fa7b144-25d7-4dd4-a838-55d88ecee70a", "value": "T165549E407BA0C03DF1B716F5B97A83A9A53ABDA19B2051CB62D53BDE56346E0EC70307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240858, "uuid": "312eb8c1-163f-419c-9ba8-b71d024317c9", "value": "a5e21eb4da4d713aa6e028b6a31293af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240858, "uuid": "ab4b5cb9-de19-4bc6-8c66-3b75cf37d65d", "value": "6144:bOnipkvI52NwNC3a6Jc3YRtoXIGimxsBqr5QN:bOniGAoN0Aa6Jc3tXpxJW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240858, "uuid": "b83b0309-42a0-40dd-a885-ce4a09ed7c97", "value": 297984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240858, "uuid": "a3e6c67b-7218-4712-8f84-1ab34d0488d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240858, "uuid": "e6078f55-15a0-4e91-8c3e-f080069d7ad6", "value": "47ca60828c6a4b0315fecb40c45b1982.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6753630-c804-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651268391, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268391, "uuid": "a4f973d6-ff85-4845-a339-6ed7b259a404", "comment": "Malware payload", "value": "b0ccd722607099896f0f02dcf36ef140", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268391, "uuid": "6a735ce7-75ae-4522-b12a-54c82d49e710", "comment": "Malware payload", "value": "34f0a2e19cc62170b2c86a3d0d2d3ed151cae7c2878bb3f9c46a97e0541341b1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268391, "uuid": "cfa78989-b497-4777-8816-3b1d132072a9", "comment": "Malware payload", "value": "b8874063c05e3b12af41c65b4771d4cf163d90ac", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268391, "uuid": "29567526-e07d-4288-a1d4-dcf077e1f355", "comment": "Malware payload", "value": "68277b877e5d59ba2abebbebeea214fa247291b08b74e1ccb41d25b666bf91d5e501a87053f28b175789be72c6f8ccaf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268391, "uuid": "b67885c0-3fdf-4ae7-a126-e1a444d5da15", "value": "T19965E0906690C136C5E11732C661B375373DAD284F3046DB53A4B2EEB93B6C05A36AFE", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268391, "uuid": "f666b061-d75c-450b-8801-5a3aa6b18714", "value": "0ae8577c85edd6de7ab512e6ace9adb0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268391, "uuid": "2ca44b93-f52a-4e63-947f-258587c7c951", "value": "24576:yQfYBjWBKdHy+vI0lBxrXPmxqig+S3w1PO8HDw7usGYWNVjR/MLYQw17Z3/1l:kjseHTRrxXeWLi9j87GYYXMLY3Z3/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651268391, "uuid": "fe1388fd-8272-43ca-bc83-a8679a4a97e8", "value": 1420648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651268391, "uuid": "0cdfa424-2768-4722-b319-e5db2bb81e23", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268391, "uuid": "c71c6361-5ebf-4862-ac69-26c8a4bfae7f", "value": "SecuriteInfo.com.Heur.2673.29967", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c83a16a-c7ef-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651259247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651259247, "uuid": "295bbb64-05c3-41ee-9f23-abec0c462228", "comment": "Malware payload", "value": "0d2e8096f997f0ab5d8898756e680a5a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651259247, "uuid": "4c542519-9096-41b9-9685-4c8f17e8ce35", "comment": "Malware payload", "value": "35a9b60ddce4e96c1f196eb157b85b4c5c8df6d9a67c2ec1a2c07d2cea3ec62b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651259247, "uuid": "ac28bc48-d4b6-45cb-8654-09f24078e7ed", "comment": "Malware payload", "value": "711db9e36897a1a2bce1431509a05b63a6c2b754", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651259247, "uuid": "62ddadd2-f63e-4124-9fa0-9286173ceaf1", "comment": "Malware payload", "value": "1c373841d2dce14b02baa851e4009838ceca43a8390fd8abfd6100118a14cf2ece764355d3e6bd6add80d76e5e6be671", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651259247, "uuid": "6707db06-5383-4c6f-a348-4f961894cf30", "value": "T103235A439B6C1675C696493AA821288487B39E6D560EFE9C4CC8B003CF7FFDAAD535D0", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651259247, "uuid": "5b4447d6-4dd1-4788-a8bd-6d7d3371b94a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651259247, "uuid": "66dd1237-b156-4f77-9b97-4c354a5c8eca", "value": "768:VwW2+2L6hJoHNzfgQy6Ju9VIls0zBKmp4as8NbtfY:CB6hJoHNzFXJGIlsgBKmp43chw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651259247, "uuid": "2d618e6a-ffd2-4df9-b33b-d4eaad6eb0db", "value": 49152, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651259247, "uuid": "201691f1-9194-4389-b629-e16d1892d270", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651259247, "uuid": "495d81cb-6966-4db7-bcfe-7d7e398c3d9c", "value": "Aviso de Pago 29 Abril 2022.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18585ddc-c7c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651240557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240557, "uuid": "f774418b-7bed-4d0b-a113-e8831a0d7f13", "comment": "Malware payload (AveMariaRAT)", "value": "76ddd89d53c561dec77b997fa45982df", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240557, "uuid": "b6197204-6860-4fa5-b8ff-72288b5d8765", "comment": "Malware payload (AveMariaRAT)", "value": "363ff6e583d91305cbdf0076a03b5c9e77ca7d423f7ce928713df6d72f2e4c7b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240557, "uuid": "f503363c-c92d-47ed-b790-2fdab10f521d", "comment": "Malware payload (AveMariaRAT)", "value": "6e79a7b9501b04b5e9814258f27f3af0bdfa5df8", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240557, "uuid": "8f595420-f954-45f5-bf50-9d1dd2cb4856", "comment": "Malware payload (AveMariaRAT)", "value": "5c196d570af1fdb6f51586c89b631677aff1675395060a5e4f850d1e690757dd7a0ece821c1321a585b31f7cd56ad298", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "gunzipped", "colour": "#3986AB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240557, "uuid": "de937942-4fed-43cf-bb54-c2a66236c915", "value": "T1B50523587BF9CB52C8EE8BB6E0B586095775535952A3E34B03C2A0EC39B73004A717A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240557, "uuid": "dbca0646-beeb-4c49-8ad0-3a1c6361f8b0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240557, "uuid": "86b0f1c3-fa7e-493e-a1f4-e824f28531a6", "value": "24576:UWHloIWrMUY+Cb59xBu/KpYq6aod/XFlvglJ:UWHWI3UY+y53Wvao13vglJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240557, "uuid": "63a596b0-55f0-463e-9dc2-2db9ac776e76", "value": 859136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240557, "uuid": "f6a8bacf-4677-4e96-ba3b-421f30eea020", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240557, "uuid": "a9f9e9c9-760a-4a57-a16f-41209b96c6f4", "value": "gunzipped", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "220b3d6c-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651217810, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217810, "uuid": "52c24b3d-019f-4d02-8505-8d085c92de54", "comment": "Malware payload (Loki)", "value": "e494250e50d7a8a83d8eb83976b06d4e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217810, "uuid": "76b3fe45-b1c4-4fa0-bc75-8e4f1c172452", "comment": "Malware payload (Loki)", "value": "381d216213204a731818814226dbbeed4e38b1712827f59804e61485c06ba417", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217810, "uuid": "430238cc-3b3a-42bd-9172-1d4804c7c897", "comment": "Malware payload (Loki)", "value": "35691b0ba318926f364a18c5736ed22cb4740b71", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217810, "uuid": "dc503b55-028c-4107-8478-4772d3799068", "comment": "Malware payload (Loki)", "value": "df48815f0ae2567408ac599202f3c215a315012e0d653198c1ca4cca4ac91f634959e8567346c6a608abe294c245b703", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217810, "uuid": "e2b712d8-8ecd-4b63-b37a-11dfc212813a", "value": "T154C301143720D4ABE5F71A321E3969F29BDCA2251079661F1320AF1D7AB23D3D50E7B2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217810, "uuid": "804e728d-237f-435f-84fe-ec53d4770627", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217810, "uuid": "9160393d-d7d9-4982-98cd-ba97f5cc2c73", "value": "3072:l1NjcVVnLpPunbYKBY4nD743lbFApYFSEGH4oPO18LyZi:HNeZm7G443lYYFSVHTOKKi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217810, "uuid": "384b462d-09bd-416b-b6ed-4b549da54cfa", "value": 126096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217810, "uuid": "2ade73f4-267d-4d75-b66f-899c718bf653", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217810, "uuid": "f0cf7671-d3a9-49b2-81ad-b265f6b51872", "value": "e494250e50d7a8a83d8eb83976b06d4e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b0eff23-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651217825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217825, "uuid": "d40be20f-f643-47db-b312-fb214a55350b", "comment": "Malware payload (Loki)", "value": "5a526d103703d218cbbca10dbdb61bb9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217825, "uuid": "492d2df9-db42-4f35-afad-82d23211dfff", "comment": "Malware payload (Loki)", "value": "38607a8947d22efc18f27b09b0f51bd9b2dbf9c8d7b60b27bcc2449dea8ef87f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217825, "uuid": "b082c0a3-cc75-4594-bf23-1beb163fd217", "comment": "Malware payload (Loki)", "value": "b7c3fabd1a7d992c584363682089c597c59b09f5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217825, "uuid": "5f3a229a-90dc-48bb-9bb3-e67f180f8903", "comment": "Malware payload (Loki)", "value": "2abecdb0b0f8fe36138912e985fd1febdb17975ce91bb16cc06b1fb7d95b6209969dc98544e160978f4730d8d3c52bb9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217825, "uuid": "b180590f-ef50-4af8-a59e-e80cc961db21", "value": "T1C7C3F24077A5C477E0A306726F7AA763EFA4A51316B4570F17906F4AB913B83EE0E312", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217825, "uuid": "ad3ef729-0978-4884-8f7d-06c84e4b15de", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217825, "uuid": "2ffd879c-c26b-485f-befd-879168b3d70f", "value": "3072:l1NjcVVnLpPunbt/CjXtZP3g+y7UnL8kYb7elJhISjUXFxRTw3M:HNeZmtCtGaM7ezO7XTdj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217825, "uuid": "854f5a3d-c061-42c8-9341-2fd03ca0763c", "value": 126081, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217825, "uuid": "df875b90-d6d0-43cf-8ca4-3ff0b2679bc7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217825, "uuid": "cc554a2e-5790-45e0-921c-431f7f3d12bd", "value": "5a526d103703d218cbbca10dbdb61bb9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1492c84b-c7c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651240551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240551, "uuid": "6f5f4b4e-bf1b-4d20-97f8-60933eaf6b96", "comment": "Malware payload (SnakeKeylogger)", "value": "428e50ce7f111d1142f0a0540b4d6fd5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240551, "uuid": "4f7e7f05-514a-45ee-90be-85260a43daa5", "comment": "Malware payload (SnakeKeylogger)", "value": "38b5f1d4735a55fd13cded959a2dfca783ce8b84dad3f5d7e12a1fa6fa1b7cf1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240551, "uuid": "210fed9f-94fe-48b1-b657-3497132dcf14", "comment": "Malware payload (SnakeKeylogger)", "value": "4d1b3275050ea68109637f565abdbf5a5d15bca2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240551, "uuid": "9fb31ff0-73d0-4f5c-8bd8-e2ffb1b94bf4", "comment": "Malware payload (SnakeKeylogger)", "value": "d38b395ac633df8530d226c792df83c8cd44d2859a15a850a01a1bdc5e85ca1027f63a85798f69e9716c7c23bd99a444", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240551, "uuid": "0ebf432f-e51b-4583-a30d-e2d427d45cac", "value": "T181B48CE53A4C8AD3CE76587706CB8E7113E34A211122F7376BD377F2264265BEA27184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240551, "uuid": "0d4e22c9-3e75-418f-8b0b-e70e913258a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240551, "uuid": "03b03a4f-360a-4f05-8dec-bc63fac17396", "value": "12288:N+1+BQ6jgkzO0GUT94GldvLNBuD0etWCrG7t76:5BcYVGUtlhNBu9BrGd6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240551, "uuid": "f9b69475-8804-4fe2-a536-787b62d55b76", "value": 538624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240551, "uuid": "1323b388-3e8b-4d59-9d00-a61a8c173321", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240551, "uuid": "e571601c-0082-4104-87ae-9ef97097a765", "value": "swift copy.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37d2c512-c761-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651198090, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198090, "uuid": "b896a211-69c9-4a26-bd28-168f4bf918b7", "comment": "Malware payload (Mirai)", "value": "641369c5b61aba2f0219e40756238fc8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198090, "uuid": "00c38166-e75f-42b9-a1d5-7fba34b5ac02", "comment": "Malware payload (Mirai)", "value": "3912dd76a7d8446a65094c0927b267c888af835809f60446766018304a0d340e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198090, "uuid": "560d5309-fca9-44d7-a833-8ff8cc0d5d08", "comment": "Malware payload (Mirai)", "value": "25f82275ca59dd7681ff8c7c41dc72036bbe8dfe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198090, "uuid": "89d7fc09-0e41-42f3-a464-e217477a6915", "comment": "Malware payload (Mirai)", "value": "7098320fe7a0910c2aec2d4f5c39dfa31df637f61551a02c4d940c5f5ce7ddbe4b6910f50ef4bb8aba88e611fed41e1d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198090, "uuid": "923241b1-3f12-498d-8f60-19f229688b41", "value": "T14123F7C67942B629C3D157BBEE9F014E335497DCD1EA3353C8280B947A8AA0F0D67B46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198090, "uuid": "850c5769-e316-4136-860a-819c0b71c10a", "value": "768:GHEwscmmayqpSNRuCRvFtS1ug1/njv2DoCerCGme0Cf+5reSU7wCVy/rCxHghW1I:GVmOWSNRcxjvqe0CW5rnvhW05qpRJc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651198090, "uuid": "a156b500-c474-41b3-a4e2-1230b942f446", "value": 49420, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651198090, "uuid": "62f98418-c398-43d0-b589-cc1e955b2388", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198090, "uuid": "6f4601d1-5d3d-48f6-9a30-5de11b926549", "value": "641369c5b61aba2f0219e40756238fc8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1088a41-c782-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651212520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212520, "uuid": "00e26b56-dbf1-46b6-84a6-20b7c6096b01", "comment": "Malware payload (AveMariaRAT)", "value": "6488fb9bc8e597f68c5e792ea06977b7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212520, "uuid": "4afaf793-c790-4761-8287-484aab7cf305", "comment": "Malware payload (AveMariaRAT)", "value": "394e0c707a2055db6a4b96ff55bcf46328274152f8b09e1e934954a2b70cd8ce", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212520, "uuid": "1c3bbf28-2c64-4fae-a8ed-69b5a1e15c87", "comment": "Malware payload (AveMariaRAT)", "value": "528dc4d62d0243b33bcdcfc1a695d068101ffe9d", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212520, "uuid": "db0cdf9c-0922-485b-ba20-16254ffa12a3", "comment": "Malware payload (AveMariaRAT)", "value": "8260ea784f687a2a63c18288683d3177c900e903be1833025cee8d496125d69a55126b2487723113074dd5aba2484dca", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212520, "uuid": "3be9d8bb-ebf3-4ced-a1c8-1dddbb536741", "value": "T1B9A423FF3F5E1CEE18594BEB1EE119B1ED601BCA232941874C9DD46FAE500E425886CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212520, "uuid": "84f5d508-2c29-47fa-9219-c310e8d9b2ca", "value": "12288:Ue+oXVPZ4GD2qX7NWzk8dx2lI/SFRUGuXwyiM9zYg:n7XfrX7s7raCw/g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651212520, "uuid": "468b315b-c94e-47c3-85c6-782d0f3a0534", "value": 482391, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651212520, "uuid": "a65f0340-55f8-49a1-9e95-4b85265ef133", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212520, "uuid": "26dcde55-12ac-4781-83f4-453e8b64321d", "value": "INQUIRY-DRAWING.bat.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7022b9b2-c770-11ec-8e58-42010a9c0032", "comment": "Malware payload (Triusor)", "timestamp": 1651204627, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204627, "uuid": "7d5b4d5d-3939-4bec-9cc5-9065bf4d91e4", "comment": "Malware payload (Triusor)", "value": "e3e77554376e0730350e3477b0adf8a1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204627, "uuid": "79f886f3-1528-4271-aae3-61651ba3213e", "comment": "Malware payload (Triusor)", "value": "395304b2e04c2d321a1a25e62173ab8671fe40ba6dd5fe189aa4caf26797e126", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204627, "uuid": "edc31a8f-adc3-42bc-8f1b-2d041a23f399", "comment": "Malware payload (Triusor)", "value": "1ff818a87a4fc86b3c3724afa13ae012d74e5d65", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204627, "uuid": "dcb3d94a-86f3-4957-a6b2-5c89b6f30f8a", "comment": "Malware payload (Triusor)", "value": "2bc03b6b2d2841aa46e48fd19ebe6654990e32f0fdccc1054306abc60120df27ec65ddab7c691b60ea6f7a5cbb855258", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204627, "uuid": "90d0cb03-9efd-442a-9d82-02dcf1cb49ac", "value": "T16DB34A227FB98473E3B60E36385C6B0801BBD5B10A72390BB3EC5F9D2FA55918760D52", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204627, "uuid": "8ab3e918-04cc-4d48-be7d-22d305d28376", "value": "12a30b523ac71a3cbe9145c89400dd7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204627, "uuid": "3630ff56-2e03-4963-878e-894dad43cd31", "value": "3072:kdg2SW2UUQGfBnPKkd4T6/yPTbjMULHmTOFbaTgdoFJuXEE0:YN56/kjiTOFbaTEXj0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651204627, "uuid": "f07dcb31-b121-4cb2-bffa-af7109300774", "value": 108576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651204627, "uuid": "38ed940c-0bef-4a47-a6dd-602428198b33", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204627, "uuid": "6494e013-9078-4942-a511-ae5ce7415a08", "value": "mad.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b10c10e-c7bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651237206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237206, "uuid": "d372a782-b358-4711-b4f2-4e98efd97155", "comment": "Malware payload (Mirai)", "value": "b7f41fe36714dcb921902d30fff90892", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237206, "uuid": "0f5aaaf6-91b3-41df-8b9c-f472045a3fb5", "comment": "Malware payload (Mirai)", "value": "399bbcfdbce2ebd743b132377287e9bc87d8d1eace45d773aca15b5fff895776", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237206, "uuid": "baa34d69-e536-4ec3-ba66-37a69bf807cd", "comment": "Malware payload (Mirai)", "value": "3983e40c68f5080d99be7fc1486659f898030281", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237206, "uuid": "0ecd5499-a8b0-4eaf-9b49-e5aa7092adb9", "comment": "Malware payload (Mirai)", "value": "f80d5b6b26b6889e736879e1b1fb7f61efea75f2516d4acaaa25ada60d702788f71b1cbe1b93477cd0b39fb30db8167b", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237206, "uuid": "4d21c3b5-f725-4625-bc8d-0d6a072514a7", "value": "T196F33B46A6409A13C4D717B6FAAF42493323AB54D3DB73068D286FF43F86B5E0E63605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237206, "uuid": "be733be9-ffeb-4790-b001-65b18a3efd41", "value": "3072:sLhuYiHv0PfbaKEbGwRFm4/w5wPf+gBcSjngM/9EPtbmTQ92BV:LYIMzaKEbGwRo4YOxcSjgM/9wtbmTQ9s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651237206, "uuid": "34b75e47-50d9-4b80-affa-d0e1c61f5179", "value": 167789, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651237206, "uuid": "9f341de2-a9d3-4a7d-a430-bb13c659fb55", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237206, "uuid": "1c029f54-73a3-4b86-b12c-ae2e63a97e9c", "value": "garm7-20220429-1300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18ca95c0-c803-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267616, "uuid": "c8ab3bc6-b47e-4cba-beab-04edb2d05aa5", "comment": "Malware payload (Mirai)", "value": "71e90e76a2ec0e6727fab7abcb98c79c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267616, "uuid": "37c6c3bf-9d92-42d1-8f93-d86e2bcf84db", "comment": "Malware payload (Mirai)", "value": "3a162604dc010b4c19974180e82af25d4ca759f283935c442624b10fc3a9b9c5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267616, "uuid": "b37a6555-378d-41b1-8a2a-23f10387ac2e", "comment": "Malware payload (Mirai)", "value": "376521b6ed2ee144c250aee8f8e1570bb854cd36", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267616, "uuid": "7329c8af-e343-4ef4-98f0-20d1c64aab94", "comment": "Malware payload (Mirai)", "value": "9f4b9152158ac02276bb21efb1f0800c3395e7e89de52e43a85fbf979ed810161803ce48d30976b1e7c52fd9e12c09aa", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267616, "uuid": "7b295aac-6693-4594-84cd-72f683c8d30e", "value": "T1822349C19643DDF5EC1191752033EB369A36F1BA2029FAC7E39D9A32D512B02B94738D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267616, "uuid": "2ed28951-e957-4e94-9bf1-b055e16d54d2", "value": "1536:R4siMVoqpRt1+fj4btHK9oYYZ5IwgJb4aB:9VoyX1+fj4bBv/ixbjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267616, "uuid": "bbf3c33f-754f-49a0-94bb-6cab4e014b6f", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267616, "uuid": "889c16b2-068b-4c98-a986-7093c57026ef", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267616, "uuid": "db07b3b5-70f7-42d0-b097-490559382979", "value": "71e90e76a2ec0e6727fab7abcb98c79c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c3017cc9-c782-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651212497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212497, "uuid": "2de4ba19-edf2-4a37-b9b9-216a04b5098b", "comment": "Malware payload", "value": "f6859e7d76d9b97099bddcaef4d176f7", "object_relation": "md5", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212497, "uuid": "a65d3449-f4a6-456b-a627-7d2ca065b425", "comment": "Malware payload", "value": "3aebb2587f146e7df15f2537b97c4010ee0f21eaa68f7219d3d23247366c55d3", "object_relation": "sha256", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212497, "uuid": "6a34e502-4661-4acb-92da-c1114a9edd66", "comment": "Malware payload", "value": "6e0c0c88416e607be52230524f98bc3e2bf7a0ba", "object_relation": "sha1", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212497, "uuid": "b85b0caa-9655-4b27-8f78-400c16eaa80c", "comment": "Malware payload", "value": "e73e6fa126bba05c487a23425112cc475632a210bec6eff0f7a461602012a9ff037892d949f5d97463ade3b0a65ca833", "object_relation": "sha3-384", "Tag": [ { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212497, "uuid": "a7200dd1-d987-4c4e-b655-b0cac6eee587", "value": "T198B42301EF0A151263BF644FAD46FEC5234CED6B9C2E1BD8B5B8392622E47D280F7255", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212497, "uuid": "6ad7a7ce-455d-4fbf-a361-3f38471d80fa", "value": "12288:dfJlzR0OLYa69lyjX1ka1zzbErG59/rWUtfmQ6I9w:d3ana04f1zzbErA9TzZJ6mw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651212497, "uuid": "37fb6adc-c307-43b0-b4a3-81203c99682d", "value": 521521, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651212497, "uuid": "9a07a42c-868e-4167-9a31-e52dbcaf5a02", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212497, "uuid": "41981de0-a088-4b88-a367-be0308cde1aa", "value": "quotation.pdf.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1705a63-c7ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651231016, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231016, "uuid": "a0e8d444-143b-41a4-a0c3-37e09eacca3b", "comment": "Malware payload (Formbook)", "value": "ac60505ff38341eb3393bcd304f82217", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231016, "uuid": "0ff66d25-987a-4196-b9d1-293354949b44", "comment": "Malware payload (Formbook)", "value": "3b36829e59d6059f545294bfcaefcbd1a19504851ac359bb8955bbf158057ff2", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231016, "uuid": "b236e10b-c5d8-4ab5-ac50-53b418d5377b", "comment": "Malware payload (Formbook)", "value": "0f2ebcf38baf04d019f9c2db430d4e89b35c848c", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231016, "uuid": "6328797e-bce4-4d06-bc03-7ed427f043f1", "comment": "Malware payload (Formbook)", "value": "226d12536fb3af1d5c32c1ca8de41b6127de6b7ecc6615a6f10243f3358d1dfbdb08d0fef20364091c93d2e9551ba79f", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231016, "uuid": "f6367442-f756-4429-9913-e3ca3b71f564", "value": "T19962D049710E42708711BC981BF570AF1196F905B8A233E773C2E56D05BBAADF3A1CA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231016, "uuid": "3de54984-30b4-42ce-8656-f02990e05cdf", "value": "384:ZGN2cN3h8xk8Q2vZjHVFTIM4q8HLG9prRF:Q2oYBQG9cLA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651231016, "uuid": "e031e557-7b6d-4304-bfa3-b14c784cc63c", "value": 14550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651231016, "uuid": "d3a6a3ff-b0cd-4263-930a-6ffadcd81a91", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231016, "uuid": "7fdde8b0-cb38-417f-90be-e7ef4740c58d", "value": "RFQ ref. AMC00145.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e08050d5-c7b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651234880, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234880, "uuid": "3663d3ba-c411-454b-846a-e8fb8922446a", "comment": "Malware payload (Mirai)", "value": "51e940445a73ad99612415d63095e1ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234880, "uuid": "44173092-b3c6-4af2-b22e-13eabe8e69f4", "comment": "Malware payload (Mirai)", "value": "3bc9d3a9a2e47279147de610703f4ecbdff80f18b902f4eae5833344c0fd65b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234880, "uuid": "c441e538-e902-41b0-bb58-fe7b35010dbc", "comment": "Malware payload (Mirai)", "value": "fc7185bf175494eecefd00db3ba07c52e9f70943", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234880, "uuid": "f6bf5fe9-2211-4c48-b391-602b42a7192f", "comment": "Malware payload (Mirai)", "value": "4f5af4c3d1617e3035711675136bcf5fcf4c4d2c8d756825321eeb3b7532987f2c9103ed76021d364f3c7c4efeebed0e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234880, "uuid": "de753eb1-b283-481e-99dc-389c762b4552", "value": "T1E0634C02B2280A47E4931AB4253F1FE057BFEAC025F4B685695FDB568635E372086FCC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234880, "uuid": "10cbb76d-b839-49ef-adb4-37949d45b18d", "value": "768:JcM3+VHuQYRPbMlxkSC1yHyx4cDzPH//1ZQV28uGFzpTYqHH5eKnsbmqRr4sGpMl:Gw+fYYC1yHyau3/Od9mREsvkI6wDlw0t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651234880, "uuid": "8315ac8c-3a6c-425f-9aba-9e6559446739", "value": 70744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651234880, "uuid": "06c5dc3e-d206-46ee-8c4e-3c8d41f60414", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234880, "uuid": "4e517a16-8fcb-48bd-98d1-d3350104bd93", "value": "51e940445a73ad99612415d63095e1ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f10ee6d-c808-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651269935, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651269935, "uuid": "69e28fb7-3c5c-4b05-8bc0-985358c88815", "comment": "Malware payload (RedLineStealer)", "value": "54510731d86ac6e99f5755f4ed37645c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651269935, "uuid": "0ece1b0e-31e8-4ba9-8df6-bc58cbe5ac8a", "comment": "Malware payload (RedLineStealer)", "value": "3bec3063cef1d442fb269c277f63a36bc471dee67bc4f123c1688a9d49aab2eb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651269935, "uuid": "d7e9da68-81b3-46cb-bed2-ade9032abd47", "comment": "Malware payload (RedLineStealer)", "value": "730c6e1ba0e622508418b233d427f2905807285e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651269935, "uuid": "c91beb0f-d504-4670-adff-7efcc0be6ba9", "comment": "Malware payload (RedLineStealer)", "value": "6d8046f93b9003c84c8872139b39c61a874f96a138d599ed384e64f4efe9d07c739bd00f4911f54539686b448be9df5a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651269935, "uuid": "aa712bae-28e7-48cc-8c31-f5690494b391", "value": "T10C84BF40BBA0D039E1B316F579B993A8693EBDA19B3451CB22C537DE5A346D4ECB0307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651269935, "uuid": "288a83b7-2f20-4a73-bc2c-d3343d75cbf8", "value": "dd713e86f79f24fed8f0b30a6d67c702", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651269935, "uuid": "6a4259df-1047-44e5-ae98-6f34d9a6a3ab", "value": "12288:+bySgJxlNXlCj9SOZR76mFZqh3yumLfjRynIu:++tv3O36MVynIu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651269935, "uuid": "cfe89fd5-03fe-4786-b5ad-b080befd6bc9", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651269935, "uuid": "ab393b1c-5663-41b8-b02e-69ffe8e7f087", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651269935, "uuid": "daa7f0e2-1eae-49cb-89c6-348b0c5c3a9f", "value": "54510731d86ac6e99f5755f4ed37645c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1149392-c7b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651235337, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235337, "uuid": "abdda2bf-7a6e-4c1a-a860-a59fd78e2216", "comment": "Malware payload (Mirai)", "value": "726f104f4d53e5719378ce640e7d7d64", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235337, "uuid": "68f0659b-4f2c-4cd7-9465-d9d2cbf61a35", "comment": "Malware payload (Mirai)", "value": "3c2abb80d996e89836010c8c24e49714847bb45828ae4915d7ab46ce90e88146", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235337, "uuid": "3320b38c-5440-4109-b744-a8acb90513c9", "comment": "Malware payload (Mirai)", "value": "f56889cda332fe0916f13bef0564e1712329f9be", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235337, "uuid": "ba704b5f-e5b1-45c0-a1ad-b639266cd24b", "comment": "Malware payload (Mirai)", "value": "05945c534127da66a417249048d6bf373c6638b1af10225dea573a8a3b12f745a1898d8c2949a947120df70f75ca93fd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235337, "uuid": "b854b30f-37ad-48bb-aa4f-bb1b5b03dabc", "value": "T1F9330991B9824E6AC9D513BBBA6E55CD332063E4D2CF7313D9204F543ACA51F0E6BE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235337, "uuid": "e206a854-cdfa-4afb-b9fb-ccd6cd006cc6", "value": "1536:m85kQYawggPL6LCgHfjHBSyEvxEy3RCaBy21TJA:LhwgOLQCorHUHvGy3RFs29J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651235337, "uuid": "08656e19-f669-41f1-b638-45f192cf78c6", "value": 50796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651235337, "uuid": "3f96e5d6-857e-480e-a77b-472752f7be6a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235337, "uuid": "4c55185d-15d2-46a2-8a62-6a2ca9dd195c", "value": "726f104f4d53e5719378ce640e7d7d64", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa1759cc-c7ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651230628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230628, "uuid": "0505971f-8b7c-44d4-88f0-be1e478fc927", "comment": "Malware payload (AgentTesla)", "value": "e464f9064f04e600ab6de29b906bf72b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230628, "uuid": "329ed8eb-21c1-4fbc-81f5-6fa1cbd655d5", "comment": "Malware payload (AgentTesla)", "value": "3c8538837acc69acb585a138963492ecc1c505140da740a88f2338a2fc771123", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230628, "uuid": "f33c5ee0-e22e-47d0-8426-cbea44894180", "comment": "Malware payload (AgentTesla)", "value": "e209b5fe827697ca440a15b28087cb50eb529fb6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230628, "uuid": "c48d841b-334e-4545-8252-e4b694d0c465", "comment": "Malware payload (AgentTesla)", "value": "94c7f5362386a801e550c19a796c2d47ae6ed42abec0ed2fb81edeb7b8ba7ef80822d6025f62728d735bf049b624dc56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230628, "uuid": "314f60d2-8a69-4913-8fa0-d636c7408545", "value": "T130942362795C31E694AA25D81E6C08E13B1BFD78167308AAFCAF0DD8FD7511D9CE08E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230628, "uuid": "f46e9e77-05c1-4fbf-8271-a9bde74a5276", "value": "12288:nrrE1hHXQoDUvwk7i7wDv4oqeL8FT6Umh:rrE1hJUuQPqeWTAh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230628, "uuid": "b8b751f1-1213-4312-927e-e5393904f951", "value": 429035, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230628, "uuid": "d0a2bcd0-eda0-45a5-942d-b9e579ada31d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230628, "uuid": "63dd7b86-33b3-40d8-9c04-b286ae02eacb", "value": "shipmnt invoice 1930.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "380583a9-c788-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651214841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214841, "uuid": "8429d342-a98c-4c2a-8413-1b9aabe584b7", "comment": "Malware payload (SnakeKeylogger)", "value": "a9ca92cedc31fa7ae6e4e5d08d651134", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214841, "uuid": "c433f208-39ec-4394-a59d-5786be218215", "comment": "Malware payload (SnakeKeylogger)", "value": "3cdb0a9f4c6b741b001e3e19e42ac835d8aaba02b7ab403f303cbb246d1b47b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214841, "uuid": "f5b95e45-04c6-4882-9426-e597ae82c846", "comment": "Malware payload (SnakeKeylogger)", "value": "19ae43eb055cf338f44beecf55c78f9a689246f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214841, "uuid": "97fd5fa3-b498-4e3f-91b5-911a9e326f02", "comment": "Malware payload (SnakeKeylogger)", "value": "eb9be2a1b2c7e017a9523beede78359bde8fc9856b48497c694892725626721eca4796f8b3b651fb0f7252c6ae038744", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214841, "uuid": "b42bbf0d-d6d6-4f63-b2c4-17001d2b561a", "value": "T14F14085E9B868930CAEDA3BC1C7B8505D8B8E9C001776B0F671688747E941CCED2EDC9", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214841, "uuid": "97fb95ca-60a5-41e9-95c9-08621fb249d1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214841, "uuid": "36c7cfae-f3df-4a02-be90-08289204423e", "value": "3072:3wA7sHakWFvBMr1/4iXq1Ogo4wQI5lWLHsyg5fN/7AVavUP2J5vpmf0lG6FQTGlv:3wEUftrR3q1Ogo4wQI2gtN7AVavUP2Jg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651214841, "uuid": "fefd11cb-a57d-407a-bd08-d75ee65ce7c7", "value": 195072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651214841, "uuid": "331aac9d-177b-42e0-ad4f-d1c79ae22896", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214841, "uuid": "fb9e102d-c0fa-4f22-ba60-ed5c867bde2c", "value": "a9ca92cedc31fa7ae6e4e5d08d651134.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e567d37d-c7df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651252498, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252498, "uuid": "20fce2cd-f57a-495f-bb3a-5b355c58317f", "comment": "Malware payload (Heodo)", "value": "4f7c76a35c9928fb5e1b5f91cdfc433a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252498, "uuid": "d89aa61c-516c-4f68-b6ca-38867bb4c400", "comment": "Malware payload (Heodo)", "value": "3d46e87ac6ea75d3eb0b91ac7eb617059d06c2cbd0b630e7241c6343b1838c65", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252498, "uuid": "162cc1cd-d916-4294-b8f9-5d41a720a6ea", "comment": "Malware payload (Heodo)", "value": "23bbe0f2bf2900d1eb6fd9c76fd047daa37aa3e4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252498, "uuid": "9e126538-de2f-41b9-b803-9771a085dcf6", "comment": "Malware payload (Heodo)", "value": "6e7fc30a65fc6e376c9685a81027ac6cf1edb11f7819c09fdd7bc8e6bd504f1deac42706ba6e6711b09b20188829676e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252498, "uuid": "bdbed9b0-ee4a-4093-b151-b2fdb3deb27d", "value": "T111C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252498, "uuid": "43754df4-057e-420d-bf6b-416fd691f02a", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252498, "uuid": "48230507-1ce0-422c-99a5-94f3452a1d69", "value": "6144:JhZ02GdOOgPY3KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfUKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651252498, "uuid": "094879a4-ab83-4c58-861b-a40457871d42", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651252498, "uuid": "cbb427ac-a971-41a8-9f11-e5b8976b0194", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252498, "uuid": "f27a47b0-22a9-4064-a82e-f2d7db3c639e", "value": "4f7c76a35c9928fb5e1b5f91cdfc433a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a67dd2c-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651232561, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232561, "uuid": "d03a8f6e-e6d5-4cf3-94e5-e13406782b59", "comment": "Malware payload (Heodo)", "value": "f5b3a82f169bf198090b4d3f230fd0eb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232561, "uuid": "f3deff44-eb05-4a87-a5cb-35f309ec2489", "comment": "Malware payload (Heodo)", "value": "3dbb02ed9e60c95a6268a63ed540c0c0b5cc8b8dc5dea0790d511c1c83c5d3d1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232561, "uuid": "7c3ec734-8ff5-4a40-b395-8024079d8556", "comment": "Malware payload (Heodo)", "value": "734e11ac08d6f483da650d43765651b1e573c1e3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232561, "uuid": "7737dada-dcb0-441c-ae0d-37a9353bd17f", "comment": "Malware payload (Heodo)", "value": "417d8ba4bf6ee9d66defcc6c6f378678c92c8b361bcd88673c627ed7a075f978b98f3fa55eb7f9e49fb2846d63091c57", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232561, "uuid": "1eb90dcd-eb80-428a-98ea-6b3cf6d2d72f", "value": "T14DC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232561, "uuid": "1814faf0-0458-4e15-9e88-429b3ad6138c", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232561, "uuid": "7b5a4569-26c9-41ba-adb7-de8575060fba", "value": "6144:JhZ02GdOOgPY8KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfzKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232561, "uuid": "2bd90d37-cc3c-4545-b321-036bcb0653eb", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232561, "uuid": "c3194f4d-0157-4eea-a645-a4e14fa2fcf3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232561, "uuid": "887bccb5-14f1-40b5-8bc8-6a3d2c339a31", "value": "f5b3a82f169bf198090b4d3f230fd0eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "019da7e1-c79b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651222910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222910, "uuid": "b221ccb7-4dec-4ffd-aae6-8d1d3c21c6c3", "comment": "Malware payload (Heodo)", "value": "50a9d46a97373362a13006c96498b9fb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222910, "uuid": "5e94d46d-66c1-4c03-a324-4dde67ef001d", "comment": "Malware payload (Heodo)", "value": "3e51df9418b0d84d5b159ac8dbe80c8616d5736dcad23ddb6d0ea61305f7858f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222910, "uuid": "f5c92c88-9902-4987-857d-74dee19c81e8", "comment": "Malware payload (Heodo)", "value": "c883533d60e6519af6ca82158c51f27f858f86ea", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222910, "uuid": "d7b3480a-cfe2-4cfb-b9bc-ad88ebc11d9c", "comment": "Malware payload (Heodo)", "value": "2a9226124aaf0d06f60afb117ef81565586c848c3e2dff80e80ed6afb865d134661412f10bb496571620a6df3ea3e2ce", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222910, "uuid": "a9c3ef33-63fb-4961-9bad-e5f2094c0d93", "value": "T133515E2C3DEA6218E6F3EF7169EC7695DBAAB562F952494D00C1070E4921600FD91F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222910, "uuid": "1ce4ce44-4f13-4d51-a0a1-aa626235b68c", "value": "24:8kJ/ByUq+fBCxXKVW9v9AuRIZJiXRF4+gQo/uIH/y1XyHgbHo/umVlncIEjaem9q:8m4xX5w6Xj03ugtHU+uccIx/cC/N4ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651222910, "uuid": "e412be70-589d-40fa-849e-cb140710cb3e", "value": 2454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651222910, "uuid": "eaba7a81-4d77-46c9-b144-35858eaf03ab", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222910, "uuid": "cb18f915-9ae4-43ef-b239-025a4204dc11", "value": "payments_29-04-2022_1515.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ba4d464-c780-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651211411, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211411, "uuid": "09fb9c13-e179-46fd-9a44-720b857ee045", "comment": "Malware payload (Mirai)", "value": "8b1a4bae42554a0258efebe8cd79cbb3", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211411, "uuid": "85f3891e-c6e3-43f5-9bf0-38fd1312a1fe", "comment": "Malware payload (Mirai)", "value": "3e6fbf6f024e1c346e10dd29b5a248158ae276acdb7fb3848e5978e5e04884eb", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211411, "uuid": "93e595de-b23e-4482-a0a2-4017aeeb66a6", "comment": "Malware payload (Mirai)", "value": "4a934cf2be65964993d20c6cf7bbe7384ac3fd35", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211411, "uuid": "7d5a8f56-8084-401c-bfdb-6b2b3721be61", "comment": "Malware payload (Mirai)", "value": "0e3756b0d29122ff83fdc9c106a1376de0f787294d7c304b3bae7291e1f659327e70688fa1321b528c138e88bc85d7d2", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211411, "uuid": "48cf1406-21d3-446f-9d13-3014a41ed9da", "value": "T11FD32B86EB418A13C5D6177BEAAF41453322DB54D3DB330689285FF43F86A5E0E63A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211411, "uuid": "0d7d1b48-38d2-4b44-bbf2-816fb574ce0a", "value": "3072:nJA99VEwh3nXXm+2ZE6CIANCHkQQWTW0M/9AySa/:nG99VEwhXwZE6CIoCKWT5M/97Sa/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651211411, "uuid": "19d55e10-b4d4-46a3-b73d-bcb65c2175da", "value": 130018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651211411, "uuid": "c31f9e58-b734-42d6-b82f-98036a572536", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211411, "uuid": "5e7f08e5-1b83-4f81-bb21-98e755cb0904", "value": "phantom.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aece2696-c805-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651268727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268727, "uuid": "68b45083-0cb8-428b-bc2c-d30fe85a67b5", "comment": "Malware payload (Mirai)", "value": "bd1ceacd92bc40f58e567905795829d9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268727, "uuid": "8e271f90-7f3d-43e6-86ec-2e9857ad7d2a", "comment": "Malware payload (Mirai)", "value": "3eb77f8e726f11d5042bf9164794e2159fc45428ce4d04616ed66ea8a278dd77", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268727, "uuid": "401f80d0-c672-4c6c-831a-160249f7ef3b", "comment": "Malware payload (Mirai)", "value": "02ac6f6ee1f4594123d16185c64e9b59901af651", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268727, "uuid": "40271478-a1dc-4fab-9c09-11adbc209534", "comment": "Malware payload (Mirai)", "value": "aecaebccb94cd502a6f8c881b77f67334f5ac8d424b7dc07de1ed703a210cfd481020480926d3f08da727cd0c0719df5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268727, "uuid": "2618bdd2-1dbd-40d0-9db4-f2e75f47915b", "value": "T105231855BC929B66C2E0277BFA6E418C7310A3ECD2DB3253CC291BE4768552F0DA7B41", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268727, "uuid": "fd51a37f-d9b0-43d7-ad8c-4ea06ca70b62", "value": "768:wD6dZmaoGjgzGaywdZuMfHnD1NC8saEDoCerCFg+JcNbm4jNAPzI329uGpEX3TJb:wkmaFEGarS8sxg+JcNS4jNIc329usy3J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651268727, "uuid": "297b6741-5185-4df0-aec4-4121cc591564", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651268727, "uuid": "787357d4-a08e-43f4-a9ef-acf9569f248e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268727, "uuid": "a09a6f98-1fbf-482e-95e3-d22f51d18d36", "value": "bd1ceacd92bc40f58e567905795829d9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a49e1b98-c7d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651249383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249383, "uuid": "164fbdbc-c4c8-4e37-a8ef-a21c9567b093", "comment": "Malware payload (Heodo)", "value": "355bf9497bfd4c75b8df10d1750e94d4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249383, "uuid": "4c48929f-973c-4903-98fd-20840f67baf3", "comment": "Malware payload (Heodo)", "value": "3fc11763648665670afb8c5384bcf5abd0da6fff41ee25ade270288095036323", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249383, "uuid": "b5d20311-1317-40fa-8c34-61473c67edc4", "comment": "Malware payload (Heodo)", "value": "f06d30d78ca0dbdede24f57a56a0e14037120bb9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249383, "uuid": "bfa1b027-76ad-4ccd-8598-56fc7ca6c5e8", "comment": "Malware payload (Heodo)", "value": "3b12347690262683ea0d0ceb5fa2b64eed54abcb35f8b0fe1f43fc5d342a31cfd424413741b920b1d33cc5bc07eb6b5b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249383, "uuid": "23053d47-7a79-4267-a258-6dc0655bd412", "value": "T106C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249383, "uuid": "16b9803a-bed5-45a6-a846-b757f7b8a96a", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249383, "uuid": "ba24a615-9f94-451b-8fb7-8c1b7d206f9d", "value": "6144:JhZ02GdOOgPY/KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfEKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651249383, "uuid": "8f5f2ad5-ce54-4f9d-8c0c-3199357671ae", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651249383, "uuid": "7850455b-9c11-4e1f-b2b8-244a4ae2d6f4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249383, "uuid": "0b11e21a-4413-48ae-88de-1c1041835a56", "value": "355bf9497bfd4c75b8df10d1750e94d4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "41e8769d-c78c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651216575, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216575, "uuid": "59374bdb-6051-4f19-b9d5-27a194b5a4dc", "comment": "Malware payload (AgentTesla)", "value": "eb6717ff51a9d8eaf328aa92ec133f62", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216575, "uuid": "8d0cd29e-884e-459b-a08c-c5e8cbdb134a", "comment": "Malware payload (AgentTesla)", "value": "3fcc51841d4fe785c20d1a967afda90cbf63ca51135ec1318d5d67363c1a8ba4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216575, "uuid": "cd9149ea-7ef1-4c5b-843f-38dd0b3654c2", "comment": "Malware payload (AgentTesla)", "value": "5ea7ddb519874eb95e356885f21731063d0e3ed6", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216575, "uuid": "6abb1079-afac-4b62-898c-0a7c5d258fac", "comment": "Malware payload (AgentTesla)", "value": "80b35f2beda0e5e571ad21ec30c61848253dd418ae1c1e45356273a655bf0a9004a7b9cb328957d2d8f7f0925da0ff56", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216575, "uuid": "de565f73-7b03-46ea-a7cc-ee9009fd4aa8", "value": "T1A225E00AB969CAB1E4384F73BED3A10C17622DF5E902C65BA6D7F2550E313B24D90277", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216575, "uuid": "8c1f966b-b740-4e0e-973e-a95c20f2d414", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216575, "uuid": "e0b5687d-44d8-4070-98be-f860cd0bff80", "value": "12288:5L3wVKdLWJexHgY5bBxRCkSYb8Y/yOGqonjj3Cf4vbQAlbuWHsWfAPAfQgCb9ks:tIKxQClPcOoY67pnjjSfmQdYAPyvC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651216575, "uuid": "e9302d35-7e71-42b2-81d5-ef651daa27b1", "value": 999936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651216575, "uuid": "86e76438-c61e-466b-a4bd-024cd1cc60cc", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216575, "uuid": "cd4cbe0a-773d-495b-94d0-aedca1a8581a", "value": "invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c757de-c7d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651247068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651247068, "uuid": "27d432fa-5dfd-4bb4-9482-bd7c335dae66", "comment": "Malware payload (AgentTesla)", "value": "ccafb6c7f30cb8ef30f05cdc19da6901", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651247068, "uuid": "0fad3f9d-c5af-463e-8be8-3969e3108693", "comment": "Malware payload (AgentTesla)", "value": "408b11d96851bec13d51adf2ed4956cff4ca20524ed233edaf9b6888a3df657e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651247068, "uuid": "b2c32b8c-cc0b-4a1e-bdc4-dd380eadd1ce", "comment": "Malware payload (AgentTesla)", "value": "c6cba1a32c75571bb497bce4d8d66abc74056d86", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651247068, "uuid": "0270a036-b00c-4d88-972c-47eaa381c174", "comment": "Malware payload (AgentTesla)", "value": "fe0706c2d08300cbced877ccfaf3447b88995b307bea6d7520ab164cc688f8c7934935a50fcce908ebe7237bc350325e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651247068, "uuid": "0be275bd-fb74-4089-be43-c1e73271c49a", "value": "T1B794221F792C6982862A3178223E11A5074C13D6FFA2E9D8F81FC8E795499ED095BCF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651247068, "uuid": "819cec87-1534-4061-b310-54fdff82b9d7", "value": "12288:f766dcqUSgwUyQCZsD2W6aDmJmtQop443Qi6:z66yxmUFa9a6kB3QF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651247068, "uuid": "fc74acdf-479a-4f08-a1d0-77e0661fdc4a", "value": 418398, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651247068, "uuid": "cc0d63d2-fcef-4701-b428-4f6f79769345", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651247068, "uuid": "f033a668-9d40-4a5e-8118-b460ba4c801e", "value": "Invoice 0125649.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d747bf2-c78a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651215628, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215628, "uuid": "5b5595c6-b8eb-4309-8148-6de579661ba0", "comment": "Malware payload (Loki)", "value": "9e0d71c3758e29b9d5b930219c5d208c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215628, "uuid": "feee4d81-536c-40fc-96d0-92e85df39923", "comment": "Malware payload (Loki)", "value": "40cdc18bc95e92cd30af274b10e9a615db920d27e8dfdac30735159c0f2926b0", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215628, "uuid": "c55dead6-a06a-491e-9370-3433ec4a377a", "comment": "Malware payload (Loki)", "value": "ecff013b90578a278ea12a9eedf209712dc3fc63", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215628, "uuid": "312806d1-df36-475e-82ad-aa83a1a6d68a", "comment": "Malware payload (Loki)", "value": "f297d2200856647125cf04f240dc1f7a406e832ef033bbbae66f60e7e5f21cc4b9949543270df81b00ddfb5d3702d838", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215628, "uuid": "3185b1d6-e97b-43c1-a066-abe5a1fde0d4", "value": "T1F99301FF691058BEF1E806B8ED325454CC911E836E83EE649C1431656F70CB3BA7804B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215628, "uuid": "b7f5ffc4-0eae-4f6f-b233-7cb23ea7443e", "value": "1536:5CXxvmlVxGMb62z9olAwWIr/ZYinkKEnKp2lE6z2HguLkWCLvyGEVOu3VB/c4:5CXNiVpbL5KlWq/qbbnGHHwKVLBk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215628, "uuid": "7720e775-b81f-4b64-b163-3f3f1c8286fa", "value": 96768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215628, "uuid": "ba81be25-57ab-43aa-8e5f-505b5b42c1de", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215628, "uuid": "020e779b-8875-4d6d-8870-084d997939a9", "value": "PO-89MDC8815.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74de042c-c80d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651272066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272066, "uuid": "79f4c1c0-4056-4970-a054-6b3c3987a17f", "comment": "Malware payload (Mirai)", "value": "6e9d5c45041a5b686381b2c586b3a7a8", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272066, "uuid": "bcb7befe-a2c3-48c7-867d-fd807fdff185", "comment": "Malware payload (Mirai)", "value": "4120e5f1c0c1e220303df263b6ac72a6e1370707117151cbb0999728357e6eea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272066, "uuid": "4bd2b933-dbe3-4e86-a051-5a854f14395e", "comment": "Malware payload (Mirai)", "value": "7b309a6c6a51546abc9dca29c55a5a76ff44f92f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272066, "uuid": "85ff7cd2-8ff7-4ceb-87d6-5eb0f11102ea", "comment": "Malware payload (Mirai)", "value": "25c42c5d647619d3cafe79bb6fc4fd831d73a753e7013b0a514e0e0c30c67fa00e6b5d0a03cc9a3f22479e4b22f86ccb", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272066, "uuid": "4ab5fa6a-d905-4fa4-aa51-417489420f43", "value": "T1EBE2D066C36BEB42D26604BA646EFC8DC035E31DD9500AF7EE4632695823F506D2E327", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272066, "uuid": "1183b56c-156b-4b3b-884e-6228314cccf0", "value": "768:oUaIpAM4zgdKfDQvTWsBJjFZkVFKv/RubnbcuyD7UVyq8:oVMtEfDQysBrSHKXR4nouy8sq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651272066, "uuid": "f13bd33d-b347-4a61-8fae-cf4db81879cc", "value": 33900, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651272066, "uuid": "46165ed6-7f1f-4444-b581-62fd22dca705", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272066, "uuid": "c3eb65ca-295a-4ae8-90b1-d157e613010a", "value": "db0fa4b8db0333367e9bda3ab68b8042.i686", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24cac6de-c7a3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651226405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226405, "uuid": "6232f919-cf6d-4832-8820-3c1d9959b26d", "comment": "Malware payload (Mirai)", "value": "a6747badf8b3f1ba6dc8816ed6205b31", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226405, "uuid": "feffbf1d-6f79-42cc-a01e-ef02b11bcd94", "comment": "Malware payload (Mirai)", "value": "427aa0b61d39e083f1468abb3d8547f6fb821f9710a2b9941ff30638cb9e3a46", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226405, "uuid": "3b46c965-c3f4-46b7-9d84-9cf8f97d6861", "comment": "Malware payload (Mirai)", "value": "e605fccd3ac42ef69487cc311f3188a4a5fbe5d1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226405, "uuid": "bd1f9c41-908f-482a-931f-78db785e847c", "comment": "Malware payload (Mirai)", "value": "1c483e7a897940754be15209d52ec3be664ed3f4993692bfb3f61b70255375c2054081eb9ba01822b5206c41f189dcd9", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226405, "uuid": "64310733-3f7a-44f3-8312-94b6b294364f", "value": "T138B2F00DF36E4E46D191433A630F03BEA713786F4A9EA68005A6A59CAB50C9AE961D18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226405, "uuid": "e352bac7-9b8d-4789-a7d4-903924aa2b4e", "value": "768:Gc4VTqxufVlHM3E4YVZDM1YIxywkNMgm4lf:Gc4VTqmVMJdxBW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651226405, "uuid": "6da19df0-97f2-4e78-962e-fda515e55f53", "value": 24756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651226405, "uuid": "1740c9dd-c5bb-4afa-a896-9f1de24af8b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226405, "uuid": "7cbbf952-92b3-4161-93ab-5d937bbdaa18", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5380266-c7b3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651233519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651233519, "uuid": "8a33a924-5d19-431c-9f1d-63d06419637b", "comment": "Malware payload (AgentTesla)", "value": "5ad9a1af93e0428df6df6277d5d0ad99", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651233519, "uuid": "4896b3bc-684f-4076-938f-64a93507a51e", "comment": "Malware payload (AgentTesla)", "value": "42d670851054ae4588115bf4c0ebdce3fcc25ea4cf2ddc8cfabcda00a0ef9492", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651233519, "uuid": "2a0461fc-5ae2-435b-88f9-8df6648c6156", "comment": "Malware payload (AgentTesla)", "value": "ab6c86288915808199960bb5b2c13e20c3e09ed3", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651233519, "uuid": "3c9d5575-8bd8-4a7b-89a0-6319c6f324d5", "comment": "Malware payload (AgentTesla)", "value": "c940b16782bfc42acc9d023055389b65ce7d6f3e1515e23a54de7583090233d57cbf3e29ba816fdd4e188e173555d327", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651233519, "uuid": "fedc9a77-c0ef-42a8-b3c4-b595cff855ec", "value": "T1ED84237AD520D673A8492CF871D222D2649D15706D7E33E88F9BF529046385CC8B8FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651233519, "uuid": "2653ea78-b6a4-4aea-bd46-f76ae1c5fa4b", "value": "6144:gzyQ+yWEpsnZeEdkhWDcZ1t4VgqR9MncMdj5jCIvVSagxZ2OmE0MFxQvT4EWTPz:gzybuUZfj8/Z40cSjNv4aUVEWn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651233519, "uuid": "d3a1bded-4781-49a5-a0dc-b8a746d4bfae", "value": 382377, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651233519, "uuid": "577cce5b-c3f1-4ad3-8244-21f050907c56", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651233519, "uuid": "c3edbbd8-647a-4aac-863e-cb39f844e3c1", "value": "STR-DD225227 (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f16169a-c7ec-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651257910, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651257910, "uuid": "7bf70933-f154-4557-96bd-83a09c239eec", "comment": "Malware payload", "value": "80cd3b1c36ab2548f1ec352c8f7cf1c7", "object_relation": "md5", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651257910, "uuid": "79d55d11-7bf0-4381-8240-2a5610feed5d", "comment": "Malware payload", "value": "42d7815d85fa1be0afe9e2b6f0c75f9996724b1ebf6e7fc30be8db570c1512ac", "object_relation": "sha256", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651257910, "uuid": "891713a4-437b-4cc9-b45e-35fc273c335f", "comment": "Malware payload", "value": "5ecadaab6579f52960d8cfad1167ad536a39ebc5", "object_relation": "sha1", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651257910, "uuid": "4f876881-1d6d-4107-bc09-e4fa9b53fcef", "comment": "Malware payload", "value": "1faaae7db32c0f0310fd8b16e287bfb5113ab8abe786ce532c7dd8338b573a4e28badd6164bf40ff72dcaa8a61a3d026", "object_relation": "sha3-384", "Tag": [ { "name": "dropper", "colour": "#04C509", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651257910, "uuid": "68add18f-62ed-46bc-9d78-b783a1404983", "value": "T17DD53345A103EBB22EF38D097E41C41E48AEBE19A0CE4D98FD7554081ABF5C6E47917F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651257910, "uuid": "17131c15-05f6-46c2-bd01-d907255b8962", "value": "49152:a1ikJNLibUcK7R01/hUkgqWy9+HpAQ1ZG+mMe4AaUF/409pNxr90jrn/8S4d7Z:P6LiY101oqWy9cpJZNezGid0j4b7Z", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651257910, "uuid": "76590905-0bc3-4c4f-b8c7-7700b7e3da4e", "value": 2950569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651257910, "uuid": "cf25465b-99aa-4a7e-a2d5-c7e9859e4573", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651257910, "uuid": "e3d651b3-d70b-4318-880e-240d9a93d65f", "value": "Hide_My_Ass_Checker_by_xRisky_v2.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "62bb9a72-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651232522, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232522, "uuid": "df6d073e-870e-4b5c-9115-5a21f41be6e0", "comment": "Malware payload (Formbook)", "value": "1f7ae41d7379cdfa750b13b8a2e47417", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232522, "uuid": "58194c65-f48e-4820-94ee-63c5c0db7f82", "comment": "Malware payload (Formbook)", "value": "43aaf13fbc49a0763cc55dfdf174892b76cc0b74a8698886d9376a4954e00818", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232522, "uuid": "425653f9-3985-461e-a253-2e39a8195d9a", "comment": "Malware payload (Formbook)", "value": "e5fccd2b32d25a283b4e5f641b8924ea71d25de7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232522, "uuid": "3c7efb75-6df6-44a0-bb43-2d1c8cfed2e9", "comment": "Malware payload (Formbook)", "value": "ee06f777393e67670273d92835bd55412cdf77d8f919d619204ee668e628ec578501d8564d386680850a7253f5c20001", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232522, "uuid": "3a394f92-b570-4bfc-a573-1276e3b039e2", "value": "T17624121432A4C062DFE25BB21F31967A24A7AA373515531F67A1DF6C3E13683F91E322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232522, "uuid": "6a0151da-5c28-4cc6-9090-57a57316bccf", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232522, "uuid": "cd3ced26-8563-4fad-b175-7b69771ad021", "value": "6144:HNeZm1cJqf41056IUu1mUY8Vx9FrM0nLSsoKDzb:HNl1cUfbTUY84tLSsoQH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232522, "uuid": "23cf67ff-600a-4113-a59d-69aaecd55762", "value": 219148, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232522, "uuid": "de452477-b49f-442c-9d97-20bf32617980", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232522, "uuid": "8b3ebf7b-26c6-420b-a262-5750c386f571", "value": "odeme.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ab37b42-c7d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651249366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249366, "uuid": "dc16ac2b-439f-407e-8dc9-ea34654e9a66", "comment": "Malware payload (Heodo)", "value": "28bdd74cfcfba8f30cd5b18db435c519", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249366, "uuid": "aaf8e28e-2fc3-4848-88d9-eccf4487c2c8", "comment": "Malware payload (Heodo)", "value": "43c44b6b7daa5427f9a8eefbc88beb9888ded6babd847ce08743a5335eabefe8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249366, "uuid": "6eee763f-2929-42a4-9d48-664d77bf8cc7", "comment": "Malware payload (Heodo)", "value": "b2dc61273505a6ee6a9b9a68a44e9c6b236281d0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249366, "uuid": "ed911b76-bb70-41ad-a2b6-3458a383c90f", "comment": "Malware payload (Heodo)", "value": "03e0a5323e1d4b0a6229084c2206625273a1e5249bec54f756d09157b9b1b89168a8d9dc12040d2600119da34eb24275", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249366, "uuid": "7e8bec2c-3e5b-45af-b29c-b20aad632740", "value": "T108C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249366, "uuid": "8bd694bd-6cf0-41b7-a5aa-069511667504", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249366, "uuid": "6670579a-c697-42f6-9037-2180937dbda8", "value": "6144:JhZ02GdOOgPYwKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfHKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651249366, "uuid": "b33d25e9-d410-4b50-872d-6b2a398d1291", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651249366, "uuid": "b894852c-c170-4bb2-af3e-7b36837dabb4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249366, "uuid": "1897dbd8-f799-4b49-aa92-e3de127094c2", "value": "28bdd74cfcfba8f30cd5b18db435c519", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e68f0f23-c7c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651240903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240903, "uuid": "d4eb0362-065b-49fe-940b-7b3111827935", "comment": "Malware payload (Formbook)", "value": "6ffc9e7df20de5d39705bf3246b17581", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240903, "uuid": "791217e6-e1f4-4b64-aa3c-0b0d5b9cafea", "comment": "Malware payload (Formbook)", "value": "444be9cb116433157d82b0fd5880014e73d1d4e3181b2e199a4decb63089023e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240903, "uuid": "6416bac2-49e8-41d6-867e-05c2ce64b8f9", "comment": "Malware payload (Formbook)", "value": "fb0d68a6a450948b3978618e569632d97b40c552", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240903, "uuid": "74e41b73-ab46-49f0-843d-7cf95a7da0f2", "comment": "Malware payload (Formbook)", "value": "c5d35d5ccbc1183bbe2c626962faa63cf1b9a95427b3b1eea789ff7a0b2c0fba17b8d6f9fc7b1636ccc0a6aed44d7931", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240903, "uuid": "d7b9c12e-6ca4-4cac-b58f-cd7f1560119b", "value": "T10193F14BF3786CA7F2B3363C5D84629A53A9EE0749A470F23908BB44403CCE4655B64F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240903, "uuid": "1306d3c2-3597-4428-886a-6f007619c635", "value": "1536:xuKz+mp66TbY5/gCu4J0+CmqwOplKjSKWxTDzmO7UDVJRUSBsilXoH4rkxvr:xuK6eRY2Cu4JfqwdjWDqOaJRU0Fl40s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240903, "uuid": "eda3f494-25af-45b6-bfcb-67ceff23b91d", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240903, "uuid": "6027f9f0-aa17-4b42-acde-ca7a79a54bd8", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240903, "uuid": "89ef9418-911e-4c53-9e82-68e626823ad9", "value": "PO DI03526.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25a6c517-c7a3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651226406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226406, "uuid": "d1a7719a-455f-4409-80f1-79a14eed001e", "comment": "Malware payload (Mirai)", "value": "cee76d5567b8cf62fddd0f7b8fe9a1d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226406, "uuid": "61cc3536-ee29-4270-a22a-44024b139dd0", "comment": "Malware payload (Mirai)", "value": "44ccf904bd9bb44cebc7a3e43003e19966c76da4fa4d13e358a82f84eabdddea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226406, "uuid": "e0b8eed6-7fda-4fa4-b0df-3e00f2808133", "comment": "Malware payload (Mirai)", "value": "7e50a90a97e76572eacc3d65ba18df4824552e1b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226406, "uuid": "98d0a4b6-454b-4db8-b599-02eced6abd90", "comment": "Malware payload (Mirai)", "value": "33f6dc57183307611f55e44af64695645398cb3655111018ddcc5d9f88a2439bff95f523bc844e13961915d0be41154e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226406, "uuid": "fd76fad8-0d7a-4be9-8613-92c346109305", "value": "T15A23F171E31EE0D3C227D8B6CC7F4780A92E1C5AE1EBB41A44DB7558639188F1B68297", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226406, "uuid": "da359fc9-c8f0-415b-bc29-f697a98b9292", "value": "768:65lpPa7beMGLDtWFuCLImiVKb0rmekqlE2MvMd9q3UELuyTQPvfaYvCinHpM:6JPa7bQ8BWr9+2MkwLNQPvDvCiJM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651226406, "uuid": "7b2bf80e-a309-4899-afbb-0ac743807751", "value": 49000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651226406, "uuid": "4522fbf8-482a-4c92-ad02-dcba8de26062", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226406, "uuid": "a20280ac-3463-4502-9d3d-a560872d4a35", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcae001a-c816-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651276052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276052, "uuid": "617a2a38-c07e-40cf-9b38-4eee8b8ac6b6", "comment": "Malware payload (Mirai)", "value": "c4b6464ece65eded1acd0f3f289aef41", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276052, "uuid": "965bd603-cdd2-468f-b3ab-1852861b2d92", "comment": "Malware payload (Mirai)", "value": "45b362949667a45323bee0af963a14a54e0fff2a700e7d88d8c839e9bd8c1675", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276052, "uuid": "61601310-bc35-4d94-b20b-6b6d55efaa5a", "comment": "Malware payload (Mirai)", "value": "2dab1e6e26824433b879a34c93f2d70ce5a2c6e1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276052, "uuid": "ea75db28-93f8-463b-bcaa-250984a83337", "comment": "Malware payload (Mirai)", "value": "b420cb0b6b3b103db642a213df755198b6d0f8162b6ef08462c7325cb71b53355e513113d47e8bc67e24900465b43c3c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276052, "uuid": "b6201566-b8c9-4b38-9520-03a5e950d00e", "value": "T1E1F2F150FB8C4AF2C1F429BE5CE0D285B3AA18FC2615287A4374171A52F0649F5FBCA3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276052, "uuid": "cff7ef65-8df2-4a55-9274-6e372af7e042", "value": "768:2QUUa5U+g9V3RJCAroYE8iENsLgElalff0B9VievU1ZsvT/i0RyB3UgI:2QUU86h8XkNsUsaAgevF7i0RT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651276052, "uuid": "fd27dd22-eb6e-4d24-b082-974f96bd91ef", "value": 36544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651276052, "uuid": "1942fd70-4230-4958-a7df-d18182c8def6", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276052, "uuid": "42233d78-7109-400d-bd33-16b3900f7c25", "value": "c4b6464ece65eded1acd0f3f289aef41", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c2f33d9-c79a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651222579, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222579, "uuid": "c0f57d32-6281-46d3-9318-afbce3a47c50", "comment": "Malware payload (AgentTesla)", "value": "9cd3fb722ba429cb981f669c47b51a46", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222579, "uuid": "fb207e66-06a3-4da5-b554-9e2096de7643", "comment": "Malware payload (AgentTesla)", "value": "45d0d4782445316fcdede97d345190bdea59d3e4d3587ca07d3500f74087ee71", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222579, "uuid": "d16ffe82-2812-47f2-84cf-62f6d243e8ea", "comment": "Malware payload (AgentTesla)", "value": "ec51fd3734ab313fc834c624909c40df56c122da", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222579, "uuid": "5fe1e073-a475-4f47-9711-f8f3035c6e06", "comment": "Malware payload (AgentTesla)", "value": "0a553eae6796f23f88c33c29de57ea6d37d534229904fa6674e4e5e48143b1ec72ef02ad34000903a5ae2696adebd0d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222579, "uuid": "9bd214c7-9a1e-4373-b0a9-b0390bef853e", "value": "T106C40118F7AECE0AC1AC0B77D5D7184403B18E45D113EB9F3BE9928959233AF4D96782", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222579, "uuid": "af772947-b26e-43ff-b850-aa3fff8db007", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222579, "uuid": "e09cd4be-4654-44d4-a545-ec9526bae6ac", "value": "12288:hwR4qn+ovxDfJk0vF+SxtF4Q/fmAq1YB9Qeu:SR5tk0vF+6F4UujuP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651222579, "uuid": "44d52587-e7bd-4124-baf2-0aab15c91e26", "value": 583168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651222579, "uuid": "d24eb487-77b7-4804-8d16-47c33235218f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222579, "uuid": "9484d8f8-8785-4456-abf1-d1ff6f53682d", "value": "4cgZYpqAoEaTxvo.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9578f00c-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651232607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232607, "uuid": "d1d40209-cd24-4955-bf3e-41b455ac871b", "comment": "Malware payload (Mirai)", "value": "1dc83623cf2bd7e149cc40122b653b0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232607, "uuid": "100f5b9b-916e-462b-9295-9e9abf89d247", "comment": "Malware payload (Mirai)", "value": "469cee2aa5fccaf051b0454907a0b6239ceed3368d08c3a5511d5d16d290d86d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232607, "uuid": "9d8a6c64-ef8e-4c21-a4f8-592f9a0d3237", "comment": "Malware payload (Mirai)", "value": "754c2cf7803c20045b98b3d268f40d8263a9b6a9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232607, "uuid": "8595edbd-8290-482c-b72f-f47c6db89016", "comment": "Malware payload (Mirai)", "value": "1ee30c7c7df2f07183fb1887f0b6e1d8da4a1f804c613eaca090918f8c89fe9a0343e813e43453efb644b48a5583f799", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232607, "uuid": "607cc0d7-e378-4b63-b273-5784d1e73ed6", "value": "T1E5C2E08DAAEC785BCE6E1C7A81DE5608898EE08136C707BD2FA54CCDE339113350C42C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232607, "uuid": "022edc7f-0245-41fb-a93b-18deecf0b4e4", "value": "384:SW+ETVLoV9mcN+pCgDjNl06viaEG2yd89s0rZkE3pylsHpW4son7EtxsSiyvRWGn:SmJLomcAGaEX/9sIp4dVonUx7Wy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232607, "uuid": "69f989a1-8532-4b59-af66-cb1cc1a24c9a", "value": 27180, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232607, "uuid": "8030f44e-dfce-48d6-85c1-49983ef114cc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232607, "uuid": "5ac37338-9450-4705-973f-306821699466", "value": "1dc83623cf2bd7e149cc40122b653b0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba03e62a-c796-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651221072, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651221072, "uuid": "9dfafb17-d772-4ea7-a6f9-44b448893581", "comment": "Malware payload (RedLineStealer)", "value": "374672b33e3ac296e3d970cf94618480", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651221072, "uuid": "407c2792-752f-468a-a37d-e3580b689646", "comment": "Malware payload (RedLineStealer)", "value": "4702b521f1ead3366fb531d2d375520287a1e3aabe68850f53d2d6c45e987c93", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651221072, "uuid": "695ecab4-83da-4af6-8cd1-a5bd51bfdb2f", "comment": "Malware payload (RedLineStealer)", "value": "3930081628c3aa8c60285c393071bfa66fb637e6", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651221072, "uuid": "4ece8b67-4ca9-41c2-bbf8-8c47a1f0eade", "comment": "Malware payload (RedLineStealer)", "value": "f1c793acd41d16d17f34c2083748fdd499986fb3674ca27dd769c7bd56b5e846db2cfbc14a6479537e84af8fa7be1ed5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651221072, "uuid": "36966c3c-4930-4e1c-8dff-5acea7c40dab", "value": "T11684CF40BBA0D03DE1B316F4B979C2B8753ABDA19B2051CB62D62AEE56346D4DCB0707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651221072, "uuid": "a7216051-a57f-4007-a7d2-a5b2d5c82eea", "value": "afc01618e0df309805fa06d056c565e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651221072, "uuid": "63e14e9a-8279-43ff-a6f0-fc7e6695e872", "value": "6144:yrc0tklfrftCbBmLbWVrdY9QOt1avYeelkkJ2bCTX/miTSbU/1:yrncfrVwQLbWVGPt1wYGkJ2bCDuiB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651221072, "uuid": "ca948098-c31c-44c7-b0f0-693f9c037543", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651221072, "uuid": "6ee5cbbf-cc9c-4aaf-9e32-391ea8b66383", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651221072, "uuid": "5741caf1-3f8c-432d-a687-980808cdf199", "value": "374672b33e3ac296e3d970cf94618480.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "867076db-c770-11ec-8e58-42010a9c0032", "comment": "Malware payload (Triusor)", "timestamp": 1651204664, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204664, "uuid": "4e9e276a-b4c7-4337-8fe3-d77c7c511535", "comment": "Malware payload (Triusor)", "value": "dc24540bd3ab33eda3437d86df50855f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204664, "uuid": "833e9fb7-cdd6-4246-bc23-ceb50467ad91", "comment": "Malware payload (Triusor)", "value": "47b2c7fe0ea017b8ac11f7abfec208cf792b23d5123c4d85429f52c5b482586e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204664, "uuid": "fa45e3da-2719-4f1e-8ffb-29d0003f4bd3", "comment": "Malware payload (Triusor)", "value": "12c39363162bb7a01a48b0b3fedb536dd96a64da", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204664, "uuid": "f339c794-b44c-46a1-afcc-2f9a97e9d201", "comment": "Malware payload (Triusor)", "value": "bdb79066a578ab960560bf9579f7c118d2f89b83f7f02a8e477031606f1f0b1b2603a1e6bf37b1ad8f6f28c8178af2e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204664, "uuid": "54160f88-2919-400f-9042-d49cdc7d5a53", "value": "T10C939E2B7DD109A3DCB2067110DA5B2ED77BFC20032691A7970F6FE61B215D19A362CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204664, "uuid": "46217e6c-22d3-41db-806c-8f1439e8185e", "value": "12a30b523ac71a3cbe9145c89400dd7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204664, "uuid": "1175d257-a832-4d5f-9497-1a153ce8d481", "value": "1536:/JvJnBpwdaMIOOnToIfiV6pdQ4jcgZDpoSQI:/JvxKaCqTBfioohgZNoSQI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651204664, "uuid": "079a7cf9-67e2-4126-b065-69ad33f55a4e", "value": 94208, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651204664, "uuid": "ed570571-2255-4b9e-b783-6629faef347c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204664, "uuid": "7e308cbd-f0af-4374-b284-1707f47ad7a2", "value": "rage.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35f304ca-c7cf-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651245331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651245331, "uuid": "2f58b9cc-cdd5-45e4-954d-2ee0ece5528b", "comment": "Malware payload (AgentTesla)", "value": "b35927d5d248a0c044a2537c6bcd1acf", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651245331, "uuid": "dcc09205-bb45-43c1-b0f8-bb8177bb62bf", "comment": "Malware payload (AgentTesla)", "value": "47b640456d966af214cf3c3d4a8d5794171149a9271487ca2895eb75b7e2098d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651245331, "uuid": "2dc64cd2-9950-474f-8156-159af0b3fc74", "comment": "Malware payload (AgentTesla)", "value": "53dd0d508f987fb6075383dcaf21509fd002d05d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651245331, "uuid": "ac6cf5b8-a383-45d2-9cad-5115c61751ba", "comment": "Malware payload (AgentTesla)", "value": "bf28e0e71362d90944f3ba79d027054d57b7c6b0be528d6a5b997e07736b101feaea3b76c6fd7d793c87a560cea2cb7e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651245331, "uuid": "4bd3e84b-d319-49d8-9ed8-d4d53709cdbf", "value": "T1B78423333A17504EFB3B9195F15102A0D67EE1EEC60F76C8520EA7B65AFB6B123045CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651245331, "uuid": "5f60eef3-aa0a-4b1f-93ab-6671f6703f22", "value": "12288:2FF6W78Ba0TJ0cZrWVhwNHmaf/Fv1JUpJ:2FF6W7ZiJFRehwjp1Ji", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651245331, "uuid": "3d77f1cb-5765-4843-a094-0842f0eb0f57", "value": 402573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651245331, "uuid": "589277e3-77b5-43d4-87a3-6782abe303f6", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651245331, "uuid": "a579568d-257f-4b0d-a249-e4338bb0b13c", "value": "updated statement.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e67a2c-c802-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267529, "uuid": "07d65c29-3265-4b94-8157-a786831e4ccf", "comment": "Malware payload (Mirai)", "value": "5c0441d8871e07214de0338277cd13c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267529, "uuid": "b81e2403-1e54-4716-8605-e184f97de417", "comment": "Malware payload (Mirai)", "value": "480476815aba636fabb12c7a5d8f5a234ddb263b8a118c5ae6f1b8a2cb9699b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267529, "uuid": "cdf37239-742c-41d5-877c-4991ce7f17c7", "comment": "Malware payload (Mirai)", "value": "b7b873c9af7ad5db43f89735acc6057924c0e345", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267529, "uuid": "7a8deedc-aeca-4b94-9fc1-ec1a56c9b2d6", "comment": "Malware payload (Mirai)", "value": "d797d10685a446766722d466d11743dd824a5012479be3d87a6927980dbfb14a5df1d17455c168726dabb977a3521a1c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267529, "uuid": "a553719f-69de-4798-ae97-dce6221d2393", "value": "T12CC2C17DE8A4BD46C9ED08388CDD13B4089D36C6B68E4F6DD2161DC4BF6118B3C9A464", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267529, "uuid": "e5f85384-b784-462e-a2dc-d7039c932b25", "value": "384:3KWUv+78AdGa2nS3xbjJUFbviosPlozhfbIAawprR9gICSk3kImQ0KnEzrEcftwY:l7ddenS3j6Koolozxfk5JmsEzrtt6HWV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267529, "uuid": "41151f8d-74ad-4540-9aa6-f7350a7114a5", "value": 27260, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267529, "uuid": "42aa84b2-3fed-4974-9fce-14cce8b4738d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267529, "uuid": "f3154f63-1289-4e06-9a89-297e19febf60", "value": "5c0441d8871e07214de0338277cd13c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dfcc7b70-c802-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267521, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267521, "uuid": "9e0bc66e-5f01-41c7-b4ae-4714080f30e0", "comment": "Malware payload (Mirai)", "value": "0b92c5334f6896e4da188a8d215374c3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267521, "uuid": "a11d282d-e4c7-4541-8443-7265abc4d99a", "comment": "Malware payload (Mirai)", "value": "484950073f6f8e521bb1ed7f9994f3eba6e91c5c837d8d0ef92da0007c6f69b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267521, "uuid": "61b23e66-e29b-4c80-bc0b-ccd32d250d54", "comment": "Malware payload (Mirai)", "value": "9f46bfa9437ac37caf54f30d853b9bd13aa4276f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267521, "uuid": "00899dec-dba8-41f5-877c-09113372d837", "comment": "Malware payload (Mirai)", "value": "2b4fd68c9a0400ba99b9e937d253c577197899fcdc73956dc2457d0a4262a30c82122af2dcd9e1d42f4402f2169611b0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267521, "uuid": "05caf228-69ef-4a16-a8b2-2487ceae3a75", "value": "T1C4D2D0241E280AC6D938F97D67D5A3683D6C26D6F2428D1A9409AEC3CF5E9BC1E037D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267521, "uuid": "96f72ced-807a-4e2e-bd49-3b5ebdd86f7a", "value": "768:q7W9lR3h4CibL1/yGgFVSYF41nDn3bu7JJgGlzDpbuR1J8:a0r1KJBnDnsVJu2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267521, "uuid": "c1caccb0-ad1f-40c4-9d1c-b2ff76d619b5", "value": 28924, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267521, "uuid": "c70a52d0-34fe-4539-b02b-b300325da825", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267521, "uuid": "8fdcbc61-7e13-4ad3-8d3b-3e700efe0b3f", "value": "0b92c5334f6896e4da188a8d215374c3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "403437fb-c7ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1651230316, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230316, "uuid": "dac2293d-3d4f-4e5b-9b43-edfb3261f626", "comment": "Malware payload (SilentBuilder)", "value": "20bd9bb05f5f4ee63e615c8c0ec47708", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230316, "uuid": "76c8b1d6-f920-4cd7-a449-87bc4b4310d5", "comment": "Malware payload (SilentBuilder)", "value": "492c76ffd310044aca669706931b948254c24149fd1864c564835b11a4e45266", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230316, "uuid": "ff97d670-fa90-44bf-846d-6e027407d12c", "comment": "Malware payload (SilentBuilder)", "value": "1b1910c4b53b4036ff579e5ce04c6f5296c592e1", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230316, "uuid": "a79624d9-8124-4d86-a2cb-ef0ed013ab4a", "comment": "Malware payload (SilentBuilder)", "value": "1deae4ab3684c6e4dc7dec0a86c3b7751d35723cf1b9b88180517eca5e3cc1a5308ba173fe88d008bf4aa495ca5009c3", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230316, "uuid": "ab263442-34b2-4420-bf08-7a336a413ada", "value": "T1D5633B47B589B46AE916CB3D4C974F95B613EC104B960B83BB09B3597FBE9B04E0310B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230316, "uuid": "ad7e7d5c-9c88-498b-a16f-1849e92cfd07", "value": "1536:5+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgZYW/ESKQHS1yXJFaGqEkc:kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230316, "uuid": "b1fb4e57-485f-4eff-a4fb-ae80e05a0304", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230316, "uuid": "9deaf24e-5bcd-4276-bbe4-ca6b2785fc37", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230316, "uuid": "6923470e-bfc7-453e-a8c6-ee2f002d823b", "value": "ClimaxoilfieldXSwift_29_04_2022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b19ae1-c7a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651229205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229205, "uuid": "3a1621eb-6b5a-477a-85f7-be33a9085b6b", "comment": "Malware payload (AgentTesla)", "value": "f29af9a19afc8c596d07928351c7abc2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229205, "uuid": "eac12ad9-6bbe-467c-a286-5f92a87aabe3", "comment": "Malware payload (AgentTesla)", "value": "49bd3c488691020ff227ec1fd3e2c29b346726d6678d5a02f72004cb43e1e42e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229205, "uuid": "3503b108-e802-45f9-ad55-68c9114c795a", "comment": "Malware payload (AgentTesla)", "value": "e208a3cb545d4583cd458c90f2f54a1dc230b134", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229205, "uuid": "833f0998-5b94-4943-99eb-1d4a0c041a8b", "comment": "Malware payload (AgentTesla)", "value": "3e4f3a46097bb3c4dc70d90fc34d71a1c4996f73e7831229e4e0104d93336bb6fa531b4ce5b337810a6fbf75cf47e9f6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229205, "uuid": "fe8df544-89ac-4dea-aa6c-61f63c11e8d5", "value": "T156942308BCB14D6811C4D11BAB3EA66EE9C8A381F3C4C19E1261635F979F97B83E13D4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229205, "uuid": "6b5a184c-f2c9-4e95-9107-2c8cdbf7006f", "value": "12288:Kobfy0XaPGUpeZLZgEV6pL1fXgx8esB0bH:KozVaTWLm2TsB0bH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651229205, "uuid": "d224348e-6e51-4edc-a33b-5dce38622b4f", "value": 426439, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651229205, "uuid": "6b663873-c24e-4c7f-acc5-3ebc0a6d52ab", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229205, "uuid": "91be05ff-d7cb-4ec0-9c7c-aaed1cd56344", "value": "SWIFT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f70c4a3-c7f3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651260890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651260890, "uuid": "42238187-5578-4342-a7e0-9f76e723be2e", "comment": "Malware payload (Mirai)", "value": "97fa94e2b7720418d591d889ab8a876b", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651260890, "uuid": "4f1e7e99-778e-4f30-b08a-9660782bbc10", "comment": "Malware payload (Mirai)", "value": "49d8d5047676d5ba521a54b49ec410e4ab92708eeeccefd8d8b21db5b8843e7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651260890, "uuid": "8cc57d4a-e1b8-4061-8ba1-3674e82f3160", "comment": "Malware payload (Mirai)", "value": "67b20590192b13080b91c8b0b5f8de36295f97cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651260890, "uuid": "f7c1df56-dc00-4638-9cbc-192107f6944c", "comment": "Malware payload (Mirai)", "value": "8aaf4f65d1db32e9671914ec78b1d7d1cd1ec7ddc1fa47c36b0e6979b25b35603c3f50229c7d8ae2503d632ba43b12e2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651260890, "uuid": "e0313ad0-a4e0-4482-9a7b-5c2d522072b2", "value": "T1D1431925AD792E26C0D8B57E11F78724F2E2620E25B8C65E3C721E4EEF04740A5537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651260890, "uuid": "2871cfe4-a975-4e6b-8949-3652d644b58a", "value": "768:eLobAxU6q9Hfymp0xginuYvCkLB6WsTwIC1DQdszoDaS0O+DCDc:eL0AxvSHfymp0xgunvCkV6vTMDauX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651260890, "uuid": "1ea74d8c-397e-422d-8fd3-328cdd8b4a87", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651260890, "uuid": "76850474-5c73-4048-9d79-9cb2d78e2090", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651260890, "uuid": "84faf923-b365-44ab-9c8d-147151ad57eb", "value": "97fa94e2b7720418d591d889ab8a876b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ce7355fc-c816-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651276082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276082, "uuid": "88e6f381-914a-488e-b3dd-87f997219865", "comment": "Malware payload (Mirai)", "value": "e6aaeba4d411ee232574fd8597cfd1a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276082, "uuid": "94360c36-5ee3-460f-8464-d224fbc591f5", "comment": "Malware payload (Mirai)", "value": "49e02cb03b69037eb8b1e0f332c4162f72fe9ae3d31085c9ebde432300902e7e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276082, "uuid": "ceb418c1-fc03-4a4d-804c-165916508fb2", "comment": "Malware payload (Mirai)", "value": "24f145b9af1df5a6d151ef3eabc1480715a627d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276082, "uuid": "360445b8-bce5-4250-ab9e-bdeef5afc5e3", "comment": "Malware payload (Mirai)", "value": "ba39bde5d8b0c0d30fce06af0424f665f8ce61422ef9d1acc764f7d31143a8e3e301c972eae5b15608c622f0f5fb71e0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276082, "uuid": "1fb0da98-71c7-445f-9626-97baeaccd1b2", "value": "T19693BFB1D468ADE0C26C0239A5E789381723F50564270DF16A59CBAB584BEFCF50E3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276082, "uuid": "ca262e16-38f5-4128-99ab-d20e3b0707bf", "value": "1536:B/MJ9b0tMaswtFtT2NaY90NxciE08OF7xaFaEV08IvmQFcOupGyCC2C:B0Jh8MHitT2p90N2iI1IECLmscOupGyC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651276082, "uuid": "5e455f02-0bdd-4265-babb-2660a543e103", "value": 91188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651276082, "uuid": "0e5e19e9-8fc7-409f-9f0c-864cd67a8cc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276082, "uuid": "a2c63a04-d172-4f4a-b152-976771348be5", "value": "e6aaeba4d411ee232574fd8597cfd1a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8aa1ee9-c7bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651238786, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238786, "uuid": "9aa6ddc5-14bd-47a4-a589-722a0858e2ba", "comment": "Malware payload (Mirai)", "value": "d72b22b2e37ac54c77d72f5e97d517ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238786, "uuid": "fdd1c860-ccc4-470d-a38d-0ed0148d80e3", "comment": "Malware payload (Mirai)", "value": "4a6861f8cab808fdb2e99daa8b3bd071d2775da943765886763f76d13987f51c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238786, "uuid": "ca3a9e36-c3d9-49d3-b595-5014063764eb", "comment": "Malware payload (Mirai)", "value": "8931b0b342beb4aa320ebac44d9c42a6600bbe9a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238786, "uuid": "52b6affa-b2cc-4a48-923a-0717651ce942", "comment": "Malware payload (Mirai)", "value": "8f62b6e6a3355dc60ffb46943342a53cb88571d8169c78a3bf98d4714806fc599d303c95418b8d6052ed2fa62639c1a3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238786, "uuid": "160c2fa8-5f1b-482e-8756-e4c39d4dac45", "value": "T1F3B2D060AE611C70C7741A3AF62A948939D707B8A6B931762AB54728FBC740B49B03C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238786, "uuid": "3f7f3177-ee71-4cdf-a313-09a943e9d0ce", "value": "384:rlKfFJz9lWUcx5yu4nl95FlGrgx5p9rJgm/K3a6WgM/hymdGUop5hKg8K:rY7GQuQjFG299gmXs3UozYg8K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238786, "uuid": "88a6826c-8e25-415f-a665-5e312a342607", "value": 23788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238786, "uuid": "69a732b4-ded5-4d6e-ba17-94911551fbbf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238786, "uuid": "df48bebe-0bcd-4f74-90b3-196378fd15fa", "value": "d72b22b2e37ac54c77d72f5e97d517ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77209a7e-c782-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651212369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212369, "uuid": "5e3e253f-8294-42b7-b0ca-46ae75ba92fe", "comment": "Malware payload (Mirai)", "value": "e5c23d3af05ccb2cf7a4690a128df54e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212369, "uuid": "65733e1f-0392-4fb8-86a7-97008cfca8fa", "comment": "Malware payload (Mirai)", "value": "4a8c6394b51e4245b49c229d5e1fe07c9c82ebe9454bf22fdb5be8906e9edfff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212369, "uuid": "30683fc2-5c8d-4744-81e4-d3677ebb65d4", "comment": "Malware payload (Mirai)", "value": "a2415d1c4918d358b41351307134c5dd79b9efb4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212369, "uuid": "1750af3c-7b33-4cef-aa18-bc0f54aac143", "comment": "Malware payload (Mirai)", "value": "9cbb4e89a98fc4a2c0d607c20e608adda3d8d62ce35c8ca8e14da444a5aecabbd16c76f70319bb7713b2c4d3a0579fc0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212369, "uuid": "d67fa598-4207-428c-9a85-4a6f76557247", "value": "T165332B42B22C094FF9E65AB0343F1FE093AFE95024E0B685A54EEB458536F771486F8D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212369, "uuid": "ec9280a9-dc91-48c3-b269-7ed84d7a2977", "value": "768:SjZpE98U613gtWfL33RiMuIwPf/0GwSvFEwWM7zjr7aVUjdNNX8GGQ:Y8iU613gtWDHE2eWwWM/TpHXv5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651212369, "uuid": "b8c16961-2a49-4532-bb40-c632c79ff60e", "value": 52724, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651212369, "uuid": "16882ee8-2dc7-467c-b595-754d940d327f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212369, "uuid": "bcc73d2a-25fc-47e1-8e95-597ec16661de", "value": "e5c23d3af05ccb2cf7a4690a128df54e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43082d89-c7a8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651228603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228603, "uuid": "951df814-b4ff-4b69-adfd-de4cd6840b8e", "comment": "Malware payload (AgentTesla)", "value": "dda6a90ff559822ef0d3dadbfd2ff707", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228603, "uuid": "09b09c45-6ff0-4898-8814-c0653c408c82", "comment": "Malware payload (AgentTesla)", "value": "4bb77389193dcb659a85c5bf3711443f9ad4493262e02943444d19a3394e60b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228603, "uuid": "bd2f85f6-3c18-42b1-addb-83e55cd8d22d", "comment": "Malware payload (AgentTesla)", "value": "a3862e9585b0774b74fee56438415ba0edd226f7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228603, "uuid": "f5199279-9ca2-419c-bc11-032d4af295be", "comment": "Malware payload (AgentTesla)", "value": "114c4605dc7aa5d5a1d726dcc3e5390b56dc871e6ede5edcf27b62fa05315e779999d0deb8f90e357bf85077da26fcae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228603, "uuid": "88f01aad-4ff1-42c5-ba61-15a6392389a2", "value": "T17494235B386C3F51FBB85B04C5A9810BAA37F38E553825C7E2EC08E80512D2FAA57D75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228603, "uuid": "b017a102-8ddb-45b1-96ee-aeaee899748c", "value": "12288:gGDulkbUhy0R3B3ZIfVOTHBK+eiObmmVLSNRZFzA3vdpi:gSu6Gy0+wBNeiOam1SXA3vni", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651228603, "uuid": "6950d8b2-9e19-4de6-b329-03b27fce6a57", "value": 428389, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651228603, "uuid": "85ffc184-5318-43ea-a4e1-cf2600185a8f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228603, "uuid": "e404f533-3c54-41a5-b057-acf1e73a2378", "value": "PO-120220052.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37a425b-c785-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651213813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213813, "uuid": "64077df9-4520-4e09-be8d-4d4407a0c27e", "comment": "Malware payload", "value": "94a6462ba19ea26fe5c070b53bceeedf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213813, "uuid": "f797fdd7-37fb-4ac6-99af-fcae0ab7c570", "comment": "Malware payload", "value": "4bbf54f3fff6e970356086e462e4c9bfe9784bcc26f183c74881250f5354ce3c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213813, "uuid": "08da2a2a-625d-458f-9ed0-6fe908c1cab6", "comment": "Malware payload", "value": "b66a23ee5d333ab6b1aa69c8e46add29b3ad1f1f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213813, "uuid": "479a7da4-0784-4d8c-80b1-6f53eb8b8048", "comment": "Malware payload", "value": "8373dd68c8c6daccb9fbeb4b969570f2f45b305f2842e74d95c31e6fd5c8200a5b6dff5e7b6ea7080dfc1c5f917c5307", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213813, "uuid": "dfebe791-ce36-45f1-9dae-2238093da913", "value": "T10B24D9B4684F0872C309DC1E25A47645AE79FEE374C1557223AFE434CF9AAF29EC4541", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213813, "uuid": "c5a79635-6713-4699-afa9-7088c6ff8b60", "value": "1536:isDDA2dfyFHZbv7A6rbN5I/1oK33sLloGdzFz76mAg5eeVhMDw5wfL7:ixTb8WiGdzFtr5RDAw5wfX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651213813, "uuid": "305025fc-a331-4386-b7cd-0b3bc6188b96", "value": 222834, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651213813, "uuid": "f23c2f99-bd4c-4c8d-b3ee-c7a4f3c6f11b", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213813, "uuid": "1b3b4370-b218-4d44-b6f4-6c1b2c0832fd", "value": "PO65928.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6cea6e9b-c7a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651225237, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225237, "uuid": "d0ca1d15-28b9-44a9-adcf-ed8488efae70", "comment": "Malware payload (Loki)", "value": "ad4496ae22184db87ffe02c7eb435458", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225237, "uuid": "70cc3583-67a6-4159-b5d7-a2c3dea12c04", "comment": "Malware payload (Loki)", "value": "4c4dfdbf6ce033bba719e0bc922c364ccd1997d5fce329084e16164416867fa2", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225237, "uuid": "7970d3d3-f910-4e11-9f0b-4d3bc5b9a85b", "comment": "Malware payload (Loki)", "value": "70553f692cc63a68d6e8ae536fb08fa2db4e157b", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225237, "uuid": "a6cf4d75-097f-4752-a878-2b75116ed7da", "comment": "Malware payload (Loki)", "value": "52d40f63758f09a2855361bd72fc214f1df867042ead7c9b87f1fea5f074e627784cefaf236de485b21f10b03fc5bfbe", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225237, "uuid": "2ec511cc-8b22-4736-a476-1a257e55efce", "value": "T1F1942338777C53530FA1E448A0613E95E5B3E9DCBB367126CE20623376855B9283B738", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225237, "uuid": "891cfafe-a2d5-4f6e-8568-564ab885a429", "value": "12288:5ti88CSj0WEdHEnEisK/ga2vy5Ot/44+jElfyz:5tLf20WEdHrVG2G/5Elfyz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651225237, "uuid": "556819b8-7fe6-4f9d-baae-17d52ca35c2e", "value": 444672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651225237, "uuid": "13c54000-2c29-449a-888b-c07d0c19238f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225237, "uuid": "4adbdead-06c1-4ab6-99c5-502f8a1f012d", "value": "Purchase Inquiry_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "133f684f-c783-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651212631, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212631, "uuid": "bac8345e-9714-4618-9107-1f83c7d0d58b", "comment": "Malware payload (AgentTesla)", "value": "1dd6a25cde677c427823bdbc9f63e365", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212631, "uuid": "9a95bfa8-7dd0-4262-8085-931662c4a4c9", "comment": "Malware payload (AgentTesla)", "value": "4c9bf38ca90e14651d2498e021d4dec5a9987ef64cd05006e5af6f0ceda0cdbe", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212631, "uuid": "bbac00fb-9c4f-411f-9a97-47d879d715c5", "comment": "Malware payload (AgentTesla)", "value": "a2b9e3899e8108f7be8e4568d0dfda0de5fdbd02", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212631, "uuid": "6dcce0e2-e71e-44cc-93c8-9b7f2013b167", "comment": "Malware payload (AgentTesla)", "value": "8cf16d49a9b8021f343bd5f91dd97c0f55da8e5785ecfabdc4a8e7e9aee01202bde7431ddc9ab15367afe1a8b718deb8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212631, "uuid": "48b5e829-20f8-4146-9422-38dadae8d090", "value": "T19B942306AB8D7D8EB35AD88D167FDB223F2049CA68A4CC15A7AA3B42FD5541341CF317", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212631, "uuid": "2feb74a7-0dc9-4261-a20e-0b3035ac4814", "value": "12288:j7J3BhPxEzvXXLqpl5400SQcUfg9aYvtih7pHTYQBk5i:xHPaz/XLqpl5bQcUfg9J1ihRz2i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651212631, "uuid": "2a1f5ef2-adf1-4c51-ba70-a3af424fab9d", "value": 443264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651212631, "uuid": "c465dcf4-a2c8-4e5a-8d1e-4db892d41f49", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212631, "uuid": "0524e859-b750-4461-bb3a-d703cb311f55", "value": "SHIPPING ADVICE#SHELLSEA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f726ff80-c7df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651252527, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252527, "uuid": "fc781486-cf66-4a6c-bb28-c13083dce092", "comment": "Malware payload (Heodo)", "value": "43573833ff740266b5c32a56cbc82796", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252527, "uuid": "113428d1-b0a3-4234-8de0-66c6d9ced968", "comment": "Malware payload (Heodo)", "value": "4d4b476528bc1c635081ea56680df609c946b3863c0289503e4f3266a0076f84", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252527, "uuid": "e28f6975-718d-4ff7-8709-67b1132aa248", "comment": "Malware payload (Heodo)", "value": "5f9a53062191ca92d8c2b7275844794a00454817", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252527, "uuid": "3c68f8be-6696-4efd-9148-8ffd1c24edd8", "comment": "Malware payload (Heodo)", "value": "bf833314b3997a761ec5808c75a84becf6af2b1e0ab1f93479e9bf58845ff08c1e0d19298e06643fafe195f3df5732f2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252527, "uuid": "79e6fcc1-e864-4aaf-aba1-4b5839263097", "value": "T161C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252527, "uuid": "b8bf3d7a-9c01-4fe0-bd64-deb68bd9b0dd", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252527, "uuid": "0d734c5d-e7ae-41a0-8930-bfab3c6aaf6f", "value": "6144:JhZ02GdOOgPYSKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfNKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651252527, "uuid": "0a2c0432-44c4-448b-af94-660be2514954", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651252527, "uuid": "d40cfd4b-a77d-4766-8e4c-45f31f030ace", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252527, "uuid": "48fd74ad-5954-4f78-a071-d93b96c755c3", "value": "43573833ff740266b5c32a56cbc82796", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2000f435-c7c1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651239282, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239282, "uuid": "6b794bb9-6fde-407b-91db-0c45f715d5cf", "comment": "Malware payload (Heodo)", "value": "ea2f0ca557b05d8556cde9f6743d4007", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239282, "uuid": "1a212e68-2b62-4ecd-93e6-292063bb70e5", "comment": "Malware payload (Heodo)", "value": "4d8fe5c15c5e1618bd104c53208b0df36a4cfcddde71f9b03b9f85004be7409b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239282, "uuid": "52a786e8-6983-4400-8ca9-e4077c0cd844", "comment": "Malware payload (Heodo)", "value": "c6fe1cf52c7f3299f07a1e1c05e19e2013330e4c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239282, "uuid": "271d21e6-dc6a-4081-92b8-7f12e2de178b", "comment": "Malware payload (Heodo)", "value": "f882919d6872bd046204ea21bff7380aef50b773ef9db3f9faf6f351043f8f19205a03c9502c77fc6fa4465bacc9442e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239282, "uuid": "a1f03bfc-cd02-4b93-9e01-f2c5bd0ba9b7", "value": "T16ED49D11F6AC80B5E07BD13DC9A3875AE6713C9847B943C79255EB2A2E736E05D3E320", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239282, "uuid": "9f64227d-5256-417a-b978-c5f15617c410", "value": "6ba79cbed2acbe9b8ecc8e14a572f100", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239282, "uuid": "97696be5-c7b8-43f3-8533-7a565143cc46", "value": "12288:C1FIcocJwMTHzXO7N2uBHiyzskF1CubVnmn:tco9MTHzXO7Nf/115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651239282, "uuid": "b902d323-5823-4e45-a980-623759395939", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651239282, "uuid": "2db897c0-e149-4eed-998b-b2393f66b455", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239282, "uuid": "60f2ec53-ba68-43f7-aeeb-be7aea9fbc65", "value": "emotet_exe_e4_530c844b0404c92ccc260411c66e44480f430736d8186968df67713c4a765c9d_2022-04-29__133435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1f5f682-c816-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651276061, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276061, "uuid": "002e7d8a-3a7b-4bcf-991d-925895b26f03", "comment": "Malware payload (Mirai)", "value": "97c9528060f8d7075966744a3fda9e53", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276061, "uuid": "7cae3d81-2c3b-44f1-8f0c-f407271c5f51", "comment": "Malware payload (Mirai)", "value": "4e2366b06748b95d5afd7210b19ac9a514bb7517a9ebff32b2b0950d6f64e7b9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276061, "uuid": "4f441c4e-f625-41c1-9b2b-60d6be3f8d12", "comment": "Malware payload (Mirai)", "value": "f026c1030ee5ef82b013421dc844c3cb3d4e0fc2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276061, "uuid": "2dab949b-eb42-4433-b1aa-064fbeae6859", "comment": "Malware payload (Mirai)", "value": "dbadadc4093cf1f84bf648c9ddb685ad1ac2d0c6743224d5e928622f6b3460dc5349b73f6619ce966b3ee550ae9a9b49", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276061, "uuid": "48e8c6bc-0dab-4012-8f00-711df4dbb21d", "value": "T18F03E1A2A2A2DED5F1DCD07B391F75048C001B1ED21498DE97CE5126E452FBA3E8CDB2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276061, "uuid": "1114dafb-3b68-4a3e-a85b-9fd5283e8d98", "value": "768:6QqYDQrMpW8QcLtR17R/YN7raDAVIa45tzaE9tk2jjcmJlZFzGCgcnbcuyD7U0y3:VV9DQcBxYprPIam1joyF7nouy8Pq8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651276061, "uuid": "2f1def0e-5bb3-4d27-8123-6568b373ea15", "value": 38684, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651276061, "uuid": "6e6d78bd-0fa2-486d-b72c-981efd23cef5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276061, "uuid": "4348cf90-0798-4e58-963c-10ba4e4c77a8", "value": "97c9528060f8d7075966744a3fda9e53", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bdfda391-c7b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651235681, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235681, "uuid": "99b5f2e6-2462-43cf-9eab-18e0dca94079", "comment": "Malware payload (AveMariaRAT)", "value": "8ebb27236c0033a8f709f62a0e40f894", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235681, "uuid": "6d87b948-6000-4836-a8ce-6640dcd32429", "comment": "Malware payload (AveMariaRAT)", "value": "4ec3b97bf4710ed109c3109ee0badded97b078fbe246125c5611c0e05d226791", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235681, "uuid": "ad200102-a2b9-46f6-8b17-7ba0ac13359c", "comment": "Malware payload (AveMariaRAT)", "value": "91ab8aab13d8250859d005da639c81fb8c026878", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235681, "uuid": "1706baec-75c2-41ac-a0b0-dc60d9e3508d", "comment": "Malware payload (AveMariaRAT)", "value": "28a60685ec1f2305579e1f58178473f5c7114d070527a80b829bb06f836e6f5cc681b01153ba995a16ed254007d6e7ab", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235681, "uuid": "c65f21ac-5d96-43dc-84b6-72fb0412ff4a", "value": "T1EED32F8661044232D9640DFE846873C90E6BEE1707369595B43F7EA9BFB71808BF9347", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235681, "uuid": "3e63996f-e43c-47c9-b458-76d6b05742b8", "value": "384:G96S+6kDcC5WSagtJQQkdvffff5SI22rscNO8M9dLTceCjpIhppw:GK6HSIHTe9dLTdpw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651235681, "uuid": "3606ee33-b8e6-438c-84b4-16ac908e4120", "value": 131072, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651235681, "uuid": "fb41ff58-e3da-4cd2-800a-9d0610469547", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235681, "uuid": "285e750c-693e-41f0-8b43-33a933abb46e", "value": "RFQ PO NO. 4500038224.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34df6778-c765-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651199803, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651199803, "uuid": "373790a4-52c5-4f3f-9d16-a68024da1312", "comment": "Malware payload (AgentTesla)", "value": "0704ccf331e1e2fc7cf2511d6060a69d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651199803, "uuid": "ebff8f32-8b55-459a-a20f-200976f0bce8", "comment": "Malware payload (AgentTesla)", "value": "4ed1612427dd78fd270107fe98510b3d11c2a1b8a2b3b85d7890cce753ac244b", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651199803, "uuid": "ee60d202-3a2a-4bef-876d-71b6596a1421", "comment": "Malware payload (AgentTesla)", "value": "24205a28b0134bc6cb505c91ac4a4a1f5542a708", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651199803, "uuid": "f11b3d33-82d7-4e47-9ba4-dc1c897b6b7d", "comment": "Malware payload (AgentTesla)", "value": "ee831525c23321ecd828d2ba3b9a514fd7c4da5daf441a74f5436eb632ed84b8a48d1cc393bc3b56cd6529b9d6606088", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651199803, "uuid": "d988aba6-00d0-4f44-9df6-57b67a67057d", "value": "T1CDD25B41BA59D813C9164FB5C5CFC1104B751B83B1C0CDE77AAE62E96A427E3061AECF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651199803, "uuid": "f23c4969-aae6-46c7-ae6b-93c5b56d25ae", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651199803, "uuid": "2b966735-7c0a-4072-a1fc-92a17edc70a6", "value": "384:tk0sUxRKFM2Cw9ei2vRqkugRT2eDSaltavXAKEOQIiXOUVxOWPBfNC4I/AfLRKto:tk0stm2dei24knRT2eFlss1bBPial9hR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651199803, "uuid": "96d0a209-994e-4f7c-ac35-f25def4e9450", "value": 29232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651199803, "uuid": "569a44cb-e583-473c-961b-e691b4e1cfe9", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651199803, "uuid": "f8dfc07b-b478-4290-8719-43aba69333b7", "value": "SecuriteInfo.com.Trojan.PackedNET.1293.2721.14561", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "519fc6ea-c79f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651224762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224762, "uuid": "364874dd-c39e-4635-9ae9-8fcb8bb5c03e", "comment": "Malware payload (Formbook)", "value": "5b3bebfdb5f166ac040c34fab1bdba6e", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224762, "uuid": "fc53735f-389f-4f6e-bd43-bdb64b353c92", "comment": "Malware payload (Formbook)", "value": "4f99fa17f3e7cdc941a0f8b0d25948be0bfb38c209bc416ee0ad952ea0150f40", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224762, "uuid": "a1def423-f0e5-4438-9afc-33fa1c567bc7", "comment": "Malware payload (Formbook)", "value": "bee81151982659000ce56352ae043243ae8acc7b", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224762, "uuid": "590bee7a-2c5d-4500-8bf7-994ba996da5e", "comment": "Malware payload (Formbook)", "value": "cd529c4e4f8b04b80326f3cf6eee8b2f9cee1f07d3af49a80366f8d6f44926d75e9e88707578d3e89d314e9c14f62e14", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r09", "colour": "#5B3928", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224762, "uuid": "e9651d0e-0e4e-4a6d-b163-7c1df071459f", "value": "T13504236DA434DB3FA5073279617C0155E132E3DA716A9BC649982E3F0C08DDBF4BE921", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224762, "uuid": "8eee8d6f-a3a3-48d4-bf36-2db7c8013c8a", "value": "3072:4zb8T2wvITh8iDG550XqLUL4IeK0bbHE2PynKxYVnCaLuP/gaBQM9PKe2y:IG2wKhZDULUzeK0PHbMCWC1P/ptPKby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651224762, "uuid": "b6639656-2158-4493-a807-db72b6855a4c", "value": 181240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651224762, "uuid": "48a27f4e-2aad-4110-8bcb-e3d402957faf", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224762, "uuid": "d845dcc9-14d2-4b7e-974c-9158e7a466a8", "value": "Nueva cotizaci\ufffdn185225772.r09", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d81df955-c7ab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651230142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230142, "uuid": "aa53df7c-e1c9-4083-b137-7595e0e1ccdb", "comment": "Malware payload (Heodo)", "value": "32b58f9030c534607515375c91965edb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230142, "uuid": "bc0d8728-abe5-4d87-a73c-b2aee8f922cc", "comment": "Malware payload (Heodo)", "value": "51079269c5763cf7b4c608ad9068715b060efa1d26ae927670ce03da20d16d86", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230142, "uuid": "3c0f9d7d-a4c0-4429-83c1-267f27397e1b", "comment": "Malware payload (Heodo)", "value": "f5736f97997397eb085d5fa261796965b878040d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230142, "uuid": "957e03b9-039f-45bf-9a19-3fe8c4659c3d", "comment": "Malware payload (Heodo)", "value": "6aeb2cd77fd15e09b44ea910eda1563f53a59c128ea5055b6baa4a4b52e18b72148b72f044af0144798603286d00d320", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230142, "uuid": "bf8e6be1-d1a9-4684-a5be-d757738133e8", "value": "T1F4C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230142, "uuid": "6dee949b-d608-4dce-b954-2d4f36ede4d2", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230142, "uuid": "ce2c5dda-23a0-4a13-b37f-e947fc23af2b", "value": "6144:JhZ02GdOOgPYBKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfSKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230142, "uuid": "ddb1fd68-f102-4e4d-a6ba-784c02740299", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230142, "uuid": "567f8182-72ee-4681-bafd-12af131167a8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230142, "uuid": "9604cedc-5dc5-4c03-8693-f22be7f99025", "value": "6XOJJXJiywSOXFV15pkddkYzfCWZoUclzW.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe62c015-c7bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651238796, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238796, "uuid": "8e61cf85-830a-4e4b-8c7f-9a4b3b9accd9", "comment": "Malware payload (Mirai)", "value": "245052bc65e0cc7e77b53cc48194892f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238796, "uuid": "5b7ff9b3-86eb-4c52-ab70-88cc85f543df", "comment": "Malware payload (Mirai)", "value": "51726c296745dd3e58da90e69fe9d78c1b1b72349e95f9b460e02eb0b7ac2036", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238796, "uuid": "bf5a9f5e-6326-4d5d-bdbe-448efd6c43fc", "comment": "Malware payload (Mirai)", "value": "c86f3cbe9820d18e5e4b9d595aa40e7f0bc07402", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238796, "uuid": "6f5dbb79-c4e7-46ec-9f15-c90ad1a81ed5", "comment": "Malware payload (Mirai)", "value": "8fc63373e082c7ae472d9cf3fccd5571fbf2a6e5e94f32b9114ace05a3681dba56a461dc1d4b77ec2bc81e405299f6be", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238796, "uuid": "35b0be37-5bd5-4901-b996-d42fd3115b3a", "value": "T1CC533A99F4029E3CF98BE5BD84150E0AB92033D851931F2766EEFC937D331A49E51E86", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238796, "uuid": "d8786cda-9e42-4e34-a1bc-fe74310bd7a3", "value": "1536:A76gTszWCCXIIxwFB0a0hP8/28A5wf8LPB:AegTsKCIM0awVK8rB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238796, "uuid": "f6fd71d9-b184-4598-945e-d31dff9b80ce", "value": 66560, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238796, "uuid": "9f34fdf5-8b39-4e2c-9fe2-9a74544f1c3f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238796, "uuid": "563063e7-75dc-4372-a89c-9e3d7bb05215", "value": "245052bc65e0cc7e77b53cc48194892f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ac75f967-c7ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651243383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243383, "uuid": "1f0b3fdf-e498-4750-abaa-729800d9ee6d", "comment": "Malware payload (Formbook)", "value": "104933aa1049a47e753635f2c0e25589", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243383, "uuid": "3fc40e2a-7917-4bf1-86dc-0f3b44f132c8", "comment": "Malware payload (Formbook)", "value": "51a4706290a1e3d57684d218dc1bc95bb7435ae9108a1d845d6eaa88fdddcb40", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243383, "uuid": "2b660342-58e4-4d46-9c20-1f56dab6315b", "comment": "Malware payload (Formbook)", "value": "547268c2c13167ad6cb4ccbe267ff0391b95ddaf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243383, "uuid": "26d386b0-595e-4912-92a6-4935b2aa9a95", "comment": "Malware payload (Formbook)", "value": "1e4d3bd7fce1676093390f4820b9645176e986dbbdf52ebc2c9353544d86cb4d51937b74f10231b6cd3c68288e40209f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243383, "uuid": "927c260d-4713-4392-b532-32a684bc3dd5", "value": "T10524121522E4D0B7E8A722F22DBA46B58FFBB10D1070870F63941F5DBA36692D52F721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243383, "uuid": "32d1c739-51d1-4ffe-aeee-8fce88be5e39", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243383, "uuid": "d83e7b1f-c4ab-4987-967b-7f7845f25d4f", "value": "6144:HNeZmdChTQNR6Y62X86H129DbhBeScAvx4RiB:HNldC5IHkzBexAZ4MB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651243383, "uuid": "af986e5c-04cf-4592-8965-a3e6fa03a02b", "value": 218805, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651243383, "uuid": "433e220f-5bd1-457b-a064-77ac87602435", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243383, "uuid": "3a36ffef-5a87-4b3d-98e0-7fbd89be600a", "value": "104933aa1049a47e753635f2c0e25589", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "713b5771-c7a4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651226962, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226962, "uuid": "6ce9b069-42d2-45e0-80fe-716208fed1f1", "comment": "Malware payload (AgentTesla)", "value": "35bb1474be74cac7052306451b4e5cd0", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226962, "uuid": "b9f805b6-fa26-4af2-ba3b-de719c87fb87", "comment": "Malware payload (AgentTesla)", "value": "520474ba25a9febaa557a87c76401b0b239f6eb2a35288c5d0b7819f7cf407f1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226962, "uuid": "02339ddf-5fa5-4392-8e23-446825c8f04f", "comment": "Malware payload (AgentTesla)", "value": "0b0c289b5071e68d21d2ee92c571e7293fed974d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226962, "uuid": "011c5ebd-ddd0-43f4-bc4c-eefb73ddb545", "comment": "Malware payload (AgentTesla)", "value": "695d6bf4f9968ed04a2af0684631281febcb8ac8c09ea9037ea32340d04e6f1c7936974588c1d93023636cd1be52d974", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226962, "uuid": "d58e1c80-b8b6-49dd-8917-d9390f714ad3", "value": "T13CB423F39293989AC68ED52A5C17695F712A3FC0809402B7D17B4C96F3C7C3687AA4D3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226962, "uuid": "904fde1f-f083-41c0-a844-353146b732c1", "value": "12288:6/kN6n9oUukD7MxtiSQRJdrEezvf0bTcfuBL68w:6cN8xHMxtVmaezIO8w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651226962, "uuid": "d9eac719-fd78-430a-a49c-0427cc3fa811", "value": 515793, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651226962, "uuid": "2cef3f15-099a-45a5-a0cc-471bb50f7f3d", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226962, "uuid": "0ac92c77-08c6-46e3-95fb-c19c9596b64b", "value": "Factura de proforma.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "29ddf306-c7d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651246600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246600, "uuid": "fc817c01-d158-4752-bb79-217fa6a97ddf", "comment": "Malware payload (Heodo)", "value": "ac8a2b06de15c2c177db632c68521944", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246600, "uuid": "78001c96-40b5-4c79-bb2f-de8c573391b1", "comment": "Malware payload (Heodo)", "value": "524480d428fd0771b04f11efcd43cf5b3f36fa74b57f65612f2eca0e484d383f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246600, "uuid": "52245662-1443-4b53-922d-75c4498772c1", "comment": "Malware payload (Heodo)", "value": "6c191a71d2f68c78cffc7a68e5c74741733042ef", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246600, "uuid": "93b01095-4c62-4c52-a54a-eeef2cfe21a8", "comment": "Malware payload (Heodo)", "value": "f2d2a2068fa5c5cc32afd6b2695f599ab3e2f1cec23ba532a42f18f4c59caf7dce645c6066a1d68cd479bcc069b36b93", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246600, "uuid": "6ea91a0c-3a07-4721-b738-140397b7649e", "value": "T145C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246600, "uuid": "968d0cf8-76d9-4283-adb9-54da619fbd67", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246600, "uuid": "aca1822e-522a-4df6-88f2-45361f3a0bd8", "value": "6144:JhZ02GdOOgPYsKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfLKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651246600, "uuid": "86a60625-1d74-4d07-a190-ea727dbf9393", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651246600, "uuid": "1481ecf2-2168-44b8-a875-f139ca771235", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246600, "uuid": "d983fc08-7774-4655-bc5c-0d0b6652e81f", "value": "ac8a2b06de15c2c177db632c68521944", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e0accd0-c782-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651212381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212381, "uuid": "a3c05ec4-9248-4860-a44a-4d49e9868785", "comment": "Malware payload (Mirai)", "value": "41c9caad07d89f3de5e31a77a3f62783", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212381, "uuid": "28a8e810-f3ef-40ba-a2b2-4b76d49eb8ef", "comment": "Malware payload (Mirai)", "value": "52ed12c0862e3f2900a6b46179eee9e3471581546a7342406e673f8f7994b784", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212381, "uuid": "7a9fd84b-59c6-40df-956c-214c05a58e6d", "comment": "Malware payload (Mirai)", "value": "c77fc0665afa5bb7b0cb9593f79b9277fd66f53a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212381, "uuid": "d8cde893-ab30-48ee-b0da-b7547463d021", "comment": "Malware payload (Mirai)", "value": "aef1efa8755173c7a4cd8ad745ced9b92461f65095ed9d746c5385c8b673833b8edf6452c5af143188c653c0063a037d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212381, "uuid": "0d75857a-1319-4efd-9c32-56a8e9a00b16", "value": "T1F4337DA2C16DEDA8E1108A74BD254B789713E100865B3EFAD7C4C65A8047EFDF2487F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212381, "uuid": "71f1050d-ee57-423d-bbad-277c23780f91", "value": "768:qvgRGwtamXt5vxkxbeH9+tdvmGmwGwyWfs3IClU/UOWCUoeBQCj:UKGwtXXE1PuGmwGGfs3LlU/7WwiQCj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651212381, "uuid": "50df1b09-8982-4040-af6f-191ca7142ef6", "value": 52644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651212381, "uuid": "76b272c7-cb99-4c21-9265-74b388ad0f34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212381, "uuid": "955ca391-9996-49b1-9d3a-8a0aeeb12b9e", "value": "41c9caad07d89f3de5e31a77a3f62783", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49815248-c7ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651258249, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258249, "uuid": "09beacb1-1b3c-45cf-8e70-0ca5f25359e8", "comment": "Malware payload (Mirai)", "value": "6e410f31d0f598c9d8c80ceadec8eb62", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258249, "uuid": "3c0e6121-50e0-4e38-a924-32abb49f6a2f", "comment": "Malware payload (Mirai)", "value": "52f097859db125317c0172f8ff14c8a3d0fc87aa4b733254ca88201c1b7a43a9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258249, "uuid": "ab827c58-edf4-41b4-bd91-a23ef6c7249d", "comment": "Malware payload (Mirai)", "value": "0ddfb03b0d9de5e7eb27699e76bc85020a674e76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258249, "uuid": "69cba8ff-9dfb-4d14-8077-9088978e9bdc", "comment": "Malware payload (Mirai)", "value": "5e483d54d10a2faf2ac5fb18eb34f2799820f552b2f4f5fa20f295938a95233196b9edee46df6014b24e855190ac1c07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258249, "uuid": "25687539-a788-4263-8cca-2675f08262c2", "value": "T1ACA2DF0825CDE932D1B0903AE23CC347AEEB87B652FE327E1E084799A45191AD3BD945", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258249, "uuid": "48d1130d-0fe2-4251-a492-b28f5e274000", "value": "384:YAmog4c6L5i4+stIW01vhQIE2TQKMpI8QwxZVFjfPnSbH5hymdGUop5hXQ:Ypoh/DxCvhdR4IjWVFbS9s3UozJQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651258249, "uuid": "14405be7-40c5-4329-92df-5b180ecdb820", "value": 22132, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651258249, "uuid": "30d96433-4b23-49be-b6a7-1041cae213ea", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258249, "uuid": "bcb4e3d8-e631-4c17-88e3-399f513338b8", "value": "6e410f31d0f598c9d8c80ceadec8eb62", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bc53c68-c784-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651213129, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213129, "uuid": "538abadc-e745-4fb9-b15b-0f268bc24182", "comment": "Malware payload (Formbook)", "value": "3a7e461606e73c437ff6ff374cd9883e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213129, "uuid": "ec45b0e7-60ce-43d3-827d-2e4ebdc737c1", "comment": "Malware payload (Formbook)", "value": "53448d24ea22e0023f992eb1580cb482f2efbd6f2ff2af29aca645d77c41a117", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213129, "uuid": "a79704d9-e4a2-4093-b7a4-6e4df96686f0", "comment": "Malware payload (Formbook)", "value": "31de077f6e46cafea9ba462db2aceb94b9316736", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213129, "uuid": "e83af9a1-48ca-490a-9156-5bc996de51a5", "comment": "Malware payload (Formbook)", "value": "efe94ff763e39b83113b5acecb339f179eaec16f4f26603d82b7817dbdbe4a6eb2c4afced914bc05fcb56f8081904058", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213129, "uuid": "35239d6d-678f-4f96-8181-456b015b6363", "value": "T17413E75A3892961DC5D47BF869B1618366367CE10124C18FECF97F29AA73323DCC21AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213129, "uuid": "22f3d5a3-85d5-407e-8c7e-61cb20e44da9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213129, "uuid": "c29fc4ca-4630-4304-981c-e92000bdd697", "value": "384:mRW3pEvRiJIHbPSfffQaulaipMwCKzH2S3dd0hUADka9s:mRW3ytbaGlbMwCKN3deVDQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651213129, "uuid": "9d4d8f9e-5e57-459a-8a67-917cb6c41145", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651213129, "uuid": "9492c89b-3254-48f4-b6a4-ef07af721f97", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213129, "uuid": "e20e194f-372d-4331-b718-a2c1bd642a82", "value": "AWB-#150322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d5c50e6-c753-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651192113, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192113, "uuid": "08615306-dc55-4df6-96fd-34ee5ca2089d", "comment": "Malware payload (Heodo)", "value": "09009d4ca42fd76c0383c9920a3cb782", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192113, "uuid": "bf2ebbfa-a07e-41b6-b557-02a9284730b0", "comment": "Malware payload (Heodo)", "value": "53965f7d6a285f658755efaf3981978fbb23d1fb4499ca91c1a0f52b696b7b67", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192113, "uuid": "c5d02428-68c6-437a-997e-fa46d4813d92", "comment": "Malware payload (Heodo)", "value": "d6c35c6f5cf63f15333af1b183df4b4fb9fcf4f9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192113, "uuid": "9e50edb8-3288-4947-a280-9307bdad69e5", "comment": "Malware payload (Heodo)", "value": "40bddffb4c7a027354e736c10abc5aa4ee59c54cb44737eefaabce259d30ecb0239303b8207843e23b41f2c8ad805793", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192113, "uuid": "32026d85-4efb-4d3e-944c-4f7cd0c985d0", "value": "T1FFC4AD0BF7BC88A7D162E57984239B8AE7B2BC114771D35B4760572A3F333A05D2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192113, "uuid": "edf1c979-3f59-46f5-80ac-1f0c88074ee1", "value": "1134f6be519e9c35b5478dccf9efcfc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192113, "uuid": "7b10b75e-96c9-4054-878c-d55ceb4dc809", "value": "12288:FX18uCYMUhDfWKN/QduUaQkhS+W/uczzIEudy7JMv9:MuCcVNIomMSLjQE0mJMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651192113, "uuid": "d3978c28-050b-4204-9512-e1dbe0c63743", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651192113, "uuid": "85c1f7be-1af6-4402-a391-574e731d6f25", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192113, "uuid": "9df90d32-83c4-4e6c-97ca-1221c6722b26", "value": "09009d4ca42fd76c0383c9920a3cb782", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1091f514-c788-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651214774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214774, "uuid": "f7672c8a-0c2a-4df6-8bcf-5e29086ca0ef", "comment": "Malware payload (RedLineStealer)", "value": "3c4feab9b6820c245333a25802d043c2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214774, "uuid": "9d19377e-88af-4b0f-8fb8-c32f5614165e", "comment": "Malware payload (RedLineStealer)", "value": "53eaf05c27e159da471ed944f082cfac253c5512901ddd6fcde731e7f186ff7c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214774, "uuid": "4a53269d-5421-4456-b6da-81de13dafbb3", "comment": "Malware payload (RedLineStealer)", "value": "b47871af466f1a64f02b24590669bd6758f0a70e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214774, "uuid": "6a4394c9-844e-4495-b5ef-cd0ed30311d1", "comment": "Malware payload (RedLineStealer)", "value": "4d893ae280b975f98bbe5796585d11adcf6b1d3b5a33b1c1dc7910b9d9f70c2d40330282d3ccc85f87f1c621e1b20369", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214774, "uuid": "6ae48745-d9b0-40df-9024-b4a0f41bca1c", "value": "T16C84BE00B7A0D039E1B716F4B979C3A8763ABDA19B2551CB22D63BDE1A346D0DCB4317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214774, "uuid": "2928c8a9-647c-47c7-bd15-97d7745028d7", "value": "a5e21eb4da4d713aa6e028b6a31293af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214774, "uuid": "a33bb950-b994-45f6-a814-2028f8528825", "value": "6144:AaETeqnXoim0NCLX7+x3AjeUr8Uvc5iuYhRQ0SlCitY/Q+BesfouBGeQ+0Wvk:AaECIYimoQX7+x3Gr83iM0SlCjbBeQf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651214774, "uuid": "1e9ee9df-d435-4bd4-aea2-0d53daa75235", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651214774, "uuid": "eb00149c-5950-4e32-b061-5926d9231910", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214774, "uuid": "b4bcf285-68e9-4a83-833a-febfef4eb1f1", "value": "3c4feab9b6820c245333a25802d043c2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c164079-c761-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651198124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198124, "uuid": "85cc6b58-0fab-451e-b8fb-a58b9e80de6b", "comment": "Malware payload (Mirai)", "value": "0985bfa67f090bdfbe19ae13d31cffa9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198124, "uuid": "d2da4b2a-4240-4437-b92a-1452af81a739", "comment": "Malware payload (Mirai)", "value": "541b650a56fe8927a35f65f2df7168d33ecaa4428563cf708bd373e8f464228f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198124, "uuid": "efc6e55d-0c2b-4895-90d2-2c2e7660ad31", "comment": "Malware payload (Mirai)", "value": "d912ec83cbf2fe5622f32b177176af60789d1523", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198124, "uuid": "c8e01980-e605-4ccb-bfdd-0560016bb583", "comment": "Malware payload (Mirai)", "value": "c247d34aa88a8eaf6eeb95d5e39a3cadb534d16dc606da16fbc5ad694849a43c957766363cfcbe8296c0982cce2dfea5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198124, "uuid": "35e60b67-7117-4faf-9fce-bcb75811a288", "value": "T14E63960A3E218FBEFBAC863847B74A219658339626F1C5C5E15CEE015E7034E745FB98", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198124, "uuid": "718c023d-b016-44b1-9cbb-df6380f672f0", "value": "1536:j9NLNxDu9H/hpVBi6yI4W0vK0pErAnGzUNPKkifx:xNL/Dw7j14W0CEELINPKkCx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651198124, "uuid": "d4145ed7-1486-47b1-9ac6-162d0a7e2e77", "value": 69416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651198124, "uuid": "aaaa50a5-5076-4878-bf5b-4f9a20e28338", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198124, "uuid": "7b00111d-1eb6-47e0-be61-9f18b0905dcb", "value": "0985bfa67f090bdfbe19ae13d31cffa9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fed29066-c79a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651222905, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222905, "uuid": "599f4952-cb0f-476b-a135-c7b9b4d369f8", "comment": "Malware payload (Heodo)", "value": "d15754b01be71d1f91ec918afec8aaf7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222905, "uuid": "620cf748-689d-4476-b887-034db14a3743", "comment": "Malware payload (Heodo)", "value": "54ac8c1948392f1a5db4319595d812af6c8460250249f4ba8ad910ea6c912b1e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222905, "uuid": "08fa242a-300c-4a72-ae0d-5a2b5f3761a5", "comment": "Malware payload (Heodo)", "value": "ef129f7f6ff2cee35dbe5be545e6059f010b98a0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222905, "uuid": "223db7f4-d4ef-4611-8e52-965c6a37764b", "comment": "Malware payload (Heodo)", "value": "fb1e2a00826534d8f235d573d34237842ef69803201ba4e5474a3e1a25fe26ecce7fc777f40b203b7ff03e21c187f1b9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222905, "uuid": "0f42e788-1415-43f0-8055-eee2c56935b5", "value": "T1BB515D282DE91219F5B3DF7059E97A85CEAEB9A3A511894E00C1074E4921A50FD91F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222905, "uuid": "e39f1e1e-f504-4087-9004-e3ed84cd0a0b", "value": "48:8mRp8/6XjwGFUv0ca9kMY8SWGgcIuhkXfcC/t4ab:8mRO/6Z+8cGkMAzwD/t4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651222905, "uuid": "b43a1876-28c0-48c9-84aa-8cf2c0b58a41", "value": 2526, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651222905, "uuid": "17056ee5-0d68-4b1c-95c8-e1b0c4cf3a8a", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222905, "uuid": "5cf9a955-f19c-4208-8904-01a9abfa4033", "value": "Invoice_Copies_29-04-2022_0805.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6bbb8498-c7e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651254012, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254012, "uuid": "e3d2f053-9112-46cc-85f2-4932d2631704", "comment": "Malware payload", "value": "30596531875a560a3cfef8b4e5b47f7b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254012, "uuid": "83952f67-e4db-4ebd-aff8-537348156c7f", "comment": "Malware payload", "value": "551a13afc6b98c1d36eca348ebf6408d50d2797898fe041943c336b130d2d43c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254012, "uuid": "505bd62c-822f-4bed-b93c-4609ec7c43c3", "comment": "Malware payload", "value": "05accd4c34d22cd1d78956088f1ae3b333971090", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254012, "uuid": "95dbd32c-49a3-4f14-bcf5-5788e752d4ca", "comment": "Malware payload", "value": "1609ec28b0ac71ecc1edfdc7e25973bc8faa219cbce69b0513ddc8c54f082fdd7e1b166854a29c946ba32b2034a3af95", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254012, "uuid": "651e4aba-19ae-472d-a0fb-dbbd75a5f10d", "value": "T1B2347E176DC25133E9BB2072CE46A398BEFD95401B1AD9E3DFD188840A20DF79A3D609", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254012, "uuid": "ede8a782-fb00-41fc-86cf-0a5f478f93d7", "value": "3072:F+rq2vw40MRBPAOeXTXlslRqq0nH78BzEDtf6yNARBbRKMDcT8gy:w5uMRBPbeRsaHgEDtHOdtD4c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651254012, "uuid": "1d98d781-68aa-4861-9948-75a52fe19712", "value": 235130, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651254012, "uuid": "6f019372-e0ef-4dbe-ac93-21994f0f5b70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254012, "uuid": "0e99258a-7c4c-4b82-8cf4-145864793283", "value": "emotet_exe_e5_551a13afc6b98c1d36eca348ebf6408d50d2797898fe041943c336b130d2d43c_2022-04-29__174007.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d27ff388-c816-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651276088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276088, "uuid": "6cee1093-73fe-455b-9721-3d6ca283a571", "comment": "Malware payload (Mirai)", "value": "1ab3bf1f45816cee4d20d60ebcfdc741", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276088, "uuid": "38a6d971-2951-4ba0-aa29-b7c298d6d501", "comment": "Malware payload (Mirai)", "value": "5552d874bfe1255868879a1ad00714005d6814bde467b2ae8bed30651daf9082", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276088, "uuid": "162199cf-ed68-47c2-90b4-c434ce335fc4", "comment": "Malware payload (Mirai)", "value": "9a1b4753e6a19777d09e838dca3ccca2ec29f265", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276088, "uuid": "950357c6-78f1-4884-bd39-54fa4f2829d2", "comment": "Malware payload (Mirai)", "value": "e34a526eb985c6f8326514516c326b9cf5aedae6d673da3cf1fd4edab69e849eead1342f08f4e2e445e26446130ffb07", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276088, "uuid": "95e1a2de-8b09-42ed-bbbf-3d40ec768cce", "value": "T191A38C21BC7A2A26C1D4B17B02F78321B1F2279D34A8CB5EBD710E4EFF156A064175B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276088, "uuid": "0ae44e13-13ef-4fa5-ade5-56351c4690da", "value": "1536:YOhkcISpiNZhVIvYbc+m5qfy3G38vjvwEGmvgRN:TNcnjxq3J0Uv4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651276088, "uuid": "5647366f-f4b1-4dc4-b916-0b2f2e04589b", "value": 99392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651276088, "uuid": "a42d334e-755a-43ab-8e74-103ce3dc415b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276088, "uuid": "60393e1c-a303-4cda-9196-9e2a9edf6099", "value": "1ab3bf1f45816cee4d20d60ebcfdc741", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b6d1a2c-c7a3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651226416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226416, "uuid": "bbcdeb3c-d3f1-45ea-b934-19c44205ba89", "comment": "Malware payload", "value": "1215ca026c8f1a6d216b9ae53c930241", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226416, "uuid": "f9d09d27-2202-4854-bf2d-02d54ce94c8c", "comment": "Malware payload", "value": "565ffd0396b1c352e00f7728ed34a0eb2261f12e2b9c7ae482f3388d66d55d55", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226416, "uuid": "b8ccd989-117f-48dd-a36d-e21af3e987d6", "comment": "Malware payload", "value": "e325f083db3e3efb7fe8c275cf60f445bde13a6a", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226416, "uuid": "62eaf4de-de82-4bc5-acdf-386ecd9f8e6d", "comment": "Malware payload", "value": "8ba9caece96f5513ce9446a3174588fe6a56a28665aaee1c0a114b7714d35123b4e1652b1eed13548bcae943fa341a73", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226416, "uuid": "9894356d-b88d-4896-bc8f-708fe701af26", "value": "T19D335C33274BBDCEB77B2E88F90436A11C9C7A6B97C94858BFCD099425F6450EE1D890", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226416, "uuid": "2071768b-4f0c-4280-9a57-f19c956caecc", "value": "768:9rwvSJE+vHE44XNJLb5K0cDVi8TzuTUoQ5xN2oSOaGk5mElU/bdLr5tPvCsP+8h:1JE+vHcX7Lbw0EVimcvQgGhEl8p6sP+A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651226416, "uuid": "30922146-d216-4ffb-a48f-ea9dd11d0bbd", "value": 52568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651226416, "uuid": "265f7219-e9d7-423a-b027-58cae5a58758", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226416, "uuid": "4b6df680-976d-417f-a82e-ea562f4c855e", "value": "newddll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96768be0-c7ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651230461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230461, "uuid": "078a5d0c-01ed-4e9f-bed7-395bb5124a39", "comment": "Malware payload (AgentTesla)", "value": "7ceaedf2bbf52ed42e49020a614ddf02", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230461, "uuid": "d8098b14-6ddf-4311-8add-ea80c84b6020", "comment": "Malware payload (AgentTesla)", "value": "5676f0887ad55e92af77cfba02af1955add0f85916f170e47ac8b1aacebfa475", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230461, "uuid": "bc42ca8e-750e-4215-86c9-a434de094216", "comment": "Malware payload (AgentTesla)", "value": "d551dc57c451307280df65c6ba068720444c6bec", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230461, "uuid": "e4fc65da-6153-47b0-9800-617162065edb", "comment": "Malware payload (AgentTesla)", "value": "d484ed6f28add7bbfb3826cc0455e50d15d8a3ee39224d9f6a3457a364f5973caaab80a2156e37385e02cfcc5333e425", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230461, "uuid": "0c2190fa-de77-49cb-a5a4-2716e2e0cc24", "value": "T10A7423D1D74B76A44E17832E789D16CC4ECAABE688812DE525BC5C3835E26DEC112ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230461, "uuid": "dff70adf-d181-41bc-9719-2a6a475ccb51", "value": "6144:UHbZJEm6BezKNGKAnafevzTf5XWhE912QlY9+uOEPAhms4w3iaB2zCR+/:0JEpezCGnQeLVXW6qQlY9pOEPteiaB2H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230461, "uuid": "4709c49b-46d9-430e-824e-c429b120673f", "value": 369381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230461, "uuid": "ac64cdf6-7671-4649-b0b1-0eb4d8f7a51c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230461, "uuid": "a4cd906d-3ce4-4ab4-ba60-92c84ee98ffc", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e8f89c-c78d-11ec-8e58-42010a9c0032", "comment": "Malware payload (GuLoader)", "timestamp": 1651217251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217251, "uuid": "8a8e84bb-c1f6-4953-8ebf-5e0c96ad9d0e", "comment": "Malware payload (GuLoader)", "value": "52a3dd2b5822e39f36e3d8a97670863e", "object_relation": "md5", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217251, "uuid": "79ddbd85-279d-4d59-b75b-f4862357df7f", "comment": "Malware payload (GuLoader)", "value": "568e0923d9ea3ba8b31ee8c153a8a391341937c5dafea9e811a4eb7b936ccbe8", "object_relation": "sha256", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217251, "uuid": "c4e14786-9f43-41ec-b061-be59c3ff13bd", "comment": "Malware payload (GuLoader)", "value": "f5e0b1cd4b42a2d970dca57807c7b967cffece1d", "object_relation": "sha1", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217251, "uuid": "aaa003c7-e26e-46cb-88ff-b75fec191f6b", "comment": "Malware payload (GuLoader)", "value": "4ef5a0a99c8cbbc1afbae003218fcca25cf275e8481088b769bd0e35d6b890a0e5cdb9e83990f362154358b47742744b", "object_relation": "sha3-384", "Tag": [ { "name": "GuLoader", "colour": "#DC91BA", "exportable": true, "hide_tag": false }, { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217251, "uuid": "134b0856-3b05-421f-aa30-0d891aa6c906", "value": "T1273487358FD3C85F854A99E84D8B1DF22A3F8A318BA3490C4B8A1D467D185B3527F74B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217251, "uuid": "0fdd2a24-be1c-43c3-a3ed-f9e9f922c3ac", "value": "3072:fibO0uujgPA4eYpzR7m7VaLx/EgldC5Dr46E:yJjwrN3BW5Dr46E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217251, "uuid": "76d3ae60-7be0-4adc-81a0-536ae1475c1f", "value": 244478, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217251, "uuid": "1e29bf30-748f-4cde-a519-57ea6b5bdd80", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217251, "uuid": "3ceef4ee-c9e8-4b09-b064-6675d5d85e1b", "value": "090250123638_Booking.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7368a01-c7d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651249387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249387, "uuid": "eaadd80d-08b0-4ef2-bed4-bf6d935d1abd", "comment": "Malware payload (Heodo)", "value": "124c5802b19dfdd303b946569f4ed62d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249387, "uuid": "93e3667b-3763-45c6-bd5e-d4d4e77dcc17", "comment": "Malware payload (Heodo)", "value": "5771edd04b83579ee63f276be520d7279f22abafa23bfabe87de1b03f79325f0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249387, "uuid": "e1318877-589e-4342-ba9d-b3a9ce86d94e", "comment": "Malware payload (Heodo)", "value": "1d2b87d06610d875f07356f7cbac0da87e15cb09", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249387, "uuid": "64a28b63-256e-43bd-a6bb-08205e176fbf", "comment": "Malware payload (Heodo)", "value": "a8c95c4ab6ed96a18bace0834c7b707b6fa97a9a754ad3db1de24022262d6c9985e06aa640f2c5d1b9a16fcc52830879", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249387, "uuid": "b838cd93-8df2-40fd-bf47-6aad2d9552ed", "value": "T1AAC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249387, "uuid": "bc09fc07-4abc-4bec-95cf-23feebe448d1", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249387, "uuid": "5a7fb43a-2897-4baa-980f-ed529f54f6cb", "value": "6144:JhZ02GdOOgPYOKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFflKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651249387, "uuid": "1253d371-3a77-4dee-a198-4fa52a72abe0", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651249387, "uuid": "ea8952b1-dd30-47ae-a083-8020b6a233d0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249387, "uuid": "cb9b1d03-4e2f-4cc2-aef5-3178859a3a29", "value": "124c5802b19dfdd303b946569f4ed62d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4eb55f39-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651217885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217885, "uuid": "6979e55a-308b-4f37-8a44-8a95982510ef", "comment": "Malware payload (Loki)", "value": "3b42178618a4b83f2b4df66724ffbfca", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217885, "uuid": "6ed3aec4-0ac9-4ec8-9365-9c2ddce4d0f3", "comment": "Malware payload (Loki)", "value": "587867e9c968134fd523f952aad07d20e17da41fe0b976e9e5d8456ce83f6012", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217885, "uuid": "6caff9a3-696c-48a7-9f38-18b07da0325c", "comment": "Malware payload (Loki)", "value": "7eb8b24d9b19971daa9a94a8906a5cdbff23cb40", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217885, "uuid": "983561af-f7af-44fa-9226-4c40e15b1f65", "comment": "Malware payload (Loki)", "value": "b1a2094d6e154e1a4474181901c12e2f417288284276c8543850860c8a4a5715c94786d722571e653f2188101d12918e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217885, "uuid": "1c9889af-5eb9-4c2c-8f3b-746414943152", "value": "T149C3F12973E8C4BBE8621B312FB9A3665BFDD51114B54B0F5BC0AF4D3962382560F722", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217885, "uuid": "04c12b10-1c31-4455-b279-b7caf12e44ff", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217885, "uuid": "d3c152e2-ab67-43cc-adb2-c2f5278a610f", "value": "3072:l1NjcVVnLpPunbkPgoKneY2BfUapnlLQ+6FRi:HNeZmko2q8lLpsQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217885, "uuid": "e9897473-65a2-42a2-8386-1f0fe2b38e14", "value": 125658, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217885, "uuid": "c38077aa-6d0d-49dd-bc6f-312d57847d28", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217885, "uuid": "c032c592-9750-4eda-bad3-a853cf459958", "value": "3b42178618a4b83f2b4df66724ffbfca.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d6d2ac4a-c816-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651276096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276096, "uuid": "f8ce97a9-4e85-4d72-9ad1-6c51e0ae0efe", "comment": "Malware payload (Mirai)", "value": "b26d9a7b715f505e3f426cf882dd5512", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276096, "uuid": "277ef543-d179-4390-ac0e-2de7ef5bfeff", "comment": "Malware payload (Mirai)", "value": "58bc010c7e2362e6939fe572c3031f84bbc3b6c28774db028e0f2b7aca8d8954", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276096, "uuid": "a31d31e7-a9e3-47b3-a8df-917304fdd6fa", "comment": "Malware payload (Mirai)", "value": "f2455d3354a3c0e7a740c3c168d286d86f1a81b5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276096, "uuid": "0ef669a2-dfd5-4e8e-b5a3-ddfa2285e979", "comment": "Malware payload (Mirai)", "value": "b996223641f6d80fe084f6dbfaec05e8825856b7c4794f6a9e1c541b8145efc1723127a2bfaeb147b181e203ab17abdd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276096, "uuid": "923e9639-7d17-4e56-aee3-ea8f7cc9cbb9", "value": "T14703D03C0304B5F8EF219ABD436053A149740FBEB267ED0B5966EC8E3B115B4B955BA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276096, "uuid": "0d151fb4-549a-47da-a0de-092b6a5e5d3a", "value": "768:6xGZESnOzHUlF7Fz8hkbpJXimKrCyVBz3zJgGlzDpUYsx:FpTAhkb/XimKe+BDpVqYq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651276096, "uuid": "85af82d9-389c-4b79-9f27-7955a013cc12", "value": 38040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651276096, "uuid": "5d0bb5b0-c18b-400e-a1da-172fc1e45ced", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276096, "uuid": "6c1c03b9-daf7-4cb2-ab38-9511447c5cb4", "value": "b26d9a7b715f505e3f426cf882dd5512", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3a63954-c7e6-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651255528, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651255528, "uuid": "851cf728-319e-4d9d-8726-439edb38b3be", "comment": "Malware payload", "value": "218438c85fb15c27e7e796a798fb5d30", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651255528, "uuid": "503820b9-b789-4d05-ba00-797e152b5b14", "comment": "Malware payload", "value": "58c673d8636d32026ec1e836bb7c26743454c710f06408440686ccf62083ca3f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651255528, "uuid": "31e6994b-73fa-4fb1-8c34-c78beccfa2e8", "comment": "Malware payload", "value": "64d1b2454ede51bee28729f6a68916782f538384", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651255528, "uuid": "16e441fa-3405-46b7-b264-81961a7ead42", "comment": "Malware payload", "value": "d75a588ea091d5d90c297a57e97111b9a7c82dfe111a9f17ae6a5e5841554b48df3aadf4b5d592061c323c453a6ea789", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false }, { "name": "Zusy", "colour": "#14D9BF", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651255528, "uuid": "b22422d6-9855-4d0a-bbb4-431d076a48d0", "value": "T1CF25AE0273C1D062FFAB91334B5AF6215BBC79260123A61F13981D7ABE705B1563E7A3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651255528, "uuid": "c4e3995f-ade7-4e37-a4c0-2b081951f71a", "value": "0b768923437678ce375719e30b21693e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651255528, "uuid": "3618bda2-dc5c-44c7-9305-594f05d942ad", "value": "24576:s5EmXFtKaL4/oFe5T9yyXYfP1ijXdaM93OK:sPVt/LZeJbInQRaM93", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651255528, "uuid": "6859f30b-1fc7-45ac-be33-9150d2fc5069", "value": 1003520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651255528, "uuid": "aa4c881a-632a-40f1-b95b-35edeb579c3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651255528, "uuid": "053ccaff-baf4-45b8-a838-1bfdf8eb8a8d", "value": "autoit-script.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "098cc397-c801-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651266732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266732, "uuid": "6e3c5720-a800-407e-b8d2-d9e9dd5178ff", "comment": "Malware payload (Mirai)", "value": "a7f1184dab3c588e46a6de6ae18fb758", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266732, "uuid": "72598c00-1a0b-4a1e-9cb7-aa2af332b664", "comment": "Malware payload (Mirai)", "value": "5954c263688e131db9633e2d182fb4845a06ca233b8f3cb4d818b753f4549f9d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266732, "uuid": "1c243907-2696-4b68-92f0-2a11e74fec55", "comment": "Malware payload (Mirai)", "value": "0ce2ad33e921a7ffaca57ad00a62febaf6b1d635", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266732, "uuid": "64bcd75e-b999-40df-9dc7-61b12dea9fa6", "comment": "Malware payload (Mirai)", "value": "fbfb8ab5fe46164010f35a5917435d3b9f7284fc0e67b2ce9bbb6586c53836416fa56cce311118c2671c6257cd015d13", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266732, "uuid": "aaeacbb2-1128-41ab-9a88-53a193ee70c6", "value": "T1CCC2E1F8E95E85DEC09D74B0C2B817503FA88B265943FC9A1FDAD6C6DC0A7E471826C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266732, "uuid": "e4dfa545-ee4b-46ca-8e4c-8c51312dc0d4", "value": "768:P8kbmEOt3oOmSQxJUdvwte/8/JgGlzDpbuR1Js:UkbmEOt49SiCdoiiVJum", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651266732, "uuid": "c968a269-02ec-4e7f-8342-83706c0467ff", "value": 26176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651266732, "uuid": "2f5814b3-1ea3-41c1-9667-17c4e691cab4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266732, "uuid": "4a43542e-0a13-4d3f-948e-9228ae093ff8", "value": "a7f1184dab3c588e46a6de6ae18fb758", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e683b7ea-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651215563, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215563, "uuid": "d7832b6b-e00f-45f8-bd67-9907280bdc9b", "comment": "Malware payload (Loki)", "value": "1e361b424b19ccb44116e5c1fb2a0636", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215563, "uuid": "2e1cd2e0-a8b7-445d-ba77-b41391806128", "comment": "Malware payload (Loki)", "value": "59ceae5da524e793d6ff40fd3bcc5ec6d2d16333b9401219e5064962261e0f1f", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215563, "uuid": "1f763446-852e-4711-a6f2-84db88cb3544", "comment": "Malware payload (Loki)", "value": "bf834640fe23693c81bd08c1d20e099cc3965e37", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215563, "uuid": "549b8156-6313-430d-a022-ec3420c9be3a", "comment": "Malware payload (Loki)", "value": "fe1821d1898c36d3079fa9568a6262ae275804df69c804bdd672aa29e6f998c07fdad9c692b8cc2ba83b4dde9b41d452", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215563, "uuid": "5d849f3b-7268-468b-91e6-6bb252541faf", "value": "T108C3015D9B9B88D5E0E3A432064DD6841D349DF2D89F3D147181BB9FC8F76348EA029E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215563, "uuid": "4d4130ff-8dd1-4a37-a999-21fc1b6ed718", "value": "3072:dmMCLL3eWXumUjiZF8R4j8qtF2XZvZRbbHv9ysekzkGcFx:r4L3eAumUji78KjrtoXbRPYsn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215563, "uuid": "7336e522-a5f7-4839-9977-5cd0cb3bc75d", "value": 121344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215563, "uuid": "0c0f43d5-de50-4725-b165-a2fcd9aba1ee", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215563, "uuid": "61224748-361d-4a60-a328-2a2ef7bc24a7", "value": "shipment assessment.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c747bd69-c77a-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651209068, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651209068, "uuid": "c3c72245-99a8-401b-a38c-ca0350fc92d8", "comment": "Malware payload", "value": "a7200b0d446cddedcd1acc01ff3501af", "object_relation": "md5", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "fernandestechnical", "colour": "#3B43B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651209068, "uuid": "a9e31ad4-3af6-4549-b395-030aae65ec95", "comment": "Malware payload", "value": "5a5625a467ae867e63176fed56f8926b239841b70bd61c80a08a545023246fbb", "object_relation": "sha256", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "fernandestechnical", "colour": "#3B43B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651209068, "uuid": "2661a5be-5e5b-4eb8-8b46-3b548f21bf88", "comment": "Malware payload", "value": "b5a95243a0d08b734daf573fdcf7f499a224b387", "object_relation": "sha1", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "fernandestechnical", "colour": "#3B43B6", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651209068, "uuid": "48e3004e-db75-4ebb-8967-04ec01f32d38", "comment": "Malware payload", "value": "beef9a4eaf594e8e9f3f73276de75f59c6707865360bf42ef802c2564983c06bcf25631c23d447b8a227f9433dfd372e", "object_relation": "sha3-384", "Tag": [ { "name": "bat", "colour": "#2812F5", "exportable": true, "hide_tag": false }, { "name": "fernandestechnical", "colour": "#3B43B6", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651209068, "uuid": "2197ce31-c101-4c0d-8a57-2a29c3f13c11", "value": "T104C012218EDBEB1D9F41D8EB9AB160C4D05191507C4439D9A7211D484388529E99D540", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651209068, "uuid": "d2215b19-cc8c-499d-904e-5a7c80fd9259", "value": "3:SzLJJFF7FNcF3VYrSLcgKmyTJyKlQHTkFKPSS0wJAFm1myViEaKC5yOImyViEaKU:SB5FNUOGLcuu8KKHAwPSSHd1hnaZ5RIW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651209068, "uuid": "dbcaf7c8-cb9c-4719-9d4c-65c19153e3ea", "value": 181, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651209068, "uuid": "9003af75-7fd0-4ec7-825f-b621fd52a182", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651209068, "uuid": "2e74f8be-af87-41a7-8534-9677d1f91bad", "value": "util.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52db3211-c804-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651268143, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268143, "uuid": "71b6170e-b5a9-4c78-9efd-5f4bd3a913b9", "comment": "Malware payload", "value": "66ddb99d89ca653385fed85b10dfb54f", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "QR Code Theft", "colour": "#D138AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268143, "uuid": "3e4e7415-2cbf-4266-9d76-a2e2966e5ef4", "comment": "Malware payload", "value": "5b835e17d3d67c898fb52a57a8d11473d4dd4048ab2743bd39d2af926ea33f2c", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "QR Code Theft", "colour": "#D138AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268143, "uuid": "fe9d8b96-f88f-4336-b217-0e7082796aed", "comment": "Malware payload", "value": "9bb7f99174086e1f27b94212d663400cb1f12bbe", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "QR Code Theft", "colour": "#D138AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268143, "uuid": "93e7de7c-2cf4-42b9-9ede-fbb4ea2e7fe6", "comment": "Malware payload", "value": "f4521a11a36a63960716c87d1021a380afdb7c1368e158fb207d935146bd1eb15ca8f30c91ab77916ba452eb06e755b5", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "QR Code Theft", "colour": "#D138AD", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268143, "uuid": "6b919472-afa5-42e3-8ec3-13af217300c8", "value": "T1875633B912B8E5EB2546BDD4D1BB3B5AF9D4E880B3570ECB0D46442B7032FE784605AC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268143, "uuid": "73b8dff5-62fa-4283-b268-a87c06f46732", "value": "98304:D+o1WLq1RUOTxMhCrLQkxmNcpN4Mx88EeCI7TbijQ+cbSNxDg51mNW18ct/7Bnh:DH1W+1RPx34pNcjFx88EeCCSdcWDgAWT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651268143, "uuid": "142a4b12-182d-40f4-84eb-255486df368d", "value": 6273893, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651268143, "uuid": "dfc654fe-e9a8-44b5-b1b9-f2b1e785166d", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268143, "uuid": "b13c9e96-3fdb-4889-87d4-e33641723cb6", "value": "QRG.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7936231d-c7bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651237713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237713, "uuid": "d5f67a93-5f69-427b-8935-2418daa2a8db", "comment": "Malware payload (Mirai)", "value": "0fa889475678ce15d1405ae04e63a953", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237713, "uuid": "5b011d3e-34aa-4a26-bd5e-edc0d4b60084", "comment": "Malware payload (Mirai)", "value": "5e323f35a1ba5177984734a32bdf655fdd90f81b8fcc788e674cbaadff83d522", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237713, "uuid": "838c729c-7573-40db-9be0-c63f7f8aaf88", "comment": "Malware payload (Mirai)", "value": "ee29139e84d141dfc4fb46720a90493b0317a555", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237713, "uuid": "d8b9f582-b3ab-420e-8e92-e7217943f22d", "comment": "Malware payload (Mirai)", "value": "02d592ab7fb8c49b64d3c2c308fc933c9309b1d423c8dc764a81bd71e7873795e37876de8c87868b83ec86dc9ae753ed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237713, "uuid": "29fd434e-e5ee-4713-a19b-72779f3736ca", "value": "T11DC2E1969BF5DEEEE015833F2449CD56245DE8E387DD11232F9E0B2131AB1210269EE7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237713, "uuid": "77361347-756a-42f1-ba1f-704e5f907048", "value": "768:IFjC7WUARSpqU86YKzQmtV8tv3YDgmqH9Er5V:IFu7bAQpuKsmstv3gUo5V", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651237713, "uuid": "a53ee6ca-87b0-4acf-a685-4ac5594a6418", "value": 27736, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651237713, "uuid": "6ddd290e-37b0-46b1-935e-40699d4ce584", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237713, "uuid": "40191918-c3fd-4dbc-b31b-eb1c122ee4ce", "value": "0fa889475678ce15d1405ae04e63a953", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "32a7d5e6-c7ae-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651231152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231152, "uuid": "9013a7b8-c3af-419c-b010-39dfd6b4ef8c", "comment": "Malware payload (Heodo)", "value": "207166772feefd938a1f299ca5a3a78d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231152, "uuid": "bed831ea-efc0-47df-80b6-c08c06420f76", "comment": "Malware payload (Heodo)", "value": "5f38405470444b691ee14ae9f8893686b6afb0712a07c0d1fb690a46fbdedbcb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231152, "uuid": "d7e6fc63-d104-4bfa-b444-eb061a55e9f4", "comment": "Malware payload (Heodo)", "value": "6006501b3c316b836ebb9e4b6bae5d60b2c388ff", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231152, "uuid": "e262da8a-1953-449e-b2ed-df86c172b6fb", "comment": "Malware payload (Heodo)", "value": "c83638a885494df2019d323ba51af01923e527492aa4504beef249f3ff85486022e97be99fa4728c0d15e8293d22bd97", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231152, "uuid": "7049c82f-82ae-4ef5-b64b-183b6590ec6e", "value": "T1E7C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231152, "uuid": "579bea86-e96b-432b-b095-a6002a9663e3", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231152, "uuid": "cb2270a9-3025-48d1-9825-a5820ce56fd3", "value": "6144:JhZ02GdOOgPYJKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfWKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651231152, "uuid": "8301a87a-409e-46c4-8e3c-a35ba4124c5b", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651231152, "uuid": "84372baf-5df4-43b1-844f-15bf59d07203", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231152, "uuid": "b4c9bcb6-185c-4c7d-92b2-70f2304e0407", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4fd0d9b2-c761-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651198130, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198130, "uuid": "e104e328-bbcc-45c9-8781-939a2f891562", "comment": "Malware payload (Mirai)", "value": "b76dcc1464856db934c0d68dddf36752", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198130, "uuid": "92e6cab7-3219-4299-a98e-c302d54b76d4", "comment": "Malware payload (Mirai)", "value": "5f6e842e942b5476ae9088f5dc44bd7e4e9e7dd809903e26d4debc7190f68711", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198130, "uuid": "787f7050-2f10-46df-90a0-305b89e9043f", "comment": "Malware payload (Mirai)", "value": "0f34964d353cee8fab9f7a08f03c774f5e222a76", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198130, "uuid": "4b889790-6c73-4307-9b67-dedadf206430", "comment": "Malware payload (Mirai)", "value": "0f7ea41c4b2f5ec548bdb80ef989d856c42379aa8645d7913b292044ee6dadde6dbbad81096ecfa05eb44a664e93a234", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198130, "uuid": "6a38c2cd-347d-46b9-aa76-c227e6328fb5", "value": "T1DF530A85B8819A25C6D113BBFE1F018E3316975CE2DE73128D145F647BCBD5F0E2AA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198130, "uuid": "521f2139-1772-4fa3-971a-39187c64c444", "value": "1536:YdnWpBh3cLDNoATqrjjK5yAMQ1fwnWmLdI8niD7noKWp:lH3+po+qra4XQtwm7noKWp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651198130, "uuid": "e67f7435-6386-4743-9b34-8612e8bbbe44", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651198130, "uuid": "2dc34731-6020-4393-9811-128bc354a3f8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198130, "uuid": "206be774-ded3-4110-8928-692918b571d2", "value": "b76dcc1464856db934c0d68dddf36752", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5704887b-c7ae-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651231213, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231213, "uuid": "1a01f93d-c2d1-4e4b-9f23-53438d0cd4fb", "comment": "Malware payload (AgentTesla)", "value": "1a93d3c99d6604398788c3dfce098cc8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231213, "uuid": "4f541a11-1ff7-4723-8648-4a7b040bd4cc", "comment": "Malware payload (AgentTesla)", "value": "607c5f7e40746d81ebef9ca374e7e668d3c9f23a4594c4e17d072eb2aab1bbf2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231213, "uuid": "0c2980e5-a329-45bd-8e5c-a4c1fd1bf9e0", "comment": "Malware payload (AgentTesla)", "value": "d8cbc36f131fc1827f1b54eb0b5ce70552796b99", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231213, "uuid": "5ccd0d83-248b-40f4-b32a-41707a24bfbe", "comment": "Malware payload (AgentTesla)", "value": "c7608972ee03b4aa79771e51e5265c74f48c9a788cb608baa4126aed5b8a5b4454005c2a6832e9f7a5009a92d169ed8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231213, "uuid": "bd8de705-a9c1-4001-95d2-4633f5a76b0c", "value": "T149942373614932D062E7C3E50DE73CB2970867827782A864064CB3E7175BEE294E768F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231213, "uuid": "363b81f9-6f52-48a5-8407-07c6cb496e95", "value": "6144:ApTQJHMMzxnSFHvlF0KxriR61+f36PE7saUG5NcPMHTLCXpCj8K2QZfCfHUdC:kQXzpS90mriR61i57saUgTqpC0QZYUI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651231213, "uuid": "c1e589dc-5404-4954-a797-047476046c4f", "value": 415884, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651231213, "uuid": "a2a72f86-f131-4603-a273-a2cdc861b21e", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231213, "uuid": "102498f2-2f49-4fb1-98fb-590bc212c6b8", "value": "STR-DD225227.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75dbe6fc-c7d9-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651249734, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249734, "uuid": "a347373b-4b7f-4a5e-aa98-289a126f8df3", "comment": "Malware payload (Quakbot)", "value": "d446ba8af3d83fc4111942d9b75d5164", "object_relation": "md5", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249734, "uuid": "5d4ee14d-d1a8-4794-9786-f7dc6468e6f3", "comment": "Malware payload (Quakbot)", "value": "60a0695f0e64b208e38aa1688237937e4dfc3054fee40f143934a09d29e4dc19", "object_relation": "sha256", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249734, "uuid": "73b672d7-e946-4ea4-a8a8-8f88c0c7561c", "comment": "Malware payload (Quakbot)", "value": "06ab5bab87b7a103c279fda38d1d975714e37a5e", "object_relation": "sha1", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249734, "uuid": "2707ab4e-fd25-431b-9ac7-94f7c53e80e0", "comment": "Malware payload (Quakbot)", "value": "9a3ddcc67b6cfd1a31a0e703c24f9535a4a69e3bfb025402aab75dc34c638d7966c87ebf671c6b8cb529f2481725a10c", "object_relation": "sha3-384", "Tag": [ { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false }, { "name": "xlsb", "colour": "#0C1619", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249734, "uuid": "b00b81b7-e07c-4128-aeeb-0921304c1f12", "value": "T195452373BDE07CA8514E953DFE9130A4EAC2B9413FD6CE7358B61D7295AA0D2003C5BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249734, "uuid": "01963f8f-4e5d-45c4-bc59-62725ab4e1e7", "value": "24576:AnbKJ4LIxfqGGQbL2fWOlxCBpBnLl/T67X61PjJjLQo7l0FN74Ne1:AIsIxSGGQ/2fWOlEBpBJ/TqX8r5Qy2vh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651249734, "uuid": "65d05f60-5346-4ea4-baee-8eb7e6752f0b", "value": 1203168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651249734, "uuid": "be2d57b3-33c3-4ea5-938b-9f7f6f510b84", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249734, "uuid": "5455e7ab-f75d-4293-ac74-1668f7bb0802", "value": "ClaimDetails-1021637739.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7606ea50-c7ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651236419, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236419, "uuid": "124a4a62-d3a1-4324-be0f-2596fe75bc4a", "comment": "Malware payload (Mirai)", "value": "f065efce2988a609e71b922ef28cea37", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236419, "uuid": "5238efb6-a9b0-45f1-82c2-5dd2b2aa4992", "comment": "Malware payload (Mirai)", "value": "60ba447618b51800d412346b0baae6d3e4b5e7d215ea7faccfdd833110328b56", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236419, "uuid": "a7a51b4e-0292-4e66-8439-3bd4b29bb013", "comment": "Malware payload (Mirai)", "value": "d9af85b8c16c3a871e7469bfa059c171f1aecc9f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236419, "uuid": "60d82fd5-96d8-45e0-9742-a4c7953cfb24", "comment": "Malware payload (Mirai)", "value": "d5ac5f388d5de4c2fdb270218bc9b86a53b2d046a8f0b4557087ec943f2453ec9a1716d5e7e3d7d086eccbe32b32ae61", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236419, "uuid": "e1cbe44a-4816-4e0f-89ef-74ccd9493c7d", "value": "T100732996B8919A22C6D4137BFA6E41CD372163E8D2DF3207AD201F6477C681F0D67E45", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236419, "uuid": "4d712244-d670-4fb3-bd53-e749faf8dc69", "value": "1536:XpXcKpBUlet3DBboJubLCNgpRTZGTkcahWMPiY4g5q9/e35roFQ:XpXcKLU1cRETkvhTkgp3WF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651236419, "uuid": "fa5204db-a264-4630-8d0e-da486e4361a4", "value": 74744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651236419, "uuid": "f4af00d6-24ff-4ba4-822f-bed3ae9cfe2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236419, "uuid": "e6054baa-b623-4e5c-b2ec-905228e2d374", "value": "f065efce2988a609e71b922ef28cea37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a453a040-c7ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651243369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243369, "uuid": "b28236bc-b480-42d5-b0c9-c15cdf7c4940", "comment": "Malware payload (Formbook)", "value": "75cef7a355873409f7bc1d9bc7a6bfd4", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243369, "uuid": "85d99684-5e2c-4822-b0ab-8c7890ba0a25", "comment": "Malware payload (Formbook)", "value": "61545f6e85bfb0ebb6c65a52d511bc09f9eb8f17f41f303fc4028bfbc6a333dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243369, "uuid": "89d4fec9-3caf-4da9-b748-fe8e12413184", "comment": "Malware payload (Formbook)", "value": "64ed3c36ef49e33520ba68649a0fa1556fa400b1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243369, "uuid": "e937b440-a329-4dfa-adee-64811ae718f1", "comment": "Malware payload (Formbook)", "value": "52a0ceace21f22f44334ab78807bd2fd38bd8f5ef5f218148e762661e5e0f12a5ff9a174380b098ed8cca5785a511963", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243369, "uuid": "e119ff6c-ac81-4165-ac73-0a6583377675", "value": "T12EB4F158B2BBC902C2A80733C1E79A0403B59B45D263FB4B37E556ED5D133AB4E453A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243369, "uuid": "6833a28c-d7c8-41ea-acbe-1debaeea4ba8", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243369, "uuid": "7d6f6a5e-d3b9-40c2-9065-c172463429aa", "value": "12288:G06Uk+oY6Zv9OAu/w7NsQK+vdLP1XrV9/Z:G0h6ZQtIjKerd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651243369, "uuid": "ec6f76aa-0227-4e4f-810b-a6a1bf426622", "value": 527872, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651243369, "uuid": "21342b2c-8ebd-4320-bcc3-38f9deab1665", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243369, "uuid": "38c697d3-ec5d-4c82-b7aa-f3e553864163", "value": "75cef7a355873409f7bc1d9bc7a6bfd4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a116833-c7bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651237285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237285, "uuid": "8664f1ae-bf11-4ead-809c-c825d4e815a8", "comment": "Malware payload (AgentTesla)", "value": "dddbbfa1fe3bd945d55002c088d06190", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237285, "uuid": "f66303e8-fce4-4c65-be2d-1c548ea9f4c5", "comment": "Malware payload (AgentTesla)", "value": "6163ad7ceff2ca31cdb64d7a8a5c51be29057bb0360c81f09db6fb20f83be429", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237285, "uuid": "9158ea49-c93d-4a2b-be97-b5c55570ccc9", "comment": "Malware payload (AgentTesla)", "value": "055ba7bf9a8dbe0bb75ae9d548449df4ce3ece69", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237285, "uuid": "f6442d1c-4f64-47ef-8807-f0075dbc93d2", "comment": "Malware payload (AgentTesla)", "value": "3a85ea9ebbd8d05343dc509fbbd01979c08afc1c1dd6dc9ac66e22593452a7d895ddf32c624468a3983050b6663a162b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237285, "uuid": "3d93a974-6847-4fcf-ad52-13a59798fc8e", "value": "T157D49DE2324C9AD3CE75997616CB8EA103E349251122F7336BC37BF2364265BEA171C5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237285, "uuid": "9971fbbe-2f05-41b3-9212-796ad9c1b9e3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237285, "uuid": "de4b9e16-fad4-4f80-916d-a8ddb8940ef0", "value": "12288:iDnx6/cE9gCyGuA9w0xUtLdkRgR/rhtmpG7tVf:Mgcqg4Z9GTmpG/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651237285, "uuid": "5aa6a244-740d-4a01-b3fc-f51281c14661", "value": 650240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651237285, "uuid": "3151a992-9d47-44f8-80e9-655d27d124fe", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237285, "uuid": "7906ced9-a281-473a-a321-c572803273fa", "value": "SHIPPING VESSEL ADVICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e568ee11-c78d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651217279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217279, "uuid": "e42fba21-75bd-423c-889f-13be2318dc87", "comment": "Malware payload", "value": "e26a531fc331deefc14a0d0ed551ad02", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217279, "uuid": "6216c187-2551-4119-9d27-1e6016a27115", "comment": "Malware payload", "value": "619834708c823655706de814652326d8dd0e2bc5a6027be6b787fb54036f0dff", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217279, "uuid": "d3debd00-a6d0-4a38-bf55-adfcfc436a8d", "comment": "Malware payload", "value": "f5a97d9840e08ee5b4f595187050d3de9a8ec9a6", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217279, "uuid": "82c4b8a6-ffa6-4407-9535-7b8c33bded03", "comment": "Malware payload", "value": "ed0c8b7534821be63e785a4568eba03e8af04028b2aa66f3775cc80538bf758ec2e78059a348cdca19338960bbbff53d", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217279, "uuid": "6b295d6f-5031-46ff-acd4-21b2ac8369c3", "value": "T1D323D7AAF2D9DC06D955033548DBD6FA3323BC225FDB96473284F71E5EB4A809A03513", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217279, "uuid": "bd68977e-0ede-47ca-88e5-e60f437e9e7d", "value": "768:PqoMKpbdrHYrMue8q7QPX+5xtekEd/68/dgA1AoWsXIlCsSDldks3k73uOSHU/:StKpbdrHYrMue8q7QPX+5xtekEdi8/dz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217279, "uuid": "3b0d167d-adf1-4d08-bac2-c248b9a534ab", "value": 45568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217279, "uuid": "65ef00b0-ed0c-48e2-968a-99af02d742a2", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217279, "uuid": "3e882801-eee8-4c6b-96ea-6fe9acc0abfe", "value": "payment_info788.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ed9fff9-c7b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651235387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235387, "uuid": "1a53f415-fe21-4f00-b600-11e60536cdb4", "comment": "Malware payload (Mirai)", "value": "5882d860c67644e90c9fda1cc8322815", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235387, "uuid": "5cc2ead2-e751-4ca0-8404-cac206b3c044", "comment": "Malware payload (Mirai)", "value": "619dec14d076b1e7d27a03d4372c382c380dbd5b2cc4235b1d1102ba0b0fb655", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235387, "uuid": "86d73e1e-64c0-44c9-8e86-9ccc0e22ff0e", "comment": "Malware payload (Mirai)", "value": "775916d54fb27787f6f8f43104cc994b18ed8764", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235387, "uuid": "186f3b08-a593-43f7-b4d5-cffa2ed5cab1", "comment": "Malware payload (Mirai)", "value": "39e81a54dd2e1cc7aecd694c0fe06a5063a4d84cfafc3cb82d8700f20fd824e9dd7316b6072ff26eb572b94ab2b2fa8a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235387, "uuid": "d3483d22-50fa-474e-b4f3-16dc5681987d", "value": "T11E330891B9824E6AC9D513BBBA6E55CD332063E4D2CF7313D9204B543ACA51F0E6BE81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235387, "uuid": "935904b7-42d6-4343-aae2-33cf2d4c7753", "value": "1536:De5kgYawggPL6LCgHfjHBSyEvxEy3RiaBy21TJA:YhwgOLQCorHUHvGy3Rls29J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651235387, "uuid": "b759cdd1-4af4-4dd7-8377-c8e3f61c5c08", "value": 50796, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651235387, "uuid": "f6d18de3-a264-4215-9466-689357433bce", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235387, "uuid": "38aefb67-84c3-45c9-8ca7-af00887b73a7", "value": "5882d860c67644e90c9fda1cc8322815", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40c38c0b-c7d1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651246209, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246209, "uuid": "bc619d79-8f32-4ecd-87d3-f8ac9693beba", "comment": "Malware payload (Heodo)", "value": "e923e1eb1a6d90ca333d6a5bfc90735c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246209, "uuid": "407ca9e3-b60d-4841-bb2f-022ed557017a", "comment": "Malware payload (Heodo)", "value": "61e483dd44d619ef46ea01cfb44bc2cad21da726d54be9ba9c8c154e6da5a260", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246209, "uuid": "3d4e99bb-8335-4764-9953-53eb362cbcee", "comment": "Malware payload (Heodo)", "value": "b1c8803fea45557342b8d18437fc707b0e58ceae", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246209, "uuid": "ebd611bf-6a34-4014-b859-60cf2d0d5b6c", "comment": "Malware payload (Heodo)", "value": "55996a41ec73a0b391db67272681af2de517d968aa2919199f73e9e9525a386f3e8b31271de22b2e82e767fe989f85a2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246209, "uuid": "54a1946c-a90e-4943-a933-b1a6866e3bb1", "value": "T18394D0076A534EB9E627C23745E2F3329072B5553225BDBF2E92CF330F2AC605B69149", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246209, "uuid": "e64ac905-9bde-469a-b1b3-9d4e60fd6c42", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246209, "uuid": "148d2d97-e11d-4735-a52c-a171164fdae1", "value": "6144:JhZ02GdOOgPYRKUUAKM4cLuCKhS4OzJ1fyoogcK1GY:JhFfqKRM4c6CeOFzLcQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651246209, "uuid": "78829924-4ff7-48ea-9079-b4ec7769889e", "value": 433776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651246209, "uuid": "9dfad393-71d3-46f9-809b-031cb5576e96", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246209, "uuid": "f948472a-5aec-45cc-8f63-51866ecbf459", "value": "emotet_exe_e4_61e483dd44d619ef46ea01cfb44bc2cad21da726d54be9ba9c8c154e6da5a260_2022-04-29__153003.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6d74de6-c7a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651225334, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225334, "uuid": "784e2316-a1a5-4a8c-9f63-ca312c5894f5", "comment": "Malware payload (Formbook)", "value": "9c145d8a2dffa0eafb09c0978f4a2364", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225334, "uuid": "a8c5d43f-eee7-4397-9f62-f3635eab049e", "comment": "Malware payload (Formbook)", "value": "621b174ac7de9b3b3b7698769ba6a83577db9453c8a93da26491d0cbfadf9f62", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225334, "uuid": "bee5958e-b3be-4cfb-acc8-88a57dd57064", "comment": "Malware payload (Formbook)", "value": "82c13a966ec7e2e037c49ae1fa8779d0698e465d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225334, "uuid": "b390c5a8-906f-4ced-9d7a-7c7206919641", "comment": "Malware payload (Formbook)", "value": "e011475bc1cb072fc2dd5553102ecbb96681fc2f3ec6e6a73576e455747b5ff82181569ff5dada74906318aec6d4033e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225334, "uuid": "c0adadb2-843e-49bd-a7d7-98df37057e50", "value": "T15B64121C3DD4C853CCD62A352D3B7A57EFFBB92A25208A4B1760BB9D7541B409B2E309", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225334, "uuid": "febb24fb-4bbe-4fdd-82ac-14ba1fe91b5a", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225334, "uuid": "acb913e2-07dd-4b96-93b2-38ba4e6953af", "value": "6144:HNeZmPo4tFXm5Ikh/celbL/ZDXbxdbv2+cyBoyGArniWg9S:HNlPo4t1Dkh0eLXbXbv2+b8Wg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651225334, "uuid": "78a89c2c-a884-4b08-aa24-e6066e2d7655", "value": 330071, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651225334, "uuid": "109aa30b-0cb3-4a72-8cd5-1aae679325e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225334, "uuid": "8946ab92-e201-47a8-b060-cdeb721f0c05", "value": "Shipping documents FDW11341-6 .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40609d15-c761-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651198104, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198104, "uuid": "cbbb732e-e6bd-4834-b401-aeba5c4a8173", "comment": "Malware payload (Mirai)", "value": "1ce89df9dd6f60cfb534416ab0a8f430", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198104, "uuid": "a8f793dd-e6f2-40c7-88f3-adaf867bfe2d", "comment": "Malware payload (Mirai)", "value": "62bc23a0472b18da02e05228ab6132d07b18300f1bfa03b9651e08e6cab87a2b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198104, "uuid": "f38e6dc3-f010-4b65-8e99-05e1cddf529e", "comment": "Malware payload (Mirai)", "value": "961c867f4da83d56154511e90c1436e92c741643", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198104, "uuid": "d451a7ea-62a7-4682-9868-f43f800a48d3", "comment": "Malware payload (Mirai)", "value": "a1852152894ea8ea271c86a481723d59ef35ef74a9817b98d57c1d62aeb1ad320840c2e3d2ca3feef89f881de96546f6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198104, "uuid": "0e1c0021-f1d0-4de5-899c-4457641e7a55", "value": "T1C7333ADAB902AD7CF98BEABE80160E0AB23123541053073777EBFDD37E321549956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198104, "uuid": "64363e16-7eb3-4c6f-9e95-4150731ce393", "value": "768:mLGOe2kf9e9X9nbenyIvvch9QnAs5gFHviPuzWeHXpi2UJTpDnH638g6:mL/4f8F1ej0wYFvimzpZi2UJJnHY8b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651198104, "uuid": "c164bc61-270d-45f0-94f1-1d3fa18741a9", "value": 53056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651198104, "uuid": "2ce24330-0c96-4fe2-acac-80fb80ec526f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198104, "uuid": "9eddd622-b0e0-41dc-ab1f-3bb5859b5c74", "value": "1ce89df9dd6f60cfb534416ab0a8f430", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60515943-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651217915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217915, "uuid": "634379c5-401d-47d1-9693-ffd4bed5852e", "comment": "Malware payload (AgentTesla)", "value": "d01fe4e79ed8e17b43b7ec4de7ba1ec2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217915, "uuid": "b02874c3-e4e1-46e9-a124-47aa86a51e4b", "comment": "Malware payload (AgentTesla)", "value": "636a37af253fe844ef53adbf8d0e1a3b360d80bc79c2d64c9feef972a0997e30", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217915, "uuid": "f7f0689d-6daa-4107-891a-2cc579d8f6e9", "comment": "Malware payload (AgentTesla)", "value": "11f715e68da8838005f638694f5835f107eeaa73", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217915, "uuid": "262c3471-2571-4969-9c7b-30c6a1fc0558", "comment": "Malware payload (AgentTesla)", "value": "88ae8ab3f44d33ffce74516614b393c51182b5b3b8108d0722955ae8e3fe7e47f80089375fa3bbc8afcc781eed29a2cb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217915, "uuid": "3089e7bf-3f9c-42da-859c-372f5fe2564b", "value": "T185B4BEE432809AE3DE66C87B17ED9F9011B021728175F7436F4073F507A3AAF6A65AC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217915, "uuid": "7f37b61b-2a64-408d-a51a-5f462c9b3a73", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217915, "uuid": "2cd83e79-6f19-410d-9b64-c37bab5dbba2", "value": "6144:K3UVLbF19agUWgGrClgTl6QobvrcU54EWYcR9+IlIqrhomhitAOjDq+z9CLVFOMp:K36vf9ab1GrXTl6QohBk9vIqrKmUG7t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217915, "uuid": "479e96ac-7b7a-4b53-b21e-ec550fb8cc82", "value": 516608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217915, "uuid": "dc0398e8-8a88-4f83-a03d-84cde0537577", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217915, "uuid": "284b04c3-8584-40ee-91a8-e4a2fe134932", "value": "d01fe4e79ed8e17b43b7ec4de7ba1ec2.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "308082fe-c788-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651214828, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214828, "uuid": "edec95df-c03d-4590-9830-f95a102bae29", "comment": "Malware payload (SnakeKeylogger)", "value": "96cdd571cd3dc4fe77ad377026b27019", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214828, "uuid": "968f57d2-17cd-4ae2-a941-efd6120b4117", "comment": "Malware payload (SnakeKeylogger)", "value": "6551736e57761382adc73f0a9e50c8d2ecc0b11e2ed1411c05d83c03e2978c00", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214828, "uuid": "91bb6bf0-e843-4af2-a2e8-653a4819f01b", "comment": "Malware payload (SnakeKeylogger)", "value": "95a3873dcf8c4bc09117ab054cfc0244dd2eff4a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214828, "uuid": "2bb0f31f-9d09-4e2e-8cd4-3f648cf436e6", "comment": "Malware payload (SnakeKeylogger)", "value": "ca249a7b5ca18b632e7e99f06358a315b2c2668a8d3098b69ccb779a84cd6c865065ca2c386926c3907a4ee2f6b0b7a0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214828, "uuid": "58e81eae-62d6-4a46-905b-7ae45beee080", "value": "T175B48DE1368C9AD3CE3659760ACF9E6113E349211122F7336BD377F23542A1BEA17285", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214828, "uuid": "23881ae1-9922-4454-aca7-4a20cecb47d5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214828, "uuid": "de056c98-d50f-4717-b0fe-50230db55342", "value": "12288:3o8LxB6My9+mLsOarX47kyogyCF2jSsAsfG7tfa:d04OaM703Cw/AuG8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651214828, "uuid": "767ddb52-abdc-4f99-8145-14deec53929b", "value": 535552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651214828, "uuid": "ed972fdc-f587-4334-a96b-62c744587257", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214828, "uuid": "3e4c9189-59f8-4551-8d86-d374da7837d0", "value": "22041081517_20220329_16042903_HesapOzeti.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8737589-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651218036, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218036, "uuid": "ef9d025e-4574-4468-bd7d-f4020d5373cd", "comment": "Malware payload (Heodo)", "value": "758ba45b2691db6a890a613774ca6e8e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "HbustxpL", "colour": "#DB9DD6", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218036, "uuid": "cd0f5ca4-c9ae-4987-bbd2-cf68498b6c80", "comment": "Malware payload (Heodo)", "value": "6594f84689ea36bb680c387dce3ce64590d0ddf4d98b7075a3843f00e1f09ef6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "HbustxpL", "colour": "#DB9DD6", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218036, "uuid": "db3c06a5-19ad-42d0-97a2-420772d1174c", "comment": "Malware payload (Heodo)", "value": "1a52226cdfffcaa743bdab92e568a20d1f756f53", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "HbustxpL", "colour": "#DB9DD6", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218036, "uuid": "0b221376-2312-4c62-8fed-4d1d46bf75ae", "comment": "Malware payload (Heodo)", "value": "010b1324715e36edae82dc928fb6718f91f944f44878024c9f65e34603f171fb03e2d0ecce92425a7f5b4b7ada6a9fc0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "HbustxpL", "colour": "#DB9DD6", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218036, "uuid": "d2319f4b-28f7-4778-9403-89645ac92685", "value": "T16321086C49A09FA0E0EC603E5CEE3F64402094A9C0720757D0E38E143AE7DE8ED09D1E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218036, "uuid": "4529493e-49d4-4948-afc1-c05797a7f423", "value": "24:HdX7wA4d9eT7zWhSp9adfn9RsFE1Lg5MH1LaPmh+TZ+0/n2NMJ1farty0EVKOOLy:9rwXfe/Kh49ajMyLg5sc1/iSyrts9OLy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651218036, "uuid": "063f5414-5223-49d7-a0a6-9182c6a37c8d", "value": 1405, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651218036, "uuid": "108f20f1-49a5-4c79-b41a-0b9db2c9f297", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218036, "uuid": "9a1f0254-c44c-4448-9069-a208dba714db", "value": "Tav_Dokumente_2022.29.04_0916.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870ab306-c7db-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651250621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250621, "uuid": "3a881ead-4572-46b0-9cd8-53e214387a09", "comment": "Malware payload (Quakbot)", "value": "c4eeee3b55d2764c3b91a041b2f67b04", "object_relation": "md5", "Tag": [ { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250621, "uuid": "dc864c6c-fc4f-427f-aa64-6f1cabc9a220", "comment": "Malware payload (Quakbot)", "value": "65cea9811034ab826cd29d81c9e89a7dd054869f45ef617e5e7f76c29ffc498c", "object_relation": "sha256", "Tag": [ { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250621, "uuid": "158ce3b4-2055-4967-88e3-5425162e10b7", "comment": "Malware payload (Quakbot)", "value": "4d58d7ee14bd02f9c83e2b864037dd0954efea60", "object_relation": "sha1", "Tag": [ { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250621, "uuid": "f99ee209-6e76-4244-bdd0-38cb10b1e8be", "comment": "Malware payload (Quakbot)", "value": "a5199fdfa4f2b3e8d3130330c44f44e26301526feed12f7dc36cddde0f150ce1ad7c1b94755c0e3a59c7ca7e0694b6b4", "object_relation": "sha3-384", "Tag": [ { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250621, "uuid": "f54af7e2-6205-408d-99db-b5cb3e925858", "value": "T1CE45236278F4F47AC4A6D138A9C030F0D7CA26562BD2CE3B9D665DA055B70F2827847F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250621, "uuid": "8e2a8cad-f1f8-4ebf-934c-1b5fab4f72ef", "value": "24576:8vTXkVoeqpLi2Wu9rsK+rgxmQjpcNWpJApJ2pJDpJOpJspJT:8Dkvqp/Wu9gK+rgxmEpMsAmzu05", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651250621, "uuid": "14f2c3f8-5c38-44d7-903a-fa21cedf8a8b", "value": 1230040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651250621, "uuid": "ef8cfa85-3eed-4edd-ba89-d1357ed3ab78", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250621, "uuid": "3dec1f6b-cc98-4e0e-a3b0-d77dd21bcab7", "value": "ClaimDetails-958201137.xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe51ecee-c7df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651252540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252540, "uuid": "1791d282-c62b-4269-b917-7aa5f6fdc5aa", "comment": "Malware payload (Heodo)", "value": "37b8e4fb6a0c458b9f9e8fcd6b3d2058", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252540, "uuid": "33640b59-0972-4bd4-a664-587b6db9cad7", "comment": "Malware payload (Heodo)", "value": "6696da4130c4943421a89e9acaea0ec43754f32eb525d6f3269de94672658bb2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252540, "uuid": "8e323adf-54b9-4f53-8b29-81be15031bed", "comment": "Malware payload (Heodo)", "value": "270b5900adebc3f5ddeb41b08e87279f4d38201f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252540, "uuid": "8544f1c6-1000-493c-bd2e-e7742b4c3807", "comment": "Malware payload (Heodo)", "value": "cfe7253bc979c50b6c3a5d4c4fb1b12fe1b6ac1088bb882f681a47396b9fd09313006e168bffc52cc9184ac6b97fb509", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252540, "uuid": "d77e816e-7097-4862-9ada-3cc36941445c", "value": "T1D2C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252540, "uuid": "652912d6-bb95-4797-9a88-cb32f49828c5", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252540, "uuid": "605f769a-a973-46ac-9492-840db4c3635e", "value": "6144:JhZ02GdOOgPYvKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfUKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651252540, "uuid": "88ed9f90-22c5-49dc-9fc4-3b58659737b0", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651252540, "uuid": "81eba5b7-99c8-4d6b-b9df-50393caf3c05", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252540, "uuid": "0deabe22-2a32-4e7d-8ed7-7f04196e39eb", "value": "37b8e4fb6a0c458b9f9e8fcd6b3d2058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdddc176-c79a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651222903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222903, "uuid": "832f2e3e-e679-416b-b7c1-8ca493aef016", "comment": "Malware payload (AgentTesla)", "value": "dde77927aea31a4a4aa674a2bf79d42c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222903, "uuid": "c42f8761-bab2-425a-8f18-d9f4c845b3cc", "comment": "Malware payload (AgentTesla)", "value": "6716ce8c961f701ca25fe831ecf94dd60dc70990b31b92f229a34317c5cf9cbd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222903, "uuid": "f31013d1-3560-4932-ba74-7f8578ea7f53", "comment": "Malware payload (AgentTesla)", "value": "ce422511a98374e78a9424d89c816c3220023ea4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222903, "uuid": "914cc2ac-1752-419a-a69a-4378de5cfcff", "comment": "Malware payload (AgentTesla)", "value": "afcc55d6bb294bbbfaba2c2d1ed4f58260b5249b8b4c6efb1259795c679576df42e44d053dcbe9c0f6f16e4584de1c91", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222903, "uuid": "ed353345-8557-4a6b-97f5-2b05ee54e5db", "value": "T1BFB412562BF98F26C5BD8BFD413A9A054770DB662962F30E1F8460E97DB63800B02797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222903, "uuid": "98ed9e2e-5b84-40f0-8005-e46948ce3e9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222903, "uuid": "649e1289-fcbc-4e0a-93a7-2d388f160104", "value": "12288:rPVpUZYum6uUviVn1Y+wUXHRsgH83iOGue:rUZYubviV1YMHSgE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651222903, "uuid": "d3bad316-019d-459b-ba2b-6f1c0d01ba10", "value": 534528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651222903, "uuid": "0346a99c-4e3c-4ee8-9e19-69f031412186", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222903, "uuid": "3142bc68-9417-417c-bd96-f2515623b90c", "value": "Inquiry.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30cf2fb8-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651217835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217835, "uuid": "6c551c28-a0d6-472f-bfd8-e63f6afd2c4b", "comment": "Malware payload (Loki)", "value": "d1198b5359d61f2ee98a814eb9ed27a3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217835, "uuid": "df5db083-e165-42b2-bca6-7bb74ca0b737", "comment": "Malware payload (Loki)", "value": "67286378272f3092628103421067df2717eb8b6c7e75dee664ae2157b2fe01be", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217835, "uuid": "263df70b-7a14-4034-80db-79f828fd1113", "comment": "Malware payload (Loki)", "value": "0fd81f702d9de5e291dd66db68992314cb391b54", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217835, "uuid": "51919102-c99a-45bf-95a5-f6f97071a698", "comment": "Malware payload (Loki)", "value": "967e1fa93522705ce5b650d30d206131b5a88cfe7ee7300af1bce739a532f6c2987eef4ef174c4378125855c234a191a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217835, "uuid": "06789148-5c33-4957-bd08-7e1d398ba173", "value": "T101C3F1187BD1C4A7E6A20F324E3A574AA7FAA41B1975C34F33A05F0C7D31A838A1E715", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217835, "uuid": "9092eeac-521f-4668-98fb-e082454b8c37", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217835, "uuid": "85b07a43-3009-4503-bf64-ac157dbaf2ba", "value": "3072:l1NjcVVnLpPunb4fDm35x92/BxIV1FzKjMXJJf8Xzqwu4959Y2l/ecaaU/9:HNeZmYeY/LI5WjcrmzJu459Y2lWcaa2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217835, "uuid": "a6837999-f9e5-4737-9cea-33003000d865", "value": 126532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217835, "uuid": "42d48175-772e-4f37-a093-37f37c42be3c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217835, "uuid": "88e29b1b-21e5-4350-936e-e5434b767327", "value": "d1198b5359d61f2ee98a814eb9ed27a3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "286e3f1e-c7a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651228988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228988, "uuid": "88180f73-ef96-46f8-81d6-2b699a5c95c8", "comment": "Malware payload (AgentTesla)", "value": "9e25268b6a9a3e8c453e6911486b44d8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228988, "uuid": "3fb7f856-dcd8-4a39-86fe-03e5952291b1", "comment": "Malware payload (AgentTesla)", "value": "6728945cf1f21b7cecb35e71f9188832b5d269522244afca0f67fe474d90620e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228988, "uuid": "af26ffae-cfdc-4116-8db2-7573417f28c8", "comment": "Malware payload (AgentTesla)", "value": "d6d961b6a8a50a81c9855fc04f1d7396553b310c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228988, "uuid": "8cd216c0-cc10-45bf-b3da-3d6c0bbd283c", "comment": "Malware payload (AgentTesla)", "value": "644627432bed4e7635c07340c18e68d5122a7437c69f2ee740a9ae99eb54f53e3bd637e5f21de744ab395a54130ed847", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228988, "uuid": "6cc9aa6a-01b3-4e21-ad9c-f4cf6ba0ac22", "value": "T167056D32F2D18537D1721A3D9C5BA3A4582ABE512E38794F3BE43E4C5F3E68129252D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228988, "uuid": "cf193ec5-9834-4a13-bfd3-c2da74de9df0", "value": "332f7ce65ead0adfb3d35147033aabe9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228988, "uuid": "885082af-2493-4fde-b86f-afb5b21ffc69", "value": "12288:WMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9rQj:WnsJ39LyjbJkQFMhmC+6GD9E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651228988, "uuid": "4d2df2a0-5ba8-4d45-b579-bc6f9133c82e", "value": 810496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651228988, "uuid": "77add2e3-5903-4d03-bd0f-15af21b2f24a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228988, "uuid": "70fb2103-5804-44eb-bf1d-c66e8e23bd45", "value": "Kxqpdqxjm.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "77e55e9e-c7c5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651241147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241147, "uuid": "70de3cfa-e493-4d2a-8159-81aa466a40d2", "comment": "Malware payload", "value": "16621efd1fcb469c4dd2cf3b08c99359", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241147, "uuid": "af8f7690-fba1-4f10-a6c4-7b47bb166831", "comment": "Malware payload", "value": "672a907427a33e44ed76b2c260ef0420c09654c73ceba350b23690089365441e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241147, "uuid": "3cd1b8d0-6759-49c5-8eae-44d8d540f8ec", "comment": "Malware payload", "value": "b11bc398b50bc3a6ab0571a8f30777d86f65c47c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241147, "uuid": "09c2ab0b-c71e-4ecb-a471-3b92aad4e2f0", "comment": "Malware payload", "value": "215eb7480bf86dbc23d3043cbde5cdd2bd884a8b1433a687b0c80498105aee79fd5024b06946398f67c319a62c8820f6", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241147, "uuid": "1d65b9c6-bc5d-44da-9e4a-7f37635c0918", "value": "T10323F9AAF2D9D84AD94507354DD7C6FA6617BC618FAB9387318CF70E1EB42808E03563", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241147, "uuid": "b99bdda9-f578-4e7e-9075-86333c10a450", "value": "768:AqoMKpbdrHYrMue8q7QPX+5xtekEd/68/dgA1AoWsXb+q3GSHhQZyEHB19KNwoj:dtKpbdrHYrMue8q7QPX+5xtekEdi8/dF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651241147, "uuid": "f4b2d43a-0260-4035-8705-336fa4dcfe72", "value": 48133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651241147, "uuid": "2331942e-3a99-4bc5-b2d6-14d8b398d6b5", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241147, "uuid": "cbad0f7a-7bc5-4cf5-9d19-e1b5e10a9505", "value": "payment_confirmation1808.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f535b7d-c7d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651246609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246609, "uuid": "a5d1ca49-6e00-4657-8757-01c08ebea875", "comment": "Malware payload (Heodo)", "value": "f68127e62cc980a549b06bb31bd50939", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246609, "uuid": "f06cd410-20d9-4c0b-8e61-e89ea0704b96", "comment": "Malware payload (Heodo)", "value": "678aa9e570ec47ad573b7d872ca5c76d4e30fa23ff9c7457b37be2814d92e4d6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246609, "uuid": "d1b17efc-ff6a-4ea7-95be-12eb17321207", "comment": "Malware payload (Heodo)", "value": "5739273e8562211e844ff80b7e36f74223a61305", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246609, "uuid": "2f4fafe7-8284-4dfb-b7ae-6e94a673a1b8", "comment": "Malware payload (Heodo)", "value": "d81baa891713eda96f3aa9db3481c0d060dec8ad48cf3083d2a242d1cd7733a7c0c7c03af3346de84e6656a6e901fc0e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246609, "uuid": "e981c660-c3e4-48ce-b8bf-a379797515da", "value": "T1DEC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246609, "uuid": "83dd1d4d-dbdf-4aa8-b7c5-8fcb0f4fd47f", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246609, "uuid": "68224df1-1f02-478a-b05e-f1025fc0ed81", "value": "6144:JhZ02GdOOgPYjKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfQKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651246609, "uuid": "00028317-5669-427a-ad93-0136cf654ed8", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651246609, "uuid": "9c451724-05a0-422f-b353-0447fbf8dc08", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246609, "uuid": "a42965e4-ff83-48df-989e-d857f2b66c35", "value": "f68127e62cc980a549b06bb31bd50939", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bac9f51c-c7a5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651227515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227515, "uuid": "b421266e-beaa-46e5-9a42-384dfd19c5d1", "comment": "Malware payload", "value": "aadb2e95e78fcefa25d0fb7cc5e6d385", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227515, "uuid": "a742d6cd-f623-4766-a286-fc006004e6e4", "comment": "Malware payload", "value": "6857d7527345c1dbcc85bd372cde2335f6e3ad7a75c0e106293c97be6e94e505", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227515, "uuid": "337b1fa6-9694-443e-9bb8-0ff450aa1ed3", "comment": "Malware payload", "value": "6d272f1d6fd78a64fd6ce007104354a0bc5ee6e9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227515, "uuid": "2625288b-6ec7-42de-82a7-7b1c08ec5376", "comment": "Malware payload", "value": "3c2963ae6da0ca8490db394d144631e28aa488def0321017e40fb34763308e94b932d4c27cf4978a520f351dd5b22238", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651227515, "uuid": "e7646b03-b803-4eea-8007-c0d9a95bcf79", "value": "T165F47C105B52E25FEEC678F1BC1D59C09C5493A1EDAFD36E088AC51AFACB1A91007B7C", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651227515, "uuid": "facced0b-9919-4756-8340-2d1612f9a447", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651227515, "uuid": "3d7ee5af-8053-4dc0-a43b-abc132186423", "value": "12288:r2ZN7b0zfaV4bX1DAjv4n2VCoWsyTkzd/CLJio+ZzV+2XYTAhjafGeOELhh8E+ww:r2ZN7YOVAIxVCoVyTMEJn65FKAhgLhh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651227515, "uuid": "239ec538-c243-4353-98ab-f730f0570a67", "value": 735232, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651227515, "uuid": "5513b418-f455-44f5-8a1c-1890cf6f205f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651227515, "uuid": "2439fac6-6a69-4e95-92da-b068befadc02", "value": "HSBC-SWIFT-FAILURE-COPY2022_pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "787edb53-c791-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651218814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218814, "uuid": "a60d6fa4-920c-4c4e-9d2d-7a50a11ecd8e", "comment": "Malware payload", "value": "5d61b5829bc3e9f0a7a1e25916c8b23e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218814, "uuid": "9acb146d-f3df-441f-abd1-2dbbffd55f3b", "comment": "Malware payload", "value": "6887fcc1ceeb4408a181419909070a560f9f83fe77e3bfe26933c34da70d3356", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218814, "uuid": "7c751611-93aa-4964-a51a-6733d395bca9", "comment": "Malware payload", "value": "1411511c64fd34cfb66eaf6822cd0d78291eb12d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218814, "uuid": "4465a953-c538-41d5-8404-0f5259454812", "comment": "Malware payload", "value": "fcb4707cdf060bfa00d29397be2a1dae791d32a31640d5019e405f9273e342b96e523aa4ffee9e5c56d9913fc883432e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218814, "uuid": "efe84fa2-8246-4782-91e7-c1640661148c", "value": "T151A41226FA94CA8BD5B548F118320364BAE6FC211014D21BFB60BBADB8F70D1B75954F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218814, "uuid": "1618b189-be2d-497d-9acc-09d7703b8710", "value": "61259b55b8912888e90f516ca08dc514", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218814, "uuid": "ff6497b9-159f-48f3-919d-91499fc337e0", "value": "12288:9YyfXQggPUow2qfdaZaJqnOZA8dGL4kPmFqgE8af:9YkXZo3wxv4L4kPODPaf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651218814, "uuid": "7bd14f42-0ba1-42ec-9196-5e5bbc03010f", "value": 489569, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651218814, "uuid": "1b2a9823-b856-4812-a1de-f1b36d558347", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218814, "uuid": "02b543a5-2c21-459b-b53c-cfe56143863a", "value": "AFVANDREDES.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b30171a-c803-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267593, "uuid": "ff5acde8-9487-4f0f-bf4f-a940ad5c3bca", "comment": "Malware payload (Mirai)", "value": "7ea036941788221e6f9747714b3f12e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267593, "uuid": "eb3919da-e389-41e6-8f9a-d34aabad35ff", "comment": "Malware payload (Mirai)", "value": "68f72dfa7753f6ed79dcfd01d63fa5a490ae93be0ad703c7c1ea01dd43cbc99c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267593, "uuid": "20e03ba6-a10b-49e5-9da1-549b46a38f2a", "comment": "Malware payload (Mirai)", "value": "bceb1f4794c8420dbcbb579b503e7d272d6fa7d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267593, "uuid": "7f2c3005-fa56-450a-992e-be443cfaae30", "comment": "Malware payload (Mirai)", "value": "51d0d112bd276a14b6362dee352bb3949705f99b7e456590417db61433910fb0eb551589de40904e56a26f7ce9ac0d55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267593, "uuid": "6f071fe6-4e5d-4dcd-9935-27ead212b490", "value": "T172237CB198FAADD4D148C674A9248A780B53E402C6472EF95A4AC356504FFFCF62D3F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267593, "uuid": "b2c088ec-f458-43ea-9137-7efc18f42c57", "value": "768:UaKtUwth8ANVYhxneqCBvV9grHnl/fLiMd7/qBDCIm4owE4JCrpAm:UaUUwtO1MErHlXB/qBDewBJCrp1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267593, "uuid": "90e2ccff-1366-4d4a-9a9c-f39581de49f6", "value": 48784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267593, "uuid": "406be2c1-b6d1-49fc-b8f3-7800cfc6bb1c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267593, "uuid": "8445c260-341f-488b-9f64-7ed0a03b17b6", "value": "7ea036941788221e6f9747714b3f12e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eef95471-c7c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651240917, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240917, "uuid": "fd62a635-1990-4857-a2cf-6d014225777b", "comment": "Malware payload (Formbook)", "value": "d9da666e1b1d654546fd876f25208302", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240917, "uuid": "be9eee8f-ab94-4642-9084-cb35259ff671", "comment": "Malware payload (Formbook)", "value": "6a0a14fea572ac8e09a2165d0dc723d61727459673648a338a4b5056c8a4090c", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240917, "uuid": "b83d39fb-a0bd-4961-8656-c16e31f0e118", "comment": "Malware payload (Formbook)", "value": "2fe267bc5c2898567acd7efedd35a45c17d2c6dc", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240917, "uuid": "9dbf8a67-b5f8-4d7a-8ab2-4a645c38248b", "comment": "Malware payload (Formbook)", "value": "a3fc5b4508bf7cc8381c78ca9458b7f1c42911932edacbfd4bb6eb72ff3e6b1833802e4aeef82775e6a2bb237e13e059", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240917, "uuid": "8dc2d86d-ad0f-4d7d-b75d-2001a8f6e072", "value": "T10593E197225618A3ED73FEB24D6402D2DA247DE2BC30F55ABE36335915702C39663F22", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240917, "uuid": "a37d26e5-9d58-481d-9c3b-c5b2598ad6cf", "value": "1536:qG88u+tqB8whLFzbBM3xi+pfbXLwVWQLhCiklWWQM25S4QhZSNKvBFK5On:qiqB8wtFz8xFpfbE8wv5Sbhmdg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240917, "uuid": "0a16c9f1-8d8f-4ba7-b183-c3bfcc847045", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240917, "uuid": "f458a69d-46fe-42db-8409-e1b6a9642bcf", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240917, "uuid": "de1d5c22-f14a-4fe9-be95-c174b2c3fc23", "value": "Shipping doc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb96ccb5-c78a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651216001, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216001, "uuid": "f68184f8-9261-4f94-b33d-d67c9313bdbf", "comment": "Malware payload (AgentTesla)", "value": "783d9c8e359e74ad4b43aa7f092d3f71", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216001, "uuid": "f1f7b6cb-dcf7-468e-8ef0-324a3d9075a5", "comment": "Malware payload (AgentTesla)", "value": "6a92304fbafc74aab184e275a37c417e31936d6a63ec620de592478fba06629c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216001, "uuid": "ef3a7323-3758-4b1c-b179-41468c1c0425", "comment": "Malware payload (AgentTesla)", "value": "b6ea9acb252aca6f873f1939e2113abfa29cc2ae", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216001, "uuid": "1022c5b8-65dc-4a32-86d5-dcdb9b736ce8", "comment": "Malware payload (AgentTesla)", "value": "08afc263687b60ea94ea2fe7ea06756be049fcc0be53b510126155ebb3c4cf5f32a34a63678ab873fc3f55c8ff85d7d5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216001, "uuid": "31af3d1b-0d6d-4c39-aec2-23dfb8c5bdf0", "value": "T18DD4334B897503971F8DAACD7739A8B9D36160373937702218E6733F4BF0A1876052BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216001, "uuid": "9e783bcc-bb3a-4fb5-8b90-24f0a8461015", "value": "12288:711c77YABZtm8plIE31h9HIMWJMtdjK5lrEYOaoeA4jJS9D+x11MBfSmldp0:GBLR1h9HwMm5JDjA4Q9Dgeblz0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651216001, "uuid": "59efb696-0467-48e1-ba29-cb52a1282649", "value": 604788, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651216001, "uuid": "0be602af-4eeb-45b8-bf48-a8076d238b34", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216001, "uuid": "2fed0ba3-b8f2-4687-90e9-9f68cb51c1a4", "value": "PO-PROFORMA INVOICE.r13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b779e30-c780-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651211410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211410, "uuid": "7d4a4ea9-629e-430b-a249-af626d496697", "comment": "Malware payload (Mirai)", "value": "44d2d4b828f3b7fd409e9249e275bb2a", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211410, "uuid": "66213686-869a-4735-a4aa-04ff5072ce21", "comment": "Malware payload (Mirai)", "value": "6af406ba3b93c270320c56f64fe0b043061b1973bcb7ca0d117b717078f83a9b", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211410, "uuid": "135782fb-401b-45fb-8548-0354b29b5464", "comment": "Malware payload (Mirai)", "value": "5754ff34f4ab5c592e2f69f97d1e4abaa775d9da", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211410, "uuid": "fd613565-fa22-4a90-93b4-8a6f36d99275", "comment": "Malware payload (Mirai)", "value": "06703f1d395bcd4542f8a07967960a15aa1315776afe2eb789d512a43170f50339866bb6ce9231cd93fe1b74dc4ddf16", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211410, "uuid": "aec83dbf-6b65-48da-b4b3-d34febc5ce39", "value": "T12E63B506BF610FF7E8ABEC3745A92B0524CC650B25A97B75B930D818F64F24F19E3864", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211410, "uuid": "305a85b9-3ef5-4c1d-bc4c-91eb8416ce5c", "value": "768:kJnll3Ge/oH8QxRtzDevTJNYiXwLX3XSCg66PNAK0UH5Y4ePePseNJZfgDSAXiSF:kxll3GcoPSXwbdg5PQUHpamsoJZf5+Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651211410, "uuid": "cfafc4a0-831a-4254-884d-3f6e90170a59", "value": 72952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651211410, "uuid": "cf1bd84f-a8d2-4f6e-bc9e-481f56a53d3b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211410, "uuid": "ccd319ce-cb4c-4103-a8eb-a493a3d17720", "value": "phantom.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "289bf97d-c7ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651258194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258194, "uuid": "c0b52051-0b26-42b5-987e-9e1d8e96ff35", "comment": "Malware payload (Mirai)", "value": "50df619baf94386327384f54a1639f51", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258194, "uuid": "b0bf6e94-6fa4-4fe9-aba2-b488d603f2ec", "comment": "Malware payload (Mirai)", "value": "6b4b514f2fa353e3095bc786fd3476e530e0bd0c7d18fb2b2b0f0397fb9b510d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258194, "uuid": "24fb2e28-dbf0-4ab8-94c4-49266fba3438", "comment": "Malware payload (Mirai)", "value": "3278bd59c2d1f9a8d4f10b3c7dc13399fa510d3f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258194, "uuid": "b0fd4613-3e12-4811-8775-affb725a255f", "comment": "Malware payload (Mirai)", "value": "008bffd451635d9a0100afdee28d75c3b22e19f60b59dfca14dcac7fe7a01f5ddb4ea3d895c8712dee8a3286bad66588", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258194, "uuid": "4ce9b07d-a366-4e82-9dff-f19735c5ff3c", "value": "T10A2302432093BA03F43098FA45228D9DB55AA6BDB1BFB7A721450D194C35D93ECB18ED", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258194, "uuid": "0f0a67aa-91e1-4d49-a133-31542a6f0c50", "value": "768:aK7y1XGO1LCNgukEkvwtqPnH7u83nc0iFoLQ9q3UELWt/iw+kvBGg6+fYtrBHx:E12O1LCNguovDPH7TcrGlLWhiw+kvBGn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651258194, "uuid": "d3f9767e-5d3c-4343-b61f-15d969757629", "value": 48696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651258194, "uuid": "5696ee70-6f76-4b46-9dff-ac409e3f1257", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258194, "uuid": "fbb5807f-d085-4dd6-a59f-dd53926b8b01", "value": "50df619baf94386327384f54a1639f51", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b78c827-c780-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651211410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211410, "uuid": "087b4826-7086-4889-9566-1b956af66f34", "comment": "Malware payload (Mirai)", "value": "9d58da8ba809412eacbc1f7f2a8c4dd0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211410, "uuid": "a453f4e8-0c26-473f-907a-33658a7afd9d", "comment": "Malware payload (Mirai)", "value": "6d22732bf6215cba80dda7e0aa16e94e697841f82f15e7a75f93c0a75bd0ec95", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211410, "uuid": "9df0215e-8454-4b65-87af-151210a493c9", "comment": "Malware payload (Mirai)", "value": "5aabd4d127902a69c25a140296dc187a41ff61b6", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211410, "uuid": "7dd11075-d5e4-4d9c-a6b9-7301ca56a2e6", "comment": "Malware payload (Mirai)", "value": "63a44e609843ed9ec1f84bb54880895a748edde48ec7db31b56af36bc2d0b13335cdfb169344b9c664982ab537af1f48", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211410, "uuid": "92cd4291-7dc1-48cd-b0ff-3c9a27c0acbf", "value": "T17763A7193E218FBEF79C82384BB78A215648339637F1D584D19CEE011E7078E645FBA9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211410, "uuid": "53b5735d-5855-4729-ac8d-3be0e225e0d8", "value": "1536:MWQXy8iy8JJSn3kwykg1w0vELws5irPEnnu7x0mIu5:MW4yBy2qUwq1w0cEsSEnnu7x0Fu5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651211410, "uuid": "82a5e3c4-0682-4583-8814-541d59fc2455", "value": 71672, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651211410, "uuid": "8f07e06c-5494-4cca-b740-f3af88862664", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211410, "uuid": "2e573773-ec0f-48c8-b3cc-ce3cefe37f0a", "value": "phantom.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "924a547d-c753-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651192229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192229, "uuid": "44e90952-4311-484e-b8d3-7609997c59be", "comment": "Malware payload (AgentTesla)", "value": "01ec9c547276a2208643eb5433ead00f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192229, "uuid": "46239527-2d7e-4ccc-a490-0c84d18ab1cf", "comment": "Malware payload (AgentTesla)", "value": "6e35d430640791e6426081818996c0646284c58b2d5673b199bc8b4b2fc12847", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192229, "uuid": "17b36e91-3e1f-44c6-81bc-333b598c540f", "comment": "Malware payload (AgentTesla)", "value": "85d9a4d62bdc851f307704b71a7432cbbbed9a21", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192229, "uuid": "b49fefe7-9494-4c75-bbea-3370705b2df1", "comment": "Malware payload (AgentTesla)", "value": "17a595a27ec9bd40c7a74e14254ac39234bc915c00536e7207ee33cd6b7f9018e5cb3a2fca2540e77bae0a11e5e60eeb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192229, "uuid": "16187b8d-70f1-4629-a1cd-7aa983974079", "value": "T131C35FF5E734B919F010C97CF99982703AF9EF609F329542B469763A197E2BC2D220D4", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192229, "uuid": "c146a2ff-1341-40c2-ad22-fe782eee9de3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192229, "uuid": "21ebdfda-00ca-4b45-94c5-ca2db0f2f681", "value": "768:W7VsMwNduuIImiFez53maHiYswN8Agw3nZPHbzYKT:W763/uuIIpy2tAVZDz7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651192229, "uuid": "00bb69c9-5671-4436-a0e2-cb668e2c78a2", "value": 128000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651192229, "uuid": "bcfb0e65-152d-4400-b6d5-ada8b82297d8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192229, "uuid": "f8e2169b-e26d-4147-aada-f4c1d075811f", "value": "SecuriteInfo.com.Variant.Strictor.267773.26324.23954", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e32c10a7-c7f8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651263231, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263231, "uuid": "93bea4a1-bf94-4ab3-88b9-83f549cceafe", "comment": "Malware payload", "value": "fc0aefa47ff38fa8eb4384d4a5e22302", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263231, "uuid": "214d364b-a661-4f4b-9f21-b4fdb5a4ef15", "comment": "Malware payload", "value": "6e450e38be8f6ab5d497cbdf26e5ac2d8e24fe7fe97f5f06e308a287c9c58be3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263231, "uuid": "134c54d8-5d8c-46f9-b22a-f80be1bc6c26", "comment": "Malware payload", "value": "ac28c95fd83a88d5192efd1ee716c52fa67181d7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263231, "uuid": "5b55d3d2-99c4-496c-aa59-b68143f5ed9e", "comment": "Malware payload", "value": "0e62b100a774f4eed740dafb3f628fa11f5604b41dbdb1e462603cb2fe72c82e3b4e0a077c0af9defcedaf7c850737f5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263231, "uuid": "07ff3640-7a64-462a-ae5d-a8d43d2db710", "value": "T1A3E41241B645C290F4348A77D497EDF10F213D1EEF52A81B7688BF1638772226E27B1A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263231, "uuid": "4e513d06-8949-43f0-a2a8-3e6bafb003d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263231, "uuid": "88bcab65-49e7-4e0f-aed0-2df3cdfb558a", "value": "12288:Guft1XI85Qyfmrso2JstksbJ1fQPU//pDd1a40TkvTjufqQ9hG1KR+muOb+VNCxX:GuV1f5QyuAJGk0JCc//Rd/L+HhG10+md", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651263231, "uuid": "efae3e56-0fe7-4a3d-a098-289702a7d73c", "value": 671744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651263231, "uuid": "c72d70b7-e438-4444-a71e-0a0a6fe4376b", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263231, "uuid": "45008200-87d0-4589-b8b9-260dea447f47", "value": "FudQuasar.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "71d1ee88-c7bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651237701, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237701, "uuid": "df07cde2-9d83-4b16-9a68-a3e4d4015ffa", "comment": "Malware payload (Heodo)", "value": "4223fb01c5a178161de151b6c548b0be", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237701, "uuid": "3bed7520-47e7-4f8c-ab04-dd1fc75ad13a", "comment": "Malware payload (Heodo)", "value": "6f0fe03bdd1766c138fa1076e61923338685d333a09c852f375b3b762b5cf575", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237701, "uuid": "98683368-94f4-4ecb-9403-025d8975fe05", "comment": "Malware payload (Heodo)", "value": "ed32c7df48a4129ad02e7601c04c1df95e288ba4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237701, "uuid": "95fd7601-93be-4e46-8d0b-ce921db5d825", "comment": "Malware payload (Heodo)", "value": "ad4bad3836ea25cc65f8d537425c667eac031c9041240b407db21a23fb3ccf816285565f6a5fb13a376a84ddc7d2e34a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237701, "uuid": "2ecc3d8b-8185-4dd7-aff0-e1ce1abf708c", "value": "T1F7C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237701, "uuid": "8b5d2477-cdd5-4b5a-9560-5c5e4507a748", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237701, "uuid": "ec2063dc-262a-4eb0-892b-60125a990b99", "value": "6144:JhZ02GdOOgPYqKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfBKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651237701, "uuid": "e782f306-eb6c-4f70-bfc9-bc00f99d4e75", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651237701, "uuid": "e8d3464e-8241-4ac7-88ec-a2ea7c9915c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237701, "uuid": "f0d36054-587f-4d76-82e6-a9c550b4bc41", "value": "4223fb01c5a178161de151b6c548b0be", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78deb092-c7ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (AsyncRAT)", "timestamp": 1651258329, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258329, "uuid": "ea79cfc7-53e3-426f-bf85-4cecaf55110e", "comment": "Malware payload (AsyncRAT)", "value": "b0d3f508b4ff81f796f0a9ee1520911f", "object_relation": "md5", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "BoratRAT", "colour": "#B1C696", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258329, "uuid": "6eef7903-458d-4d6e-a09d-962d1bcb5819", "comment": "Malware payload (AsyncRAT)", "value": "70566aebcd8c141e593d00e189a43ee1d9b08e745aaf3043153c2087ba8c2671", "object_relation": "sha256", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "BoratRAT", "colour": "#B1C696", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258329, "uuid": "d9406b89-baa1-4e60-b47c-7a1eb424be86", "comment": "Malware payload (AsyncRAT)", "value": "45563437253a445b36c97d152eecae3d9de59b09", "object_relation": "sha1", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "BoratRAT", "colour": "#B1C696", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258329, "uuid": "1de49045-0989-43cf-8d48-d0ecd1800015", "comment": "Malware payload (AsyncRAT)", "value": "459182fed4cc25b5e7cd04cbcd0d4daa8fa1661d2dcbed2f95d3316bf18522706f402b974439240a0c20965cdb5664c2", "object_relation": "sha3-384", "Tag": [ { "name": "AsyncRAT", "colour": "#64C37F", "exportable": true, "hide_tag": false }, { "name": "BoratRAT", "colour": "#B1C696", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258329, "uuid": "4ecf9f45-9909-4cf2-9f39-b50af58f4ca7", "value": "T1F1435A083B9885ABC3ED4AB8A8B2535582B3F3632603E79E0CC491F609177D75912DF7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258329, "uuid": "50cbe37f-a8b4-4c10-b109-b391b61eee63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258329, "uuid": "8be84072-7c56-4569-9a7d-a454a6fff17e", "value": "768:kdiv4Kbwg2V+YV5QfADYI1WQZConqLMh0AoE7pwaambG4lRFVPJ1M2RhXIxT:k+b5sCKqLzECafbX3zxTRpIxT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651258329, "uuid": "f38932d6-c759-4f95-a7de-a1c146fca4d7", "value": 57344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651258329, "uuid": "66ff972c-3cfb-4b1b-ad09-1108759503ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258329, "uuid": "03ead203-c2aa-44ac-b038-f7c818e66738", "value": "Client.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b992a60-c769-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651201640, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651201640, "uuid": "b19d1214-04a1-422a-9bc8-55c10c0fa565", "comment": "Malware payload (AgentTesla)", "value": "0f3dad2e45c360d3cb4c689da971e9c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651201640, "uuid": "20873774-8973-446b-8e7c-1f18d63eea04", "comment": "Malware payload (AgentTesla)", "value": "70b17d2490b3f593a2116347867b6e3a65bfdcc6c798587f08737f119f582001", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651201640, "uuid": "a87aed10-52bf-4eb6-afed-93069d33ff15", "comment": "Malware payload (AgentTesla)", "value": "26cd88b6bc778a3a3187e872a3613288ec781430", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651201640, "uuid": "ead86797-33cf-4b8b-b9a8-06486a45d7f9", "comment": "Malware payload (AgentTesla)", "value": "0c2f119e4fd72f1f819ced2c8fa959c80e995decbcd8733b03de67fc0d6b71ffbcbda481b07b3c009c833e1794e21c6c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651201640, "uuid": "885ebef5-e997-471e-b8fd-52868f60aad7", "value": "T178C4024CE2AC9B12ED7F87F86564264183B03A657016FBDB8FC2B4E80E357E14591E63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651201640, "uuid": "be624385-f5d0-490f-82e3-e333ee38c3d2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651201640, "uuid": "550d3753-3ebb-4e02-866f-17059fcb0821", "value": "12288:hHLWJeYyqCSPfb5NRztNhHe0CZZnC67rV5rSrKNZH:9QbyqCMb5NRzJHe0CZdJrSe3H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651201640, "uuid": "3dd103ba-b857-49ce-bc7c-b09e2acc07f8", "value": 576512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651201640, "uuid": "962c906f-7c8f-4c37-abe5-85b37779417e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651201640, "uuid": "b522cd19-6c6c-4ce7-9a63-7cb414b51918", "value": "Shipping Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2be55541-c761-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651198070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198070, "uuid": "7e7ef0fe-abc3-42df-a088-fa0874873ca3", "comment": "Malware payload (Mirai)", "value": "77db619deec9837f8d2515a3c9cea8d5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198070, "uuid": "977a4667-5f4a-418a-b172-21d84da0e887", "comment": "Malware payload (Mirai)", "value": "70c32389109f8ec19b522f17b41ca120d2daa8b3e5f2474d1bc5e5ade0c9a887", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198070, "uuid": "34c15142-3b95-4d45-8d35-ecad8e9e930f", "comment": "Malware payload (Mirai)", "value": "89efe601d9653a46a19122f250e589dd679bea97", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198070, "uuid": "7194fb91-dd75-408c-8b0a-68051cdc0fd4", "comment": "Malware payload (Mirai)", "value": "7cb65062e9ac86c02a90921974c2c6ad2d14f3dc2ad63569e61c26d91806972828d12f4d06f5d84c3bca72e54b558f82", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198070, "uuid": "6d6ff623-4182-4b5b-88f9-f148c35d8b7f", "value": "T1E8337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198070, "uuid": "b2ba9e04-10db-477f-ab7e-8aaa711942f5", "value": "768:jaixFwtLSYAagMo0ebfEL9v0X3pyWfs3I9ICJUU/qMCqKomQRCvl:jaQFwtOGNv0XJfs3kICJt/qMF/RCvl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651198070, "uuid": "32506f6e-6ed0-4725-bdcc-20e38b8b1205", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651198070, "uuid": "c30a4abd-f4d9-4932-8743-511866e480ec", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198070, "uuid": "64d9662a-2fe8-4384-aa31-c6e4f7a9f7f0", "value": "77db619deec9837f8d2515a3c9cea8d5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50c6ef32-c7ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651258261, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258261, "uuid": "a72653d3-e90f-4ee2-bcd0-ae29bd388a60", "comment": "Malware payload (Mirai)", "value": "af6f444f036e335a3605cbd63d699312", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258261, "uuid": "179fafc4-282b-4285-b9e4-fc81e85e61e8", "comment": "Malware payload (Mirai)", "value": "70dfb4acd87bad2267eab83233fcc11a27685e2a3eb1cb740650a1bd3eda3998", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258261, "uuid": "2a12716e-cae5-49c8-b3ab-84c47a350f9d", "comment": "Malware payload (Mirai)", "value": "297983a041b2269294ae7e76744b72d235542cd5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258261, "uuid": "20abdb7e-d9eb-4ecd-8db5-e4fe5f31ae33", "comment": "Malware payload (Mirai)", "value": "086a389fcb0621f2e81d37e5bc98b24c9789c67789659ba8a76eb8d1a90317193e7fcf266f23187470660390f556f32a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258261, "uuid": "55fcd07f-ccb4-4328-a1c9-b549484ae5cf", "value": "T1CEB2D11AC0AE2EB4FEDBBD755941E2817B615BDF3A618EC01BC15A010232D686F986D8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258261, "uuid": "83a55800-ab0f-4dca-a793-20564ca2329a", "value": "384:EA0AeimAzNCdvw1PwIWWtKfz9VuBFoeIoA8FXw2t7tTmojIo19M4uVcqgw05VxJW:KApCdvwJr69VJoA8FZtxCo8N4uVcqgwx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651258261, "uuid": "7b90b87c-d7d2-42b7-b693-eac747b8b74b", "value": 23936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651258261, "uuid": "8c161d92-f92d-4272-9f0f-3dae8b1475bd", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258261, "uuid": "7ec4738f-4ea3-42a1-a568-c894df54078a", "value": "af6f444f036e335a3605cbd63d699312", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "281ed025-c7ab-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651229846, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229846, "uuid": "e96eb470-271b-46d3-8665-d63f7a441a14", "comment": "Malware payload (AgentTesla)", "value": "301202ac0a1f0c3f5eca6b93128a111a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229846, "uuid": "ee8a6afe-24cf-428e-b06e-4f2606debb90", "comment": "Malware payload (AgentTesla)", "value": "70f5bd6f8b02cae21fa961eaddcbb3a423d18f7df5edc08f72a0c8b0e8de0fe2", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229846, "uuid": "96bcd4a6-ead3-417a-b124-2c3ec97de770", "comment": "Malware payload (AgentTesla)", "value": "6f194f63d6f311206550906ba45e96ccf5e2e7a0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229846, "uuid": "88ed7386-b75b-4da9-8579-f4b4952eb83d", "comment": "Malware payload (AgentTesla)", "value": "f3795023b1006cbb6c6b39daa04f92c527d6f99839cd6705a68caf177f178680061f03358f64b0f815532879830bd20e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229846, "uuid": "00ed5dd5-e8e9-4b79-8a02-eece919a33f5", "value": "T1F87423DA25CD6C64DCA773A8030B1DF0243B262533BF676D1375AB0872B394BB53A261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229846, "uuid": "6e016ff5-a08b-4dcc-87f9-75a2d19ef1cf", "value": "6144:vX0LLgYkkRQeuqu+3IZvJy887gjJRHDkBF3n4+HXJ6HZc/xbxWqE33koq6:Mg7Bek+3Ip07KfHDIzXsAxdWqEEr6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651229846, "uuid": "7c27c187-572b-4eb5-ae84-a581f60a1806", "value": 348316, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651229846, "uuid": "ea7e1251-f30a-41c9-9e3c-326c0b34c7f1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229846, "uuid": "5e098693-5c91-4484-8067-67f7721a29f3", "value": "ASEAN LOGISTICS SHIPPING ADVICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef74348f-c78a-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651216007, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216007, "uuid": "c2716e70-b530-44fd-a679-afc65e098306", "comment": "Malware payload (AgentTesla)", "value": "bf6ff33a6ae602a76ba7163702376115", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216007, "uuid": "12b1e652-3911-4d11-8b79-40e52fef8869", "comment": "Malware payload (AgentTesla)", "value": "7183ee2d84e02f7b1b35286281121b4e51c5f72e7ee9b969e344a896d7c410b3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216007, "uuid": "241e85ed-c13b-4c41-8d26-8cd81fd4cd30", "comment": "Malware payload (AgentTesla)", "value": "fd5f347b6697a92aa84bd2b34d336db5df76dbc1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216007, "uuid": "f5486310-77b8-442f-a9c9-9b1887242c6e", "comment": "Malware payload (AgentTesla)", "value": "7636d2b61afa50d8c2cd6111d4ec9b74770b974e9235459993d8db7adb88345b6a4078c7f58c81c93289ad843419134b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216007, "uuid": "de30dd40-d82f-42c5-b4ed-9aced1878f7c", "value": "T10EF47AB32B507E2AE65D4FB5383B038546F08F21A5D9E73E095034D1AAB13DE3516FA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216007, "uuid": "f2fbb731-03df-4124-928e-6e0c4fb72fce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216007, "uuid": "5e12dd89-d038-48a1-a783-e617e2e2a002", "value": "12288:bFhhAYtv/hLA1NX75ZwmHYh6iiNXBZpp6ARiNXt2pp1NXoC2EcnbnomBgozJSv4m:bFhhBdhCNX75ZwmHYh6iiNXBZpp6ARiV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651216007, "uuid": "2d12cb92-ab12-4c0f-9eaa-9779a3a7cb61", "value": 766464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651216007, "uuid": "e88ade70-e643-4868-954d-bc72c7806153", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216007, "uuid": "931c4c23-b6b9-492b-a8e8-ed0a8dfc802f", "value": "PO-PROFORMA INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e33650c-c794-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651220059, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220059, "uuid": "3afd476b-ca0c-4d56-81ad-e66fb4b47b3f", "comment": "Malware payload (Loki)", "value": "aa9c09a2b81161c682d58447af89f454", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220059, "uuid": "235dc6e7-38a6-4eb8-ae33-5411c9a37267", "comment": "Malware payload (Loki)", "value": "72e03c50cb2874cebdeb96aac8aece79c25ee3558adc047b85575938f47515aa", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220059, "uuid": "2080174b-2a7e-42bf-9fc2-1705b9d6c6c2", "comment": "Malware payload (Loki)", "value": "1c636c683a3a86118dc38f47fa8372447cac3745", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220059, "uuid": "7e90a048-3ac0-49b3-a2d8-f392cdc08ad5", "comment": "Malware payload (Loki)", "value": "af83094fa8df5493281dac5f7a2a98023491b61ace1c5feb738625554aeaa417f8ccde8585b5f0b096ca662a5362d79b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220059, "uuid": "bbed3fb6-4965-4aa8-a422-9f877abf3614", "value": "T18B94011812BCCF63C4FD4BF8F5265A055B749A2AA523F34E1F9870EC6D763804605BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220059, "uuid": "715faae1-1473-4747-bfe1-ad567980afcc", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220059, "uuid": "7831d56f-b898-4acd-86e2-7e13080408cd", "value": "12288:FmiHgJAunwWoOCc+dDyCrSb4uehr/hxi6mpu:FRHgJo1OCPhrSERZd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651220059, "uuid": "6859ee6f-1d51-4b01-b7b8-049f7acc3a82", "value": 416768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651220059, "uuid": "43d6010d-c3cc-4cb5-8a69-0d7919dfb56c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220059, "uuid": "0715c3a0-d30e-4963-a2de-2db9d44ecf41", "value": "Barclays-#700339Customer Order #471320.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3e28200-c7ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651236604, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236604, "uuid": "61e883f5-1a49-443e-8288-79339b45a6be", "comment": "Malware payload (Mirai)", "value": "24cda436ba122cb1d278f177f11d84ad", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236604, "uuid": "807567c9-ddee-4174-9372-b60d98e53433", "comment": "Malware payload (Mirai)", "value": "72f04815e982716a0ebfe9a9b9280852a50068a534bc73c4ce46a1f2fcf3a55d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236604, "uuid": "66044615-5f17-4a9d-8793-327a20cac90b", "comment": "Malware payload (Mirai)", "value": "c440908383d83f88869ae065d85e7071bf33de5b", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236604, "uuid": "c4906d01-c664-423a-bbd5-3c2cd81b6bf3", "comment": "Malware payload (Mirai)", "value": "82fd8b47a378f3464803a2aa58ecca21446967ac6d1736b6dc8f92f3650d05ff2113cd008b07b7db803728ae1cbb39f3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236604, "uuid": "95be3430-4e6a-4746-be14-cc52a2121178", "value": "T10EE31946EA818B03C4D62776FADF424533239B54D3DB73069928ABF43F8679E4E23605", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236604, "uuid": "12f6c3c7-ef40-4c32-a4e1-9f0a33867527", "value": "3072:vn3q1G9n+aZ7R1C3GuGD6HN7CAJS4DWSEWM/9Ll7j5BSl:vn3q1i+aZ7R1C3sD2CzOWSJM/9LBNIl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651236604, "uuid": "2a28655b-c018-44fc-a332-39c238f3f5c0", "value": 145201, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651236604, "uuid": "b5c3a129-e857-4f67-992c-d49f1dd1040d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236604, "uuid": "990d6554-3f0b-4698-a420-8e4a5379c598", "value": "Cronarm7-20220429-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50e39b6f-c7e6-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1651255255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651255255, "uuid": "2007cce8-2ec8-4a37-951f-f05a0a589cb1", "comment": "Malware payload (BumbleBee)", "value": "582b7d4c035a5df8cc871e583a80e448", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651255255, "uuid": "b740ea8d-10e0-4e73-b57c-a242df21370b", "comment": "Malware payload (BumbleBee)", "value": "7333dafbe1771c055aa40acc2f8d34b812ec2bf81ab3ae7976753040eea1b0bd", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651255255, "uuid": "1ac9fd7d-9286-48f6-a928-447a5159b84e", "comment": "Malware payload (BumbleBee)", "value": "632e0803fc037774f79c72eaf4b63027a9145a49", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651255255, "uuid": "34ae9f1f-06b9-4827-b235-56477b6988bb", "comment": "Malware payload (BumbleBee)", "value": "c14b07cff767c12c75246fa886497630071105f53328653473800d2614c113a086608eb5f4e4192f5b98343e0e43e842", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651255255, "uuid": "ca752b92-b661-4160-82e4-268be8ffd00e", "value": "T12ED5E1094E140D1AD6B40EEC28DF3BCD02186757DC686D5B99B2A4ED277EAFB302351E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651255255, "uuid": "90c29ee3-c7b0-4c84-8353-5af271bd0468", "value": "0c85cc919aa73be02e9d5d942c58302e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651255255, "uuid": "7d5941d9-8d6c-48e7-a43b-a3da8739e4f8", "value": "49152:mcWp/NAvX+9SgH1ZDwRTLrVw1C3/ew15zqLomMi4+Ki:/Wp/NAvX+9SgH1ORTLrVYs5zqLc2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651255255, "uuid": "1a4b254d-889c-44b7-b1bc-ff0b6588dba5", "value": 2771456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651255255, "uuid": "5b06ff88-53d5-4af5-9c97-1711323a8ea4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651255255, "uuid": "ce869f5d-ab36-42af-9238-5d0394bc2793", "value": "tools.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5ae25e86-c790-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651218335, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218335, "uuid": "ad5a9505-2cc0-4866-a536-d7c868c0958d", "comment": "Malware payload (Heodo)", "value": "d5e06fa6d4bd51d0f29a7bcc51567152", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218335, "uuid": "eb35c0e1-3717-41c1-a8be-d67d5d0471fd", "comment": "Malware payload (Heodo)", "value": "7341b81222bb1c379c05fa569035b9c76b36f61e89c780559b181c9b70feabc2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218335, "uuid": "b7a55768-61d3-4665-b821-6b6afc87bc6d", "comment": "Malware payload (Heodo)", "value": "6aab0219b509ba7e9d5c31dbdfc1a8c661d3f4a5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218335, "uuid": "87ef768b-358e-486b-b8c2-a4cf8ac7ff1a", "comment": "Malware payload (Heodo)", "value": "8558c513d246ac531b603b19013b5f0a5e9a06e4dad6d0eb2c944dd2f4d1099a9e5e01ef24c5270bd7d701b0cef8d391", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218335, "uuid": "9ccc6249-90b2-4da8-84e6-4fa25161d07a", "value": "T141C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218335, "uuid": "daa71e28-c45e-4caa-b435-15f5958c84e3", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218335, "uuid": "81eb548d-47c8-4b45-ad96-dae72acf1fab", "value": "6144:JhZ02GdOOgPYmKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFf5KRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651218335, "uuid": "34181a9e-17fa-4db4-ba4c-b1f5ee599d70", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651218335, "uuid": "6740d247-cf29-455f-b1e7-c628cf29a9cb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218335, "uuid": "b0adf858-d689-412f-85f4-6b7cfb71e74e", "value": "aCpKMkkXeGqjCtqcuvuAZjoB6WC8pcaaozX.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5dcb667d-c7d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1651249264, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249264, "uuid": "8a459ee6-1190-4666-9594-b0e773cb276a", "comment": "Malware payload (NanoCore)", "value": "ad0b8a306517027f72bc792b90181211", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249264, "uuid": "9fba47f0-e2d3-4dfc-8665-016db6c7d2ad", "comment": "Malware payload (NanoCore)", "value": "7392b0793ba90aa943dd80bc09ae0242ffcfb6829d3415822c2e0dc1ef91961b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249264, "uuid": "928d9a50-ad34-4491-a5c2-34b7874588e1", "comment": "Malware payload (NanoCore)", "value": "96248a043ac3de3e1caee85f3fa2ce2c3dbf437b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249264, "uuid": "1e77c112-1e5f-4a6f-95f2-2cdf9fb5904d", "comment": "Malware payload (NanoCore)", "value": "9f04772c7a299a12c64a7a6913be2ee752dc727e1a89357e08a30e01caac5c0292f2fb819bb7482629e4b30d7e8ad272", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249264, "uuid": "0e31c64e-eba1-41c0-8fd5-bb056da201d2", "value": "T15114BE5537A94A2FE2DF86B9712256029378C2E398C3F3DE18D455B78F223E50A0B1D3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249264, "uuid": "ca0b7a27-3567-4ee9-9059-55678560f7fb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249264, "uuid": "d72a6d1f-127d-4a4c-a3d6-3460f55c3763", "value": "6144:gLV6Bta6dtJmakIM5tgCpVBVl30m8A2CSFixQfx:gLV6Btpmkkgqv3ftEFnfx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651249264, "uuid": "d77328ee-9412-4d7c-b5bb-db466b3e68a0", "value": 207360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651249264, "uuid": "67921f5d-824f-4f93-95f6-5a5f07cdaa98", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249264, "uuid": "dcccb9bc-5a92-453a-a8f0-bdcd61ef96b0", "value": "ad0b8a306517027f72bc792b90181211.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ae60c2-c802-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267552, "uuid": "78b3acf6-d77a-407d-8045-97d2d5e5b1ab", "comment": "Malware payload (Mirai)", "value": "3dba4c660df906f936f4d110d7149697", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267552, "uuid": "2181d30d-e5a6-4c22-a219-f32344b67066", "comment": "Malware payload (Mirai)", "value": "73fc3abec5b81573ee036df951a55034217afc8368ca96f72fd2aeff0904ed31", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267552, "uuid": "4daea68f-47d0-43fb-953e-c7ffa2332944", "comment": "Malware payload (Mirai)", "value": "1138b98c4780697fd4da185559c36dfe68e9c672", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267552, "uuid": "c595408b-49c0-4ddd-afb9-11048e175f5b", "comment": "Malware payload (Mirai)", "value": "0071b6f94ea86f7d092169eda824dc3af807be0912bb7fa46532446fbe737e4c060f4ae782466ab4230a9a2d02393e3e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267552, "uuid": "e3dd356e-89ad-4391-9dc6-98cb0c0b44e4", "value": "T1CC431854BC929A22C6E4277BFA2E418C731563ECD1EE3202DC292FF4768582F0D6B751", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267552, "uuid": "49870406-c89f-4662-8ea2-38a036a7b15b", "value": "1536:wXe9WaJ9833g2c90d9IcjNI62xPYB71/5se1:wXYWyCc90TIQp2xyR6e1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267552, "uuid": "40a1ada4-2e97-498f-9054-ac1d97257c36", "value": 56144, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267552, "uuid": "b18d7624-a8b9-468e-962b-2295fcb353d9", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267552, "uuid": "18fe55cd-54f4-43ef-97e5-df2571dc5351", "value": "3dba4c660df906f936f4d110d7149697", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "aa1683c1-c7be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651238225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238225, "uuid": "7dfbf57e-9c13-4e38-8813-503ee3f2f688", "comment": "Malware payload (Mirai)", "value": "0747985f0958238e3afa97c883bfb42e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238225, "uuid": "4986cc77-59ea-4e83-97c1-0a2bda3ef0e1", "comment": "Malware payload (Mirai)", "value": "741af4dccc82fcf9ce85879a00ae985fadf90544881b45fb659da7fc039295d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238225, "uuid": "cfb1bd19-bc35-4402-8f0f-f1ca7d209313", "comment": "Malware payload (Mirai)", "value": "0c6be9929ad69c1fd36bdb6a9a209f5ab0c16156", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238225, "uuid": "382a59aa-6ffe-48b3-88d3-a4594c71ce7d", "comment": "Malware payload (Mirai)", "value": "2414133d3ce44ac7c6f1ffde2622b3023dc031f50a6173e718be56bae2d5a5730d48814db430268737996866ce036644", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238225, "uuid": "b5fffc20-b6f0-4c0f-8a96-55d1a94276e3", "value": "T1C9C2D094D02CAB50EFAB69B49C30DFE53FD52FAD3AF18BE6644ACF55062B50A50488C4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238225, "uuid": "c3cc125d-4526-4272-bc04-6e2ad1981d0b", "value": "768:Qca9m7xu14kRbj+8CrEt8p6a6Fw4uVcqgw09g:dwmCSlrEuoFw4u+qgw09g", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238225, "uuid": "e19155de-669a-475d-a4b1-5061f2293d4d", "value": 26252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238225, "uuid": "f9916947-2380-4b35-ba6f-10feb3541928", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238225, "uuid": "74d908ff-d80b-4af8-9e74-5906191b81cc", "value": "0747985f0958238e3afa97c883bfb42e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c55ff4c-c7be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651238175, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238175, "uuid": "efda67a7-a1d9-4705-9e09-097626fdfed4", "comment": "Malware payload (Mirai)", "value": "fa2ae30be85daec2430c140ce698ff02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238175, "uuid": "67afa53d-5ab9-4992-8994-4336d413b5a7", "comment": "Malware payload (Mirai)", "value": "7449e1070f6ba919a8da953fea79c32fa3ef8124d890ac202bb2b0821a729d36", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238175, "uuid": "e8332275-2c78-44b9-a920-6283f89824da", "comment": "Malware payload (Mirai)", "value": "a69cc6899ad08da0cd28e14d7a88268d4d23629d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238175, "uuid": "d6a1dfbe-b116-4b20-abfa-4ed2b0c544eb", "comment": "Malware payload (Mirai)", "value": "f99406165d242a3daa04964caf4fe6af05e7cdb2e40a84a90d400731334b8aa748721641d7df0f2b4b90f70d64649113", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238175, "uuid": "92d202f8-e021-43e0-bc7f-9cbd20542d71", "value": "T134537D39D469ADE8C0464974B854CE345F53A484C3A32EF69AA083EA9453DFCF419FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238175, "uuid": "74ade1e1-1588-4fd9-ab3e-85ab4c496ce8", "value": "1536:jaPzrUMVC7FuwtV7alBmxffs3bHFk/q6LyyGuCI:j+AMVC743af+blmLyyGu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238175, "uuid": "4d6ffdaa-d014-4baa-84a4-ed24980d5cbe", "value": 65040, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238175, "uuid": "b26d9060-b359-4add-a2c0-df1e1fb84608", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238175, "uuid": "bc639128-fd12-415f-a5f4-a757a7a8ea71", "value": "fa2ae30be85daec2430c140ce698ff02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f98c849-c79f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651224732, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224732, "uuid": "29ac84c2-a80c-4501-a351-5e0f89f3e133", "comment": "Malware payload (AveMariaRAT)", "value": "6b8fc6dfd10cbe08fc93abb917c659e3", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224732, "uuid": "4f877cf5-08dc-41da-8e57-a1d9d7a76e45", "comment": "Malware payload (AveMariaRAT)", "value": "748d9b1717a39fcf1b335244a11095deb0240d4d02bf3141e57a07cc9f60645e", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224732, "uuid": "4f8f8188-0060-4298-8a19-6145ca7a4644", "comment": "Malware payload (AveMariaRAT)", "value": "a77c1772d83a5d93f57304c85566844d38384ab6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224732, "uuid": "7f6e88db-e8fe-41bc-993c-be3c682a93b7", "comment": "Malware payload (AveMariaRAT)", "value": "e23d33bd0387f09c567982f4a2d41df7bde58a4196090e85af751aa32a09c63617a5c667a1a3539f4469f9485330816b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "lzh", "colour": "#4A0445", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224732, "uuid": "23144e1c-99ad-4365-a9e6-ec9b2a313775", "value": "T11C942314DA8C0FF2DD3DA2BB24879B53BFBF35886D484252DD7E273485861E49CE8684", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224732, "uuid": "5fb1c7bf-1fb7-45d6-ba11-c4a1ce1c5359", "value": "6144:SoGoCvHRRVDUHn7gnTlID/Crjv+Ry81fqdw25X9eqitdsOfLkfWeftsx2eC5fmAk:So7GR9an7kTrj2Ry81EX9e1TLMNNw2t6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651224732, "uuid": "80eb4d91-9edf-451e-8500-6b61993cad89", "value": 420199, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651224732, "uuid": "08b27cc0-251e-4947-9823-61ebd2eb8a0d", "value": "application/x-lzh-compressed", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224732, "uuid": "06e2b14e-647b-4ee5-8cd7-aa9787d7476f", "value": "PO 202204TR.lzh", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45ccc4db-c7c3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651240204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240204, "uuid": "e85d25e2-f4e4-473c-bfae-a2e9f07f89d1", "comment": "Malware payload (Mirai)", "value": "23002a34729d7ffec584f11977cf6201", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240204, "uuid": "dfa1499f-9e0e-42da-a889-12ebd2cce856", "comment": "Malware payload (Mirai)", "value": "74aeae6aaddf21f0f2dadbe7168ccff689e43eed72888b79f4c03d5a8b52f745", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240204, "uuid": "4d0ce763-e407-4292-a9c6-44ef29837d8f", "comment": "Malware payload (Mirai)", "value": "a0f3ad32fdd971a6eb71303b018bd62636ed19a2", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240204, "uuid": "417544b3-7b1f-44b5-9d4b-842c097fd77b", "comment": "Malware payload (Mirai)", "value": "6b257630455e79ee04de2a5cdfb1870eb9a847feb39ee29fe323366a7ffc06e565939348dce999fb71e528de231f08c8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240204, "uuid": "cfcc13c5-a098-48f8-8ecf-d1ab21f786b6", "value": "T1C6F2F156D29DE740F9AE83396EBFE12E544E052C819E4B78C2C8251E71FAE1D6B291C0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240204, "uuid": "aa2211f9-d920-4cba-8fa4-4e93ab330cad", "value": "768:r8ElvTpUgoRSpQ7mMxT95v89bDCtplYJ0StpMPFDui6qY4nbcuyD7UrQRjj:r8El7mR0Q7mMxTrvQbDW0GqmFDN6InoH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240204, "uuid": "b838a0e3-aa2e-438a-90d0-96bb76d8cead", "value": 35212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240204, "uuid": "d25a3353-a864-4e0c-bf62-79b5a2df251b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240204, "uuid": "df891a15-efc9-4e0a-832a-0c063e4c896c", "value": "x86-20220429-1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "719271de-c80d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651272060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272060, "uuid": "137fcb6f-d4a5-4cd0-9e04-b1c0e5f3744d", "comment": "Malware payload (Mirai)", "value": "1954d22259ea6cb07e78d3a7809043d2", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272060, "uuid": "a7dd5ebe-ab3c-44cd-9c0b-7050acbd4d87", "comment": "Malware payload (Mirai)", "value": "74e51fe1815fe021417a1228fc58613a7f514f89ae52fb6104612f33b941a7ef", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272060, "uuid": "9c16732e-e91d-4520-8358-8a324c428df9", "comment": "Malware payload (Mirai)", "value": "cc351e86a1f7f1e4909fc23ce99f2452819c2c73", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272060, "uuid": "1552e8a3-a958-42c9-9370-b4b18134c0e6", "comment": "Malware payload (Mirai)", "value": "72230f9b5c55c61c0ebfda2a654c2e444c720fd7589fdb5adc3f602411b695a2a52f59148a521269622c6e3ddf9d584a", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272060, "uuid": "21ce6898-7025-43bc-b56b-4a00edbc091b", "value": "T14CF2D0DEE6887EC2CEDD1CBE50B81A6465855481328F4B4CB791CD54D52880BF58ECBA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272060, "uuid": "72caffa1-587d-4786-b057-d7e23a879cff", "value": "768:BCzcbYKeRsj+ZHuQ6VfAP8vcIG0HXKA9uEu039G51WOTzI9zPfMfgWMI:EcMKeqWuZxmAG03TQ1d5kOnI9zPUfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651272060, "uuid": "aba876e4-bf26-45b7-b18e-8d23edeb5461", "value": 35060, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651272060, "uuid": "036990d1-cc34-45a4-a048-064d987a1f70", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272060, "uuid": "949d0301-d475-4c20-87df-79e8bd0f7cc7", "value": "db0fa4b8db0333367e9bda3ab68b8042.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18d2316b-c7ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651230680, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230680, "uuid": "e0eb0382-dc77-4483-a19e-bdb7cb24c452", "comment": "Malware payload (AgentTesla)", "value": "822da17bcefc638f29bd38f8d9d6aa50", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230680, "uuid": "b6169049-849f-420c-97f4-f3d84db9bc4d", "comment": "Malware payload (AgentTesla)", "value": "75a58572c8f67e692052a19c215da9b6bc835bcd756862a4193bc11e1061bcc7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230680, "uuid": "47bd624d-14de-4418-9cd1-dccf0cdb2e7d", "comment": "Malware payload (AgentTesla)", "value": "8b70d9a0f5075b8b9f7ca80e7e9cc8986c7f08fb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230680, "uuid": "e94e1a49-6a92-4908-be7b-60c4a72d61a4", "comment": "Malware payload (AgentTesla)", "value": "90543a29c273f58f298a0a48856def09ff35907d2a812a1eaf649560f9a076bcad73175f0fb93bd95da638c2ea38963c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230680, "uuid": "26b5dfc3-1c22-457e-b1d3-efbf0cbf60a9", "value": "T12B84237AD520D673A8492CF871D222D2649D15706D7E33E88F9BF529046385CC8B8FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230680, "uuid": "f0b08637-d95a-42ea-8c04-e2cb6f4a8495", "value": "6144:XzyQ+yWEpsnZeEdkhWDcZ1t4VgqR9MncMdj5jCIvVSagxZ2OmE0MFxQvT4EWTP6:XzybuUZfj8/Z40cSjNv4aUVEWe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230680, "uuid": "56f258ed-dad4-4d84-b3b7-7afde98e5a91", "value": 382381, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230680, "uuid": "271c5ba0-34a1-4167-bec9-5255a0b25dad", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230680, "uuid": "d6d97b1d-1dad-4462-92ca-8ea45477ecf8", "value": "PURCHASE ORDER (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2ac88988-c774-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651206228, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651206228, "uuid": "a0679c42-c568-4144-b630-df0b8e1c5842", "comment": "Malware payload (Heodo)", "value": "62b59078c9d9c52b8cd004ed652614e1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651206228, "uuid": "6f2f071b-0606-4d27-9967-571324bab3bf", "comment": "Malware payload (Heodo)", "value": "76358a7126ac313905b9b1cebc82ac2fd207a0f2b76b60dadac09f1e3a83e81e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651206228, "uuid": "cb81fa3f-f8f2-404a-87f1-9415ade667fb", "comment": "Malware payload (Heodo)", "value": "3073fc76539da85ec75596878de72fa23dce3480", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651206228, "uuid": "e56daaf3-4cbd-44e1-8ed3-38f2eb12c1cf", "comment": "Malware payload (Heodo)", "value": "a9c53543ffb5a5d1e15735b2d38a33c967768fd187b14ac32ff09adf1096fb56d6acd9f9117be383480a485906f97508", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651206228, "uuid": "1ae8ff25-6f66-4c67-992e-99ca47a4bfa2", "value": "T1CE515A283EEA6218E9F7EF7069EC7595DFBAB552B952894D00C2070D4922600FD91F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651206228, "uuid": "c263fd12-6553-42fb-8320-d108998ab60b", "value": "24:8kJ/ByUq+fRadPQG0L9AuRIZJiXRF4+gQo/uIH/y1XyHgbHo/umVlncIEjaem9dk:8meQI6Xj03ugtHU+uccIx/cC/N4ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651206228, "uuid": "1c171534-48fa-414e-8fa8-6a381224b46c", "value": 2454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651206228, "uuid": "75153cbc-53d4-4762-a59d-80b787f18833", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651206228, "uuid": "e88f2fa8-6172-4da7-a91a-a7745c4e54a7", "value": "ZUD-010422 LBJE-290422.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7df730dd-c7b4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651233856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651233856, "uuid": "f35c46c8-49e9-4a4f-9fc3-088429d8431b", "comment": "Malware payload (AgentTesla)", "value": "d887940ccc6dd0d1fb6e747b4296f913", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651233856, "uuid": "c01a07bb-60d8-440c-ab26-0f6d127e5e7a", "comment": "Malware payload (AgentTesla)", "value": "7683d97f42097601b67f6e5c9c9188f3f7629ecab29911982f2744b1c8038318", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651233856, "uuid": "7eb8aa1a-95e0-40c5-991f-ecc8da2fa8a1", "comment": "Malware payload (AgentTesla)", "value": "6a877703d1ca328afba8cedac7789df04d9dcab0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651233856, "uuid": "83b36bc2-b7e6-4804-9196-f7b7c4217b4c", "comment": "Malware payload (AgentTesla)", "value": "ebee3b9f6a10562b323c17bde3f1858bb6cc9146172645b12ab1d2511500edbc86cf06a9aba0c2910e3ae74a75895d52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651233856, "uuid": "e34b4280-f635-4101-b2fd-65e2dd267112", "value": "T1DD84237AD520D673A8492CF871D222D2649D15706D7E33E88F9BF529046385CC8B8FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651233856, "uuid": "1bd93a02-efe1-4591-b2c1-1fe967eee4d5", "value": "6144:1zyQ+yWEpsnZeEdkhWDcZ1t4VgqR9MncMdj5jCIvVSagxZ2OmE0MFxQvT4EWTP6:1zybuUZfj8/Z40cSjNv4aUVEW+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651233856, "uuid": "11fd42b2-5030-441e-bd3f-17c03bd460e4", "value": 382351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651233856, "uuid": "3780951a-60fd-4688-b188-074d1894cc1b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651233856, "uuid": "01610a2b-29c1-439e-8235-53b47f8f449f", "value": "SOA.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2630475-c7d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651249379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249379, "uuid": "dab56ad0-c3af-45e6-8ee2-ec831fff6e84", "comment": "Malware payload (Heodo)", "value": "671e9a6d6f8107ebf1ca2afd036b97ab", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249379, "uuid": "0bcd540f-48f8-47c3-af6d-f1d6d3713358", "comment": "Malware payload (Heodo)", "value": "76b0566ce0e3d759d22313507298ffeb752f8d6cfa4da2970f6b7bf7cfb50979", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249379, "uuid": "825d9627-df1c-4664-bddb-4c004413ccca", "comment": "Malware payload (Heodo)", "value": "4c15ca3b87811f45220e097789240716a391936c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249379, "uuid": "62f1ad23-fc2a-48e4-9871-f727260e3fbc", "comment": "Malware payload (Heodo)", "value": "13457e3316de0a4786a47c4d95f355e1065eac41c6cdd75f9c7fdff45c497a274c0733d7f9cb7f16869ca2b2fe8e1eb9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249379, "uuid": "b4847c4b-3c9b-4cfa-988b-485e86fa2a36", "value": "T14FC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249379, "uuid": "c12fe1ca-5d0e-4dea-afa2-667d1ac83d70", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249379, "uuid": "86309b2e-972e-448f-8e4e-6d02b50ea806", "value": "6144:JhZ02GdOOgPYvKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfkKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651249379, "uuid": "f136a992-d724-493c-82a9-5f4e38b8287f", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651249379, "uuid": "22c20dfb-ca9c-47b1-b415-4a73a5aa0423", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249379, "uuid": "ce4245d9-408c-4b72-986b-37690a595340", "value": "671e9a6d6f8107ebf1ca2afd036b97ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e02d902f-c7c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651240893, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240893, "uuid": "a669fc7b-568c-4e73-ba3e-3df65a56d13f", "comment": "Malware payload (Formbook)", "value": "0ef80bbf8440723a506f4a9f7d444650", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240893, "uuid": "298a9a2b-db35-4781-a1e9-a49118751d22", "comment": "Malware payload (Formbook)", "value": "773aa098dd7de71c80ffb645ea803dfc6f8359939e49aeb216513e99f4ea4082", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240893, "uuid": "328eedc6-8064-48c1-a799-8670abcdb03a", "comment": "Malware payload (Formbook)", "value": "982778649e2e6afe0b51e4a1b9f6bb2c28734120", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240893, "uuid": "eb353b69-5821-4738-a6b0-f39981191741", "comment": "Malware payload (Formbook)", "value": "777db06330c1e7a65cb874a2b7d20905079d403d5ea414bf9f55bba7587bdf3dae88d5d0dfc8d8b27eae976378ce4022", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240893, "uuid": "c880c482-b02a-49fb-9727-b5e322105bf0", "value": "T16A93F0CA70A01B9FC499A2F8753755265F796DFCC828E0F73648B089F431DE10AA4BE5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240893, "uuid": "0bcac38a-057d-4f17-b50f-5197437aa7de", "value": "1536:Ee9eQmpcmILxp0ZD9TBtYBy8ibwZcpiHjSB/z1I49mabILLPnWnn9XFAG6k2p3:Ee9UpcmIkBwu/piHjw/zxP8fWn9XOPk2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240893, "uuid": "806b8e84-dc5e-4a11-9984-fe92f53b3443", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240893, "uuid": "974535ec-c4ce-45be-93ea-0d78403fa2a7", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240893, "uuid": "cf4fefb9-9e01-4842-b2b3-f1e721ea48a2", "value": "PROJECT , EQUIPEMENTS 2022.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0608f318-c7fa-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651263719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263719, "uuid": "963e38a9-7fa1-4184-abc2-f54527c67d8e", "comment": "Malware payload", "value": "c4a01d4df678b152785d4be1d3af20ec", "object_relation": "md5", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263719, "uuid": "3f71147a-4887-46dc-a3cf-50dc3bf55cff", "comment": "Malware payload", "value": "774420b92537712e3f73a06eee58455e674de5a1c834df01a0014401e64b20a5", "object_relation": "sha256", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263719, "uuid": "a7b1aeea-a83b-409e-963a-efab62a177f1", "comment": "Malware payload", "value": "d1e1addd7ebe55e335e1629b642dcdbd59484ca6", "object_relation": "sha1", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263719, "uuid": "c7a22b1b-2c66-4909-bc38-f0da9e5ad385", "comment": "Malware payload", "value": "2684f4c8fced2ce46620eb9c2957ee08ea921e3c7641b7730a54b0d2a62e4efad92c2cfdfc0a469374751404c68037df", "object_relation": "sha3-384", "Tag": [ { "name": "vbs", "colour": "#05BD76", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263719, "uuid": "35062444-3f4d-4a42-86ae-ded944ec616c", "value": "T1B503281EDE9E25BF0C25B08566697CB7AC5F4901B6407660F38A4C0F60FB8299DCE27D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263719, "uuid": "676f040f-5094-453d-a74a-7c893a57daca", "value": "768:gNM+YFtFRxr3X72udy+jyP1fRuSVlkd1yb6l0EmLeFWD8EbB:4MhzLrHyYyH1pul46l/D6B", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651263719, "uuid": "f33f6ff8-d85f-4f2f-9cc1-f64fdda6777f", "value": 40271, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651263719, "uuid": "f8e47b39-60d3-471f-b434-3235a8daae6e", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263719, "uuid": "b548f843-ac3e-479e-ba14-3f137bf0f12a", "value": "aaaaaa.vbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063e3813-c753-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651191994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651191994, "uuid": "3b072db8-9dfd-4fd5-a4ae-0a9347f581bd", "comment": "Malware payload (Heodo)", "value": "1bb0ee64c4197dc44d5e5164d2c6ec48", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651191994, "uuid": "43cb2024-04ac-4dc6-8e8f-496f43293abe", "comment": "Malware payload (Heodo)", "value": "7779cca8d3b2d25f235c774ba0ef78d10db51a26576744c7a102998cebaa86ab", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651191994, "uuid": "d116ad93-2130-4983-8117-cdb8e06aeca4", "comment": "Malware payload (Heodo)", "value": "92a6a176abcee0a542bc32a43326a98eea0a944e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651191994, "uuid": "eb1abe9d-a9dc-49eb-9d87-bc1fba5da6af", "comment": "Malware payload (Heodo)", "value": "ca0d150e5617297c34cf715e93efa67af31d7b789fb306c49518dda9158d9d6ffa70557349bbec1c966aa30e172e4e1f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651191994, "uuid": "6b6166f2-03d8-49bf-9988-563a8fa4d2b3", "value": "T17EC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651191994, "uuid": "d356798b-543a-4285-8923-b548cd5a67a9", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651191994, "uuid": "77dd8154-f74e-4156-ad8c-b9fa57e31a92", "value": "6144:JhZ02GdOOgPYXKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfAKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651191994, "uuid": "c0365c37-4820-435a-8a9d-bfffc91b7f24", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651191994, "uuid": "ab16807b-d1d0-4f9c-bf50-6e99edc22668", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651191994, "uuid": "fdfbc619-6dcc-4edd-a40a-c571a146caed", "value": "emotet_exe_e4_7779cca8d3b2d25f235c774ba0ef78d10db51a26576744c7a102998cebaa86ab_2022-04-29__002629.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06697388-c771-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651204879, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204879, "uuid": "570000b4-9c35-4498-b1a6-dd9277e0537d", "comment": "Malware payload (Formbook)", "value": "e1ab0094c29ed433ad4ea0a06dd421c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204879, "uuid": "4e9f8090-3e9c-4a8a-a800-6af7385e2f28", "comment": "Malware payload (Formbook)", "value": "77a001f7d410c04d71c229ad7c3c07fc7a9a50943c0a7adcd080a0c93d2abaa9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204879, "uuid": "48ab3031-f5d6-4108-93eb-723b3609c21e", "comment": "Malware payload (Formbook)", "value": "ec8638b941f0ae47f0727dd718690639fab0bf22", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204879, "uuid": "1f2b6683-d7a6-494f-ab30-f16979913e19", "comment": "Malware payload (Formbook)", "value": "3d1b7b34fa993756a1c1340b6301b89e45ef47c3e4ba0cc2783d44806d0c240fe3b347706b5017d6333a9e4498e5bc4c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204879, "uuid": "a14fdfdc-ced0-4a82-93d9-40d661418640", "value": "T1A714024469A4C073D5A39B312E366B7B8FF9B96602714B0F03A06F0D79736829E2D395", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204879, "uuid": "1be482e9-206c-40da-9d26-7c2c2f450da4", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204879, "uuid": "02313d77-4ddd-4442-8609-35a2c7a3e48a", "value": "3072:l1NjcVVnLpPunbJRdtUG3nJ4X2oppsCXS2yrbgIcTjd0HkxUdd9rxu0Xi2byxS:HNeZmJ+anu5ppsCMgl3d0HFbuAv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651204879, "uuid": "d7b10efc-77b3-4609-9f4c-b798c21837a0", "value": 196715, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651204879, "uuid": "b285aab5-3573-48fe-9ba6-1d2faed2e816", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204879, "uuid": "1e5acb0c-40b2-4ded-9418-ef5df9b06971", "value": "invoice..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48410870-c753-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651192105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192105, "uuid": "dd4467e0-5372-4d63-8061-24436f6c47b2", "comment": "Malware payload (Mirai)", "value": "bde0762800ca4d64216be33318123a8c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192105, "uuid": "abfd83b8-1c9b-49f3-b4af-994855e3a79c", "comment": "Malware payload (Mirai)", "value": "77bc76a08839977651ec40ea6ac68164ce23a51538317786bd34ae5950f7e1bc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192105, "uuid": "c8f8bb65-57fd-4f45-b1d0-39ef9185a64c", "comment": "Malware payload (Mirai)", "value": "bc55d55fd3be614e2d2ee84cf3857f9f75d89210", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192105, "uuid": "936ebcdf-1108-4b7c-9946-8b02788815f0", "comment": "Malware payload (Mirai)", "value": "39009389e45fe26ea7c53bcb0912ceaed6fac7a1df9c80f374b1180c5899956e5e1b2289512234452caba1f26a6a7733", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192105, "uuid": "ff054a00-707d-4363-844e-f4d7aac9dcae", "value": "T1F95312536C521531E25428F2FEF2C98AA17B7C7D589D61BB33FE8A587AF2107C2E8150", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192105, "uuid": "6324d2a8-8702-48f4-98c9-6d059f638481", "value": "768:yJi4Rg6s7D3YtNrlWaG4uxeXtuwcZGBdc+WQAGTmYcvHGVq3U7BSWB0O2qOwgDlO:B4imWGuxeX80dcCm3GZBSIb2Ute6t3F", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651192105, "uuid": "a9ef220a-57da-47f2-a750-824cfd5f232b", "value": 62552, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651192105, "uuid": "da255c8b-d880-4a75-b268-46c9b0758104", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192105, "uuid": "654023ae-e765-43f3-89d5-c3e065cfb87b", "value": "bde0762800ca4d64216be33318123a8c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e13f723f-c7ab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651230157, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230157, "uuid": "8e955d6e-a0d6-4ee4-ac2b-7f75244bb530", "comment": "Malware payload (Heodo)", "value": "0aff1a3d4ed66e4a385c89a1145f7bfe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230157, "uuid": "21bab142-f97a-4666-9645-086147e9b369", "comment": "Malware payload (Heodo)", "value": "78d3e685ce0580867282ba74d6648b185f68b77aca667c527804eedc9e72e630", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230157, "uuid": "dc66d474-88c3-4f45-8a47-09f191c83410", "comment": "Malware payload (Heodo)", "value": "719949498342fc04f677ab8c9cdc56d54c960797", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230157, "uuid": "efc0a35d-fdd7-4401-a058-2a220139b1c3", "comment": "Malware payload (Heodo)", "value": "e38735993c85f9e8bf9fd797cfb5346018074508177e47bc987f60abe7700bf3cd07c889d50141b57de30fdcd9b7d13a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230157, "uuid": "6ff9f242-8689-46ec-9cac-5de632c5d0b3", "value": "T14A514D2C2DEA6218E9F3EF7069ED7645DBA67962F952494D0081074E4D21600FD91F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230157, "uuid": "8217c33e-c394-4567-8fd3-1904474249ff", "value": "24:8kJ/ByUq+f4lwu8JB9AuRIZJiXRF4+gQo/uIH/y1XyHgbHo/umVlncIEjaem9dRm:8mQlv6Xj03ugtHU+uccIx/cC/N4ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230157, "uuid": "1759c61a-81b7-4aea-b902-5e2a39476fc3", "value": 2454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230157, "uuid": "092dd2f3-e002-41e5-8555-b8c5a2536e51", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230157, "uuid": "51021993-6733-45db-bd1f-8bcd29078456", "value": "Angebot-WUNVF-451556.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2480b5f1-c7a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651228981, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228981, "uuid": "07f3118c-d98e-43be-8e13-1c7cc0df36f2", "comment": "Malware payload (AgentTesla)", "value": "0f618666e3442baeb7dc86704e3d4272", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228981, "uuid": "c2915b38-55e7-492e-b586-35aad3938e21", "comment": "Malware payload (AgentTesla)", "value": "79b228bef2ca2afbb37b50a441517cdd316c9507210b2105aeba5c92984b67af", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228981, "uuid": "e36cec5b-f332-4f8a-b80f-970f9dd45fcd", "comment": "Malware payload (AgentTesla)", "value": "00e82e00e0fc4fc65c06cbc6356b99815607ce87", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228981, "uuid": "4f3e6cae-528e-4c4e-a5b2-4a6e07dcc789", "comment": "Malware payload (AgentTesla)", "value": "deefa607687ae2498b92882eedb06d163b8ab783a6541616ae67ec3eb966d11392777e9cca75586cf6a757b1230e0c30", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228981, "uuid": "0ed5090d-6cd3-43f8-89d1-d6857896968f", "value": "T1A364234842BD3FB4CCE533859D729DF72A1E4141BEE150AAFA45CCA92DB431BA4D07E8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228981, "uuid": "41052669-bb8c-42e7-8b62-f366271a9bf1", "value": "6144:c/uoGMo0/tTE2cJtvw1enzAwWqwAD4s3bqq9CK1CazhXBLLP:TEoklcLo1mEO93N9CRa5Zj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651228981, "uuid": "ce058462-28a4-4e25-afe1-87d0e666130c", "value": 334888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651228981, "uuid": "c87ea949-877f-4ad9-8180-32a0e2318263", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228981, "uuid": "0b609ce4-f7c2-4621-97d2-a9d246d7d2dc", "value": "sk payment.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4af34bf-c7a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651226244, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226244, "uuid": "e2520ad4-3789-4a66-a6ff-5ac748fc624a", "comment": "Malware payload (AgentTesla)", "value": "6022c9bd369a0b133412b50b66098628", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226244, "uuid": "8b72ef53-a386-47d9-aff1-32aeb824e4d2", "comment": "Malware payload (AgentTesla)", "value": "79d300fd91068d4692db976bd9faf3fcb99b626baf772efebcd76dd1cb46fcad", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226244, "uuid": "c803a0b3-c1a4-4274-b65f-6771ace89469", "comment": "Malware payload (AgentTesla)", "value": "e8f818a9d4d22a20bf3b1eec92f2af8681400b58", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226244, "uuid": "a9831035-8d6f-45fd-a541-24b579523225", "comment": "Malware payload (AgentTesla)", "value": "b75fb33a2ade9b9ffa061d127a5aefbd3e9ad93b0580fae3135c85f9d3b09e597e76d1afb1e3f259c007db8c9f5aca3b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226244, "uuid": "66145aed-a9aa-49ee-ad52-e55a46b4faa5", "value": "T1E6036B01BB071162DC094BB784DE91044B31BB8775A7CAAB78ED72D99B933C31716E8B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226244, "uuid": "7e25a197-7c34-401a-9ba9-0540f6427c8c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226244, "uuid": "f75f5063-9578-40aa-bd08-42e7ee2085d0", "value": "768:pi5xbuYTMKsNErLLuSEtyUU6CB2G7S57al9hR:pMCY+YGlsxS57G", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651226244, "uuid": "e7599a6a-7987-44e2-8086-e5970c083aa7", "value": 39472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651226244, "uuid": "29ebc208-288f-498c-adb4-cda779d59036", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226244, "uuid": "839c1243-e2f6-4bd5-b275-b697477fec71", "value": "P_O_784836334.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "757cf24d-c7ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651230406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230406, "uuid": "5667b56a-07d0-4794-9f01-5f333e770db9", "comment": "Malware payload (Formbook)", "value": "ca0d4f320c887cc76fe4de4129b4f5b4", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230406, "uuid": "f1853a04-514f-48e7-a220-be9f741c71fb", "comment": "Malware payload (Formbook)", "value": "7a1eb01ef1d72252a77bd5e4deeb7228a2767d7476d1e1b48655621b9eccb700", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230406, "uuid": "1aef7bc6-d639-4902-87af-56f61beb70c4", "comment": "Malware payload (Formbook)", "value": "6b624f7f55e79f735b325be06c634c4dede3b61e", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230406, "uuid": "87e9ba5f-e8b6-42f5-80b7-030caee24466", "comment": "Malware payload (Formbook)", "value": "74f8af907b0473da0ce9ec200cdcb5f792b14c70c136fa349a1a41d76b76e65116d46a9226134905c7e414ee6a93836a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230406, "uuid": "84550fe2-1657-4b5d-a011-ec88910ada5a", "value": "T1E284236F8DCEB1045C806FBBAAF40C06AA4F45D8B65605869B025ED2E4FF2C1E7CDD91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230406, "uuid": "764b2d2a-02e1-4849-b96e-37c2860da137", "value": "6144:K5ywxJH4WyQvfG3fuuZXNddAI/whxjrYNmYvvs4AZLvP/3FrHkMPQlXGXEI:Q9yWy/3fuuVHdL4hx/rYn5ARn/RJRF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230406, "uuid": "9541c74c-b3ef-483d-b41b-f4e0bfe93f8d", "value": 405571, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230406, "uuid": "bea12e6e-71bc-42f1-8a81-f467f37e2f91", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230406, "uuid": "10f89a74-665b-4f60-91a6-88dff8d59abb", "value": "POM21002942.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d15eb0d-c780-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651211413, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211413, "uuid": "07a3caa9-c1c1-4bd9-ba65-65f371e1386f", "comment": "Malware payload (Mirai)", "value": "efb3fd3dd6e89d7c0c69c3e3b8531d6c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211413, "uuid": "1d4bd8bd-5aff-4651-99bd-c6a51cf6eb95", "comment": "Malware payload (Mirai)", "value": "7a2024076480ac54a9a6b7dee9eaacacd396b7d8bf9b0d90cad861114c30d966", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211413, "uuid": "1d3217cd-dd9a-418b-a5c2-c58a2ca86209", "comment": "Malware payload (Mirai)", "value": "678c41fda8f33b7ac5d12e495ff05d23077dd282", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211413, "uuid": "17e75910-cf65-4c86-90e2-932b7dfbef4a", "comment": "Malware payload (Mirai)", "value": "553e362de0ba332134fb7c2fc289c5e566a2eebc63f39ca43076c53aeb0b580559ab0fc3f4da6a087c6762a82da03d13", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211413, "uuid": "5f1f6d4f-f6af-4967-960d-fccd5eaafbf6", "value": "T1BB33D8C27892B639C2D05777EE5F414E3314A7D8D1DA3353C8281B90BACAA1F1D67B4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211413, "uuid": "68fd1c89-e8b0-43f0-9e34-3481802f9785", "value": "768:8vgKtmm2PcgtAG7RHoFk22uUVnjR+/oNYpoAV/cbvU7wCVy/rCxHghW1/Kw/tH09:immXdG9bjR/ANczvhWr5sK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651211413, "uuid": "760c5b57-6437-4fc9-af82-c025de72884f", "value": 50840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651211413, "uuid": "ce87aacf-eb9f-4159-b879-128bfd957943", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211413, "uuid": "9be4014a-ffb3-48b9-9c0c-69ce268205dd", "value": "phantom.arm5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e1343f-c7ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651231022, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231022, "uuid": "2f25a476-57af-451e-bff5-d64929d9881b", "comment": "Malware payload (Formbook)", "value": "6d1a242639e6eb5404c4ff6b0a022fc0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231022, "uuid": "d6015219-4ec9-4745-bb7f-d3ce045e75b6", "comment": "Malware payload (Formbook)", "value": "7aa9f7a67f816c6ca6d6e812b2948e02754d981f65f233c695063ce49d936608", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231022, "uuid": "420ca801-ca8c-488a-8d41-9ef0b02a4ffd", "comment": "Malware payload (Formbook)", "value": "f3c354c9485b3a8bb7bf83add1d07787349c9d15", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231022, "uuid": "9fc8b987-0f20-4323-9da3-dd73c0476e24", "comment": "Malware payload (Formbook)", "value": "ab43b90db85ff2611b7242167b5968dcb1a87bcaecb21ba567230efc9d6d9aab8244b8b8ede32d9d3f3f04e0dfc5030d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231022, "uuid": "a40e5679-fa72-4b81-99ef-9dbff1fa96ae", "value": "T17513E61638A5951AC5E83BF869B061937636BCE50024C18FDCF9BF29A9B3317DCC126D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231022, "uuid": "75b79b6f-64bd-4b91-9a73-a255cd642581", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231022, "uuid": "1d5f3082-d083-468a-8d05-cb1a188ae5c4", "value": "384:WXZfffff4AQLfDz+x1pIEHeoHznwQXulaiAMwCKFH2S3dd0hUADkaju:UuAQLDz+x3wxlmMwCK/3deVDA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651231022, "uuid": "b73fbbd0-4afc-4762-af97-60b1c508957e", "value": 45056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651231022, "uuid": "57b72f95-d513-4b7f-ac74-f83b8ad8dc7d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231022, "uuid": "4ecc8f48-4144-4156-88cf-8228daaf7f59", "value": "RFQ ref. AMC00145.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7275835e-c782-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651212362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212362, "uuid": "99302201-8bb1-4810-a123-79ad1ad42243", "comment": "Malware payload (Mirai)", "value": "bd49508b1e95efe9961d0143b6aa9ed7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212362, "uuid": "f3f14510-6c6d-45c5-9cea-b184fd8c8350", "comment": "Malware payload (Mirai)", "value": "7b11b5e4095f2356025bcb2f6c658eba49221040ad10b866c47e7f96deaa911d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212362, "uuid": "9482f852-0eb6-4414-8cd4-5053970cd14f", "comment": "Malware payload (Mirai)", "value": "c7f0db1d5731d39ab8d3ac0ba8ce10baa9e53732", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212362, "uuid": "bf58aa69-e68f-4b4c-97e6-7234350c6b5f", "comment": "Malware payload (Mirai)", "value": "784c74bcd835524e423e8e6e0d2794b5dc3c0f00e969d31b46e32d605b0bdcb1a17e096dbe03c1b4a8ce327af80d0209", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212362, "uuid": "e16abae8-273c-4625-ae00-e45fb6e40853", "value": "T1064318817891A626C6D05377FE6F018D33189798E1EA33538C292FA077CAD1F0D6B75A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212362, "uuid": "eeb2ce93-4c78-4500-83b0-1a43616cfd26", "value": "768:SjGn7QzCpg0aJjrbI/jBdKnjue4z54fduaH/qyENIQLJSULwCVy/rCxHghW1/KwJ:z7PK0wjuspi5IM8fhWF5qYuju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651212362, "uuid": "125854a6-2a0d-421a-b9d4-9707a9f49392", "value": 58212, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651212362, "uuid": "96c60588-b388-48e6-9174-f686579b7620", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212362, "uuid": "da92af83-2006-4ca7-bf4d-312cc4796311", "value": "bd49508b1e95efe9961d0143b6aa9ed7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c57ab4f3-c7ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651230969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230969, "uuid": "0961e98d-53d9-4318-aa6b-59423f1d9c85", "comment": "Malware payload (AgentTesla)", "value": "38124df0c6c4ca1e6c222de78a46bc24", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230969, "uuid": "93fce4e4-b796-4bfb-bfdd-b23b1677bcce", "comment": "Malware payload (AgentTesla)", "value": "7b2a904b196bfd42d4d23fa885600a01a243199e3f02d207e0a32edcfe38ce0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230969, "uuid": "6282ad9c-a094-4cc0-9cfa-9ed8f49e53f1", "comment": "Malware payload (AgentTesla)", "value": "b6cdcd5c883ed5f880d8d286e22c0ed3c631012c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230969, "uuid": "85438c08-ecb7-43de-bb78-5f297ef806dc", "comment": "Malware payload (AgentTesla)", "value": "75889cb104804a799c5bcca16e68e0de5600d4a60f875ab659a8180abf7147636f4619337aaae8c9bbc8ed7aaea17723", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230969, "uuid": "00c0f14e-ad62-4e0e-97e3-b4570c39e6d7", "value": "T19994234D0AB5DC84B403DD566537F4788EB8AB46BD4990889F713834ACBFC8E63657C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230969, "uuid": "58971297-3536-4395-bb27-21b2fc24319a", "value": "12288:4kX0i5oywwrX/qkhet3pQ//TkOu3IjgRa:4835osLyOuQT/U84a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230969, "uuid": "e2555128-babc-4d92-ad2e-0c889e17b1fc", "value": 444914, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230969, "uuid": "651d1026-d259-4c8a-8b0c-4f4051b99a5f", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230969, "uuid": "d9cde43a-c113-4e43-a77a-9e8c33444d3d", "value": "PAYMENT SLIP.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8194238b-c755-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651193060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193060, "uuid": "8b788c99-7495-4d2b-87a9-eaf77ebff915", "comment": "Malware payload (Heodo)", "value": "7bb673dd562dd80a02fb8bca8dc635a5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193060, "uuid": "87161fe3-5b67-4e53-99c4-59dcfc41c7c6", "comment": "Malware payload (Heodo)", "value": "7b7504070b43002793d4ab178cfaeb4c186e24fe99f083ccdb564b50879c8b83", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193060, "uuid": "5c30b566-1e13-4e61-b0b7-8c224263f28a", "comment": "Malware payload (Heodo)", "value": "b4964d868f291b5daf19bd3cf42166c6fae8e1e1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193060, "uuid": "8fee0195-e23d-4dfd-8c02-532c8e3a4e24", "comment": "Malware payload (Heodo)", "value": "87e56c54372f505f3163ec29303150aa7e51a813e4432291f83efbdb1833204753ca7785e86be433293582d85fe54ef0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193060, "uuid": "9429f2df-5ccb-452a-935b-91e0bbab63a1", "value": "T157C4AD0BF7BC88A7D162E57984239B8AE7B2BC114771D35B4760572A3F333A05D2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193060, "uuid": "cc3b50d5-e2e7-478c-93ce-ab1a40315483", "value": "1134f6be519e9c35b5478dccf9efcfc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193060, "uuid": "c9cab4cd-1c7b-452d-8c73-85ee02c677e3", "value": "12288:FX18uCYMUhDfWKN/Qd4UaQkhS+W/uczzIEudy7JMv9:MuCcVNImmMSLjQE0mJMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651193060, "uuid": "a3b6cce1-b771-4341-b40a-ae3ea66fadfd", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651193060, "uuid": "36b4e158-8ae3-41c4-b25e-cf1e11d50681", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193060, "uuid": "60a948bb-2ed6-4585-ab4f-343e0a65bbad", "value": "7bb673dd562dd80a02fb8bca8dc635a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe37022-c779-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651208572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651208572, "uuid": "b2d48ee2-6011-4919-a876-f752711fdf4e", "comment": "Malware payload (Heodo)", "value": "25bb72a4ae2fcdd0e3961ae9eba29056", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651208572, "uuid": "bab1fad2-40e3-4c52-8865-219e80143164", "comment": "Malware payload (Heodo)", "value": "7d10db2a2422c1ee286cddbe66fd02ef7eb0b2340a7b8570f62e52e5f7f57dfb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651208572, "uuid": "481413f2-b1e1-4e0c-9514-ebcd412dc33c", "comment": "Malware payload (Heodo)", "value": "7d6919b83631b8a4ac1504da99e736c9ab40e001", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651208572, "uuid": "7614ed5c-20c9-4649-865b-14d979c5012e", "comment": "Malware payload (Heodo)", "value": "cb4115470f29cec5d31154feafec68e9af5e795cfdc6a6d424026928525688bde2c68b27073c92659b7aeb461afb71cd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651208572, "uuid": "2534d07b-7eb1-45fd-9104-20a22cd871b4", "value": "T11B515E2C3EEA6218F6F3EF7059ED7685DEA6B962F9524D4D0081070A4922600FD91F3F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651208572, "uuid": "37e9a32f-5a33-4a6e-b330-82131570bbc2", "value": "24:8kJ/ByUq+fZYjjQtOB9AuRIZJiXRF4+gQo/uIH/y1XyHgbHo/umVlncIEjaem9dk:8mB156Xj03ugtHU+uccIx/cC/N4ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651208572, "uuid": "2c020da7-e021-4385-a6fe-08999d37efcf", "value": 2454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651208572, "uuid": "7fcec4b3-fee7-4b51-b133-44cbb50ac46b", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651208572, "uuid": "db1e780b-f03e-4258-85b7-6d6e0978980a", "value": "20220429_838873_0069.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "089861b5-c78a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651215620, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215620, "uuid": "4dbba0d3-ccf0-496c-97d9-b1420b778e7d", "comment": "Malware payload (Formbook)", "value": "1c31c64da774c9daeade9d4318bdebff", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215620, "uuid": "d0ab1e33-0123-4755-860a-d11432866ad0", "comment": "Malware payload (Formbook)", "value": "7f1f3e5447a338953bf0cc01487ab4ffa21f3a0037605dc9347886d4ccf6cb0b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215620, "uuid": "5acdf358-82f5-45b9-be13-844df3d0e35a", "comment": "Malware payload (Formbook)", "value": "1a801b147c751d7027783726642715a39eecb4b9", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215620, "uuid": "4b79342d-b024-4ce0-8ecf-78546f6bc9bb", "comment": "Malware payload (Formbook)", "value": "eb0a9c5ceee26f6c8c6e9843ef731125ce44482750a248d26f9bef6b38b23ccaa54d39f0a87a72d2e960bcbfe01cfe3a", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215620, "uuid": "5a4aa337-4cf1-4ff5-a643-57c8d1a7562b", "value": "T19393F1853F83D9F5CBAB8A7E0576AC1AB63DDC946D54A0BA63873F475E33C402812325", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215620, "uuid": "6da80fff-ad91-4d6e-b401-b29fe1d032bc", "value": "1536:QaVJ9Iq5cV158hAtj7NHvbR7nV5mnf6mIlvCPx+l5F2+Iwq4k5lhlZBAVzOp/QlL:QaVJ6q5cV1588Vvdmnf6D0PQrF2+Iw5q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215620, "uuid": "af736c85-f407-451a-b5d9-a773405e318b", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215620, "uuid": "02f70d0d-d818-4a7c-b0d4-b9fa930866a0", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215620, "uuid": "6b873bcd-71c2-416f-893f-ee5b7c94c7bd", "value": "OC.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "91c3a88a-c7e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651253646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651253646, "uuid": "000c4513-dc65-4733-9990-5308088bdfe3", "comment": "Malware payload", "value": "5897e67e491a9d8143f6d45803bc8ac8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651253646, "uuid": "1d7c8029-7aa6-4c7e-82ff-5147cc2e9843", "comment": "Malware payload", "value": "8148aeef6995c99c6f93ebce65b60bf57109914c45aa86d26a5cdc6ad8bba634", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651253646, "uuid": "acc2802f-8fb2-4acd-8e92-cc2e3acd1937", "comment": "Malware payload", "value": "d91ffc6d48f79e0b55918fb73365b9fca37c9efa", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651253646, "uuid": "211b6001-75fd-45e4-b9a9-b0bde42e96ce", "comment": "Malware payload", "value": "9f06f298d0ea6388bfaf51657c157188a4d17ac27fc99825d765a7c84aa61a59f754a27650f1a220dd1e6412c0abea63", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651253646, "uuid": "4ffda810-fed5-4574-b01d-3008ac7bf446", "value": "T1F2F522B353A92185D1DCCC3D9A37FDA0B1F7072E9F81A8BC48CA75C526564E1E223A53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651253646, "uuid": "8b9ee2bd-1a43-4160-834a-fc2cfe2e006f", "value": "ace5d0b52a1b14242630bc1db5d5c01e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651253646, "uuid": "0f065b6b-6c6f-43ba-9d5f-e945a5ee4151", "value": "98304:Y2pmOfhXaBWMVdxQ5kEiPgcW7aZ3nhmHIXfEOd03U:YGZYXHgcW7aZ3nhmHIXDH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651253646, "uuid": "cac79fcf-efa8-4416-b814-d3b2b8f6b84e", "value": 3528704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651253646, "uuid": "1852f4c2-7964-4841-9e52-58c135e62b90", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651253646, "uuid": "bfa98eac-a9e8-48cb-9085-b817f014fb22", "value": "msvcr100.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5d7f7ca-c816-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651276121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276121, "uuid": "7b7a2c3b-6ff3-4853-9b6a-44ea0d0f217a", "comment": "Malware payload (Mirai)", "value": "d98450cb69d897b7483b5ea72f89320f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276121, "uuid": "c10bcb69-7eb7-408f-8c94-4904686fdbaa", "comment": "Malware payload (Mirai)", "value": "8198994251c4349eda6ef794e04245c7b1a2c3c3c091e3a9406873f3431fcc30", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276121, "uuid": "40de2265-d6d0-4e4d-ac10-3185eb380186", "comment": "Malware payload (Mirai)", "value": "f556c0f33e6e85cd8dc6b53016675cee59824d5a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276121, "uuid": "ba746688-fd28-4e97-9d35-f409750644c2", "comment": "Malware payload (Mirai)", "value": "ed620b8b09c40012fea04288fb98d5d02da57a3a27cf61b330da7e62c2aad42883be72beb00ebf5c15f6ab8f9369a9f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276121, "uuid": "075a57d7-5b9f-470c-bc35-f9ccc12ba69b", "value": "T185A319B81999F26CEDF15078F41320DA28610A0C37ACD1E3B9D750BAFFB5708B16AD59", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276121, "uuid": "f4cb6078-3d37-41be-926f-f227efb5788b", "value": "1536:vBjHPam3VgGzjz5apRO/GLg5UyG8/v5qqB/WfHflwV9CZ4LWGK:pjHSm3VgK4pRUOyG8/vFB/WlSL6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651276121, "uuid": "1a6b5484-a41b-45bf-9e6d-ebd2b3898381", "value": 99780, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651276121, "uuid": "cfdfb4a8-e0e5-4b77-bafa-bb58a2b5dd41", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276121, "uuid": "c250c1c5-eac4-43d2-8fb2-55bdc7926e87", "value": "d98450cb69d897b7483b5ea72f89320f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283be80f-c770-11ec-8e58-42010a9c0032", "comment": "Malware payload (CobaltStrike)", "timestamp": 1651204506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204506, "uuid": "179fe7e7-b245-4b53-9476-0b006fbc0558", "comment": "Malware payload (CobaltStrike)", "value": "193e421c7636bd78097de9541d296cd3", "object_relation": "md5", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204506, "uuid": "d2615127-f4c7-4724-a1c5-3e99d1a972d7", "comment": "Malware payload (CobaltStrike)", "value": "81b676ba4819628bba0d7bbd3f624c94bd6c0d6bec5c51db30f8eb8b6deb5cf5", "object_relation": "sha256", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204506, "uuid": "cad5bcd2-3b57-45ae-916f-544f721530ef", "comment": "Malware payload (CobaltStrike)", "value": "c83abfa50faa9239e9b60947163b4cd611909a87", "object_relation": "sha1", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204506, "uuid": "eef53e95-34d9-449f-a304-d13f1b32bb75", "comment": "Malware payload (CobaltStrike)", "value": "4433add04ac7fbf6a42b405cc4576125b69ba8aa9400667aef47732235d558ff6e221191ee1ad596d8f8ee23c9afe7e5", "object_relation": "sha3-384", "Tag": [ { "name": "CobaltStrike", "colour": "#8E4D73", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204506, "uuid": "fcbc27b9-8d1b-44a2-bb24-71e17e280173", "value": "T17894BF03FD9184B2D7321C7F09A5A611157C6D220BD09A9BF3CCF9999E31CD1AE31EA6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204506, "uuid": "b81e9393-9f3a-4b77-8fdd-f7c50c257db6", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204506, "uuid": "3085dc5f-bea9-431b-ba3f-d6679373e182", "value": "6144:48JsLcpjzTDDmHayakLkrb4NSarQW+HUBcXPe8gVy+4if3o67lVdEMz:VzxzTDWikLSb4NS7/icXmX3o6+Mz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651204506, "uuid": "8fd761d4-9e0a-4230-bc28-7274797fdb42", "value": 434433, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651204506, "uuid": "d3cf82ff-9560-4a51-b42a-de6e43007446", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204506, "uuid": "e9c22580-b870-49be-979b-566ea4e6f4fb", "value": "\u4e3e\u62a5\u6284\u88ad\u5927\u8fd0\u4f1a\u5f81\u7528\u6b4c\u66f2.doc .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da6a7bd9-c7c4-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651240883, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240883, "uuid": "38993ee9-dfb5-4942-a184-1cc391942830", "comment": "Malware payload", "value": "c8f35b0e280f4f212171adb651c966bd", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240883, "uuid": "4a30bbfc-d9ac-4fd6-8df3-e5ce877fe7f8", "comment": "Malware payload", "value": "81b6ecf8e9c114094ab8273245806595e7b690c3f85bdf91dc5d6390bdb53712", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240883, "uuid": "e52d9ee3-6cee-478e-9ee5-c7c763e8d78d", "comment": "Malware payload", "value": "e550952e4472d67c1fc35b3f4c7e8d5514afcbba", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240883, "uuid": "ee8acead-dcb6-493a-9c14-8b95fa3cab12", "comment": "Malware payload", "value": "eedbf29d81740306453134dc63ff555f13ca38c84b75e04ce4f133530a0ac9ec1da87ec25923be09752c5b58849e3534", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240883, "uuid": "20a14e4d-25d0-40ad-9e76-b538f74d4dec", "value": "T1A12412D072C4A25AFF9132F0103C46B41AE9DE73649E63592EE53A4A3375D3E80952F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240883, "uuid": "5d7bc232-f92d-4aad-bd43-5c63a5f22c61", "value": "6144:g3dow5QzKxizomoMfRExd2Snzcj2ti6zXj+L:g3MKptMW32SzU6uL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240883, "uuid": "776e969d-0cc1-4917-b915-e7a118b1ad18", "value": 229688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240883, "uuid": "674535c8-46b9-4e2e-8ffe-8eea39a4707b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240883, "uuid": "97a9763b-05d0-41b4-99e6-c4f3e51ce753", "value": "INVIMM 22100960.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4a1faed-c7ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651236605, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236605, "uuid": "a986ee9e-b59b-418a-8831-edfdd74819c7", "comment": "Malware payload (Mirai)", "value": "38d6ac70962af5bb84ac7e7c43b75be0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236605, "uuid": "44abda3a-0825-4d4b-b4ac-b7423f282103", "comment": "Malware payload (Mirai)", "value": "821f28a10ce6d234f1e6b5b4ede0da671da4937e9e9cf6b1800943cef8c2c276", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236605, "uuid": "88efe2da-ff15-4f60-869d-e4e2acd9b456", "comment": "Malware payload (Mirai)", "value": "6e191376d215f202554e7843296c7b222080ceb9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236605, "uuid": "efa6ee7d-a384-4857-89aa-e524747acad7", "comment": "Malware payload (Mirai)", "value": "fcd8bb2b880dc6cdb4f2883cfb638f01e2c7470316c3f819eecf96da96446572e18ba6d32bdb930fd18102cc4d190e02", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236605, "uuid": "9f613bcc-3ac4-40a5-8d01-62041630ca09", "value": "T164532989B851DA26CAC052B7FF2F018D371593DDD1EE3303AD281BB0768B85E0E5765A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236605, "uuid": "90b24d59-21e9-41fb-9cec-a4aa8c786056", "value": "768:fgl+47FoAoUygw0N00WTjfuLFbSqvxooaAG9W3Gl3nB2oUlUISI41++ZnxFGq2XD:B47F1yj0WT4bSGxWWK2wR776BgQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651236605, "uuid": "983a44ff-5593-4546-af60-9a84da708e9a", "value": 62460, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651236605, "uuid": "43c3f4f1-000e-4745-9886-9b8b04173ec8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236605, "uuid": "97d98d61-51aa-4965-9fc0-3d07865f8352", "value": "arm-20220429-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4485f4a-c7be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651238215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238215, "uuid": "aee10431-e1cd-4189-8012-b951a9eafcb1", "comment": "Malware payload (Mirai)", "value": "0c90acaa9ca445c43e9c429d0c79b509", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238215, "uuid": "a7826ed6-bc39-4c14-89ab-6c556f8a1809", "comment": "Malware payload (Mirai)", "value": "8228632f951a738b7d408bf073121b28caadcf41035bae695e401659b3e6d182", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238215, "uuid": "34aa7217-4fb0-42d0-9eff-740cd36322cb", "comment": "Malware payload (Mirai)", "value": "754c9148af4c749603381a2f7d1dc16a8fa3f50b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238215, "uuid": "dd01278c-932e-4d43-a7e3-d666546446e7", "comment": "Malware payload (Mirai)", "value": "933e77647e5c3d36b8199ca93454055db586678a5d4e6dd75fe52baf9b65642f05e93534842780a1e351a4844a7997ad", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238215, "uuid": "fc211790-1bba-4dcc-bede-7bc415b45220", "value": "T1B2D2D11F1B56A699CEEF7C31A0870BB15A8571C336A95B894F464C80B12850DF9CCFBC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238215, "uuid": "911edf42-e775-4d0f-8f2c-fbaa623c50d2", "value": "768:5VYLMI+v86bUI3ad8L3wbwPu+42yETV1M+JumX5NC/Dx2aPxWID:/uMk6YmauL3wbj0M+JRX5gt2aP1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238215, "uuid": "3473b398-85b3-43f7-8399-a4f4b483c071", "value": 29980, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238215, "uuid": "a83da595-f584-44f1-bc69-9f69fc3b426f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238215, "uuid": "49a1ba37-5977-4ade-a790-4fbb41d59a61", "value": "0c90acaa9ca445c43e9c429d0c79b509", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2af40ba-c75e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651197008, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197008, "uuid": "2c1b0a0d-5b47-4a2d-bc41-91abb4436385", "comment": "Malware payload (Mirai)", "value": "59f0b4c76fa11024665e33a296b3bfea", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197008, "uuid": "8135390b-a865-4002-9e8b-f46073b7bee7", "comment": "Malware payload (Mirai)", "value": "82bcc815f36245c35b75e9f1112420ee7240359b3144c89936d43482b11e0e42", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197008, "uuid": "fca4c1fb-a55b-4d54-bd4c-98b11c57f2e7", "comment": "Malware payload (Mirai)", "value": "2ca5e743b44f97212cb83b83d7a68d4edd014ca1", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197008, "uuid": "5bcdc111-81fe-4a5b-badb-00354c79687d", "comment": "Malware payload (Mirai)", "value": "09664cfbe97038266a8d24bb60eb214e3816f8b11b43d703255c4a421fc5d6afeef5e037f96d23f7ccc3656439a1cb62", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651197008, "uuid": "32e63203-3f2b-4ccb-933e-9bad25d8df20", "value": "T1CA233BC0A682F9F5EC11457C307BA7729E77F436A03AEDDFD7D9A423A841602920729D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651197008, "uuid": "3076b210-36e2-47ee-9b55-937ca312795c", "value": "1536:Ovmt6GStZRjrMcPzOubNw1poPYdIYfQ5Igomv4aW:O5GS1HMcPCuheoPII7iavjW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651197008, "uuid": "4014c95a-26e7-4844-bc81-eed731709a63", "value": 49852, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651197008, "uuid": "827b58bb-d36b-46a9-a878-b631699b20cf", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651197008, "uuid": "d3a73960-e9ef-4b81-9c0c-1541ab90d147", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "494ed759-c7cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651244075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244075, "uuid": "e5777d77-1f47-4819-994a-0e0eece19c1b", "comment": "Malware payload (AgentTesla)", "value": "2b11a66d3d62e7b0c4853e5ca7104845", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244075, "uuid": "a89d329b-2d9c-45aa-8e2a-e4faaea90f65", "comment": "Malware payload (AgentTesla)", "value": "830e61a663372a76dd7efa8d808227f49a41ef0fc9acd908fb558b00e57546ed", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244075, "uuid": "e383df61-64c9-4143-93cb-bfc75215d525", "comment": "Malware payload (AgentTesla)", "value": "b328a62f1842d00f7712215b9f34f87e6453c8f4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244075, "uuid": "37c2af9a-85eb-4b9d-a3b5-e9621a4fe117", "comment": "Malware payload (AgentTesla)", "value": "77ba06e7a9c06fcf003b3f86746176fba683873b8559a209df83c2b7751c1da58b452c13d72de680cffa46f6c7ce1c13", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244075, "uuid": "5e3bd9c7-1766-4fae-b257-2219e36f282d", "value": "T1589423E2EC9D4A66DDF3454026F22447B05220C59E6CCED790685C6D6ADC93EA8C0BFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244075, "uuid": "f2525b71-cd44-440d-9f21-bfd51c2cff06", "value": "12288:RxAGq41ittm8fGPVIWvUZu4PEjw83Hk6Z6g57NX:RxpJsmxIW4ubjwWHkkJZR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651244075, "uuid": "5c7c1c2d-ac73-465b-8f92-26ec305ce249", "value": 415018, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651244075, "uuid": "5aaadcc7-451a-46e1-b3b3-7384c5a2e7df", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244075, "uuid": "21300616-2a03-40c0-884e-0e2691d26c1a", "value": "Invoice 0125649.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b391d59a-c75e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651197009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197009, "uuid": "7476b59b-40f5-4b33-a823-4dde4edebe8f", "comment": "Malware payload (Mirai)", "value": "1f1846827a0ef6acd23ba07dea896dfa", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197009, "uuid": "0f31a96c-6e38-413a-9e22-93d3f8688776", "comment": "Malware payload (Mirai)", "value": "83bd9c31a0bd940301263c78f04fa1f65153548ebd5902154743f8c230f83217", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197009, "uuid": "ea46dc66-70ce-46a5-b833-fac66ba71198", "comment": "Malware payload (Mirai)", "value": "b5d72bcac04efea9474956a5914169a91f84693c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197009, "uuid": "34784fe8-de31-43a5-98d4-09376d920deb", "comment": "Malware payload (Mirai)", "value": "9e770fd6081288d05f18d3d72a3b12411b40281c3f8e36555a079903bd0fca96f3b477a133badfaca2e3554d82772a79", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651197009, "uuid": "08f7e603-5c81-47e8-9976-2ff6eda06140", "value": "T1B0C32B46EA408B13C5D617B7FAAF41453322DB5493DB730689285FF43F87A9E0E27A06", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651197009, "uuid": "e22be15e-12d3-41ee-8dd8-347f24e23c1f", "value": "3072:K8PXmy9MphJXM93N30yDShgFKeqBi+nbHM/9trM/:pPXmy9Mub0yDShg4er+nzM/9trM/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651197009, "uuid": "2442bc28-e2c1-4db4-860a-393f653dba2a", "value": 128047, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651197009, "uuid": "4c178bd2-4407-4037-8fc7-e30099e7624d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651197009, "uuid": "14f517b3-4e9e-4f6b-848d-f6c60005dcf4", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75f90816-c7bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651237708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237708, "uuid": "b7b18ac3-76c8-41e2-8d54-aa74f805ea8b", "comment": "Malware payload (Heodo)", "value": "ad6fdf6a420324b961a9abf633fa51cf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237708, "uuid": "4775b7bf-1eca-4d84-8398-d74ea6b3c84a", "comment": "Malware payload (Heodo)", "value": "850253474db6c1b08ae62756459742be761769858a28c6ced29662ac871c54f2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237708, "uuid": "25cdf3f3-02a5-4cd5-b682-8e71c706a95a", "comment": "Malware payload (Heodo)", "value": "621c06289aeb808bc9ea4bc1fb6a87039ed9c79d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237708, "uuid": "4c3079bf-c0cd-4ad9-8fc5-87cadf9fe068", "comment": "Malware payload (Heodo)", "value": "13bf29e42bd3240bb1083657e30bf27792ff7dff9deb67745ff32fa3e67d30a27866e8124ad0e938eabba0a54fd958d7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237708, "uuid": "ff9b2c76-d797-45bc-8db0-04b7f9a216ef", "value": "T1D7C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237708, "uuid": "128a609d-fa92-4669-b39c-1f2f470b4339", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237708, "uuid": "d1c552d4-1293-4f01-998c-456306b2226f", "value": "6144:JhZ02GdOOgPYMKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfTKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651237708, "uuid": "1990b8c3-9b69-4aa3-a181-be59920c9934", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651237708, "uuid": "c4133fd0-e782-42b3-a187-06297fcf1073", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237708, "uuid": "a61717af-a1c9-4327-8337-430303975b31", "value": "ad6fdf6a420324b961a9abf633fa51cf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4d11ee1-c78a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Voidcrypt)", "timestamp": 1651215963, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215963, "uuid": "4e1b5a2e-42b6-4e5d-88e8-6c923dcb1c14", "comment": "Malware payload (Voidcrypt)", "value": "60678bfceb6e15b6b55b7be0d7048121", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VoidCrypt", "colour": "#F7E6F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215963, "uuid": "954f16c3-050c-4f38-99af-36bca1ebbd40", "comment": "Malware payload (Voidcrypt)", "value": "85e20e2f586121db07acebca51f79553b081babdc09471548d7f6b1845af4885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VoidCrypt", "colour": "#F7E6F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215963, "uuid": "20f8fe05-bdd7-49c3-a8d9-9b7156c1bad3", "comment": "Malware payload (Voidcrypt)", "value": "9edd3d920fbe89240d52cc8b300a90e5bf576f73", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VoidCrypt", "colour": "#F7E6F4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215963, "uuid": "c89edf39-e3bc-4838-8d85-bae9007723e1", "comment": "Malware payload (Voidcrypt)", "value": "bbfb77854a507160fe01a67ed2b360c6da176d3baede0debcc35a355eaa6fcdffefcf5e9db63fe0b2013b8b975eb5a95", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "VoidCrypt", "colour": "#F7E6F4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215963, "uuid": "9be1b345-a711-4076-87c4-0165dcf14a0e", "value": "T1952448F1EFF83960F51946327538427C59E3EF61DCBA40AAE1AFF14A18769C041A8E17", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215963, "uuid": "f7adc7bf-d549-4d83-a614-51b9f73a7b45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215963, "uuid": "9d8513e5-196f-4dc4-b39d-f82b1791e588", "value": "3072:3qBkGJ8YXmHDZLWlTSMu/9laSnsBOSrXo0hL5VkYrfV911I3vqY:fGuYXeDZW4MuVgUsBOchL5nrfV91yq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215963, "uuid": "63b1cf1e-7f35-4ad3-bb4c-173974d4a6ab", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215963, "uuid": "ce7743e7-1852-4714-93d7-58b7b6a2b6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215963, "uuid": "0d331345-0266-408a-903c-75589ce6b2b6", "value": "TiktokHeartbot.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "630af7f1-c74f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651190431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190431, "uuid": "60b72f23-dc5f-4af4-a4ab-abf36dca2197", "comment": "Malware payload (Heodo)", "value": "aa05c62944b3f72eddbd6a22198c27d0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190431, "uuid": "0b3efc5c-b733-4dbf-8e5f-02720234896e", "comment": "Malware payload (Heodo)", "value": "8668e3643cf461cc8fbdc88d24faae4036742ebfcd96e607c65be367e2b338d0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190431, "uuid": "501e22a8-cc6a-4499-b30f-74f4b3c98534", "comment": "Malware payload (Heodo)", "value": "b07ad852f720330783a4f1639d6faba0c5f847b7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190431, "uuid": "f9333fd9-72b9-4cd8-9ac5-3f83b8b6f411", "comment": "Malware payload (Heodo)", "value": "594ec87a60ff66f156e29aa3e5b9653f7c20fd8f39233d1e461ccb986259d7b4c3200c050c7e27ddf6d2e77326a4fbfc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190431, "uuid": "2d4d3090-24a4-4f02-a214-9f5422db717d", "value": "T151C4AD0BF7BC88A7D162E57984239B8AE7B2BC114771D35B4760572A3F333A05D2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190431, "uuid": "07bb7bba-3444-42ea-82ec-f476126a7e1d", "value": "1134f6be519e9c35b5478dccf9efcfc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190431, "uuid": "2d079cb8-1c95-4a1e-96f9-8dc1b5a18e1d", "value": "12288:FX18uCYMUhDfWKN/QdKUaQkhS+W/uczzIEudy7JMv9:MuCcVNI0mMSLjQE0mJMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651190431, "uuid": "3d9fbe60-59a6-4047-9ea6-165e36b0934c", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651190431, "uuid": "3b982194-aadb-4789-85e9-a6df5c533abf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190431, "uuid": "a704f916-fba4-49bc-98b6-64f5c0c42e79", "value": "emotet_exe_e4_8668e3643cf461cc8fbdc88d24faae4036742ebfcd96e607c65be367e2b338d0_2022-04-29__000008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8fd22c66-c7dc-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651251066, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251066, "uuid": "3ecfa681-fe10-46b6-a82c-0103702aa6bc", "comment": "Malware payload", "value": "ca5bdfe7d802b2389ffdd12f7c031ecf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251066, "uuid": "b0c8a8e6-e779-4251-ad4a-cfda3021004b", "comment": "Malware payload", "value": "88b2d5adf2017ee74775d111df6dc08b1761af176f57d29c3e18dbf448a4d9b2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251066, "uuid": "325c961c-4246-46f9-b12a-4d4363dddfa9", "comment": "Malware payload", "value": "d461c9431367598b9755120af5793c97a64c68ae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251066, "uuid": "a6408833-cae2-4eb8-b53a-3726101c7599", "comment": "Malware payload", "value": "c8e0a3dfebe89cc5b00982ae6c2df904649a47387cb9cf1ef21faf8897a8365245eb1e8f4bde9d5c8deb40d4e7d57421", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251066, "uuid": "11e47146-5efa-4064-9d36-d4777b84b9ec", "value": "T15A35AD71E39145BBC1733E789C3AB299BC297C101D78C4CA6BDC0F4D4B2AA5267613A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251066, "uuid": "b3809c28-4874-489f-8284-fcc26a5621fd", "value": "f5965aa7635eaf08e77b609502ff5e9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251066, "uuid": "0cc46dcf-0fc7-46d5-beed-ca46e53eb84b", "value": "24576:UmfEXFuca6UcUqybkX0YuSw7zMYQ0a4lFb2:UmMu6fUfYXXuSoWx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651251066, "uuid": "2bf3e77d-3dbf-4ad6-9c64-063fa7b33569", "value": 1161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651251066, "uuid": "58cd9773-d00b-44f4-9283-64eb92f5376f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251066, "uuid": "80cf77fc-4cb8-412b-879c-e1230def969e", "value": "44680.5787951389.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7656269b-c770-11ec-8e58-42010a9c0032", "comment": "Malware payload (Triusor)", "timestamp": 1651204637, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204637, "uuid": "a2e3801a-e628-4ce7-846e-16bb49725664", "comment": "Malware payload (Triusor)", "value": "b17c387762fbbd6702a86122a92879b3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204637, "uuid": "6566e3b3-c354-420f-bc65-ee8ddc3715dc", "comment": "Malware payload (Triusor)", "value": "892c096989346f9a62150dfa71fd4d3e78dfc87e722c825c0eb357a4f0fc12b2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204637, "uuid": "f8ded2c5-e406-469e-a5a5-00dcc3ead298", "comment": "Malware payload (Triusor)", "value": "d04100f86c39c86384616f8379713b175e0bf326", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204637, "uuid": "05d2fa2a-799a-427b-aec7-1d2b104cb235", "comment": "Malware payload (Triusor)", "value": "7576ea71c0381aefa5b055995d99cdcd65cf8ea3d63b25159a02cb072974efe810fde95541b49d22a71438587763ea4a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204637, "uuid": "51e95d57-9fec-458b-8711-e767b818e117", "value": "T1EF137D137CD0883BDA9205B225B58B2BAB3BB754174524D7EF485DEA2F330D8D93624B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204637, "uuid": "fc4901f0-5dc6-47ae-87c0-3bc95018f66a", "value": "12a30b523ac71a3cbe9145c89400dd7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204637, "uuid": "14a67871-8f3b-4338-88bf-3631b193365c", "value": "768:Wl5oOEOUPZUmYv6hGIqi06LeChWg8lFBAW2zYioRoSqSVJ:WnuOWoCxKg8F7joSdJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651204637, "uuid": "2acdff60-a8bc-4cad-ba55-92d71690e101", "value": 41984, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651204637, "uuid": "a225c8a6-058f-4d0a-846c-5ea1e4bafa56", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204637, "uuid": "1e1ec7db-e612-44fd-bb91-dd64fd3b6b7e", "value": "mada.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3dec20c1-c7c5-11ec-8e58-42010a9c0032", "comment": "Malware payload (STRRAT)", "timestamp": 1651241050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241050, "uuid": "3f87520d-0df6-42d6-98f0-b52e6ce05470", "comment": "Malware payload (STRRAT)", "value": "7c0b11da6dce235b4e2b8458c0ce2c74", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241050, "uuid": "94ae4325-bffd-42ea-a4c4-b6d9d8e6c028", "comment": "Malware payload (STRRAT)", "value": "8a0aefcbb98d4daca341c93ccef0eee97cf3df16789edbfbb4cc3c1695e630c9", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241050, "uuid": "207bea61-4b11-486a-b2e4-90e723521674", "comment": "Malware payload (STRRAT)", "value": "7ae32bc0b07afa843205a90e27b5a03589239245", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241050, "uuid": "4dbd6d39-6e87-4c25-af5a-f3c2628ebf87", "comment": "Malware payload (STRRAT)", "value": "3e9b785088a18fbd8a4df773aa263537de0d7aa0dc526aeb40a32993c6b92e0bc2eb806ad0a91d29c9c8c52c182a4fbc", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241050, "uuid": "d295e51b-379a-4478-a4d7-8671ad290031", "value": "T10F146958D6B4F675B9E85C2804650E3A07712EFD63D0CC8B5D3A6B7D9A5220A0F1E3F8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241050, "uuid": "9d902959-764a-4e50-90fd-19c05ac2647d", "value": "3072:gqYMAPX9cu3UU9KqMlZUOqh+RGLMCTqkNC1KE3TV1oIGoSw8:D2tF3Yl+8RqbVEBZb8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651241050, "uuid": "86fe728a-fc1a-493c-9f43-e225ea9e6e7f", "value": 200303, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651241050, "uuid": "71f9a7cc-db32-4341-bfc6-8e15e512145a", "value": "text/plain", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241050, "uuid": "ad68245a-8cfd-4509-841e-b8dc22b65d45", "value": "proof of payment.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3bbc184c-c788-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651214847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214847, "uuid": "9d5f48d9-0ff4-49e8-be37-6a2ddd01ef4f", "comment": "Malware payload (SnakeKeylogger)", "value": "5a6b350486c4c74f17725660317929cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214847, "uuid": "f48bf213-b3eb-44bb-9641-d455b7abebb4", "comment": "Malware payload (SnakeKeylogger)", "value": "8b2d1de8b9bdb843d046a4c9e5cf3b3793f77ee3b6eb0d7b1f3129882512740d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214847, "uuid": "7a67af44-6135-47a3-bc90-f388bd559ecc", "comment": "Malware payload (SnakeKeylogger)", "value": "f1df08fb55c7e3f0c4607ffaa9d32804e7942277", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214847, "uuid": "547e193a-21fc-4fd9-8121-62c1db9f6eaa", "comment": "Malware payload (SnakeKeylogger)", "value": "33e7c32a27456c3ac5673032f9888f1504265d524fb32d3b2f07765b5539f53819b87bf3684d6b50b54f6c93b9cf00c4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214847, "uuid": "ddab0287-c2a2-44c3-8c73-0bc82139f47d", "value": "T1F4050209FB73ED10C5940B73C4C7A91843BA7F62A423E71F79CC365686333968A4769A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214847, "uuid": "cd42a0b1-07fb-4f0e-849d-38948574b813", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214847, "uuid": "69e75785-3f76-4c36-b6eb-e6a0202595d6", "value": "12288:UD1TU9fNkpXDUbCvt1/gNNLXWjK9Xni41jPaTHGMyT+OcGcRk+xRYo0THDfk:X9apXobMssjK9XZjWmMWBcGYY5s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651214847, "uuid": "a0a909c4-a007-461e-84bb-63756858e216", "value": 873472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651214847, "uuid": "2351d2a6-aaae-4173-acb4-52c428348236", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214847, "uuid": "a99c6ea9-8f1c-40f0-bd74-bdb259faefad", "value": "5a6b350486c4c74f17725660317929cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "97658876-c7d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651249360, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249360, "uuid": "51d7eea7-a451-4e3c-85be-4ff8e3281696", "comment": "Malware payload (Heodo)", "value": "0ac73a2bdf55cfb1008ebd808c03d464", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249360, "uuid": "7692ecb6-83b2-4042-82fa-6d3b07f00fe1", "comment": "Malware payload (Heodo)", "value": "8b9ea792c3c594449242e58deddf8bad37d7c4c356e44ffc3254d14d4b9aa83b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249360, "uuid": "203f0150-585c-4792-84d5-0afada2b10f3", "comment": "Malware payload (Heodo)", "value": "18fb1871ce29dfbc2317859702bee081b7b76712", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249360, "uuid": "7c29a702-f9e7-4799-859e-1df5d02fde7d", "comment": "Malware payload (Heodo)", "value": "fcb4a26acc5a5483c50eadda696367a7d6ff21f3151292e9733d79050cbe0a4c652216a3d34600e0eaddf625b65f823f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249360, "uuid": "680f5682-d3a2-4286-b1ba-a21dddf09d2f", "value": "T17DC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249360, "uuid": "8e9f32c6-34d0-48fe-8da1-73d1ecc983a2", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249360, "uuid": "c88c796a-9b52-4c04-b094-46615eda9495", "value": "6144:JhZ02GdOOgPYmKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFflKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651249360, "uuid": "76e9d3b2-e95b-4295-bdb8-4e3084480ec0", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651249360, "uuid": "dc7ca6bd-09ad-416a-af4a-e42795ddd496", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249360, "uuid": "25032507-fa76-4694-a9bb-da80fd7dcca8", "value": "0ac73a2bdf55cfb1008ebd808c03d464", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda50ca3-c7b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651235359, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235359, "uuid": "f7042195-29e8-4e8a-97b2-9f871f504b9f", "comment": "Malware payload (Mirai)", "value": "cdd65f106d97cc2af2b279f8f0dd38fe", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235359, "uuid": "01e0919c-1077-4040-827b-e3ba043178c0", "comment": "Malware payload (Mirai)", "value": "8bca0183723a6898368ade1ff9db43c7d319c1966b956ddd955b483d3e5300c6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235359, "uuid": "be16af31-d6d7-48ff-b84f-650984a8d16d", "comment": "Malware payload (Mirai)", "value": "d36fed3d1d3f52dd6ca50611cb4cf807a2d25faf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235359, "uuid": "e040e688-b7cf-4ccc-9ebf-1d4a2d73021e", "comment": "Malware payload (Mirai)", "value": "ef613cfe0a0f70c142ebb0a52992468d92fe0dbc6674bba33d365d36e611b596d3d9ecd4bdc6c02349c7858965585f53", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235359, "uuid": "f87dc3d1-5940-4b61-aa7d-dce7c147d4ae", "value": "T136632995F4029F3CF88BD6BA94170E05B921638547C30F2BA6A6FDA37DB3054BE25D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235359, "uuid": "a525b8aa-c738-44a1-8f79-1685282239af", "value": "1536:yKYDydkSp116PU4I58Ok/Tgp+nTuRbxgNB:yKYD/S/1QUNM/xTwxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651235359, "uuid": "dfead828-dcad-42b9-afcb-31877fcdf2d2", "value": 72332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651235359, "uuid": "bc31df50-f257-4b1c-987a-b4e6629f5c9f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235359, "uuid": "31dec0b1-a829-4630-a036-7b2efc659748", "value": "cdd65f106d97cc2af2b279f8f0dd38fe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f8381872-c800-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651266703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266703, "uuid": "ae62c3d7-c6b9-49bb-82f7-65ad449998e2", "comment": "Malware payload (Mirai)", "value": "15046c6cc0382349471959516aae7284", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266703, "uuid": "db8415a8-9167-488d-a706-0e47bfee6e8f", "comment": "Malware payload (Mirai)", "value": "8c57eed03401fe090129af4becc8d37e8dbacfaacd5b9907a56afed137f9020e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266703, "uuid": "c118ba8f-e18a-45ef-8954-4afffa4ce13e", "comment": "Malware payload (Mirai)", "value": "39dd1c01f3e0b5c86edcfa1e4a1457d95dd4c3d6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266703, "uuid": "cdb0ebe6-3ad0-499a-9792-f5be0a3602e5", "comment": "Malware payload (Mirai)", "value": "6a23a4f5694c63fd6add27ab935ffab3b285b36ae286be54fd9425a17d9c9cb8bbd6f13b7a5840773b062330a8aba2da", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266703, "uuid": "6bf14de8-7ee7-4484-b2df-fda7b23609cf", "value": "T1EE637116BF601FF7E8ABCC3785A95B4A25CC541A31A93B797D34D428B24B25F05E38B0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266703, "uuid": "94176a27-408d-425c-8ab4-0e7960cfacab", "value": "1536:FJs9gGYlZma+9KRJisXkBg0rruxyDu1Z:FJs+9mLiJMrud1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651266703, "uuid": "cd274cdf-e8bc-4f59-bb71-7c075e915d6d", "value": 73324, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651266703, "uuid": "03218edc-e8a6-46de-bea1-1b4dfe43c84f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266703, "uuid": "7eae17e8-60fa-403d-b9f2-d6a0f5e36111", "value": "15046c6cc0382349471959516aae7284", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98af0b2e-c7be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651238196, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238196, "uuid": "0676eaa0-5893-44a4-a90a-b7924f4ff84b", "comment": "Malware payload (Mirai)", "value": "2625e475ffa158ea77f5612306f62f7c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238196, "uuid": "3ad98dcc-4044-46f0-a31e-2d34deb9dd53", "comment": "Malware payload (Mirai)", "value": "8cd4457acaa97bd436e0fc37b250d1321d6f835d78c5b5afecf0d2512a4e1854", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238196, "uuid": "02ad253e-9a4c-4470-83b2-81f1d1e3691a", "comment": "Malware payload (Mirai)", "value": "23dfd704463a02a3445192ec1db4f90d1ce22b8a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238196, "uuid": "fb4f7b75-78bb-4f28-9520-063298825932", "comment": "Malware payload (Mirai)", "value": "a34da9a260e73c5fe067a750e0a9b6a0fea2ad1da0c59527f5284b19b638805bd0e0a4d343fb76781f39e6309d38ec8b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238196, "uuid": "b48b329d-7894-4bcd-b6e4-d9bb9fd353f4", "value": "T1EE733A25B9791E36C0D0B57E11FB8B01F6E1228E26F4C51A3DB20E5EEF247406952BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238196, "uuid": "601c17c5-0993-4c26-8ecb-b87a7c3a35dc", "value": "1536:1gfq/SnNLlYfpDFQS2OX+msMmsRoe6vfL7rLQn:mE2Md0rvfLby", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238196, "uuid": "1d64e92e-caac-4139-8f53-435e6e7397df", "value": 75504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238196, "uuid": "bb062dc2-638c-462d-b0e2-69c82182d458", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238196, "uuid": "72153b16-0aa8-466b-a085-389a797cf6ec", "value": "2625e475ffa158ea77f5612306f62f7c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f9362ce-c7a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (DBatLoader)", "timestamp": 1651226074, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226074, "uuid": "83e1301d-6ae3-416c-a9ce-6ce979087caa", "comment": "Malware payload (DBatLoader)", "value": "47c9d0c807fd62110ecd4f8597d4c697", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226074, "uuid": "afbb5227-1ed3-4c00-bd13-9767d1e32a82", "comment": "Malware payload (DBatLoader)", "value": "8ce226f25c17d785871d2e0f33597715a06ee5b3d86cd389cca0c2de9fd6318a", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226074, "uuid": "1269faf0-428d-4475-ad69-28f61f879c3f", "comment": "Malware payload (DBatLoader)", "value": "2275e260dafeb99e76f550342e7336284237b41f", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226074, "uuid": "c47e3a2a-5d91-4161-9b57-7e06a88c82f8", "comment": "Malware payload (DBatLoader)", "value": "290843bb6803b8acdd780007a122891e3d6e2b2280ab1607c732ad64091c46d9b6c3d299090acddd25f7fc59612e5492", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226074, "uuid": "f32ae3fd-f763-43e2-aeec-32093b34097e", "value": "T10EB42336A293973C74F7AD29DF37053A50A3223AC71FA75DA67D60835742F3A23441A8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226074, "uuid": "4f4b8f20-5414-455c-b210-ded13f7a0837", "value": "12288:O9aRt3NanSxOUJih/q6fngE/zvgEKaZl9fS6jET8KpkS:zt3NRJo/q6fngmsEbtS6YT8I5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651226074, "uuid": "2e6ff4bf-d6eb-4999-a27d-256af907471c", "value": 497351, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651226074, "uuid": "008b6d74-9c25-40bb-b690-469aa8ce5910", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226074, "uuid": "4ee764ee-cd48-4ff2-9f44-9860cd12b33f", "value": "New order is %0D%0A%09attached.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63b21d67-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651217920, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217920, "uuid": "e097e9d5-3346-465b-9a04-f795014b3d2b", "comment": "Malware payload (Formbook)", "value": "a859b6df55fc1921cbf9e29b267b0252", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217920, "uuid": "c2ca9d0a-5809-49f9-ac6f-b6dee233d079", "comment": "Malware payload (Formbook)", "value": "8cfbf18a6d4b171e8bec81b40716b9214e4aec1246319dff997363dc67432a4e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217920, "uuid": "daecb4c2-bd4d-4ff8-b24a-886d44689973", "comment": "Malware payload (Formbook)", "value": "808e194f24d1f620284fb1afbe722bba41d3d83d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217920, "uuid": "6906c0c0-33e1-4648-af4b-6463426e8cd8", "comment": "Malware payload (Formbook)", "value": "d5555bad944d08bf30ff15a42ee9d9d3d07225b2cd6f7269afe4e34bc691397f50c118a9bab08935482f7d153670962f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217920, "uuid": "45dc8da9-bb7c-4224-bd70-cac04bedbaea", "value": "T186F402467A58D3F5EA390FB33E93810E5B523CF8AD41D45AAEE3F1864C716212E542B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217920, "uuid": "d3c76b2e-bbe3-4e5a-a1d2-9fd761917eb5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217920, "uuid": "a93926d4-9911-478a-9e04-ef7eba5525f1", "value": "12288:ILWJekPN3dW8V4Yz3C+zlD9oXLop3D21bdu8eTrfm2SZPz8dUcmBtDtgBjCLbcs1:UQxN3d7WqmLw3D2TxDPz8tQtD2B1sxr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217920, "uuid": "dc1539d9-a8de-4e3b-b5a9-f7096597d7d3", "value": 778240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217920, "uuid": "62428736-e806-423f-a30d-2fbbac99be44", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217920, "uuid": "8f54eb0a-8e90-4999-9cf1-994552e778e8", "value": "a859b6df55fc1921cbf9e29b267b0252.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d38dd63e-c7b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651235288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235288, "uuid": "e4e2725e-41c1-4d4e-b7c5-23b49f162a77", "comment": "Malware payload (Formbook)", "value": "3909326959d5d5db11039408b0bcc1bd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235288, "uuid": "033f0def-a9bf-4274-9526-4a648549b109", "comment": "Malware payload (Formbook)", "value": "8cfeb4d76cb22a9b1736afcfb1fd9cfe08e55bb1143560a343989aa7620f0e40", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235288, "uuid": "c4b5e90a-7748-41aa-9edd-3b9e1d2f122d", "comment": "Malware payload (Formbook)", "value": "8e4abe31e9b0eee9cc12db6788e5c86c9f586806", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235288, "uuid": "f97d9613-c1a9-4c71-bdb4-d6d9f7e9999e", "comment": "Malware payload (Formbook)", "value": "a80b3c13e1587baf74f382ca313fe8f855ebdee05e0a4656f2124a022ac76c2bfd15e78a051b6986e52b66bc7d0f6d4c", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235288, "uuid": "c30c4214-ac7f-41dd-8b25-9eb4b8e6a2af", "value": "T1F475337AC6F95932F0B44C72F835BC604166931E2E0189D65338F6DA102E8F25E5F96F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235288, "uuid": "bc6f05f1-761e-4b25-8ba9-c2dba22f28a1", "value": "24576:Ie1JPQgMB8ejVDpvICI6q84gAhPmZRz60IL5OHI7QkqwRBJNU7Z/0uTDOiSj2T:lJPvm8gVKCqhPAPHEQU07Zsu3RWo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651235288, "uuid": "3864b0e2-941e-48fb-8028-ddc82afe4c2b", "value": 1702475, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651235288, "uuid": "f7855831-99ad-4845-9448-12ae7350539c", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235288, "uuid": "ec97a9a8-e2cf-4ad6-b5d7-d92bfe1430e4", "value": "PO 19600377.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0215059-c7d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651249375, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249375, "uuid": "6ecb2793-904b-4d64-b336-44381d8f5b65", "comment": "Malware payload (Heodo)", "value": "cbeea3fff0f1c51643bc5108f2c0a24e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249375, "uuid": "5806e246-94ff-4a9b-8c92-a09b84cbc1b8", "comment": "Malware payload (Heodo)", "value": "8d87cbb6dba6e108efadfc2ff2aba270fa5c0cc17d111c29fc37fcb0e97022bc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249375, "uuid": "e64b67b9-66df-4fdb-a287-2de8123973b9", "comment": "Malware payload (Heodo)", "value": "9688e9145bfed5e7586b8fe257143f9c43d49cd0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249375, "uuid": "3a6d2fa7-c9ac-4eed-925b-9a3647248cca", "comment": "Malware payload (Heodo)", "value": "4f53ad865fe9ee0ed56214d4ba233eed10b64e3547513893a05a028c9b3dd2bbae779deb319c67bb461e9675db4ba314", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249375, "uuid": "6b259d85-5fee-49f1-90ff-a16b140b12b2", "value": "T1CEC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249375, "uuid": "717b6155-7df2-4cd1-8876-b349bc4f5b25", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249375, "uuid": "d2de4495-875e-42d0-b4d3-afd6981df268", "value": "6144:JhZ02GdOOgPYnKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfEKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651249375, "uuid": "2a4a624c-5bf2-4cf0-92eb-d84f2d9a9b5a", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651249375, "uuid": "652a36d6-43e5-428b-90a1-c47909d4b22f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249375, "uuid": "6ae6126e-5a19-4b4a-8b22-368435e9ab3f", "value": "cbeea3fff0f1c51643bc5108f2c0a24e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fbea7d03-c7c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651240939, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240939, "uuid": "490b270f-b89e-477e-996a-cc2a1643ee94", "comment": "Malware payload (Formbook)", "value": "b3726812cdfccdeab37ec569670684c0", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240939, "uuid": "916ff967-2f31-4393-bb13-e37fa7d20b61", "comment": "Malware payload (Formbook)", "value": "8e59afba3cf05f36ecea8a6e283983f03f3c0b8771f929fa100a85ca15f0f799", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240939, "uuid": "d7a2b6df-cab8-4c80-97ff-530aecd3f0a4", "comment": "Malware payload (Formbook)", "value": "cd524609680a5575d22645a32813fc04f3cb82a5", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240939, "uuid": "83fa848d-9f75-4089-b407-b5b82cb5d2bd", "comment": "Malware payload (Formbook)", "value": "4affff5c5201e765a666d3a1b16f515e76e317cbe4a8426866c5d8d1c8b0839acfc0f837f57ae13a0191b0ddbd809429", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240939, "uuid": "f4b4dffe-72dd-4443-9a8d-8bc3d2e37e18", "value": "T11193E0B02391ABB6E1F40A7804D76453FBC26C0AB8288542964FF4C66DFCE5E5E57C72", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240939, "uuid": "b3f8f6a9-558b-4c01-ab55-02cb43acce38", "value": "1536:bmd1WXOrwuVuKdb2kRIDPHXj9e6x2MoWuX63xaprTBbuyIPueh7odA9r5L1hC/:b2ZrwJkWT9e6wXEuFbuyIPVcq3h8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240939, "uuid": "1340146d-e9ac-402b-9dfd-b0973fac8a9d", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240939, "uuid": "4a8bb130-967d-4ae3-9458-cb9055a56c3b", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240939, "uuid": "35919d2e-a909-470d-a9f0-1cd990597e82", "value": "2022 PROJECT .xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b238fe0d-c7d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651249405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249405, "uuid": "7a208391-3a7e-4e31-8834-3544d610f060", "comment": "Malware payload (Heodo)", "value": "5c51b92e63865c37b2ec96d08fe8a211", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249405, "uuid": "1ff8adbd-db77-44c9-8dc9-6ade8f9d45e3", "comment": "Malware payload (Heodo)", "value": "8f4ee9d9e8e735fe2a09578993a75144d1095631ce6e6516a9dddf8bbfbef451", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249405, "uuid": "fbe07b5c-05ba-4911-a198-eb0c43c0b659", "comment": "Malware payload (Heodo)", "value": "5a428f38b9d4951aad332a69203076a72c5b7ef4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249405, "uuid": "f30a0b28-70ea-4425-8695-c5153f48cbf9", "comment": "Malware payload (Heodo)", "value": "f4835df954ce30adb56bdd77711eabbb19ef09c94fd0c7f01f9fe0cb937bb44587689cf81c3cc5c2fd7fbe8e017572c1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249405, "uuid": "1f739809-cb9e-4ea6-b94e-f285221d19fe", "value": "T140C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249405, "uuid": "543edeab-1c35-48ca-a90b-f27a74260305", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249405, "uuid": "698ed213-2960-4d76-bfc7-00919bb44f95", "value": "6144:JhZ02GdOOgPYqKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfdKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651249405, "uuid": "49db55f1-ab09-42c8-86e4-de8c1dbe2c5a", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651249405, "uuid": "809b58b1-d4e2-4cad-921e-0e6fe14f90c4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249405, "uuid": "04dba205-b492-4a01-a7f8-7b9f794e51cf", "value": "5c51b92e63865c37b2ec96d08fe8a211", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5490af9-c7ab-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651230137, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230137, "uuid": "b8872991-8727-4cc3-9e86-1c80876beec4", "comment": "Malware payload (Heodo)", "value": "db668c736ab94a4376a8e728d1c77ae8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230137, "uuid": "902a66d8-5f03-4333-a5c8-f6add952e2b1", "comment": "Malware payload (Heodo)", "value": "90dcc0b1018fdc38df485c6bed46692441da7aa259fbc7a28f79a61cf8387033", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230137, "uuid": "7866aff7-1c19-480c-98cc-5cfa6131aecb", "comment": "Malware payload (Heodo)", "value": "fe401b811b04321f1bdeb7f99861d9a1496274fc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230137, "uuid": "d337587e-f317-4234-b95e-9e3cd71d6eb6", "comment": "Malware payload (Heodo)", "value": "e96b9d86a7a2207bca4a5e8e9a4079614d9f291e06fa28d6bed8eabd1763aa44b96458defcd80b8ff3f3402cbba1cdcf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230137, "uuid": "3366eb4f-761a-476d-acee-9c7341298104", "value": "T1FFC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230137, "uuid": "d9520b69-0b74-4771-ab1e-1042e564dbdd", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230137, "uuid": "7b75a8b3-a2f2-46d3-b908-39cb1b15cf46", "value": "6144:JhZ02GdOOgPYUKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfHKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230137, "uuid": "3a17bc83-453c-482f-9ded-78364271ae8e", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230137, "uuid": "1986a135-2741-4461-af0a-7d3775cff026", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230137, "uuid": "b48c996c-ce49-43ab-8643-7e488af8b31b", "value": "k5rhsoQ8uIWCT33w7ko2k.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d28dd553-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651215529, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215529, "uuid": "a58c09be-ef94-46c9-a0e1-03add139ada2", "comment": "Malware payload", "value": "0855037eedb866e6d1c46ae0cb32af0c", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215529, "uuid": "15607993-84b4-4553-9614-fc7ae64ee940", "comment": "Malware payload", "value": "90de7b02fa1a245023a0e38dbfc6f28fd95dabed5c9700ed7418e6a51d547b63", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215529, "uuid": "f657d1d6-9dfa-43ba-b589-da8b8ce640d8", "comment": "Malware payload", "value": "0416df74f3e6044f4d88b0841164e64b639baa1c", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215529, "uuid": "0635d84f-297f-4bfa-ada4-0ea95888493b", "comment": "Malware payload", "value": "a83f63247e7f844425a6d7af315da26d3534c7d88956a2c6eb6ff515990941e02edb77b58963c5947eefa9210cb23a52", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215529, "uuid": "c403c9f6-c8a2-45b6-a13e-e5385ece5c32", "value": "T194066B96B2C9693EC06B1A7745379618893FBA616913CC9707F80D8CCF36580363BE5B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215529, "uuid": "63c3b2a2-98fc-42de-a135-0b71fea0e571", "value": "49152:WkpOYtEAQ9P7ZTg8J2SUU0tM4mG/++4xrdlt6Tpv36c893/E:jOYeAsPt0E4mKUrwfT85s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215529, "uuid": "c0a51805-fb64-461b-93fe-7d0940e5a339", "value": 3911168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215529, "uuid": "1e648530-47ae-4ec7-a344-7a1177f84364", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215529, "uuid": "91bf3818-b6ba-4ffe-bb2c-7eb383d1cdec", "value": "NFTS.Iplacenotaprefeituracnpj892379110162-25.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1482d16c-c803-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267609, "uuid": "8371f6a7-56ab-4323-b5f5-7fa6308800c5", "comment": "Malware payload (Mirai)", "value": "237ce7a9210044f3a73fa502ad6fa455", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267609, "uuid": "ea548df2-d735-40f5-a509-fa57de91005f", "comment": "Malware payload (Mirai)", "value": "90e354c12a5f985312c00a838a64ddf53b9b3f6939b3fd8c2f75976c1a6e698c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267609, "uuid": "45f97a29-c1b3-4a13-81aa-322cbfe86f92", "comment": "Malware payload (Mirai)", "value": "10e0c7d040678854fe59fd437bf82af9f12e49f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267609, "uuid": "b13c9dcd-15db-44da-b1c8-16c29b7b2c35", "comment": "Malware payload (Mirai)", "value": "bd84dd039d4aab7afa2732ac47295727584acf37e57f9bda381d444cbb019bd3645c1e978145fdf851529fe9f610867c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267609, "uuid": "f0347952-0fae-4e51-8fb1-c1c20d218b10", "value": "T156537C39D459ADE8C0064A74B819CE344F53E48483A32EF6DAA083EA9453DBDF419FF4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267609, "uuid": "29e9e6db-5661-477f-b504-d9f3c95fb3f3", "value": "1536:Lan3rst5CCFjwtV3W69e+wfs3y7pI/q+LKyeqCM:Laot5CCdoyf+yNWLKyeq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267609, "uuid": "3f2b37d3-279c-487a-9dd8-1a4609f82b9d", "value": 65044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267609, "uuid": "84125139-72ad-481d-83ca-4997efbac8d4", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267609, "uuid": "9343a7fe-e22a-4418-9482-6ba94cb4db42", "value": "237ce7a9210044f3a73fa502ad6fa455", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bbac3cf0-c7e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651254146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254146, "uuid": "4300de6b-2d44-4b31-ae72-06137f568eb8", "comment": "Malware payload", "value": "294117d1f651bb4e9ebc98e455ab6e52", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254146, "uuid": "816c223e-d576-4cff-95a7-ef609a37751e", "comment": "Malware payload", "value": "91e532dc3030b3cc1c1a7df7cc27cb21c943a763109580d402995d51cd49f094", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254146, "uuid": "eeb9ab44-249a-4677-8e65-a3bd018cb290", "comment": "Malware payload", "value": "265429c2752acc80fca9375223f7299bcbbbda7c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254146, "uuid": "418a5fb7-c5b6-4858-af88-5cf5c26d71db", "comment": "Malware payload", "value": "8dcba60c2404c3eaa3747a4cb619261396df7db8cba5da6f839a7ae4ee3e2b46abf28b8fbbfba8ae6df9192c54ff54ee", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254146, "uuid": "597ec1ee-471f-41e6-aeee-fce3dffc2b25", "value": "T11FF48B42F95C7DD5E52906B91936E5303265EF9A1C2DCE0929F17E8BB4713C2F022E3A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254146, "uuid": "61515ffc-874a-4d6c-9d4f-5880b0e8e4f0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254146, "uuid": "354f228b-2e09-410e-ab1d-55d94a6a4852", "value": "12288:DdKf0YnB4QLUSjDZ10myQsKauI5Zf8libwFJ4T48cTM:Y9LUEIf1JsFJQcT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651254146, "uuid": "acce246f-faf5-492c-8de3-0daafbc0b6ed", "value": 776704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651254146, "uuid": "ce230996-ab95-4eaa-afbc-106be2a19ebb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254146, "uuid": "7c2f2ff7-47a4-4600-847f-44999d562dd7", "value": "SecuriteInfo.com.Variant.Strictor.271551.29580.31085", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "18db8818-c7d2-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651246571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246571, "uuid": "c6e1c0cd-7ee2-48d0-a798-f644f5376b90", "comment": "Malware payload (Heodo)", "value": "86833d2ead0dfb533795bd95627e0c73", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246571, "uuid": "9e3cd8fa-49a7-4ea9-8762-460575772764", "comment": "Malware payload (Heodo)", "value": "9209f5c8a46f8f56cf2157b1d59f30c819a69f2105e49bc405ac0fadd224b308", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246571, "uuid": "5b960029-fa5e-4d24-9c8c-9d23116d7fa8", "comment": "Malware payload (Heodo)", "value": "ef76fa2f93ecd8b738e22c9167943683d9f5418c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246571, "uuid": "754ddcd6-62d1-4d9b-a89c-ecbe89549caf", "comment": "Malware payload (Heodo)", "value": "27f70521d1e93e33974e857a66b9ba504771edb8f649fd20948958c08bcf4bb20a2261708a811a12411e48e8071d1fb4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246571, "uuid": "de32d970-5157-49d8-a375-e639592d41b5", "value": "T1FCC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246571, "uuid": "c91dcf6c-bdc6-43d1-8917-cf1e8b5c557a", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246571, "uuid": "9c90b489-dc93-4a2a-9183-81a7873fe77a", "value": "6144:JhZ02GdOOgPY/KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfMKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651246571, "uuid": "5d485a5e-b651-4b45-8dd2-590a2e09b18a", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651246571, "uuid": "b28bcdb0-e579-4851-a894-44ea57448823", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246571, "uuid": "76395089-1d22-46be-9522-a97427790534", "value": "86833d2ead0dfb533795bd95627e0c73", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c34e56c5-c782-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651212497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212497, "uuid": "f54a3f81-b658-4ca7-bc4a-015993d58c41", "comment": "Malware payload (Formbook)", "value": "ba8f66839f4d0aad3e37cdcc51dd5931", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212497, "uuid": "c9145b87-41f7-4b03-a84c-8ae5fd67c133", "comment": "Malware payload (Formbook)", "value": "927a6d1881637855f1d9c2fd2d6ebe44badb2871411dd3d441903f0981371885", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212497, "uuid": "177f3d4e-5dce-4368-a09c-ae0dac91042a", "comment": "Malware payload (Formbook)", "value": "c19edcb0f7dc2a61b0cbe70cd970d32214f7ceeb", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212497, "uuid": "415531d9-e8e0-4033-86f5-3e346cc9ff09", "comment": "Malware payload (Formbook)", "value": "bfcd8c8f36f0a86496af181599c165e016ff093938acc7da7e49c432c79a19118f6b6511185eb11dd224ddb0f9eafd63", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212497, "uuid": "b03e4761-d654-43bd-83a6-60964c236177", "value": "T1F8D4120BE310B666CDB80FB214676960A6B7BE632532BB4E21CC7E65ED33BC1D502571", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212497, "uuid": "a35def00-df2b-4e0f-9371-deb87c0c9fc6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212497, "uuid": "7f5ee22c-b553-46db-ba67-a6b2e814487e", "value": "12288:7TzO9CUxgA2vLJtj3sheZTebWe2bVwvtxvpM792JJ:TO9zX2jJdmeZqmV6lU92J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651212497, "uuid": "08b9ff69-55fb-43e7-b334-70e273e6e91e", "value": 610304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651212497, "uuid": "11bb0249-60b2-4179-be43-3cc04a234dff", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212497, "uuid": "8ae27f5e-0525-42ce-8283-0631a809ab0b", "value": "Transfer_MT103.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c487d2c6-c767-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651200903, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651200903, "uuid": "25ae26ad-0e42-4fa4-b6aa-e8d5ccee8e32", "comment": "Malware payload (AgentTesla)", "value": "0ba808bd5a60215673807ecd70994b9b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651200903, "uuid": "c90dcb8d-fb0e-4068-ab33-4c2c7aada22a", "comment": "Malware payload (AgentTesla)", "value": "933e38a0229465879cd725c857d6434cf6a6870bbadfeca8320799e4cbfa6434", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651200903, "uuid": "a934e456-6c37-4f78-8a3e-0c1f9ff0a29c", "comment": "Malware payload (AgentTesla)", "value": "357e5c9060e730f04d9d80ccb20bd1987a181df4", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651200903, "uuid": "ca0b9a13-e33f-4408-a3b3-93998146f6d7", "comment": "Malware payload (AgentTesla)", "value": "fdbd8349da86f5eae7a1842fddae31981a7f87ba31225a6c13bd311e00facfb925733e4d71d5a2af2f25450dbb267089", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651200903, "uuid": "3dad5971-8638-4932-924b-522c83013160", "value": "T133056BC7664D390DF495DD7536A06683B3ECB8B24CA0B804368E1D64E4D14BA78FA27F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651200903, "uuid": "1c4e73fb-ade1-4aaf-95d0-0ebb628bf206", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651200903, "uuid": "e79f338b-d271-4b45-a0c0-39806fe1a65f", "value": "12288:nuCe1ZPvtj/iy8o1NvBtmUaR6ZTTTbZ2tHaYXXnobzLaw2a:nuCEZXtj/iroOxE7ST4bzLn2a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651200903, "uuid": "eaa46ed2-9b89-4fa6-99d0-265fd1a51769", "value": 833024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651200903, "uuid": "145980d1-aeba-4353-b1cc-56666c591585", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651200903, "uuid": "33355b0d-2c6a-4f9c-bd85-e76d3b499b4f", "value": "RFQ #14331- ABU DHABI HARDWARE .exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2809c95-c804-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mercurial)", "timestamp": 1651268357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268357, "uuid": "545abcaa-dfaa-4d3d-8807-7d492210db32", "comment": "Malware payload (Mercurial)", "value": "84737f0c7ed11f35c961c115bc85d88e", "object_relation": "md5", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false }, { "name": "QR Code Theft", "colour": "#D138AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268357, "uuid": "88dd1329-524a-4478-b88c-1836869048f1", "comment": "Malware payload (Mercurial)", "value": "93cf710da75171b8f12abb3373cecebb3096ed8b04deb9e602ee434158876fb7", "object_relation": "sha256", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false }, { "name": "QR Code Theft", "colour": "#D138AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268357, "uuid": "c79d7c86-ef7e-46e2-8b34-4691dbb5172f", "comment": "Malware payload (Mercurial)", "value": "5da7c57952ee10bb03881daf7f40b17af6751e05", "object_relation": "sha1", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false }, { "name": "QR Code Theft", "colour": "#D138AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268357, "uuid": "3ea9d1ee-735b-4988-a6a9-4bcf546d37d2", "comment": "Malware payload (Mercurial)", "value": "b4a4f8a70e5ca8d5285417593c87bc57e115693c49cdf21191e45ad62293732021d1ff2957eb217ee3e987a637301a79", "object_relation": "sha3-384", "Tag": [ { "name": "discord", "colour": "#27793F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Mercurial", "colour": "#79A0AB", "exportable": true, "hide_tag": false }, { "name": "QR Code Theft", "colour": "#D138AD", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268357, "uuid": "83a39175-5aa2-4132-ac32-23e60a07f2f0", "value": "T1C0661251379ED63FE2F952F4647486408BBAEE211528E0EA7C923ECF32F4B014535A67", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268357, "uuid": "3d5cc31d-118d-47d2-9259-535c53b69fa7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268357, "uuid": "a65219fd-5345-4164-b062-1360b533471a", "value": "98304:d7w0WYwOYA4vWVU4fgcmnH3EPIL6yFs9u/FpboNe7mZD7JOi9mq2Jo2N/03FIgcG:2s4vkmXas+6cOyR2JFNmWZCZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651268357, "uuid": "b6cfbae6-a69a-4893-bffa-b5a27048af7d", "value": 6765568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651268357, "uuid": "e15e3229-7902-4ff3-80aa-a6e099b89ead", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268357, "uuid": "ec050255-5366-48ff-8688-27fc14357260", "value": "Discord.AIO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82ccdb52-c78c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651216684, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216684, "uuid": "4e6302fe-887c-4900-aee4-13215313cdcb", "comment": "Malware payload (AgentTesla)", "value": "f3125c457179a538e52098e8e25166c9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216684, "uuid": "7ab529f4-fbc1-4923-af67-347da07653fe", "comment": "Malware payload (AgentTesla)", "value": "9415ba7fa971ee55f7a87230b88239da5788273178b76adce05d799372b03d3d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216684, "uuid": "02fd51c5-60b7-482c-ab96-48d781bc9647", "comment": "Malware payload (AgentTesla)", "value": "11166554ac3c1725effb04eef46636e798afe74a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216684, "uuid": "e93e05f2-313b-45f7-a773-648bd170a565", "comment": "Malware payload (AgentTesla)", "value": "84e4e5472c85299626abc02e89a8474f498bab67ac492fe72ad1758e462bcaeb38bc779f03f8e9dc36f2ca866c42c4fd", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216684, "uuid": "495c938d-2c83-4856-b675-679b2c1a2d58", "value": "T17125F11ABA55CAB2D43C0EB3F9D3510C53626DA5E942C25FAAC3F2460E363E61C81777", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216684, "uuid": "03ed3787-e4a0-4ecc-a29a-c7204a023993", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216684, "uuid": "6e11f9fd-b6c6-42d8-b007-1ba11496384c", "value": "24576:UeiGWQ0Svqb3MLSzoWwNEtIB8YvYGP7s+c:/0SSbFcrF8S7s+c", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651216684, "uuid": "b9959825-9aa8-41e6-96cd-1f5f46f9286c", "value": 964096, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651216684, "uuid": "7b000152-bf4a-41b2-a3fe-3e8a67559265", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216684, "uuid": "6d932ebb-8e40-469a-8e2a-9c0f8073494f", "value": "T\u00dcB\u0130TAK SAGE F\u0130YAT TEKL\u0130F \u0130STE\u011e\u0130_xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3fea0e19-c7ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651258233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258233, "uuid": "64d9c631-0a8b-4a09-8d4f-79bcb5009712", "comment": "Malware payload (Mirai)", "value": "fc2e33aee195ffc4831b1e1a7be89f9c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258233, "uuid": "1b11dc59-0563-4ea1-9d87-eb6edfd72639", "comment": "Malware payload (Mirai)", "value": "94c026350485e60178f8823c4de49b3649d32dc48d3007d3ee7fc1a5c94eb8d6", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258233, "uuid": "cc05180d-65d5-420e-b21f-1375fb5d9c7d", "comment": "Malware payload (Mirai)", "value": "e56e6c395fe32d53ac6538e2d462a18cb38e622a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258233, "uuid": "8e8064d7-72c2-4281-bd85-0fba78bf34f0", "comment": "Malware payload (Mirai)", "value": "7d301566736ff076391c04a0bc2264520adb42c12f696df123e011dae7078126b34bb12372c6457d38296b755b5c69d9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258233, "uuid": "e5385c8e-c154-4ccf-b044-be19724bce72", "value": "T195337CB5C579EDE8D1144A78BE248E749723E100C6932EFADA44C6A99083EFCF5583F4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258233, "uuid": "e095f40c-267a-499e-98d4-a2b892f49ba8", "value": "768:jaixFwtLSYAagMo0ebH4/ZvQX3hyWfs3INgCJUU/qMCqKomQRCvK:jaQFwtOGBvQXxfs3kgCJt/qMF/RCvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651258233, "uuid": "097d1476-342b-4222-8884-0648d3fe2522", "value": 51584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651258233, "uuid": "3dca2c20-f158-406b-b077-f0f33c7f6de7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258233, "uuid": "0b3d2547-2897-4950-9695-c2606dbae2e6", "value": "fc2e33aee195ffc4831b1e1a7be89f9c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87dc52b7-c7ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651230866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230866, "uuid": "03378c1c-9a81-4349-a64c-1f33bd2fd399", "comment": "Malware payload (Loki)", "value": "c54c32304b87e7d53c40dedfc8d5c1fc", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230866, "uuid": "27fe0e57-c7b2-4d01-8d52-b3e4a4f72f6f", "comment": "Malware payload (Loki)", "value": "9519aec8ec68979123a1d8c91e39d2c289cd50a8d69cea705b04c2e1d273d30b", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230866, "uuid": "3a7c2ed8-aeb6-4a55-a67b-27a8e334c582", "comment": "Malware payload (Loki)", "value": "37fbdcb5b02e42815cde9a9d89a1e50ca4b2c7f1", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230866, "uuid": "7cd047d8-89e9-45cd-bd5f-ee8fe5768f0d", "comment": "Malware payload (Loki)", "value": "d0cdad0ebed10453d907033c88a5fd35c489fccbc23cbafbe25b5e74ac154a01da87d5ad34ddd014f66ce1a709d4812e", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230866, "uuid": "d7d79817-3d1c-4e67-803c-a8c10c9bb4c5", "value": "T192F2D1DDC9B21254D60D21B4EA8E5A6E93BD3B440B4F180B73B061E46FAA1D9FF27D01", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230866, "uuid": "25ca7f40-3372-453c-a5d0-4efacecf35a2", "value": "768:BzhqmGCPTTEm6Soqex1OcCGaQHTYYhkrxumF6Fh:+EPTw7S6/gQHTBwxxF6b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230866, "uuid": "df4169ae-5445-4ffd-a725-2be609fd78fc", "value": 36550, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230866, "uuid": "27782e3f-458b-4aee-a54c-c3dbfb6e63b3", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230866, "uuid": "9aff1312-be79-4b02-ac98-b4e3117ae7d2", "value": "New Order PO-REF67340982.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "725ac50a-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651232548, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232548, "uuid": "ce980a61-7a13-4318-a638-a7fe3210a538", "comment": "Malware payload", "value": "d558257ee273c3987843846be4eb8480", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232548, "uuid": "55310725-f63a-4d99-9112-8dfe3610e26f", "comment": "Malware payload", "value": "969c23231ab40fb05a400263f0623c667c8d0bfe025ac54adc0962f677c75ea0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232548, "uuid": "9c1eafeb-96ad-4710-a14e-21fd2f6ca12b", "comment": "Malware payload", "value": "4ed510a384ff82b787ac010d1c86fbc8ea2dc0ff", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232548, "uuid": "3588b07d-d2b8-4c81-9433-730b8b003ee7", "comment": "Malware payload", "value": "4924881d70e4a943e5b5793d86352cb02adf9b6efa8ba832481ba4f589d2bc1e757283077f91b6f77a4a3ae0aff291a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232548, "uuid": "0884ce75-d87a-438c-ab1d-4da9ed152cfa", "value": "T12D620A422B68C862E6D58576884705A00534F6079463FB1F6AC9AD0EEF73AD8CBD2772", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232548, "uuid": "f5e6bac8-c09c-4dfd-ab17-74d79ca001b2", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232548, "uuid": "e3620444-77c9-4fab-b3a0-24182111143d", "value": "384:ke1KffSp/yx7vQHTeH2jST8pKDWKDaYHwq60c:ken65x8dYQkc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232548, "uuid": "079d643f-5441-44a0-8015-fb1249d4c64a", "value": 15360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232548, "uuid": "e262b57b-6c53-40cc-990c-e471d98a19e7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232548, "uuid": "56a6bb4a-d686-4b5e-9cc8-3eca4953ddd4", "value": "RFQ 1111111666.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e20c7aa8-c816-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651276114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276114, "uuid": "e241d0a0-20e5-4613-ba4f-b889aa61b84c", "comment": "Malware payload (Mirai)", "value": "42c3340decbcdb7fe3136818828e8b5a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276114, "uuid": "5408a469-427c-4b0e-b004-bbde9307d7d8", "comment": "Malware payload (Mirai)", "value": "96feb7059a9531d5f61b7468b0235cbb92986ddab088b161d4e73861bea97994", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276114, "uuid": "fbd79696-3466-4902-90e7-6f367a422a90", "comment": "Malware payload (Mirai)", "value": "7c2b3d8e6a043ce575d927e1ea9398f31d9f9216", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276114, "uuid": "07a3a448-4db1-43d3-a41e-7c278367f83f", "comment": "Malware payload (Mirai)", "value": "6c74f830d81e47da50e850c338eb332adceb4fb1c814b3912e9e1cc3471eabc6716283af98dbac8820ba044528bbb552", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276114, "uuid": "6c541d65-a8cf-4a7f-bf7c-e0fdc2d644ac", "value": "T1B9E2F152C68644E0C940143BD858C24A66A922FEFF3CE79E678837AD95B10D1D7FE7C2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276114, "uuid": "eaace455-7be7-4d16-bceb-36186f3b116b", "value": "768:RaiuI7+sMH0/OoJauW1gRHyWQoIHpima5GB0EKpyj3Ucw:RQO7/NWGRHyXo8piFH7h", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651276114, "uuid": "174cfd1c-925a-4370-a44f-fcaecc58ffc9", "value": 32640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651276114, "uuid": "9d4eb77b-c8e1-44f9-a96d-b0c17a99af20", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276114, "uuid": "d12c8120-2fb0-4554-927b-3e6a31a11bab", "value": "42c3340decbcdb7fe3136818828e8b5a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07f99e7c-c803-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267588, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267588, "uuid": "83b5318f-245c-4226-881b-4cd42b1d126c", "comment": "Malware payload (Mirai)", "value": "3823dd086756f94fcfeaa86a3bce4b01", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267588, "uuid": "9a0230c7-4489-418c-9b37-66a97d5e23a2", "comment": "Malware payload (Mirai)", "value": "970a079dfff07142216b313c52c4f2a73e89ea24dca03f4482af71a99e98a3a2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267588, "uuid": "eb99837c-e7d2-49dd-a668-a71a937a7d08", "comment": "Malware payload (Mirai)", "value": "76f09f9c983328e23bafad43a3a7b806faf9aa96", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267588, "uuid": "163d4fdc-a2a8-4900-9951-4546ea92cf3f", "comment": "Malware payload (Mirai)", "value": "b6b42ae3878b60d717745b2e1817007449b5d5133392d4542298cad1d74d41927e9b097028da7f3e4a11e86b478f6a1a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267588, "uuid": "db13ef7c-4ae9-49cf-b420-d775ba04ab4e", "value": "T1F5C2E000616724B1E630993AEE3E2B0A77436FE041FEB0F66551537EAD89B6F3278705", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267588, "uuid": "437919c8-a3cb-442b-a65c-c5f4e5304434", "value": "768:CgvZFfdEZMHhqOidieBOXQAySL3nImyouIs3UozU5:fDEZMYOidPQZyonIeu9z6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267588, "uuid": "e9d0fb7f-4640-43b8-a79b-db619a2c009e", "value": 27472, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267588, "uuid": "fdbd1a1c-36e6-4a4d-a5cf-84325c5292a0", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267588, "uuid": "1cc47f22-ee7d-4113-a56a-17cb88cd142f", "value": "3823dd086756f94fcfeaa86a3bce4b01", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "729ca097-c7c5-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651241138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241138, "uuid": "4fdbb845-79f8-4298-843b-237c1660b8df", "comment": "Malware payload", "value": "736447d268ff1c0d5d10b732b5661989", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241138, "uuid": "74aa1b5c-4c02-41e7-be19-2ab790b0ecfc", "comment": "Malware payload", "value": "97b7d12c4a348d966358ac4e7df14627fd327ec6aaee994a9100e83331f412be", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241138, "uuid": "80657fef-a9d6-4dd6-96ce-8854bb820734", "comment": "Malware payload", "value": "422d4fc9b3ef36497007183e6d429df8b869524c", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241138, "uuid": "664669ce-e075-41b6-8cb6-d19860f48cde", "comment": "Malware payload", "value": "2d205a663ee387b0f11f969ff39032bd8e4f64daa4efe2a6ce7d12c97237a8f700a5f1e511a5aa0625dae32f8d6d2dcd", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241138, "uuid": "57cf53c3-1f96-46c7-a0fa-03c2f62d2f3f", "value": "T1FC13E8AAF6D9E805D9050B3548EBD6FA3223BC229F9B53473289F71E0EB1580CB43557", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241138, "uuid": "993635a8-c8c2-46da-b032-982099f11937", "value": "768:mqoMKpbdrHYrMue8q7QPX+5xtekEd/68/dgA1AoWsXJZA1f97vbwc4AqTR8Myv68:XtKpbdrHYrMue8q7QPX+5xtekEdi8/dC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651241138, "uuid": "7c7ecf36-78fc-4c37-8ace-8e2ec2abd235", "value": 45061, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651241138, "uuid": "e13f259b-3587-445b-9279-0d3b584be4fc", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241138, "uuid": "a5988787-c6ee-4d21-a67d-283ea996f0cd", "value": "funds_transfer2497.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f95afc9d-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651215594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215594, "uuid": "fc4ef28b-499c-426a-93a2-a7e4f3c64765", "comment": "Malware payload (Loki)", "value": "c643713a4a35ca0652fbea1f335edb5c", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215594, "uuid": "21ebfe1f-ff47-4634-bc0c-3cb6f9a8be26", "comment": "Malware payload (Loki)", "value": "990c5153cf1ce6dd5db02106dd489fef43584c7071cbcf1d05c3d6946e0967f3", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215594, "uuid": "ee8b4cf0-5c47-4bba-899a-22ef3a1d4d0c", "comment": "Malware payload (Loki)", "value": "063746d530d7ca7303d0431764b52fc9414fc035", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215594, "uuid": "ceb84861-aa85-4396-a567-df271b71fe70", "comment": "Malware payload (Loki)", "value": "cf4610019eb3649ebe6925d4387d35d40d21a884f5f7987fc32ca0c30281cee5504ac8c2f89ee063f97f84c9db752321", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215594, "uuid": "56381eb7-883b-4952-a7b6-e689d3f36f83", "value": "T13E93E02AF242C8C4D9762B399F0FC10A959D7F58909745B222CB727608BFCB19B712F5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215594, "uuid": "3148f7c4-3c0a-4ca3-865c-bc97529b3733", "value": "1536:XhyIlA8wjoVIoVNYJxapEOq9RpHJQPoGgEs+1D4UobRTbUhd9:XY+ZIi/p6pHJbvE1J4UoQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215594, "uuid": "0b0d11ba-acb8-41f5-ba19-79a7db267fd5", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215594, "uuid": "613dcc7c-20ea-41ac-9a55-e56ad95741cb", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215594, "uuid": "7f00ad94-b180-469a-969e-0d208d5d964c", "value": "payment advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a66ea5-c7bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651238773, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238773, "uuid": "9e64b751-3e6c-49bb-b758-7bbca5f24d42", "comment": "Malware payload (Mirai)", "value": "df1bb7ace7c3949fbb05aa3edda653f6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238773, "uuid": "3e9d6a87-733f-4d2f-86d7-adb9b7bfbc9a", "comment": "Malware payload (Mirai)", "value": "9a3383de4a0a5ad939dec253577606387f661537ac74a65b52b66e18710ce87d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238773, "uuid": "128b4e0e-f1c4-4026-b9ad-d20533adb4f0", "comment": "Malware payload (Mirai)", "value": "fbe8b43017aa91f4eac16c8655d88107071439c5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238773, "uuid": "7d00b683-954c-4939-8b90-4dbd79e96b03", "comment": "Malware payload (Mirai)", "value": "b04dbc1fff5ed974180f56ca8ac320041e6998b3f872aa3a64debef30246b0592c0c00abe497b9ef2a4548024700e170", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238773, "uuid": "fe5ad04d-a54e-44aa-b152-b08a2a2dd4a8", "value": "T12DE2D0279316E131E6744E7BCF2503463AE945B9F0DA24F20AD48F597FB399324A1B43", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238773, "uuid": "20c0c87f-d874-4084-b9a9-5df546b9353e", "value": "768:x/2iWc4fHLeOackndAfXlZxH9C9q3UELOx:JSdeOxcAdvdL+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238773, "uuid": "36f057f9-4d19-4858-a250-f9c6921b15b3", "value": 31944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238773, "uuid": "44fcfd0f-ce2c-470c-b508-15e971648803", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238773, "uuid": "abe70bd1-326a-4f0e-b73d-2f0d2d8cdf7b", "value": "df1bb7ace7c3949fbb05aa3edda653f6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b7e713af-c7e4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651254569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254569, "uuid": "1fceeab5-9254-4124-8c7e-7baf2afc4d7c", "comment": "Malware payload (Heodo)", "value": "0a1d3edffeeca462918dbf6fb4137a8f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254569, "uuid": "f99dbaf2-1ef4-49d1-a5e6-6710ce43d2f7", "comment": "Malware payload (Heodo)", "value": "9ab7f834b560493a4fc1a029bd56267a6ee04db28bda8909a367889cc5700f9f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254569, "uuid": "a455c46d-841a-48fb-b03d-250165b6a6c2", "comment": "Malware payload (Heodo)", "value": "e5fef1200b17bb3ca86a2ef9105e14205561418c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254569, "uuid": "3e0593ed-636d-4c4e-b1ae-11c4df44b0fb", "comment": "Malware payload (Heodo)", "value": "2396c7647ab4fd75ec3e4d3d535ffd6d4984a3c12d3b60adb71cd528304fd6b03dd193e3db8dfad6e119507efbf00a88", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254569, "uuid": "c2d694fd-2c4a-41b0-8096-c8fed580aaa7", "value": "T1DAC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254569, "uuid": "1989182e-9de9-4d32-ad1a-a6aa3104f7e4", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254569, "uuid": "b9ea88cf-c774-4e5c-a422-38bafebfc6ce", "value": "6144:JhZ02GdOOgPY3KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfwKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651254569, "uuid": "9bdc00f2-d863-41a2-9cf2-f2b15c0b92f9", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651254569, "uuid": "216cee45-d7d5-4a89-9de3-5dc59d2a8dec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254569, "uuid": "e7a67b03-aa26-4707-8e90-90d730bd71e2", "value": "0a1d3edffeeca462918dbf6fb4137a8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23a81ced-c7b9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651235852, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235852, "uuid": "8b9a2b82-3e64-477c-90a9-1bda51900cc7", "comment": "Malware payload", "value": "64ef1ed141190d09c0e4fe342a7eddc7", "object_relation": "md5", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235852, "uuid": "b4e80b0c-c248-4e49-b24b-c7bce4a88f32", "comment": "Malware payload", "value": "9ad62d3e5f0c58db8ec9bd22ea736de7193f9900c497e274fa5c907c488d263f", "object_relation": "sha256", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235852, "uuid": "2746e05e-2ffb-4291-8b5d-7412df5b196b", "comment": "Malware payload", "value": "f7fcdb71ac1902d3c6d90b310e485626a74c4907", "object_relation": "sha1", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235852, "uuid": "c605e421-7b80-48ce-bcef-8875f413fd07", "comment": "Malware payload", "value": "d891841a200ac806865af60fed3d230c2541fa51eb76cdb6034b7ba4a69c88c9f96412589ef264af20379b56d2203a8c", "object_relation": "sha3-384", "Tag": [ { "name": "gz", "colour": "#97C949", "exportable": true, "hide_tag": false }, { "name": "QUOTATION", "colour": "#75C1ED", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235852, "uuid": "f0c089f0-1433-44a0-a569-9a72eae85889", "value": "T11A02B0A391AB04E875FDB66B8165A7406235B4E3DD413C6383C27DB95EACA2CCF0B01C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235852, "uuid": "c38a320d-0c26-4d8c-9bd1-6567d645fa5f", "value": "192:htVAYL/FRaME4wPubejYqUoHocMyEDUJ0mbveg5MnRYTKQp+j88:fFRY4vKjoofM20AGcMmgjB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651235852, "uuid": "b235d5fa-0ab7-4784-bddb-21c806a6caca", "value": 8886, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651235852, "uuid": "a5897d7a-98dc-4f4a-a8e2-403d4fbe93a4", "value": "application/gzip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235852, "uuid": "18bfb80e-aa12-4772-931d-ea74c7668f74", "value": "Quotation Fair Weert 2022.tar.gz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44c04775-c7e2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651253517, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651253517, "uuid": "faf76cea-bf14-41ae-a9b8-810e317443e9", "comment": "Malware payload", "value": "6e993e67435b1278b34afd578298e1f9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651253517, "uuid": "270849b2-3ab3-4822-aaf2-5c3e8f2acc7f", "comment": "Malware payload", "value": "9b18eb6dc74c76e2a438c6362b6ceb3d055ff39fd62a48def618af9c01d5c4d4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651253517, "uuid": "630c465f-1264-444e-abfe-1b0839ccaa79", "comment": "Malware payload", "value": "5dd1d79600fde3735b7cd43070c5ed6795b37eb0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651253517, "uuid": "84cbb530-927b-4295-b9e8-dcf46ffa68cd", "comment": "Malware payload", "value": "334d9b80f92e5570582bdd549d88edfc4a6d69bceab5a2baf6d876d98e7fe0fe877e31b90e0fe48310f790bb647dea3c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651253517, "uuid": "6bbf0d53-627f-4e5c-a6d2-e7f65e888768", "value": "T1CAF46C0676BFC064C9BE81748552A78AE5F1FC049B709AD797B0C73E8B336D15A3A312", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651253517, "uuid": "f39b98d7-a749-4b86-81a0-3553222ca11f", "value": "12288:VMeQsno2LR+eTz4k5UM6AywrYj2azO8BOg1s3F2r/:VDftX8iYtzbO53F2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651253517, "uuid": "6950d3a5-858d-4d66-ba2c-00fd7a2073f7", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651253517, "uuid": "6606d02f-6279-482f-bb92-ca70e38d2869", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651253517, "uuid": "fbf62242-2626-4faa-aa10-c2265e22f9f1", "value": "emotet_exe_e5_f8347fcc295cdd4ee8e908f78d09ea2ee280b095ba0a1074fed5651c8dfed910_2022-04-29__173149.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6df723dc-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651217938, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217938, "uuid": "900c9fdd-fb9c-4e02-a1e5-7ba288e09518", "comment": "Malware payload (AveMariaRAT)", "value": "ec243798d2873557591ab27adae35c50", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217938, "uuid": "f1ed6a91-ac7b-4385-9413-fdcfc400c171", "comment": "Malware payload (AveMariaRAT)", "value": "9b315bd1aec44ce59478f059b61bec4bd0db5c49c3684282b6d655f8ef2697e0", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217938, "uuid": "0b438a34-2c99-4da6-8eac-64d10c40523b", "comment": "Malware payload (AveMariaRAT)", "value": "eb0d406cfe2b8ced867ef577f51cca725b561889", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217938, "uuid": "58c45540-2294-44f5-b19b-e6a67e13f458", "comment": "Malware payload (AveMariaRAT)", "value": "e4e97f0d0b5e0fa1086b516606392d2aaa7db491a5a05f981fe94934419cdb5d7b101a321b11d76633090c7a00e7b0a6", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217938, "uuid": "069cb470-1635-44f7-9592-2c58a9854cdf", "value": "T1D515E000E991C4F2FD7139F515297B11D5797C201B2C8AAB63B47BEE9A301C0AE37B66", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217938, "uuid": "4a49a2a7-7849-464e-ab44-6b68fc454b63", "value": "fcf1390e9ce472c7270447fc5c61a0c1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217938, "uuid": "f9ce1ddf-3ef0-494f-a203-c54876fbaa5a", "value": "24576:ChvJVJdMu66lslGoG6RvwzF6egt3VTjn0AU:S3dXH4hwz8jVTj0AU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217938, "uuid": "ead25cfc-8762-43c9-9e80-4f22416332fe", "value": 924427, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217938, "uuid": "167d6294-feb0-459f-a5a7-56f3f84e4b69", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217938, "uuid": "77d68896-b809-4475-9c75-3905afe532f5", "value": "ec243798d2873557591ab27adae35c50.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5630a289-c753-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651192128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192128, "uuid": "e6f25b96-cc8c-4690-83d9-5e3e410132cd", "comment": "Malware payload (Heodo)", "value": "0815ab032e0fb210edb0db834010d2ae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192128, "uuid": "cd77b743-4017-45ec-8b6c-47fb0266db66", "comment": "Malware payload (Heodo)", "value": "9b55c4de4934875ff0c6f1437a815ce5197c9a572909591960e785d0c2a20083", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192128, "uuid": "76f5ed87-372d-4f82-bc1a-ba99cb36ad9c", "comment": "Malware payload (Heodo)", "value": "f622bda391116547ccfb1a4d06de763e4706cd40", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192128, "uuid": "25f1c08e-fb3c-4449-8002-1d650acf393e", "comment": "Malware payload (Heodo)", "value": "3ce94222014de4bba077680cd56386a2e7dda59bec1a9f31dbba285aee1c08d82c9eb164542b6b8776a5253f3b5762ae", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192128, "uuid": "a94a431d-2f34-43fc-b58a-308e6ed671dd", "value": "T169C4AD0BF7BC88A7D162E57984239B8AE7B2BC114771D35B4760572A3F333A05D2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192128, "uuid": "55b76250-1739-4092-bdc0-f96c1a7c96be", "value": "1134f6be519e9c35b5478dccf9efcfc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192128, "uuid": "0aa3e7da-eea6-48ec-9a14-95d808067c0b", "value": "12288:FX18uCYMUhDfWKN/QdiUaQkhS+W/uczzIEudy7JMv9:MuCcVNIMmMSLjQE0mJMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651192128, "uuid": "75057aec-e11c-44a1-971f-d3ee8690b00f", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651192128, "uuid": "2694ffae-7ba9-4b7a-9469-4033987cec59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192128, "uuid": "a56595eb-1648-45ea-80a7-46d191544091", "value": "0815ab032e0fb210edb0db834010d2ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "235d5685-c7aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651229409, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229409, "uuid": "88f7bb31-65d8-4894-9a47-7594e6df1deb", "comment": "Malware payload (Mirai)", "value": "64d50601ea68d164a5a5b558068fc0f7", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229409, "uuid": "a9daf420-abf3-4268-b783-810f925149bc", "comment": "Malware payload (Mirai)", "value": "9c555768219ffd36f6f50a882f9b4baa3a0a0a698633a2aa45171c0bf661a7b8", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229409, "uuid": "f259b104-e42a-45e6-820c-bc8b8e769f46", "comment": "Malware payload (Mirai)", "value": "ca093a75194332369cfbd7a33cd1508567588020", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229409, "uuid": "12bbb45d-3754-4a93-a4d6-3e46719b71d3", "comment": "Malware payload (Mirai)", "value": "4558a92f079da6e8c34c8c503f933aa03af4f9c362cfcdce5204f0ac97e0ac36ae85bf134ed5df7d6d65d66b7ead837e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229409, "uuid": "e07e8318-da60-4e7d-959e-ddf137fe74b6", "value": "T186B2E021BEAC4DE2E67548339B5D8383B34703BAD0DD618016196A24DDCE43725F6AAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229409, "uuid": "099e084a-7a59-42b6-82c4-d507ad43602f", "value": "768:y9MhmNhHXqPpY5IpXetXpsIifmqtIs3UozF:y9QmNhHXqxRpXgXpUf1zF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651229409, "uuid": "966af0ec-b781-4f43-8b91-eca81d97213b", "value": 24648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651229409, "uuid": "6b2b6054-13b0-4eda-a360-cf23c516e125", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229409, "uuid": "444445ae-4efb-4e16-bd83-b3ee23b4225d", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5bf5017-c7b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651234889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234889, "uuid": "7f5e89d7-4839-4e0d-b35f-18ec6e845aac", "comment": "Malware payload (Heodo)", "value": "5d79e177061d038aa916807509607a93", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234889, "uuid": "5807b061-2aa1-4d8c-aa51-58cfdbb32bcb", "comment": "Malware payload (Heodo)", "value": "9c681b0b32a99406e3b3a55fd481c96d1724b34f1cdb724b80001844d4b6aefe", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234889, "uuid": "9a52bada-3946-403f-ba78-08363952544f", "comment": "Malware payload (Heodo)", "value": "a81344f479e1afe147792eb40fcbd767ab90f382", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234889, "uuid": "1a7291b8-b5b7-41d7-8fa1-9bf2a441c13f", "comment": "Malware payload (Heodo)", "value": "b3633f7ff9423e142cb75982e7d4f6bd23f43e422798a213741e33a6b0d5c879e8d0ab017883a5967111b022ec32aa4c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234889, "uuid": "a7087240-b044-4069-84a5-c87f3995e016", "value": "T1BAC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234889, "uuid": "e916a10e-f9ec-4d02-a06b-8d438a30173a", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234889, "uuid": "bc0d4688-7a07-4f8b-8f1f-34ab243deb43", "value": "6144:JhZ02GdOOgPY0KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfrKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651234889, "uuid": "b6207a32-6956-41ce-9362-e37f666f3c13", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651234889, "uuid": "b925c04e-e59b-414c-baa4-10d46fe10bde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234889, "uuid": "d0e58cb0-b992-4634-8db9-2662f3eda09d", "value": "5d79e177061d038aa916807509607a93", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dc66e49-c805-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651268698, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268698, "uuid": "2fcc32af-8f92-4adc-9826-ab0aa0c1b6ae", "comment": "Malware payload (Mirai)", "value": "c522e505ab0afca61578f8b0e66d3311", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268698, "uuid": "d80b6ded-7892-4319-b851-6dfb5150d79e", "comment": "Malware payload (Mirai)", "value": "9c9ad002a3efca44a6b1b495c011310eb817ed11cf33216fc8cdb32d386fd321", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268698, "uuid": "38afe09a-43f0-472d-ba89-934e62317910", "comment": "Malware payload (Mirai)", "value": "27d13e671620943af62fab99105cff73f625c48e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268698, "uuid": "80e54c0b-81b9-4292-855d-86a163871328", "comment": "Malware payload (Mirai)", "value": "ef57d7a937af46b5f806e10e72450b0da107159c7add4296fb5b217228dfedbc883d1fcb9be63c5366853e6d2dc15935", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268698, "uuid": "82c1fb09-450d-4cb5-b228-6f6544e45fba", "value": "T1F933F1D6B03B5876EF35143CF8AE475DBC1F56F881B790B114E8016C9A8324A2FFA984", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268698, "uuid": "7bc9f527-32c9-400b-a51f-6cb70c970bf8", "value": "768:aljHCLE+aRDP0uy91q/KYNtNGTVU2YCHaNTj39q3UELQudgSFM8iCvJKaP8cQXVj:8WiDPjy91IKl5xYDNeLQYMtCevSqq76", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651268698, "uuid": "9d835e45-8f21-4081-9e62-0142c81d77bd", "value": 51512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651268698, "uuid": "3448066e-544c-49c2-891d-3191a44c98b2", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268698, "uuid": "86a76832-2d63-451a-9bbd-4103e26d69d4", "value": "c522e505ab0afca61578f8b0e66d3311", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9572de96-c7a4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651227023, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227023, "uuid": "1cef5946-173e-459e-af21-fa9caea26d75", "comment": "Malware payload (AgentTesla)", "value": "0b9b574337c9aa3125a76f8a60d18839", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227023, "uuid": "3de4be5b-90c4-4c1d-9406-636ddf488c5b", "comment": "Malware payload (AgentTesla)", "value": "9ccd4da3820a0019c72b1ef6ee8beb19a912199d4c8c07a1185e82776a5d2172", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227023, "uuid": "050a2be0-5040-4b5d-bb70-0e6e263f2501", "comment": "Malware payload (AgentTesla)", "value": "2f663565ea6ad631ebca4feb32b6c600420ce833", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227023, "uuid": "d8a1d950-42b2-4317-9794-ce1d7bb28c67", "comment": "Malware payload (AgentTesla)", "value": "c652cdf82945c4433304a69605a0ce95fea9d9648cfd059e9f5fdb21130a79ae8f15afb03a3dc44168486900197667f2", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651227023, "uuid": "03e23826-e542-4f40-b703-d97a148ccef6", "value": "T1C284230470009CB8F2A17F6F0761818DF6E55A1BF28BF262C24A89EF756645F4B538DB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651227023, "uuid": "1519479d-4f73-40ed-9238-fda2dc1f7184", "value": "6144:y6mr6m0/b12CYNq2ZJQdygHqZRb70Bf0bra1aySxw3rwkrqbtJJU61ub:y6md0j1zHqZp70J0POafcrBrqK61K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651227023, "uuid": "b1546748-075d-47d5-b746-bce6d2ea485e", "value": 393944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651227023, "uuid": "c6b87438-2454-4d38-92a9-db8886bd0e7c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651227023, "uuid": "ce42a2af-3668-45b7-a715-02e6ff3074a3", "value": "SHIPPING ADVICE#ASEAN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "752b9295-c7ca-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651243290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243290, "uuid": "76d9a54f-fd7e-4621-aacc-9d987d1c5c63", "comment": "Malware payload (Formbook)", "value": "2c1f597a4e4cb5c6c99c5e98f31a8345", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243290, "uuid": "6dd69d2c-707c-43c4-9cfb-14a109a89beb", "comment": "Malware payload (Formbook)", "value": "9d23d7567d40670b34f03bf32e99b3d0a027ce2e178cb1bd58834678e7981247", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243290, "uuid": "4cb163f9-7bb1-484d-81ba-055508aef5e9", "comment": "Malware payload (Formbook)", "value": "1ec6d07b5d2a3b37dc79ab942457f84f07779616", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243290, "uuid": "71bd080f-b7a5-45df-8080-cf47d16a4218", "comment": "Malware payload (Formbook)", "value": "7263fbaae785d73598d9eb0887402348f84bbe0fe4ee7bd974219c327ed85e8a4c90b8bea1bab831dea7aef0e2f4c987", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243290, "uuid": "7d8c9460-d883-4692-a44b-a1db248e0d42", "value": "T1FBB4125827B8AB23C6FD47F99236A3041370A768A153F70E4B9C72DC6C763914E4279B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243290, "uuid": "d3260712-4970-4bf1-8166-eef0e3712075", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243290, "uuid": "ad1cf7b5-48f2-4385-8d20-374392482915", "value": "12288:lfkspWe67Gs7jhTerHxzxQHvcmCQ2djc7g2YnC:lfZpWeM37Vuxy0ntc7pX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651243290, "uuid": "75192c99-9437-4992-8e54-2ca9208059df", "value": 505856, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651243290, "uuid": "95216556-f612-43e7-a2d1-bf8dbb3219a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243290, "uuid": "c98c3448-7af4-4183-9e6f-135047ace595", "value": "guide.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7af994fe-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651215382, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215382, "uuid": "da5301bd-03cf-4146-800c-7213db2a0755", "comment": "Malware payload (RedLineStealer)", "value": "c57d9054afac1ea643e517c1a784323e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215382, "uuid": "7d00b22d-74d2-4daf-947e-d51b150b3dca", "comment": "Malware payload (RedLineStealer)", "value": "9e1e7649b3dd5d15927f5440c5513da42ba8a98627c89cafae6c4261c111b66e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215382, "uuid": "ea057fd3-e233-40aa-b641-0579d73caa1f", "comment": "Malware payload (RedLineStealer)", "value": "fcff9a504ac797d17c8da83c39c9a9d05177c489", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215382, "uuid": "ae1f308a-1e4a-4148-a79e-143fe250eb5c", "comment": "Malware payload (RedLineStealer)", "value": "b9159af77cfaccb43c8656d7bbdd83242ba365286b8e7f23cbf7735a5a127211e787032c0488a2ac8ba1eee8abacce2a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215382, "uuid": "11ad988f-aa6c-4b61-aa2e-22f6a84779e1", "value": "T1B984BF507BA0D03CE1B356F1B9B5C3A8B53A7DA19B2055CB22C52BEE56346E0EDB4307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215382, "uuid": "2d8d0070-3bc1-4840-9f07-49b7f8df909d", "value": "a5e21eb4da4d713aa6e028b6a31293af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215382, "uuid": "0cc00685-d825-454c-90b0-c310a8e7bc49", "value": "6144:qOA+Zh6ykOLihNCVYlRIK7TekTMUWgR3g2ts/Bfwt4OvuVcu7yh4uANjy:qOAUwFOLiDSYlRIKvFwbB4n7u4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215382, "uuid": "2585c479-18c7-4c89-9a58-5d19743cbe78", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215382, "uuid": "aede0a3a-7cfa-4585-b6f7-317daa843307", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215382, "uuid": "9e7a4880-0542-4c6b-b0e5-aba57a65f0b0", "value": "c57d9054afac1ea643e517c1a784323e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8a9edacb-c800-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651266519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266519, "uuid": "2009c6fe-4e80-44e3-b1cb-0bc7a7d26a2d", "comment": "Malware payload", "value": "954c38904f2e9add398daa5a64b3bee5", "object_relation": "md5", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266519, "uuid": "cc55f1bf-2a05-4d09-98a2-f00a54b6f484", "comment": "Malware payload", "value": "9e5242eda0fbd4f81e1e78d468c6fb4039c28fab92c9ab00d8b661637b510c83", "object_relation": "sha256", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266519, "uuid": "e5f4a2e4-1fd2-4d7e-a307-5b7bf1e99ea6", "comment": "Malware payload", "value": "edbe357a5a6b6a964720b486c7eddc3f34b8531e", "object_relation": "sha1", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266519, "uuid": "5eb6e6d2-e895-416a-ba44-9e4fcb1ff214", "comment": "Malware payload", "value": "fd025bbf56ad5489a455632769425d1a72f6406e054cd1098fe18289fbd8b60e2da2c6e90c8126576809cff931bce871", "object_relation": "sha3-384", "Tag": [ { "name": "brazil", "colour": "#DAF2F9", "exportable": true, "hide_tag": false }, { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false }, { "name": "javascript", "colour": "#5DBE2C", "exportable": true, "hide_tag": false }, { "name": "phishing", "colour": "#6D4B87", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266519, "uuid": "73ca83e3-aecd-4ae4-8fb0-04fd9021f8f8", "value": "T19F73B7324711020AA4D3D28C6993AF8DC3E58111E20FDBBAB95F55B4CBEE6E845FF191", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266519, "uuid": "105bdc12-6539-4a81-a443-e5a8de880a87", "value": "1536:7aReUTZS8a4mW9aP+nTaEBhiui9GkcQD8PsYMw4VTlxqv1AedQko52pp2Ux49LvI:HnkBuktGwRpQI3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651266519, "uuid": "999a4b7e-b4ef-4ac9-bbcd-ae2fc04a14f5", "value": 73726, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651266519, "uuid": "f7a62b04-21ad-4b73-ae31-b2bdf748cd74", "value": "text/html", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266519, "uuid": "98175b98-2c89-4ba2-8559-c3bd7563f65f", "value": "amazonphishing.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92dd3e57-c7d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651249353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249353, "uuid": "8c3d69bf-f9fd-4260-a8c7-844f3f146867", "comment": "Malware payload (Heodo)", "value": "108e913e32e201e699470f18c950de9b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249353, "uuid": "ee408919-cac7-4d1b-95b1-5e7fffb02948", "comment": "Malware payload (Heodo)", "value": "9e599b3e3c4ef923837bdef544a87da5bc4bf658c75c29c1575b444b22b5f03f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249353, "uuid": "6a24f687-a21f-4085-a0d8-df676f60c447", "comment": "Malware payload (Heodo)", "value": "4b7e9ac93fa2d235b74abe20751abeaebe9ab8fe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249353, "uuid": "570bbec3-5d73-4808-9752-10b14dd27562", "comment": "Malware payload (Heodo)", "value": "fdccbae84659b1af06eb6357c27db5f4491402b551116fa8fb74b9b80b3a5daae47bf4fb4fd297a128cde4828e326dbf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249353, "uuid": "fedc8db1-ceaa-42f4-989c-e5c734eb2f06", "value": "T16DC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249353, "uuid": "29a70353-0599-454b-a68a-900fb3d6bf6b", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249353, "uuid": "98f7bc72-2d08-4520-8184-b2c45197703d", "value": "6144:JhZ02GdOOgPYtKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfqKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651249353, "uuid": "cc9b48d3-5bbd-4a04-80f5-b06353d9c593", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651249353, "uuid": "5698c3d4-900b-415c-b9aa-95df9252c84a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249353, "uuid": "3368d81a-8b47-42e7-8c19-0164a0114255", "value": "108e913e32e201e699470f18c950de9b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3b250e40-c7ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651258225, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258225, "uuid": "7148c33c-6396-4320-a724-7971482fd59b", "comment": "Malware payload (Mirai)", "value": "32be0e7f6e3577591b17e5d9c4934461", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258225, "uuid": "442ab080-e67e-434e-974c-7b0c9d6cd714", "comment": "Malware payload (Mirai)", "value": "9f1bf3a00bf560b166c715eec14cbcc4b6d04ffeb4416445e81d5262430bf75b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258225, "uuid": "2c60b4c9-c308-4987-b435-895df51d01b7", "comment": "Malware payload (Mirai)", "value": "42c8bdc9cadd07e39be915c299e0cc8fa1809013", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258225, "uuid": "97124482-c9d8-4438-9343-fcc6c6f9c658", "comment": "Malware payload (Mirai)", "value": "0bf41f2640a22e451f2ff7242b7479f4328e501fd4d2552186dbeb1e724de7c598aebaa219547c62e8a06fb4c1f62ca3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258225, "uuid": "725973a0-a5fd-489e-b762-0ec8b72a4696", "value": "T10CB2C0717015B8B387E101B79DEDCB83FB801EF8D0E8B32914A9099DAAD5D42AAF1547", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258225, "uuid": "5eb7ffc0-191d-47cb-90cb-523e873d150b", "value": "768:QX9nxn8o9wnBoWzEQf2EjKb3pmys3UozI:Qtn+o9wjfBAZmvzI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651258225, "uuid": "7210aa75-628e-432a-acc1-c4c526d9c94b", "value": 25004, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651258225, "uuid": "80d5194b-8cab-4b1c-b3bd-869923bddcc5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258225, "uuid": "edd81b89-82fd-48bf-804d-50d827a046db", "value": "32be0e7f6e3577591b17e5d9c4934461", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50f0e385-c753-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651192119, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192119, "uuid": "b6a8f3f6-e253-415b-848c-731c5cd7309c", "comment": "Malware payload (Heodo)", "value": "68eaa59fd1bceb1cae7ca569c6c90770", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192119, "uuid": "ebc1b62e-3d9b-476a-a97f-824b45aaf010", "comment": "Malware payload (Heodo)", "value": "9f39c731726cea6e798ab665b7313c3bbfd3d0e9ec1f5e4fe5952610752f7b2f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192119, "uuid": "622cb6bd-5b8d-4912-bec8-4c538cc74e50", "comment": "Malware payload (Heodo)", "value": "d7189ac416563cb9be0e4aef4f4878d4ae3e3d4e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192119, "uuid": "e7f075cd-17ae-4e47-ae88-ebd4b5746aa5", "comment": "Malware payload (Heodo)", "value": "7bb807ecc8e781b2f46a1ea6b719956a47d1963c63c12cd7512167937152165b27330097d82c58d38189e8ce96871c6d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192119, "uuid": "42f5dcb6-93a7-4bc3-b669-a469c93ffdaf", "value": "T136C4AD0BF7BC88A7D162E57984239B8AE7B2BC114771D35B4760572A3F333A05D2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192119, "uuid": "092ae010-e511-4b83-b131-c5c241b02fd5", "value": "1134f6be519e9c35b5478dccf9efcfc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192119, "uuid": "18f88acc-ac73-4ee8-9338-c15f21e2dc2c", "value": "12288:FX18uCYMUhDfWKN/Qd8UaQkhS+W/uczzIEudy7JMv9:MuCcVNIWmMSLjQE0mJMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651192119, "uuid": "bb581f76-6fdb-470e-9ede-b4146fc4e88b", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651192119, "uuid": "ffbf7eec-163e-4c0a-8cad-c23f3a8bae92", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192119, "uuid": "a13f71d4-75a6-4da1-bf6f-6018ff392331", "value": "68eaa59fd1bceb1cae7ca569c6c90770", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d37e126d-c798-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651221973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651221973, "uuid": "32fd498a-a9ee-4422-a414-2f2bf581a276", "comment": "Malware payload (RedLineStealer)", "value": "05924d0a5e43b70bb0aaa5037163c65e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651221973, "uuid": "780b6399-04bf-4fb7-b2e6-ee08c8606ff7", "comment": "Malware payload (RedLineStealer)", "value": "9f4b3611826c4254ebfaacdebada6a8ccc1df1a6ef80dc195fd9c55ae11b43c6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651221973, "uuid": "c81f552c-8c1a-4cb6-8219-02f1f35469db", "comment": "Malware payload (RedLineStealer)", "value": "d2366bdc601ee7190bbf8af9563d5d6b786bd009", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651221973, "uuid": "ab9e1bbb-b823-4203-9349-8e726f4fb32e", "comment": "Malware payload (RedLineStealer)", "value": "996c4abf82547a4333a0889c8a98d95298ba3d3a74b1820bfee5c28ad0d807adfe105e3e4f6e3455e879ef1e17b930de", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651221973, "uuid": "36677a6d-1806-4305-a5ab-75bf3a6945f6", "value": "T17DE59D033A60CBC2E0944273C1AB947C43A4FB71E5E5F25B3DA63EB9547179268C9B87", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651221973, "uuid": "c4401a58-1f7d-4658-9185-1a36b2ddd017", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651221973, "uuid": "7de6c899-4a4b-4f0f-8876-03c63c546e5a", "value": "24576:owiF5XrecmRGjcLw6P6M/kzjYp1A/5gSgZQIrlS+eX/YHVgv9Qlu8RDc2Ys0LGmz:i7KRDw6yFHy1AhgHug1mQlu8yLu+qtx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651221973, "uuid": "693ee97b-4b15-40ca-b2bc-2b130eb57ce2", "value": 3061760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651221973, "uuid": "c9d6d49a-36f6-4cab-8f90-8a9f33a0b079", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651221973, "uuid": "1c2ef45b-9b1b-4b5f-9347-5c1d18ba8448", "value": "05924d0a5e43b70bb0aaa5037163c65e.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8b686b1e-c7dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651251058, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251058, "uuid": "e49bc9f0-9b9e-4301-b509-be6ea4061b6b", "comment": "Malware payload (RedLineStealer)", "value": "7287481810570976a52dc72f87d20a91", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251058, "uuid": "d8dfa11a-34a0-4556-a367-946d1e4c7505", "comment": "Malware payload (RedLineStealer)", "value": "9fe2c6153fcb104774c237aa7d9592674bc5f936e9b503a0d243cf0088fcd161", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251058, "uuid": "d21b105b-5f4f-4328-84a7-b6ed351ed01f", "comment": "Malware payload (RedLineStealer)", "value": "90a010aee446bd8e2d845a1f13301df15f44fb2c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651251058, "uuid": "b132c917-c90d-433c-88ad-f9a1fa0e856e", "comment": "Malware payload (RedLineStealer)", "value": "3d076a6ae34bafce979a4f59ff81b07e8c871307712d4573255ba5a00ff0a718c1accaad83f1df1bd13da05ddeace587", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251058, "uuid": "3f108f16-683b-477d-ac17-bd0e23b2d78d", "value": "T11584BF10B7A0D03DF1B316F0B965D3A8693ABDE19B3551CB62D52ADE1A346D4DCB030B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251058, "uuid": "4dd1cc60-cc11-4039-97ff-2a1a981bd288", "value": "dd713e86f79f24fed8f0b30a6d67c702", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251058, "uuid": "c80612a0-19bd-4ad2-88d7-8f52b1e660a0", "value": "12288:jrDof/mGVmbrB1lO+R8ooefTUm/KKVfuKT:jfC78BPbR/oefTX/JT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651251058, "uuid": "10822fb3-6d1b-40ce-bdbd-bed964fde3dc", "value": 402944, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651251058, "uuid": "89669ca1-34d4-45f5-a2d0-107f90f7c6ba", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651251058, "uuid": "c4e52fb4-64d5-4a8a-bb9d-7b56ad021056", "value": "7287481810570976a52dc72f87d20a91.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5c52249-c7c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651240929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240929, "uuid": "5272f88f-d01c-4de0-ac1c-4e1b4985ecad", "comment": "Malware payload (Formbook)", "value": "1e4151480870125195fa4c595c867c5f", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240929, "uuid": "fa45f545-abcf-4789-a9f0-25082b4247f3", "comment": "Malware payload (Formbook)", "value": "a01c27ce9cee4ed73f1e4176156d0511b2e3512f2331f9b4bb3486919e0b78ad", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240929, "uuid": "09b41192-380a-4461-aba1-c003f28e5629", "comment": "Malware payload (Formbook)", "value": "0e6712453241c7b976790753b741c0e85dd2e864", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240929, "uuid": "f6f80890-dcbf-45fb-a3c3-7a875b417525", "comment": "Malware payload (Formbook)", "value": "d81cddb94c94f8bf8b83a4824cbc6475a4a825cd0e8114cbeaab1712ea475cd8a83837db1cd65212176e0adbfb22a1c6", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240929, "uuid": "18b67496-cea6-4bd8-bcb8-650e1fe4750f", "value": "T17C93F1BA760A7554C53332BC8939A014344AFDBBCF4A129D911473487EB4CFB18A8DAF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240929, "uuid": "615e7810-a96a-4580-8520-4dba1e3b5f63", "value": "1536:OVTbfg01uYk9198TEpEnqJuAc5XxOkxf2aEn0DZlSs8t+z4lCtH9lqIxYImNptze:Ohb1P69rDJveo2eznkt8t+z4lC1j5ybH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240929, "uuid": "3cceddf5-c391-4a0f-b1bf-06375769f33d", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240929, "uuid": "6a9823fd-cc4f-4d6d-b949-204997060323", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240929, "uuid": "68f61120-6c14-4b44-a23c-6a6c1d226038", "value": "IRQ2207798.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "330ff318-c788-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651214832, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214832, "uuid": "ca4e7473-3d59-4aa2-86d1-248eba12c317", "comment": "Malware payload (SnakeKeylogger)", "value": "91e07a3ab98d9862ed705cc877a88afc", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214832, "uuid": "c7c462e0-d988-4f94-9250-696c9dc3eea9", "comment": "Malware payload (SnakeKeylogger)", "value": "a0875082c996ce93218d906e961d336e2b2c958f742c0d43dafe30aad79ce4e0", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214832, "uuid": "eb9a31c4-58c0-4647-8ca7-d40451401ff2", "comment": "Malware payload (SnakeKeylogger)", "value": "3700e12b6439cd209500e0b8671229abbc950a06", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214832, "uuid": "b2fb9237-5571-4bb6-8998-e0839406171d", "comment": "Malware payload (SnakeKeylogger)", "value": "cb50fb85e28f255cf72642dfb75946ed2013519540763fe644027250ab367070c396307c1af5f8588b3c93054bf10339", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214832, "uuid": "6ec08150-c7e7-443d-bb44-d3a41fa8b4eb", "value": "T175B47CE1314C9AD3CE365976469B9E7113E386221122F737ABC377F2364261FEA1B181", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214832, "uuid": "bae130fc-dabc-420a-aaef-af072587fb48", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214832, "uuid": "180daeff-e88a-405b-a6f5-57b9f2e2b192", "value": "12288:VkvR1Zs+BoTeGkxCxKXLIUC3ax2iSP9ulvZG7tem:ABnazxVLKx2ic9sRGom", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651214832, "uuid": "e00e75bf-de07-4d56-8b73-bd9671a81bd9", "value": 519168, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651214832, "uuid": "953bef02-b704-481d-9d7d-cc0647909a37", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214832, "uuid": "c4736d3e-e1f4-45c7-a59a-433f20cb43c2", "value": "SoaqUAzfQHilSny.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dd4c8a25-c816-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651276106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276106, "uuid": "9d72c459-b664-49ad-9568-dec2bb640921", "comment": "Malware payload (Mirai)", "value": "4cd3b530801cd9900adbeaf4adcf5b3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276106, "uuid": "338337c1-e9d7-4eaa-9894-4016dad9d29d", "comment": "Malware payload (Mirai)", "value": "a0ce0911b32bd86daf79fe29df8e6ce55084bae92841cf1c0cfc2af04f6065af", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276106, "uuid": "a495513f-0c8b-46d2-abe8-22294c6edc3e", "comment": "Malware payload (Mirai)", "value": "84ba3bc3ba431be04318d217402758ebd17185cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276106, "uuid": "d274dcb5-588c-485e-be45-844f4d58f487", "comment": "Malware payload (Mirai)", "value": "1271c9501f1e5be9a22b9f2c18202dbf55ae842439dbda2a276c07212e37ea7da0296f61e7bea275006c1c902301453c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276106, "uuid": "c629b154-29d7-4bfb-9893-0b58113c208f", "value": "T1B10301D1CB265874D792927F94EB078311EF2B2CC1FD24B0636219143B9392BBABC856", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276106, "uuid": "5aab80f1-01a4-429d-83ee-c2dd449725c6", "value": "768:LSrMPYM9wLO2eFC48QRxMYEdaizWczhq+vdhq3UIKW:LSYPYM9wLOoltYOaMV9AT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651276106, "uuid": "02bfa0e5-3150-4420-a86d-f68bfb1f2ced", "value": 41056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651276106, "uuid": "5bc301e2-fef7-4680-be00-01befe99f889", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276106, "uuid": "ad560ac7-77ca-4641-baad-6fbbc5835c8b", "value": "4cd3b530801cd9900adbeaf4adcf5b3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4adbc7e-c7bf-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651238753, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238753, "uuid": "440e4be8-c1c2-4b01-9990-d4b0eb7d4f2f", "comment": "Malware payload (RedLineStealer)", "value": "b072bd836017725aaafd5cdaa4f3c156", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238753, "uuid": "2ead2e01-3af6-4e91-921a-9583cb095364", "comment": "Malware payload (RedLineStealer)", "value": "a18b830c0495e6f008cd9d2e83e398badc79857864e228b39c5184db797b3646", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238753, "uuid": "9bb85e49-6f9a-461f-857d-2c8b51dba952", "comment": "Malware payload (RedLineStealer)", "value": "3ed8a2f9a9c4fc6c60491e9be8c15d7f239d9aa3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238753, "uuid": "6b506c00-781a-43e7-8503-140bcbbd6c73", "comment": "Malware payload (RedLineStealer)", "value": "ad3ef7745a0847d816ffaf1fdb95e8adf046d824db36d3a1a179a3b3a879632f76a6cafb0467b24da7bec7eca36ac7fc", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238753, "uuid": "8fd174b6-7a72-4f8e-841f-351bf2702e00", "value": "T13D84BE40BBA0D03DE0B316F1B979D3A8653ABDE19B3491CB22D56ADE56346E0ED70307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238753, "uuid": "9b59605d-1b40-41f0-9c69-3ab19f9b3846", "value": "a3f6b8bc7b7cc42168607a2de14454ca", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238753, "uuid": "179e0d94-4ac9-4fea-81cb-1afeda37ee66", "value": "6144:LWeOk7BhSMtC5u3crtVf3xooX+N4R1APX28+IbKv9Igucub1:LWeFfSQKu3crtVKpY18GnvSglu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238753, "uuid": "9d8e660a-efe0-4e87-b95c-3efe49f9773b", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238753, "uuid": "5496cb27-ca5f-402a-90e5-6a2a7db075f3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238753, "uuid": "47d3cbd4-69b0-4c30-bc22-0f817096a094", "value": "b072bd836017725aaafd5cdaa4f3c156.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d9bdef7-c7b3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651233291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651233291, "uuid": "08f0aa96-59f8-4cad-a381-25d7c1d8d2af", "comment": "Malware payload (Heodo)", "value": "5af0381cd37a28b398e231747a19d32a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651233291, "uuid": "20fc41a1-e6be-40fc-8eba-1dd30999d01e", "comment": "Malware payload (Heodo)", "value": "a21059713ac574158dcf8b00552cb5fe165332a9d906a9499952ce98d503e751", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651233291, "uuid": "b8842b82-dc09-4154-840e-164a6c3ad42a", "comment": "Malware payload (Heodo)", "value": "24293a786b62316bb196686317bf5fa533794dcd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651233291, "uuid": "c66b0c0a-6c1b-4c93-b871-a02c8a5ebf56", "comment": "Malware payload (Heodo)", "value": "de96962c098ca563a905760f3df5e04188d29b8df8efd0c5cfa96e4fdf94b66752de49bff1f7c99761cf663ba6a82b5a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651233291, "uuid": "143be9c2-7681-4d5d-9615-6f0f719044bc", "value": "T1F6C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651233291, "uuid": "02be4869-090c-4949-913d-2f9b90b7065b", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651233291, "uuid": "256996cd-1a48-407e-9d28-cc3b0e56090d", "value": "6144:JhZ02GdOOgPYlKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFf2KRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651233291, "uuid": "1ff6b42f-08b4-46d9-b7c5-d28c8db4753e", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651233291, "uuid": "425ab1b5-5646-4276-a0fe-6feca62fd1ac", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651233291, "uuid": "f23ba983-bd55-4fda-9cb8-b65aab4a18fa", "value": "5af0381cd37a28b398e231747a19d32a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "61f9b568-c74f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651190430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190430, "uuid": "17d9c4e1-9e0f-4718-ad8f-8899f774505b", "comment": "Malware payload (Heodo)", "value": "f9e76660278575c66262f26907a5cdf3", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190430, "uuid": "c50514e9-84b0-40ba-9c7a-80557fa1e62e", "comment": "Malware payload (Heodo)", "value": "a21a4a5e55f6841d0f908c71b34b517ef09993d2387dd39b5b8c8de24d49a8e3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190430, "uuid": "c83aef0d-e064-47b1-83bd-7ea865027a23", "comment": "Malware payload (Heodo)", "value": "704544067436e2161139f107980f2fc15d457571", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190430, "uuid": "17e85cef-76e6-459a-a376-daf558ee97bc", "comment": "Malware payload (Heodo)", "value": "f8733abc553a8e541210ba58c422c2f4ebf90a1ea1e22f72f67296eba2275b2c3c6f79cc6721a061c20914c8cd37f637", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190430, "uuid": "168167c9-8e5b-4f4a-b82b-d916118cf7c9", "value": "T181C4AD0BF7BC88A7D162E57984239B8AE7B2BC114771D35B4760572A3F333A05D2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190430, "uuid": "d081115c-a0a4-41d0-bf3e-3e2e41e9ee78", "value": "1134f6be519e9c35b5478dccf9efcfc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190430, "uuid": "dd576aaa-539b-47dd-8486-099fbbb11713", "value": "12288:FX18uCYMUhDfWKN/QdBUaQkhS+W/uczzIEudy7JMv9:MuCcVNInmMSLjQE0mJMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651190430, "uuid": "1ffc017d-4dcf-4987-9c24-8b6cb8bfb5ff", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651190430, "uuid": "ead1f286-59af-42f1-8ac6-54c377ca6676", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190430, "uuid": "e34dbdee-400a-4e34-b8da-1106666130c3", "value": "emotet_exe_e4_a21a4a5e55f6841d0f908c71b34b517ef09993d2387dd39b5b8c8de24d49a8e3_2022-04-29__000009.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a87b3f6d-c7b5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651234357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234357, "uuid": "18c9c523-9642-4923-895d-b942d90d6157", "comment": "Malware payload (Heodo)", "value": "ba9d5e373775193a1e277fee9a794784", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234357, "uuid": "896882e7-70c8-446a-b862-04cd41bc07d8", "comment": "Malware payload (Heodo)", "value": "a226b66f1e2ffc53148a5257d541195b8c03654df5e5fc4f28007875ce674b37", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234357, "uuid": "136185b1-a792-4d6c-8d0a-cd6b5a8baaee", "comment": "Malware payload (Heodo)", "value": "d0e0d22821e339b64ea96784c74a61ff9beffaeb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234357, "uuid": "84f078c0-d37f-44f0-a9f6-544b11e70be5", "comment": "Malware payload (Heodo)", "value": "a3edf736fcfa96151209d2eb17e20cf8048a713a3e76940885db59d0f9350ba45dee0c52e02faf2b20ca5b4f3eaa3b00", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234357, "uuid": "beaa81e4-bdb5-4749-b5cf-f15267179bdf", "value": "T1C2C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234357, "uuid": "9a43dc7a-ea03-4963-b0aa-eec20abc2bb7", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234357, "uuid": "dbfe998d-3566-4b28-aac7-a97c6085a10a", "value": "6144:JhZ02GdOOgPYOKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfBKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651234357, "uuid": "4dd635aa-a96f-42bd-a2ac-cb605637c54e", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651234357, "uuid": "4ed59f83-d579-412f-a98b-dc65ff8cfa1f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234357, "uuid": "3c79256a-6384-47c9-b9a6-044605d95574", "value": "a226b66f1e2ffc53148a5257d541195b8c03654df5e5fc4f28007875ce674b37", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03747156-c7b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651235368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235368, "uuid": "9b0e0dd8-8d1b-4f6f-a66f-be639a98ce50", "comment": "Malware payload (Heodo)", "value": "a7f7d03d23c3fa3411d9ee48513f459b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235368, "uuid": "71606f60-4324-49a7-86f9-3d19b76cdf20", "comment": "Malware payload (Heodo)", "value": "a2735128724d228e82429fc06171ebbc172efecd269c170974b83227104c165e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235368, "uuid": "dd731485-182b-4618-8cd9-af2cce46d2ca", "comment": "Malware payload (Heodo)", "value": "fb6fbc53b2e8f1923df95c8307ed5965fe35d9f0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235368, "uuid": "c276ddf2-76e4-4d27-af6a-b5caaf720a7e", "comment": "Malware payload (Heodo)", "value": "aea36c33425f28bcdc158bdc187a50e2b196ba6ce01460611b449135d15d9f2ed9746f4a249651a4be27b8a99feaf15a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235368, "uuid": "e6ea2667-b606-46a4-b4c7-d312b6061ebb", "value": "T16CC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235368, "uuid": "9b783f73-f21f-471c-9bca-bbd8579234c5", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235368, "uuid": "5b95e1bb-5b45-446e-a20b-c15f81f9449e", "value": "6144:JhZ02GdOOgPYJKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfqKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651235368, "uuid": "8d90700e-390f-4436-8a89-4c79b251337e", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651235368, "uuid": "2f55aad1-8fed-4b4a-8e47-4b813c90c16d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235368, "uuid": "3a6d3345-b97e-4769-a3fe-0683ef83a7a9", "value": "a7f7d03d23c3fa3411d9ee48513f459b", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78b6fad7-c7af-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651231700, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231700, "uuid": "ebfa7961-64ca-490a-81c3-314020669f40", "comment": "Malware payload (Loki)", "value": "76209e7dce2e313e0b70c125ad476b08", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231700, "uuid": "8589f2a0-6185-4d6c-8fa1-8465bb3238f5", "comment": "Malware payload (Loki)", "value": "a2fe5ebe6f477faa947f254df0cac9ef02600904620a793cdd82fff5fa15c1bc", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231700, "uuid": "40d9d047-967d-4c4d-bf13-9207b4d32409", "comment": "Malware payload (Loki)", "value": "d61b95c7e4b62ecef9fd2c7e98f7867381c8b86f", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231700, "uuid": "30f30267-bf9e-492f-9231-28fc8fef4db6", "comment": "Malware payload (Loki)", "value": "321a945fa8e08729768d2363f3d1fa5c28e36dcde70f16c2372154df6c330b25035eea1bd429062527ca84c573e84af0", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SWIFT", "colour": "#5D4DE8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231700, "uuid": "709ccdca-4adb-4ab5-b9a6-ca76a20ff60a", "value": "T1EBA423B048AF1EFC515D0677BF58009FB6CF7BD668C1636C41930AA89B62BC97E252C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231700, "uuid": "0db17a06-573a-4dfd-9465-58fe0b5afc2e", "value": "12288:9t8z1/ZcUXB2c3G5VdFzem9BvQRtsGZHcRiAsuX:9eJZ2V5VTemPvIsGdoijuX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651231700, "uuid": "a6c5e6df-a017-4f68-b96d-955ab198ad67", "value": 477810, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651231700, "uuid": "146de313-17a0-4ab9-945d-85cb53e41079", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231700, "uuid": "9f6d75ce-616a-4d6f-a8d1-c0855a5f4ab5", "value": "Swift Copy-MT103.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05bbd357-c7e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651252552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252552, "uuid": "d36bc25f-dc55-419f-91ca-1881c44c6838", "comment": "Malware payload (Heodo)", "value": "ac7e49a4f8e747299c76a17c28622aa6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252552, "uuid": "4a77ce4c-dddb-4d91-b955-7c6260d8b9d8", "comment": "Malware payload (Heodo)", "value": "a3bc9589688429989f9df895e8e356c86dbc74d102608c70b7f216c3b027cec8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252552, "uuid": "2f2313cf-fa18-446a-b41b-283e434ac330", "comment": "Malware payload (Heodo)", "value": "e9198f50cdc8d33d7a3086e523b46616bb8f3026", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252552, "uuid": "b24f0119-13e3-480c-b444-882d926c9ff1", "comment": "Malware payload (Heodo)", "value": "f09ddb6443ba35365120122b6269b38aa37682f58ab12fda86917eb379cab387445849f88c0f03050374228309e57f94", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252552, "uuid": "4d15396c-2e4f-4c18-8dcc-513f2f1d1ed1", "value": "T16EC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252552, "uuid": "2f1414e5-e0c8-410f-abe8-08ead26fa8e4", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252552, "uuid": "0a84da6b-0473-4177-938c-2f5821706216", "value": "6144:JhZ02GdOOgPYJKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfWKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651252552, "uuid": "5531a424-ebad-4806-acaf-edf66616d877", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651252552, "uuid": "54daabf1-da27-4238-a82c-11f7a4821256", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252552, "uuid": "bd35af80-776d-49df-8efe-9b2894a0d4ad", "value": "ac7e49a4f8e747299c76a17c28622aa6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b070cbc-c78a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651215731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215731, "uuid": "fe65f623-fd09-4c51-9749-b0fb53742783", "comment": "Malware payload (Heodo)", "value": "87fdc14cee1cc29d5b4a94c25a8ef8fa", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215731, "uuid": "3a5be223-2520-4102-9425-f62177c113ea", "comment": "Malware payload (Heodo)", "value": "a3be1b1897ec74908b94e23dd209545d2f64f2f7b64ec4fda9861f2c47c8ca7a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215731, "uuid": "97909edc-cee5-4d2b-b017-e490694ee74d", "comment": "Malware payload (Heodo)", "value": "89ff682702f935f8e6bcb7a1d922d0d6da853687", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215731, "uuid": "b0d629b7-d3d1-4f62-ba23-2ae62947bfcd", "comment": "Malware payload (Heodo)", "value": "a8a85395adcfd4ee422d7e4795d6e207d59d3ba82a774449bab4eb7a175bfb0c62e15235c26966167d12af0630ea684a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215731, "uuid": "57532934-36ee-4a45-833b-d549c44f8d6e", "value": "T187C47D03F58D422CC42F587946ABB239186BA87C5BB0C55BEBD45EEE3B208D0993DF15", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215731, "uuid": "375d6391-2539-42ac-9163-2fb305651f03", "value": "6144:AFFTxxIJ5zwBlk3LkEqNz0yPWmlAz6Ac7LG104QA1Y9+hbX9:AFFT4JyBlk3LqZ86CN9hb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215731, "uuid": "339aeb3b-6538-4a5b-ab9d-9d66658f6236", "value": 587264, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215731, "uuid": "ed68a84f-b91e-4c30-9acb-62232994b567", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215731, "uuid": "8b39b319-c9c4-41a7-9e74-e212987896cb", "value": "emotet_exe_e4_18d216563207e5c7532a035c5fb1b908790ef9fd3ebc112fc37bc7cf22b342bc_2022-04-29__070207.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64689b06-c7dc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651250993, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250993, "uuid": "c33a9bf5-01c1-4c6b-b881-34e23861e431", "comment": "Malware payload (Quakbot)", "value": "cf300cd47a865824c2f8705aebae6eee", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250993, "uuid": "d8755a63-b92a-41e0-8daa-b10e73d8f071", "comment": "Malware payload (Quakbot)", "value": "a3eb42abc461cd5cc26bc87a8e7c93ec1eaa46b40c15a55b94b7c76b48cf0b0a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250993, "uuid": "b176b7e6-9e29-46a3-9b1b-2d6924085302", "comment": "Malware payload (Quakbot)", "value": "a064a0ee077e465f14f435676ff794ecc80f08c6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250993, "uuid": "24a420a3-91ba-417a-9048-5cf1ad96fa0e", "comment": "Malware payload (Quakbot)", "value": "6b13b9d378df342d97212005a9d2940673d98684848a38af81fdfc892ac8eb7c79c8813b0f92facf69d2ac9394f59c43", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250993, "uuid": "2abf12cc-28a9-4afb-9368-b1557c06a4c5", "value": "T12235AD71E39145BBC1733E789C3AB299BC297C101D78C4CA6BDC0F4D4B2AA5267613A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250993, "uuid": "8cdd0f4e-d3aa-4399-bdb9-9da951b51351", "value": "f5965aa7635eaf08e77b609502ff5e9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250993, "uuid": "e80e7f29-541c-4c03-8424-10f60651345b", "value": "24576:UmfEXFuca6UFUqybkX0YuSw7zMYQ0a4lFb2:UmMu6+UfYXXuSoWx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651250993, "uuid": "878308c9-6342-4622-8494-c46f5bd11516", "value": 1161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651250993, "uuid": "b4026e06-3f39-4638-8e66-6ffc103509e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250993, "uuid": "bce30392-e40d-4545-97fd-9df3dc263ab0", "value": "44680.5787951389.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a93335f4-c805-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651268718, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268718, "uuid": "e6977c17-62d1-40d8-aea4-5607d9aa796a", "comment": "Malware payload (Mirai)", "value": "2313805fda5bb5bb38a272c3ca6e205f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268718, "uuid": "07b720e4-ee58-4b89-8448-d47398898418", "comment": "Malware payload (Mirai)", "value": "a436611e5fef71a014bcb72f354d56b5d8ac6beb783d45ffe728f81a2e3f1885", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268718, "uuid": "9ad8b114-6df5-4357-9564-82588efc5f6e", "comment": "Malware payload (Mirai)", "value": "18538e6528879bb7cca0aef87f5249b85695ed33", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268718, "uuid": "202652e3-2c15-4b42-a9f8-1ec591249c6b", "comment": "Malware payload (Mirai)", "value": "8524fcbc773c8fad61595ab287a545dd4208b2b89ea77e51dfc87471dd990c1761cc422ac19eade58f50c65b38cd5665", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268718, "uuid": "4a15482c-ea62-4417-9735-5a911ff6833d", "value": "T1DA63970E2E35CFADFB69863583F74A205654339522E5C649E26CFE015EB070D341FBAA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268718, "uuid": "261b2bc4-a58c-4f71-abb9-f97a0641f141", "value": "1536:t0NTVpDuVo/JxlBifnKurBoLiLXabIvl8euB1HmJH:mNT/DIa+KunwIvl8vB1HUH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651268718, "uuid": "d9a96b62-44cd-4a48-826f-345e9107cdc2", "value": 71580, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651268718, "uuid": "3320ae6b-b6e3-4a4a-a5fd-042973729684", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268718, "uuid": "ec98a4a6-5adb-4277-9219-1792fd767081", "value": "2313805fda5bb5bb38a272c3ca6e205f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f3d13f5-c7ce-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651245052, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651245052, "uuid": "3cdf39e1-56e0-45c4-a210-bcc4625f677c", "comment": "Malware payload (AgentTesla)", "value": "55b5db3e3537f30cd901e7d283365ec9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651245052, "uuid": "51280acd-2d16-4ce4-9529-28f07230bc9b", "comment": "Malware payload (AgentTesla)", "value": "a4c912e00c19038d03e99558401a94b13520afa23b3199bfab77693bec96c096", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651245052, "uuid": "a3073df3-5ed9-460d-bb16-683265adf7f7", "comment": "Malware payload (AgentTesla)", "value": "666b67cc50d503951ebf9f9611db54f382480230", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651245052, "uuid": "3c1028b4-06c3-456c-9145-7e42a68766eb", "comment": "Malware payload (AgentTesla)", "value": "cd6dd9529c8f17c3aebc567086ff8a71e099d624c095779529ee1f45047d2f86d0d2b47f2b47e3a8005d5278bbcfc68e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651245052, "uuid": "f8b54424-f170-49e4-b873-cfc1fdb14449", "value": "T149A26C192796C973D4B60B3368D70A809AB9E61A6C33C31FC84A123DCE577454FE6B61", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651245052, "uuid": "aaadbadd-60ae-4ef5-b960-81a9706b2f40", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651245052, "uuid": "504c2887-8408-4d21-a5cd-a84f1cfdab26", "value": "384:JNQwff6Wd7HTeHnKxSUaepk0OOyd3zXzYato1/St:J6WPSUaq1LyJDz3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651245052, "uuid": "acf71063-f7a0-4aec-894e-f7369e0cbeb3", "value": 22016, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651245052, "uuid": "fcbc17ef-1f57-4e4e-8d85-e5ab017453b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651245052, "uuid": "207e26e5-0b72-47b7-b5e0-5a0d6805d4c5", "value": "Snubkcdrg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6674716c-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651215348, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215348, "uuid": "3b436a94-f530-49d9-979e-ed37c3d4d1b2", "comment": "Malware payload (AgentTesla)", "value": "40956e934131156991cf96df6fd80092", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215348, "uuid": "c64f90d7-c05a-4750-9fd8-72b7cc118d20", "comment": "Malware payload (AgentTesla)", "value": "a548be9f8bf199a7b5403e7636a8af3f9c2e063c8288ad05744dff1e8f2158c0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215348, "uuid": "b244c547-404b-4b08-8c95-b57b27fd2b0a", "comment": "Malware payload (AgentTesla)", "value": "32a5f104bbba813aae0f4adc07935bf5062f644e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215348, "uuid": "7724a82e-0158-475d-8639-bf50b7979038", "comment": "Malware payload (AgentTesla)", "value": "c1f369dfe6328f4c5f9ac356ffd5f8b608cce989047a8fa465eb4b7b63b390c8d6aa11b95680096fa396edc139c6550c", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215348, "uuid": "a4519fc4-afdb-4b89-a5ec-d6214802b93c", "value": "T13CB423D7631A2005A5BBA28C359B2FCE3B087ABD772E8697125CD3B474C5CFDA340561", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215348, "uuid": "331f4d09-323b-4e0e-a1b8-717e33756715", "value": "12288:fFIWBj79WEfG1PVcBCaM723kZZaSnCRHtT46+g:ffBj7n+SPmXn8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215348, "uuid": "385b3c96-8997-4fe2-9b88-b0dd9b805922", "value": 514463, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215348, "uuid": "cfc7f195-fd19-4781-b2ac-d0b0c7b12b80", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215348, "uuid": "1e91d52c-084b-4620-a40e-be8939072fb9", "value": "Custom Duty.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8efdf5c-c7a4-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651227110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227110, "uuid": "36fdc728-4df4-492e-b3eb-8c10730713ef", "comment": "Malware payload (AgentTesla)", "value": "a4f604b7e51ea4a5f89a30c591b4f2c5", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227110, "uuid": "5f83edd9-a25d-473c-8998-41b106ac123c", "comment": "Malware payload (AgentTesla)", "value": "a6f434a5a8dda29c46ba0194a81347b304b434b2f6a5567d366c63c4f4b607d1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227110, "uuid": "ff5dc025-67f4-4293-856a-98765b33de3c", "comment": "Malware payload (AgentTesla)", "value": "9c504bcbe8c9fe591fc903df2b7a403bdd8b0a96", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227110, "uuid": "4749a8d4-12ec-4165-8d72-b347c667efe0", "comment": "Malware payload (AgentTesla)", "value": "b2054bb69754277bd836a7304d71bd965cc6ef095beda7c88f7ecdbfd2347c9b3abe661bf2d4c460679b518f87c4aa63", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651227110, "uuid": "93929cf1-43ce-4164-b4ef-194f687450f8", "value": "T165842361CD5AEC95670C4C3F82FB3812F25B83F05A1D9780796635ECE4B18A3B45ADE4", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651227110, "uuid": "745ee5eb-a776-4e44-adbe-b0bc2495ccf0", "value": "6144:UEwj18h4WTwrAHF/jowAiC7dD1tiNz+ShT3MgwjUVTHbf0h012JqTDVeq/rnCs8a:UbaJ7HhownmJziN7THAUVzDS/QteqiLW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651227110, "uuid": "cd770f02-a6b0-47a9-aa85-10ef6e9504a4", "value": 381602, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651227110, "uuid": "51556321-c7d9-4657-883a-14e1ec36454b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651227110, "uuid": "b2c99aec-287d-4b97-9923-31399082cb4d", "value": "POD.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90e16cca-c763-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651199098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651199098, "uuid": "11cb2232-469d-49e4-bc32-92b434758475", "comment": "Malware payload (Mirai)", "value": "9e7b053aefc1796415388d81c3596eb5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651199098, "uuid": "64f29a37-1bcb-4d6f-8ca1-029b6f06743d", "comment": "Malware payload (Mirai)", "value": "a80c8017560d73d6cadb8904269f5cfc10b13c07e99f2f1608c6341ae856b64e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651199098, "uuid": "e405f73a-117b-43fd-b24b-3b2bede8e6ac", "comment": "Malware payload (Mirai)", "value": "d1722cd30c30dbc41176c41dfe64c055916207f8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651199098, "uuid": "40587f6d-e8c2-4c3c-a99c-8dee94a6ff30", "comment": "Malware payload (Mirai)", "value": "f3f227a6a1cda69f64fd903c95696a850e833ca6c715ee6928b5998f2b631bcf59275537c6859ee48e7b302220b46ef2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651199098, "uuid": "c3c9d3c3-d760-4afb-81e9-54b80e5e0e1f", "value": "T112432925AD792E26C0D8B57E11F7C724F2E2620E25B8C65E3C721E4EEF0474065537BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651199098, "uuid": "e3f96972-2db8-4599-b564-aef0970045e4", "value": "768:eLobAxU6q9Hfymp0xginSYeCLUB6WsTwR11IQdszoDaS0O+DCDN:eL0AxvSHfymp0xgujeCLs6vTAIau+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651199098, "uuid": "6b8aa20e-fbe7-4dc5-af29-403a74e0b4ba", "value": 60412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651199098, "uuid": "399c2242-9505-4a89-b375-bc8a72aac1d7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651199098, "uuid": "dafe616a-989b-4b82-9e8f-9c2217b9b9ab", "value": "9e7b053aefc1796415388d81c3596eb5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db031bbd-c7aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651229717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229717, "uuid": "4260c774-bf38-4356-af11-e7b3c9d6ff3e", "comment": "Malware payload (Heodo)", "value": "af3759efac5cd5283949f8e3a8d05643", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229717, "uuid": "ac692609-ea13-4ca8-a5da-319fd69a3dc0", "comment": "Malware payload (Heodo)", "value": "a80ceff7d733e312cd2a90c08c1f0f087d5ed4f842e5ce3e9e6c28f67fbf23d2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229717, "uuid": "8441d007-1887-4794-b980-482ba6fd55ed", "comment": "Malware payload (Heodo)", "value": "ac5b85530d85e83b431744d74bec3bbeeb847e1e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229717, "uuid": "84d52761-0467-43ca-93bb-11f09124749f", "comment": "Malware payload (Heodo)", "value": "e2b00ee2bddef80daeabca46cbd75ed840bba13226825d9ca996728e5a7331c2dc13bbd4eb2244563d4519ca8f03980f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229717, "uuid": "5b79fcc3-8422-4210-a321-acc8c4727e32", "value": "T1F3C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229717, "uuid": "dc9bf317-ed37-48c0-8425-7723fd0cab39", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229717, "uuid": "0a5f4342-489f-465a-8504-1c570e588be9", "value": "6144:JhZ02GdOOgPY+KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfxKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651229717, "uuid": "ee0e0159-0e28-4271-94d8-3df29fdc419e", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651229717, "uuid": "1be29b02-7e01-4988-875d-9f71465d9c5d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229717, "uuid": "2b9e3bb0-2107-4aa2-a3b6-2a17f88c84bd", "value": "Ez6n6BNVloLkQeHoN.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6adbb28e-c770-11ec-8e58-42010a9c0032", "comment": "Malware payload (Triusor)", "timestamp": 1651204618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204618, "uuid": "1fbe9fbb-ef33-4417-828d-3f101cb56fc7", "comment": "Malware payload (Triusor)", "value": "f7ffc8dc33bc4e77ef6dbf614450009c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204618, "uuid": "1b20a776-5162-4b48-b9fc-6300fa96880a", "comment": "Malware payload (Triusor)", "value": "a8be1fddd87c0ad160a3b3ddd05609c30cc79a19d5f9e3ebc130fbfb8ca3be5e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204618, "uuid": "19b24703-e6f6-430f-a92b-26582b1bcfd9", "comment": "Malware payload (Triusor)", "value": "9db39db37d4af75f88574a2c426b9eebbd528b6f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204618, "uuid": "40198e02-60ae-455a-8636-47cd6b22a216", "comment": "Malware payload (Triusor)", "value": "831e4d406540595b7b7c1c3d5ea205c00a1967860dbe96c0879b84784920788c36cf57ee1ef02a640993c69b0336974e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204618, "uuid": "76903e36-89a8-41cd-b960-60d262c43e63", "value": "T18F146C5376E243A2E2DF617943084379E527F17E8B478EE3C108FE6B25112C06E76A5E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204618, "uuid": "c5e0206d-c693-4f6d-8241-dbd5e98bd9ef", "value": "12a30b523ac71a3cbe9145c89400dd7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204618, "uuid": "2a68f6b9-c2eb-4a5d-a15f-35f520e3c685", "value": "3072:iNXDwOoxDKBN7pO5eJ+XScjg6aLoQsGulr6N/l0MtcBGcx5eUMAXVWBrRGLeON4B:+DHODneJ+CKHQsGulr6N/l0MtcBGcx5O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651204618, "uuid": "bc7e2fba-a21f-4ca4-b912-e7825e0c5d9e", "value": 195616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651204618, "uuid": "80496c78-8fa1-4d7c-8b31-d5ff3757fc3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204618, "uuid": "2d3bf26e-5339-4f0f-826d-3af16d7861d2", "value": "fury.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3274673b-c792-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651219126, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651219126, "uuid": "79bcdaed-27e0-4a85-9665-b85608fdf8c1", "comment": "Malware payload (AgentTesla)", "value": "f96c2d473aef8bb457e71baa874b2fa2", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651219126, "uuid": "36620e4c-f496-4799-abab-9701fc6602e1", "comment": "Malware payload (AgentTesla)", "value": "a93407bfd5093a87b2228f11a4532fbd1b687872a0a0392876be12bfbc2fd0b5", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651219126, "uuid": "d2ba9f7e-d9ea-4943-99c9-16bb99a74189", "comment": "Malware payload (AgentTesla)", "value": "b0cd70cb727cd03681f628bdc296bb4e6ae1ba37", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651219126, "uuid": "183c392a-8ebe-4ddf-ae64-a96c206375ce", "comment": "Malware payload (AgentTesla)", "value": "d234e01916cd5bbf427ac9931b0d45e271363aa97c4efa927d1c8b73d3ad70fe39db5ce3817ecb4639ed87eb31e93619", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651219126, "uuid": "2b0769ab-6b8d-43bb-8811-4057538c8faf", "value": "T1F7C42328FC3F712841BEF2E5AD4510405F5922108BBBE772BE2D698F3C6D662B47225D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651219126, "uuid": "8ce2860a-97e8-42a3-91af-05bf7abe2e11", "value": "12288:KbKcclARBOjQwDqmAJqYClkqb0n3gto9Izyrgkve:KmccCRjwDqQYaGwtQMyckve", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651219126, "uuid": "be30ce02-ec18-4713-9c69-b9f686218302", "value": 585938, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651219126, "uuid": "0e1a9b93-d80d-443f-bce5-d4f0c1777966", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651219126, "uuid": "689107d3-9b73-41fc-9bcd-7d887f3704a3", "value": "DHL Way Bill & Reference No.r13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b5c3115e-c816-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651276040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276040, "uuid": "c0965061-836a-4fd5-ae2f-f078c76c6ba7", "comment": "Malware payload (Mirai)", "value": "f2f9c7d65bc2c2c7da324de751145dad", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276040, "uuid": "2b1b1c1b-9aaf-4e32-b51a-f548655836ea", "comment": "Malware payload (Mirai)", "value": "a9a11c929cfcce0825ef96b7f33150f270cecbf260aebb750dab102492b4c70c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276040, "uuid": "37232925-ca23-4e4e-8bb2-11d945ad7a0b", "comment": "Malware payload (Mirai)", "value": "c0d09e44ef10426219664a7a73904396a83c9ad1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276040, "uuid": "3c1ce32a-393e-4f3b-93e4-6e6beb4008f4", "comment": "Malware payload (Mirai)", "value": "08d44b6c272f8683a1d41feed591244cbcf91c917ad28dfa931a2170d789ca8183df019e8dc216adf014c53c17bfbc57", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276040, "uuid": "a876dd69-6c1f-4021-93c5-6ef0ca3686bc", "value": "T17753F100B3495BC8DEB34B75E905841319EC2DC6E1D7D2DB6614883EAADE3162DAC1DF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276040, "uuid": "519abf50-4a1c-4692-be55-8527c67fe388", "value": "1536:w4TFMdfZFfMdcvdPRPPV6XC/wZhowCjzaP+6bHl:w4p0LfacvdPFPMMNg+6bF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651276040, "uuid": "eaeddf21-5a07-422b-bc97-2f485ab7e94b", "value": 61332, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651276040, "uuid": "c793fd55-c08f-4ee7-af59-7cd58ad30f2e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276040, "uuid": "e356469a-c896-4bcb-b3e6-6d5331fd8601", "value": "f2f9c7d65bc2c2c7da324de751145dad", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "522df63c-c790-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651218320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218320, "uuid": "bbbfc7af-7a89-4d47-9cbe-67f8ed174f4b", "comment": "Malware payload (Heodo)", "value": "f278e7df848df0e3898ae717b5baf13b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218320, "uuid": "79ad43d6-9265-4f9d-a43d-a2267f3c4cea", "comment": "Malware payload (Heodo)", "value": "aa162e642c6fa55eea5ef194b899c959a0f59cb8f588b57c988d1b1e397e7d2d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218320, "uuid": "f6f8317b-da38-4b80-a90a-e0a02fb2fe5b", "comment": "Malware payload (Heodo)", "value": "ada77e1ebd876df8aebd434088f912082803809a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218320, "uuid": "488dab07-92d9-4346-ac37-e51daba3fbaa", "comment": "Malware payload (Heodo)", "value": "945cf3269f8b893265c47e3f7edf511988627e481f661829eb00807f139a6dbdb985553cafcac78c1300befd4abb95b1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218320, "uuid": "ce2e9cca-02fe-4cf8-b3db-7411abcabb13", "value": "T192C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218320, "uuid": "80042421-bea0-4422-8ff3-68fe8155e867", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218320, "uuid": "59d78d52-1ada-49a0-b3cb-7b044d49e136", "value": "6144:JhZ02GdOOgPYrKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFf0KRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651218320, "uuid": "7a844e48-86bb-46b8-8a06-06c9c89c1448", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651218320, "uuid": "38b6ad73-edfe-4f26-8688-c255be9251ec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218320, "uuid": "a8a18bc4-f866-4e84-a0fb-33b6011358c2", "value": "TWSOUv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d37303c-c77d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651210125, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651210125, "uuid": "8b78ac6d-d444-44db-b9ad-b8ae4a2a961f", "comment": "Malware payload (Quakbot)", "value": "e4cd9a4a9f622fdba59924839ff6c351", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651210125, "uuid": "8db06c7e-b40c-4401-92b5-7b5feb98f18d", "comment": "Malware payload (Quakbot)", "value": "aa51e1a3e8343354ffc440eee74065c329f82ea6582d8524f76a9dbccfa79688", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651210125, "uuid": "d0eb9534-2392-4cb6-b831-db5dda8c6362", "comment": "Malware payload (Quakbot)", "value": "d2409765d9085708fe8accf098e45800561a1e8a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651210125, "uuid": "a51050f9-eb49-4d76-87f2-07c104c7bdb1", "comment": "Malware payload (Quakbot)", "value": "42ae114e1095247b387ca4012ed29ade51ce218dc5903119257d9b702562719753b256b620aa70c57ecf3e8ef2154730", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651210125, "uuid": "7b42d64e-541e-4327-b68a-7c00269aa95a", "value": "T1EA1512267ECB1732C4061232464B93A09FB5DCAC079696231A55B65C3DF3721A3FB8E7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651210125, "uuid": "e8cd9334-d53d-49ae-8f8e-489c50952122", "value": "24576:GZ6izUxFjv+6CupuueQojT+/e2Ur+Ig8GGZYt:GZ6izUy6R2H+6rQ8GqY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651210125, "uuid": "00ae07c4-c9cb-4b8f-8e45-c33122feb2c7", "value": 946176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651210125, "uuid": "0d900ec5-a9ba-4ff1-a0db-e39635910a61", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651210125, "uuid": "159a18e9-0549-42c7-b4e9-9f42da3f1f04", "value": "F716.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8023098f-c7c6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651241590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241590, "uuid": "a8fa4c85-4f30-42dc-ad54-d356bdc8f6b3", "comment": "Malware payload (AgentTesla)", "value": "6e22f97f4960419833e2385c8f228301", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241590, "uuid": "a3c9aa2e-38f2-447f-b900-1f71da60dce3", "comment": "Malware payload (AgentTesla)", "value": "aa868b9f2f5b49477413af6baecde340eca794b3ffa053fde9e5a87f3eb0bd19", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241590, "uuid": "b23142b9-fa84-4df0-a00a-13f9998c5214", "comment": "Malware payload (AgentTesla)", "value": "a59bd7b5201e987785ae10de85f0ff3624e704df", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651241590, "uuid": "e5a8e7a1-2981-44a2-9d5c-fe0221431861", "comment": "Malware payload (AgentTesla)", "value": "489a4c10eba8e9d9cadecdee876438248fbf0c8dac07bbb49a8c111608366475e77e6a7a14aa1ae1c986138ffc1f7f82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241590, "uuid": "df5be64c-ba4d-4e8b-9058-697ac502529a", "value": "T181C40118B6B7CE12C6690F73C1CB590C07709786E613D70F37E966EA19137AB0A82797", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241590, "uuid": "b3122d3f-c41b-437d-aa8a-1bc663d22114", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241590, "uuid": "db2c378a-a91b-4e2e-aae2-0b9647045573", "value": "12288:U3H0T+R/htSdLoM519jUZz7ZM6btYW/TZtwcA8mopP:i+4zSd0ODU1vaW/ltwNa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651241590, "uuid": "2b7635b1-5db8-4e98-b534-f39f8ec693f0", "value": 574464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651241590, "uuid": "5a5ea3c6-a2bd-4aab-a38e-3d1d9c3810e0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651241590, "uuid": "b74488a4-93d0-4991-96f4-cc8065614081", "value": "Scan.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1020bcf7-c803-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267602, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267602, "uuid": "33ee5d67-3dd2-4728-893e-c81694f440e2", "comment": "Malware payload (Mirai)", "value": "1a265e14eca9cff97fb393f328c03dc2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267602, "uuid": "9b9cef61-36a6-4313-8b64-17da28ca30f1", "comment": "Malware payload (Mirai)", "value": "ab759c18a4bb8d85db227dee9ecc9f269e399b6dc5c7cf59a6328fa7e7921c89", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267602, "uuid": "9fe6cc16-ba64-41eb-8720-595e08bc22bb", "comment": "Malware payload (Mirai)", "value": "156597fd4dbb7c22cfa1624b34efa48b1b169302", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267602, "uuid": "58c90b36-f9e2-45a3-b78c-c555adb1de07", "comment": "Malware payload (Mirai)", "value": "8e9d858821b75236b8858a5e1b1ae03a8213bd3bff5b8c9a2c51e7c7c1b2cb739ecf99cd6b92493a611478288d729e9d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267602, "uuid": "31ba7707-2c23-473b-b6e6-7479caf16426", "value": "T129531846B8818A12C5D417BAFD2E018D731263ECE2DEB212DD145FB477C692F0E7BA12", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267602, "uuid": "7299f2b2-a5af-4a62-ade7-81207b50c7a3", "value": "1536:QdnO1YaLG6KBJGaOQXH7OhJOkphJPLFIsi1qTPKWic1:5fGx7G9QXqhUkgqTPKWic1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267602, "uuid": "6c5f9d12-95c0-4b12-9516-4b57f423bae5", "value": 66688, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267602, "uuid": "1d4e2920-e00d-4b8e-8d99-abd8ebbf9c14", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267602, "uuid": "41cfdb1c-7b55-47cf-a785-cc7a81ae177a", "value": "1a265e14eca9cff97fb393f328c03dc2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ff5753-c788-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651214842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214842, "uuid": "daf928a9-9686-42b4-9efc-f6c01b195887", "comment": "Malware payload (SnakeKeylogger)", "value": "dc4cc0c2f92571f1878a348f89f1f1b6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214842, "uuid": "3f635243-07b4-4b1d-8aaa-ccf2eaa36616", "comment": "Malware payload (SnakeKeylogger)", "value": "ac75dd1e35bb582b5749b15fc415f3a0512663db01bae9176fd17ed90a474074", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214842, "uuid": "81baa975-6be4-4ae5-96a5-12dad417dd7e", "comment": "Malware payload (SnakeKeylogger)", "value": "57035a384c7639c928a3e97bdb583b0ed65f9b9f", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214842, "uuid": "72105b0a-5bd5-45ed-9157-ef47ac3c69a2", "comment": "Malware payload (SnakeKeylogger)", "value": "712d673d3275520155534ebef4357d63e20024ca61a69b0294276311e860419fd880c7d3e4b218e3e11c17d887a64566", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214842, "uuid": "eb4fb168-2a4a-4ab8-9084-d396d0246b56", "value": "T199C48DE5354C8AD3CE765877068F9E7113E34A215122F7336BD3BBF2264261BEA27184", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214842, "uuid": "1ee23868-e3c5-43ae-891a-fa9b86cd31b7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214842, "uuid": "aa46c67e-9c3b-4587-89c3-718c54887265", "value": "12288:kAcQsyjBEBkC5wGYRkn9KvY8f2FNQYG7tV:4QseaGC50YuY8f2LdGL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651214842, "uuid": "a1b94291-9c9f-491f-adc1-2999626acbfd", "value": 552960, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651214842, "uuid": "4193b02f-c452-4791-9d9e-451124331c8f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214842, "uuid": "a3541fcd-45d9-400f-bf42-bb4d3eee4af4", "value": "Prouduct list.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "50cf7391-c7b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651234639, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234639, "uuid": "8af1314a-61cc-403c-a9dd-d81e4b898a51", "comment": "Malware payload (AgentTesla)", "value": "f4ec6f8478168d96578ef38d2d7b4609", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234639, "uuid": "2c2b63fc-f095-4755-8a04-f27cd04a9cbc", "comment": "Malware payload (AgentTesla)", "value": "ae7ae9afa36189536acd53ef5429b6a202f79b00a3750b490bab61052085860d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234639, "uuid": "9ec11faa-1f79-46a1-874c-a2c5b2b7216d", "comment": "Malware payload (AgentTesla)", "value": "50789f4e387a39056459180024fed6ec99e983d2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234639, "uuid": "1482f09a-1175-41ea-9073-b963a85ef8bc", "comment": "Malware payload (AgentTesla)", "value": "9921c56b9ef25a28314e812747483bff480c9aef99d6577ae196cdbfb669416abe032e9d1232986a5dba1b5daddcfe3d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234639, "uuid": "6b6ec56f-47c1-4554-80c0-4cca391ccc1d", "value": "T1478423FB253FDE4782DC0C3193A7F511A870E214F9075B5DE8A55202479E29CA8A0ABE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234639, "uuid": "984780bf-a94e-48da-a8da-aee84ac30c42", "value": "6144:I1I4cw299WKQ8YczaZkTodGEZZ0hlg1sJ2ZdNkZs4ISz6tH87tKQI:I1I4f2+KQ8YMQknLTcxMnWtH8+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651234639, "uuid": "e626e0d4-e599-46f8-9688-25f1787e19eb", "value": 396985, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651234639, "uuid": "a086234d-b8d3-4fab-a6f6-4819218d3945", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234639, "uuid": "4b130b3b-6e74-4633-831d-634e730c49a6", "value": "PO-120220052.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b3e5192-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651232536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232536, "uuid": "40c3f128-45f3-433f-9163-af1105658990", "comment": "Malware payload (AgentTesla)", "value": "9f36a8827ea5ed60d5804aa394562875", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232536, "uuid": "ac015f2d-b1c9-44d3-bbea-c4b9d1a9b508", "comment": "Malware payload (AgentTesla)", "value": "af4b93a41e25bb68ce39adb9b8a374ded8a8ca1269d5789b4ff6e3eed0e98916", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232536, "uuid": "22faa6b9-0a32-453b-ac67-669b45c64950", "comment": "Malware payload (AgentTesla)", "value": "1ed525363a66e52a808e9707168975ec49cffeff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232536, "uuid": "ceb30da4-446b-48f3-87ef-3d45c9fd19b9", "comment": "Malware payload (AgentTesla)", "value": "ba545cb429e63e76008b5894005eca4be31c1847d8af219480147f3a07801a1ae32db4dee5c046c024cfe31b7accb1f7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232536, "uuid": "ee461369-b090-41f6-8010-c8abebdfa0cd", "value": "T11084237AD520D673A8492CF871D222D2649D16706D7E33D88F9BF529046385CC8B8FEB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232536, "uuid": "edf985b9-2a01-4117-b51c-42f5c8191ac9", "value": "6144:mzyQ+yWEpsnZeEdkhWDcZ1t4VgqR9MncMdj5jCIvVSagxZ2OmE0MFxQvT4EWTPD:mzybuUZfj8/Z40cSjNv4aUVEWv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232536, "uuid": "e3f93ad6-36f5-4084-8a69-83fcf51b98f0", "value": 382379, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232536, "uuid": "2705f39a-e3dc-4438-ace4-c214a1dd0f3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232536, "uuid": "6e0ae638-a532-4307-b825-c2835cbdd74d", "value": "Statement MBS (2).zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0585a21-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651215526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215526, "uuid": "5a288ee9-d140-4bed-b13a-42aed2e08aea", "comment": "Malware payload", "value": "ae3ee5ac211031578de410d7857a3af1", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215526, "uuid": "db494a38-1d2f-4546-bee9-a101779c4609", "comment": "Malware payload", "value": "afce378b4061e86cf81d2f0427fc8f997819da0d192cb7f601ab793fd6ace295", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215526, "uuid": "366a7bf5-3348-4f3e-82c0-ae2e498a3ac5", "comment": "Malware payload", "value": "3ce1dc59e7f90890df59354a5bac8c4bc2aaf737", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215526, "uuid": "6cf2aebf-5344-49a0-bc09-fdad08cc37e0", "comment": "Malware payload", "value": "8b78c3bbca57bddd88ca8348178267550fa6cf824908d17fabbb2cf74fc1c8a4adb06741aaf5a866d5f5517289ef1e4f", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215526, "uuid": "5dadb616-46aa-49fc-a6fe-dc2f115c748b", "value": "T131165C12B285A53FD07B1A3A4937975CA93FBB712A228D5B5BF4084C8F355803B3E647", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215526, "uuid": "e219bc23-e0a8-47f8-824d-a2e44f8c9635", "value": "98304:sHIhArMNtw1ynljkTry16e7qF/7ctBAOYSA:swArMNtwTTr3kqF/7ctBA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215526, "uuid": "7adcde8b-db6e-4285-bcab-650301298f31", "value": 4414976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215526, "uuid": "6c485583-4153-44be-9739-768301c67b4b", "value": "application/x-msi", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215526, "uuid": "ff1727dd-ac3b-4ee6-a2a2-630037a33360", "value": "Archivo.Endesa.FactsFecha2904V4.MSI", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d875525-c770-11ec-8e58-42010a9c0032", "comment": "Malware payload (Triusor)", "timestamp": 1651204676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204676, "uuid": "9ff35fa5-333f-4564-9824-4ab4dd2a49fc", "comment": "Malware payload (Triusor)", "value": "b88252ce3bb0b1eb97f5c6c3622ddebf", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204676, "uuid": "8f46b509-f957-4e63-b0cb-de736d8b4d79", "comment": "Malware payload (Triusor)", "value": "b03da8bfbdc6e79f28de6d5b1492bd752e9d79694cc227937e84daa526ced95f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204676, "uuid": "4c792002-1fd6-4a0b-90ec-aa77adc3c5f6", "comment": "Malware payload (Triusor)", "value": "d4b9b634093acb9a477982632f3b27f90de7a831", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204676, "uuid": "3c2a920f-921f-4779-8578-7db1d93bceed", "comment": "Malware payload (Triusor)", "value": "763c094f09b68b728364609fe0c3245be9f18652fa0ada887db0765e269d68be0a3906ab6c57f6ef89aff4cb66a0385c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204676, "uuid": "069d8775-2abc-4c4f-8abd-f0c33a014159", "value": "T1B8138E11B9918437D7D245B616F24B22A73F6B40035726C3BB48A9E93F331F0AD7626B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204676, "uuid": "0b3f459a-bc6e-4ae6-96a9-1d25053b9498", "value": "12a30b523ac71a3cbe9145c89400dd7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204676, "uuid": "cd8b7129-9b90-435d-ba33-14ccad90f038", "value": "768:wGdxrnkOYMIQY3rk3NmdyyglmBduZ38wyhgsIqqvYioRoOq+UU:LxrnYMIjYztZ8TgLqzoOlUU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651204676, "uuid": "f8ecf504-cee0-414a-bc7b-b535eec10aca", "value": 44064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651204676, "uuid": "760a354b-e8d1-43bc-80e3-d3a2ce57b988", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204676, "uuid": "b74776d2-8066-41bd-bf8f-35364367d629", "value": "stupid.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "471c08e2-c794-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651220020, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220020, "uuid": "f9ee2a29-3e1a-4630-8e5d-98b5ac7936a3", "comment": "Malware payload (Heodo)", "value": "4134babcb56179a97a406cc94e5b068e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220020, "uuid": "f4d6ad22-ae88-4396-a72a-ea6578057c4e", "comment": "Malware payload (Heodo)", "value": "b15e961f8d05889f333e9f3acfe52fa7579b6e9d1d3cf1cca608898c0606ee99", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220020, "uuid": "a1cecedf-ec24-4cdd-8b54-592159b96c35", "comment": "Malware payload (Heodo)", "value": "8e559a18284da8186a41c1e415b3c2967557b110", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220020, "uuid": "a68af719-6001-40ba-afc1-180e09e05047", "comment": "Malware payload (Heodo)", "value": "c283dd7ab90a50094aec3c07b2fb0d4235e7c483dac7ba802fb4bb6f8d2c7a810dca5bda3202f46629cfd7c38b84cdb8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "lnk", "colour": "#358D31", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220020, "uuid": "ee6a3735-aadc-43f5-87c6-3dbaadc34842", "value": "T15F515B282EEA6218F9B7DF7159EC7595DFAAB962F912494D00C2070E4922600FD91F3E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220020, "uuid": "e9124e86-9d46-46bb-8e08-fcdd952000ac", "value": "24:8kJ/ByUq+fC3YpIkZ9AuRIZJiXRF4+gQo/uIH/y1XyHgbHo/umVlncIEjaem9dRm:8m6oc6Xj03ugtHU+uccIx/cC/N4ab", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651220020, "uuid": "80bfda7f-a431-4901-b51f-4c9f00994fe3", "value": 2454, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651220020, "uuid": "f5e37bef-a435-4fc3-b8ae-c1a1626d3a6c", "value": "application/octet-stream", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220020, "uuid": "91511dd6-c0ec-4cb6-b611-a147c1a6fefc", "value": "form.lnk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f088d3bd-c784-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651213432, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213432, "uuid": "8f09ad75-a493-413f-b485-8e74075f71bc", "comment": "Malware payload (AgentTesla)", "value": "4dc4a542a2ff8f30ef5c38c211f57b88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213432, "uuid": "a2aade67-8017-4a05-824d-787ff68d291c", "comment": "Malware payload (AgentTesla)", "value": "b1adfeaca106d8dc9e2498a5d89ccc346c370437cf3a68a74aaf80aa9243867d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213432, "uuid": "86ac0804-fd8f-4050-a5d7-854aa9e42210", "comment": "Malware payload (AgentTesla)", "value": "3c7bee4ab46e612e021d6256ec3b780130f066cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213432, "uuid": "dd352f66-3aa3-4b7e-8b31-34b3736dc6f0", "comment": "Malware payload (AgentTesla)", "value": "3ac7de4271462c701c176a17fde82444bfb78fc5b6f9bc4d9bb2c84b31bcd4958712fa1f20f235465fc1aa5f3e61fadb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213432, "uuid": "9f098543-ebb3-4b9b-9bf5-d4c7de2c6416", "value": "T1F594237716EC202D06CD8518CD6C2B8FB61824F6E9DD9886B0D84FBE94185D07EFDB26", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213432, "uuid": "1897db20-d17b-47ed-bc71-531c043bcbf3", "value": "12288:Kj+apOUCB3rspw245L9qFoWhLiMtWhAsY1Clw:HCnI4Z4d14iMtkw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651213432, "uuid": "93e993df-f2d8-4dad-bb33-3f772a93ec30", "value": 430062, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651213432, "uuid": "bcea7c64-8308-40a1-a9b0-874a769803c1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213432, "uuid": "27a2cf51-8ca4-4060-a40b-6eab601085e4", "value": "updated SOA[K9DMVRKF].zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "04104e5e-c7f9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651263287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263287, "uuid": "e17b323b-e4e1-40ae-b414-a11ad3cc682b", "comment": "Malware payload", "value": "5bd8e30cc9d81a98e39ef0015e6e6583", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i386", "colour": "#58A09F", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263287, "uuid": "5d2e84c6-2d96-4cfd-98f5-0dc62513093b", "comment": "Malware payload", "value": "b1b1f6cdf63abcfcecaa72c2537e6dbbb04f1cf9c86dba056da424751bcb58a4", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i386", "colour": "#58A09F", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263287, "uuid": "c0eb8b85-fe38-491f-b169-ae5e8b65393d", "comment": "Malware payload", "value": "5eec96e5b02cd334ff698e8dab10cc1570b4857e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i386", "colour": "#58A09F", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263287, "uuid": "c4feef3b-fccf-4152-8518-9af468bb3acc", "comment": "Malware payload", "value": "04c41a23ba88e444315345f5e52f9ea5162795a919546607288ccdbcd877732c15e268a28f5b57eaed9b34998e341321", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "i386", "colour": "#58A09F", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263287, "uuid": "a6f4ad4d-9b70-4868-ac61-3a3d8731ee4e", "value": "T17B4423ECD983A4B73D3186BD71D925D940ACE1ED823F3A22E346A15BD21E053AC84D93", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263287, "uuid": "bba64951-98d3-4731-9788-200c0ff1595a", "value": "6144:nSDFOrnwRgUbMisI6sdkH+M6hWOcy5KOZW7U6NCPhhhR//mqYi:mZRgUY/fsJcO1KOiXOhhhBei", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651263287, "uuid": "20e953a4-08e8-469c-89a8-591718d661f9", "value": 253430, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651263287, "uuid": "3da8f245-8719-400d-8865-af1e9f132754", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263287, "uuid": "b58c33f5-da6e-44e2-9f97-d02b97289b2f", "value": "b1b1.o", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b5304b-c802-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651267234, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267234, "uuid": "eb9a3bf2-0e1d-40d2-ba3e-75034ac2ccbf", "comment": "Malware payload (RedLineStealer)", "value": "f6dbd4651a91260ffa1fa0822404efe0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267234, "uuid": "6eb02fb6-694a-434f-94df-d4890b470eca", "comment": "Malware payload (RedLineStealer)", "value": "b1dfbc722f95fe2aaa933a83f9392372a00478a08c36b6496285e4fd28d77982", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267234, "uuid": "b8b370e1-17b4-4848-b2d6-0615f80e5aad", "comment": "Malware payload (RedLineStealer)", "value": "4b4ccd5a1b1da3558f76f7ac77f8125cfc3a2408", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267234, "uuid": "0d98253c-7886-4dd2-a5ff-b35d512f5fe8", "comment": "Malware payload (RedLineStealer)", "value": "c8ab325d874d6e205215c6173c8ce63a4681bdcd689244e81346497c1714ff438f6ddbb87571104b45dd37c04c8d2c9d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267234, "uuid": "2dc4cdc3-c6c4-45af-a2ce-dc581f347d5e", "value": "T13084BF10B790D035F1B726F4897993A8793EBDA19B3592CB62D42AEE57346E0EC30707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267234, "uuid": "66947324-ae83-4362-81c9-a9d52535a278", "value": "c1c34d1e5f761dc2162c014841cfd587", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267234, "uuid": "c99235fd-87bb-40de-bd41-24b83f694f43", "value": "6144:FCU6dy4BjzocjCM8DOCsuwt52a4eOe4mJ9cnQ0V5GrL+2xJ:FCtd7tzoO/8DOCs+a4eOpJQ2oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267234, "uuid": "ac3fc452-f316-46b8-aaa6-d201b534fdcd", "value": 388608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267234, "uuid": "66058a2e-b752-4d60-b656-7f177c6fa7b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267234, "uuid": "fb442995-d5cd-4b8b-b890-dd0933899cd0", "value": "f6dbd4651a91260ffa1fa0822404efe0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c7152c7a-c816-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651276069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276069, "uuid": "a1018950-9468-4b9e-aa9c-afa0426c1b46", "comment": "Malware payload (Mirai)", "value": "9fb4a6f0ce4658dbfc9306df62de5da6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276069, "uuid": "6baadbd2-5d8c-48d1-9bc3-f9c79faae17f", "comment": "Malware payload (Mirai)", "value": "b2553567108cccbeb3e95c5114492513432c1d81ed99a1211ccfdd4916360735", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276069, "uuid": "ec0c0c14-a55d-4f1c-aeb0-eebe7792d6c4", "comment": "Malware payload (Mirai)", "value": "5bb79d587954241c9aa58994d502c2be3029432e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276069, "uuid": "653ca8a0-ce27-4d85-8dfd-f47520426a9d", "comment": "Malware payload (Mirai)", "value": "f2d7ca7af8825ab9075f90eda4f304b3f10369ce336ff4238ad7846e8e5c785336f77d0bd8f3a2925962655a1a42f171", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276069, "uuid": "105e752b-7746-4888-aade-89f897b872ef", "value": "T1B703F2EC82647BDECC9C5C7E626B0BFAA48D78D75782C40832645D17EF1A80B7D86C19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276069, "uuid": "ee1f4631-9b84-49e4-83c4-4317f2623c97", "value": "768:Gf+HS3Zct3TLi2+WpjPJIkn3vD0ap6nWABoFWM8:i+0Z8G2nPJIk3vD0BVoO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651276069, "uuid": "040e99dc-7a98-4dc1-8e29-8cc2591d1ea0", "value": 39904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651276069, "uuid": "45765383-f8b4-4d14-84ef-964a1edef54f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276069, "uuid": "38475ec9-7068-430a-97bb-ce785f851a31", "value": "9fb4a6f0ce4658dbfc9306df62de5da6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7e2469bd-c7be-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651238151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238151, "uuid": "df2d15da-6910-46d8-907d-29f667d27b65", "comment": "Malware payload (RedLineStealer)", "value": "420b97aaf69a591053681a00f7f66d1f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238151, "uuid": "90906823-4e88-4ba4-87c7-aa3f7eb97062", "comment": "Malware payload (RedLineStealer)", "value": "b2e7a49f0cd72b9f86667885c622adf4b34499a2bc7a3c9d3be355575465cf6a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238151, "uuid": "17525969-62f4-4183-a2a3-277b5425d469", "comment": "Malware payload (RedLineStealer)", "value": "51228aaf001b4f3ff6b5117909fd5515d193cee3", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238151, "uuid": "ddc3ed3e-c814-4e88-b7b4-4d2d00b5fc52", "comment": "Malware payload (RedLineStealer)", "value": "67ec09626f8a01f49078c14106d33816f6dd62ddffb29f8e5cfdcad8d86aac1aa2486017e67efb9b6d37ec82e8b6888a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238151, "uuid": "4333d45f-a333-419a-a4dc-92ac0bae5246", "value": "T13C84BF50BBA0D03DF0B316F5B97993A8A939BDE19B3151CB62C62AEE16346D4DC70307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238151, "uuid": "51bde340-4602-4a3b-b3f0-be9ae7da70ab", "value": "7fe8d05c64ac9bd6bd1b581e730649cf", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238151, "uuid": "dfda526d-4d0b-498a-a54b-a7b0a32c5ec4", "value": "6144:0kjSmpLSotCvjlHRQr0cUL5BFoWTfqyOgtU8i2:0kjtLScsjVRQrM5TtfqmNL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238151, "uuid": "2a715afd-9d8a-4d2d-8331-ab97eea3e646", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238151, "uuid": "9f1429ee-2660-4a0e-b1d6-28c0ed9c5dad", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238151, "uuid": "03702e69-eed8-43ed-81c7-c3279bc6fdeb", "value": "420b97aaf69a591053681a00f7f66d1f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12376a13-c788-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651214777, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214777, "uuid": "601be9f3-8e9f-425f-a863-9401a11c62aa", "comment": "Malware payload (RedLineStealer)", "value": "4b06575c84f80455eb60790dc2673531", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214777, "uuid": "020e7d99-9624-4153-a410-f750b0a89abc", "comment": "Malware payload (RedLineStealer)", "value": "b392c83d8e9b45c51f9f6c822d00300235c4dbb70f8b35816b72797310cfa574", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214777, "uuid": "7abd3d25-5094-490a-b468-2da8bf5a30a6", "comment": "Malware payload (RedLineStealer)", "value": "0a7af63b593cf7f4c91ade7e6cb9ad349458ea03", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214777, "uuid": "16a9d702-7169-4781-a582-9954df37c1ff", "comment": "Malware payload (RedLineStealer)", "value": "3bb392592c3cf91b73e76cec99469865a9cd6ed3a5847f32a8d60fcbe1c1e322f2bcc64d974201197c70119e52d5ea92", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214777, "uuid": "6ba63b67-75a6-42d7-bae7-72465e997eae", "value": "T15B84CF00B790D039F1B316F5B979C3A87A3ABDA19B2095CB22C56BDE5A346D1DC7430B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214777, "uuid": "8b3a8dc2-715f-4a06-940a-da9befa8fa05", "value": "c4599e160777c0c155480ae0878b31af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214777, "uuid": "c0a021c2-8585-4f5b-8efd-266cfa6e4147", "value": "6144:6W4PyebarwhvNC6/Y7tRTieh7puR+ACKm8PSVPWtLI3vmr6ZjDxURxGxRwQUSR:6W46gCwhFd/Y7tRr7crCKH6IAxxURGp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651214777, "uuid": "5970d72e-ef98-4320-be49-384eabe5eaa7", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651214777, "uuid": "bbd6b3c5-9bfd-41a7-9670-99ced1589da0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214777, "uuid": "6d79d771-580f-4887-a7e2-cb953106740f", "value": "4b06575c84f80455eb60790dc2673531.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5893674a-c7ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651230357, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230357, "uuid": "fa544e20-8ead-4291-aa32-8546bc1ecd51", "comment": "Malware payload (AgentTesla)", "value": "0d364b504a232f766e0f45ad9977ee38", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230357, "uuid": "dfa6ac97-767d-4008-baa3-09a2e1d1d779", "comment": "Malware payload (AgentTesla)", "value": "b3e1fe086f90b246f10c6c311a89a0a9ff64d71ad9a18f09d8c949f4550dc7bb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230357, "uuid": "a0925c9a-0f49-4414-b16d-84b48353a520", "comment": "Malware payload (AgentTesla)", "value": "a51cde19ae4a9e3210f46499fb61449bacdec51b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230357, "uuid": "e48b47c2-977d-4f7a-a1ea-d97e63a5fa39", "comment": "Malware payload (AgentTesla)", "value": "5677706db64647cba45ea351eb8097efcbdb6870d170dc1c6929488961dd4ee920c7106cae9e6bb48cf57d0fd9a97e72", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230357, "uuid": "58e6e160-5899-4aff-a024-c6347ac08b6d", "value": "T1F3C4F127BBBFCA12D96D0733C2D7451407B1A749E213E74FA3EA52A915233AB1D81783", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230357, "uuid": "7d837dde-b1ee-4545-8f92-84cd06d937c0", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230357, "uuid": "bf73edfc-5caf-49eb-8a1d-a9b87cd3614e", "value": "12288:3bjZZGw6oI8hN2AAaSGLX7RnKvay/jmihCdsPARWdRFd:PTGw6ohSan/RnXy7miXF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230357, "uuid": "4594c16f-22e8-4e06-be6e-e4679bcb9730", "value": 580608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230357, "uuid": "e2fe87d0-73b2-427d-a133-717903ff6f36", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230357, "uuid": "6dece437-02f4-4bd6-97cf-68b1d4519f57", "value": "550099__20220499_0011.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f145f4da-c7c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651240921, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240921, "uuid": "4c7f3dcf-27a3-4b29-bff8-08e6bc96fa65", "comment": "Malware payload (Formbook)", "value": "cc4cd21bc0e5a0703ca8f28414a83ff2", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240921, "uuid": "83dcce84-ff38-4cec-9203-771b9528df60", "comment": "Malware payload (Formbook)", "value": "b548a2274a3ecbeff9aa7062450e0b45ba597af177d40872f68bea7b55477e7b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240921, "uuid": "443a7711-7749-4250-80f8-a82c8e7a62b2", "comment": "Malware payload (Formbook)", "value": "4ef9b9d3e66677f465c650010e6d5928cc5b83f3", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240921, "uuid": "53e3a6dc-585f-4764-9f0c-166bb12f66d7", "comment": "Malware payload (Formbook)", "value": "88616910f53b9106df2c442f5172939fc3a24f369fd12c2570962372918f5b710005516eab22e2788a4de86fb4257003", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240921, "uuid": "81b84eb9-2988-4edc-8b72-a1758c560b18", "value": "T12F93E05C88FAD813D064947FC849CB9E79E82C53A90AEC34EA55792B3B31CA444373BD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240921, "uuid": "8a661b3e-276c-43c8-846a-9b16ad194bf1", "value": "1536:NodFCqYTabJCXddFwAY+6rJFb3fYLzIUK+smLHFaJF570xge8c/DZStdPZkThjzX:NodgDTKMGAY59Fb3fYLzIp+DL254jdC6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240921, "uuid": "70172b29-9cca-4779-b3df-cd38e5644e7a", "value": 96256, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240921, "uuid": "5f40413f-bc9a-4979-a0ac-acc16477f3fd", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240921, "uuid": "bd9d591d-3636-443d-a4fa-05bfcb43f172", "value": "STS_5046-2_02_2022-R1.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1bb3bea-c7c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1651240841, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240841, "uuid": "bdae3d67-600d-4624-bac5-6eab0cb1dbfd", "comment": "Malware payload (ArkeiStealer)", "value": "fd4a6ad7d2c426bd2ff5c09342bf04c8", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240841, "uuid": "192d0ebf-3666-4333-9f01-57ddb2f36749", "comment": "Malware payload (ArkeiStealer)", "value": "b64db114f68eca864203124ea0f43f216881742c797d3d607482f760b6a7c25f", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240841, "uuid": "3a7d1780-dc71-4065-ad9a-62f3c85d0d30", "comment": "Malware payload (ArkeiStealer)", "value": "d0a204c47b4652b00c592753e69a82a6762ba4e2", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240841, "uuid": "fd4cc907-4f14-47e0-b087-f4dbc64fa7e4", "comment": "Malware payload (ArkeiStealer)", "value": "b6b4f2f7c08eb7e63257cac180bcf4a2acf7fa6e6c60c02cfd68284cfaae3649fa8f79c1ef62e49ad01aca521bb89d14", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240841, "uuid": "9993ae90-8a11-4df0-90d7-06d9d2c50872", "value": "T1B164AF40BBA0D03DE1B716F4B979D3A87939BDA19B3451CB62D52AEE56306E0EC70307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240841, "uuid": "f37d720f-f332-4c7e-bb2a-0c73ca4ea12f", "value": "d79cb663527e2640458e3c3d356754b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240841, "uuid": "1a794f98-c38e-4723-a11f-a8b4e25e91e8", "value": "6144:PaJBbUVnCNCS1vrzJaavDgnzMqY4Lbv8qhH:PaPGnC91vrzJRgzRxE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240841, "uuid": "a8cbe974-e4a7-457d-b1dd-a2fc8576afae", "value": 327680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240841, "uuid": "8a80abcf-d8ad-47c4-9de7-9d86aaf62401", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240841, "uuid": "08d72cfd-f1ce-4e4c-8ee5-5604489dabef", "value": "fd4a6ad7d2c426bd2ff5c09342bf04c8.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ba14e12-c7bc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651237207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237207, "uuid": "6fc86c32-94e9-4d62-affd-c23687d58409", "comment": "Malware payload (Mirai)", "value": "13ec135fbd7953659a024614268e8011", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237207, "uuid": "954e44d4-7c8d-4dd4-a586-edd329ce72df", "comment": "Malware payload (Mirai)", "value": "b6ab826e133ae00ba9d0b336b5081962bf3002a142b2f3cd1d7d3bb8af04976d", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237207, "uuid": "3af912f5-bff3-47ac-8b7d-a58393c03e16", "comment": "Malware payload (Mirai)", "value": "445e3e354a743a599a74a695dd1f9c5a344c1d42", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237207, "uuid": "a8608345-1017-40ac-ac7e-4c9ba959b3dd", "comment": "Malware payload (Mirai)", "value": "bfa7a233a2274e7d5d167042b2c3508195542c19465425659c11759094927dce4b82bd55a1083867eb3ce57fe33893f8", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237207, "uuid": "a87ff8b1-4f65-4c99-ab04-9ead04707372", "value": "T190736CE5F683ACF5EC120678207B5BB29A33F53A1139EFD7D79869239C42A11D21235C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237207, "uuid": "1f2fbd7d-7fe5-42c8-bf5a-9329323beaa0", "value": "1536:SbX4iK3sGO7SSteYUEN71j+pEo3Yn7SP5cTgYbSGadFTSY+w:SbX4iK3FO7SHL+71yp13y7SPAg4WFd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651237207, "uuid": "bce24dfe-6a06-47d1-904d-820fc8b5ff07", "value": 75188, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651237207, "uuid": "8294cc5a-cbe0-4fcd-9495-6d72b2847886", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237207, "uuid": "92a76b7f-7f0e-4eed-969e-11c88598c9c5", "value": "gx86-20220429-1300", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c87ea0c-c770-11ec-8e58-42010a9c0032", "comment": "Malware payload (Triusor)", "timestamp": 1651204648, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204648, "uuid": "3b4d4c9b-57b4-4e89-a71c-585de5cd44ac", "comment": "Malware payload (Triusor)", "value": "b6cceed3f2e9c5aa475fa75a7fcce110", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204648, "uuid": "016f8218-4bc4-4a2b-8bd6-09c79cf3b8b4", "comment": "Malware payload (Triusor)", "value": "b6ae3f1c0b6169289a6e2c10fb952bafea456795c736d77cb1e76694fde3bcdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204648, "uuid": "7c650e61-6eed-4e88-ba2f-a3ecbb497b2e", "comment": "Malware payload (Triusor)", "value": "34079f1767b95f190daec069e32cd90902bfd089", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651204648, "uuid": "38a73e80-61df-457e-ab35-efd70fdca222", "comment": "Malware payload (Triusor)", "value": "2fbc3104ee0489cb0662cae16983dbfeb0b215f8c8decd10e76e0cf5bf1a1b9090ebc17d3504f77048572e2743362165", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "triusor", "colour": "#EF0523", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204648, "uuid": "c86e6832-5511-453d-96d8-3a57f37b8176", "value": "T132037C2E78D640B3CA494AF234B59F36733EBA31062504D3BB4D6DDA2F520D1A637297", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204648, "uuid": "94db6057-4bf5-4a73-989d-cf61fbed47d4", "value": "12a30b523ac71a3cbe9145c89400dd7f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204648, "uuid": "a2eb6403-7332-4e0f-a8e1-21d2bc41d65e", "value": "768:AE4GptYmJpWHLMSgDu7gkuLnqvYioRoWqq7oG:A2LjcgZDroW7oG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651204648, "uuid": "28298d2c-0584-4dbe-9f91-21cd4b4cf266", "value": 37920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651204648, "uuid": "2e3f0e92-255d-44f7-84ea-2adacfad602e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651204648, "uuid": "3e2dec0d-72af-41a8-851e-81b56b34a1f3", "value": "neg.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70c9dc7e-c7ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651230827, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230827, "uuid": "90f25d3c-dc1d-415c-b84a-cee451d291e4", "comment": "Malware payload (Heodo)", "value": "43bce4f0318bdaf000b2c19ab6a4de14", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230827, "uuid": "14c2e4b5-30a2-4d1d-bec2-cf72b65e3607", "comment": "Malware payload (Heodo)", "value": "b916c5dcf915b694e40b0d3ed97d78a2b4515e3d1ab3c6db0ca9333a9cebb9b8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230827, "uuid": "67e0bcde-b308-49a1-b8fe-54deebb6e6a3", "comment": "Malware payload (Heodo)", "value": "a7dd6a700a59942bb6a8026397e7c2cf7af71f24", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230827, "uuid": "52e5ddcc-d7f1-43eb-ba7c-62ab1a9a9f05", "comment": "Malware payload (Heodo)", "value": "5d38995370ff1790b013b05369d1d008526a863803ea923f36a6c89f1ce941f6aab4126c7943a6c6560a7d30e2af8e8d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230827, "uuid": "9149d41c-a771-48c7-832a-777366ad46e6", "value": "T14AC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230827, "uuid": "acf5cf77-8d10-4208-b196-a71b9dfc8c91", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230827, "uuid": "692040b3-0ebf-470d-b9a3-7acc03c2d8c4", "value": "6144:JhZ02GdOOgPY+KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfVKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230827, "uuid": "169cb884-2b49-400b-b89f-5e4cb76d628b", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230827, "uuid": "ad50a5a4-6ad9-4e5c-85d1-ecb4abb127b5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230827, "uuid": "d7eb0626-9785-4730-85e8-8e9b07fd224b", "value": "9gOXAUe7cuNF.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b96191cc-c7db-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651250706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250706, "uuid": "608da2dd-19b3-4c99-9769-4dd8b4bd3a5d", "comment": "Malware payload (Quakbot)", "value": "1351cd0adc99966329082813c30431e3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250706, "uuid": "36b7447e-f13e-441b-bb5c-0845c73b5731", "comment": "Malware payload (Quakbot)", "value": "b973baf333d4561f9b5b15e734c9ccb992b76331a37aecbdc48b953d53438b43", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250706, "uuid": "85fdb9f5-88c0-48f8-b28f-fb5535d40bd8", "comment": "Malware payload (Quakbot)", "value": "632315b808ae49d7d70a8a21a5deb21cb11b7d0d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651250706, "uuid": "70e82aa4-b4d7-49f3-8945-baeba6ed0bb3", "comment": "Malware payload (Quakbot)", "value": "3d5371a69966b3fa8f0fb316f0c4a08345031281ab6182c0fe8be1015e723702a7a7e3f5e2c636019c8779e97a0d5f04", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "obama181", "colour": "#98F1E8", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "TA570", "colour": "#FA88CC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250706, "uuid": "23c69282-4df0-4e7b-9d51-f8e6a21f8b27", "value": "T10435AD71E39145BBC1733E789C3AB295BC297C101DB8C4CA6BDC0F4D4B2AA5267613A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250706, "uuid": "9f0a16b7-4db5-4686-aa30-d0ad838dbd61", "value": "f5965aa7635eaf08e77b609502ff5e9a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250706, "uuid": "13699fc4-55cb-487a-aed4-f1996f0bbfc7", "value": "24576:UmfEXFuca6UqUyqbkX0YuSw7zMYQ0a4lFb2:UmMu69UfYXXuSoWx+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651250706, "uuid": "b8554c48-b958-4962-8388-97e1ee7ec47d", "value": 1161216, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651250706, "uuid": "7e188cbd-cca7-47f2-92cc-c343fea9b3ef", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651250706, "uuid": "e95a1197-a440-43b4-ad9b-42d702580fdd", "value": "44680.7926724537.dat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21a3c64b-c777-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1651207502, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651207502, "uuid": "766d0de4-98b3-436e-b865-41e588961936", "comment": "Malware payload (NanoCore)", "value": "eb3898abc8f8cedfc78063eb3f19e482", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651207502, "uuid": "2fa04503-4dad-4634-a451-5847f3c6c55a", "comment": "Malware payload (NanoCore)", "value": "b994c0775331cdfaeb9128c5857fc37d6d9882114d2bdcab712f5857ce423a98", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651207502, "uuid": "09c168fb-5067-4cfb-8c19-77ef5d1ecf1c", "comment": "Malware payload (NanoCore)", "value": "71381ab6e8b4541ea3f592dc46720fa0bf78880b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651207502, "uuid": "96c14198-23b3-45b1-b66d-7c3c90fc9731", "comment": "Malware payload (NanoCore)", "value": "74bf62d38ef97e5711933a59f3e96827f9d959948db29bab94e5c0286c5c1f30a766ff74305a3b3159c0320926a348d0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651207502, "uuid": "87aeb6ce-d105-4a64-9d17-ee62049e4a0e", "value": "T1212431D1E9404A95FC2717F15D3ADE2010B76EADA4F5A10D30AA7E2776F3383106AE4B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651207502, "uuid": "d8b7a63c-d8dd-4d50-bd9b-50144e483f59", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651207502, "uuid": "6e06f2a5-20cc-4ec2-b792-a1913edc3729", "value": "3072:/oUtkOcy2jc7uqkwAzery88888Jc+vcfNeGG1xneue9Y:wKN4iy88888OmcfsGG1xneue9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651207502, "uuid": "ba57463f-b6d4-4925-9855-d8cd9c073871", "value": 219648, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651207502, "uuid": "29819b9d-e1d8-4220-a25b-e212fc7f069e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651207502, "uuid": "ea725449-bac4-4c30-b3ce-270831b2019b", "value": "DOC_BANK.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "36cfa747-c7ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651236313, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236313, "uuid": "b1cabe8e-d799-41d1-a923-aa1943f63a8b", "comment": "Malware payload (AgentTesla)", "value": "5653e9c84ba916e1e4a8e66b8edf553b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236313, "uuid": "5eb1e017-9598-4897-a476-37fb1663c06a", "comment": "Malware payload (AgentTesla)", "value": "b9b2bc7db3bb3c2648bc97e30e8020dcb1158ec423144f5b89260c97ec8443d0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236313, "uuid": "c6a18854-1443-4018-ad88-0d9627488c08", "comment": "Malware payload (AgentTesla)", "value": "cae9a9303c0512aa2b4ecd5654d7d92b51e3a807", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236313, "uuid": "f843c36a-76b6-4d2a-89f5-42555e406577", "comment": "Malware payload (AgentTesla)", "value": "146f34e3d5324654ee597a1c36fc40dad476b1f8fcb9630aff70f1bf42ba50e37dd61c1738c5b68ef9ac733df57bcefe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236313, "uuid": "5e408ef2-a3b9-4aa5-8048-a050c1cc6f9e", "value": "T13A9423E2EC9D4A66EDF3454026F22447705220C59E7CCED790685C6D6ADC92EA8C0BFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236313, "uuid": "441d30f2-70db-4b52-b7d2-2f75eade6546", "value": "12288:DxAGq41ittm8fGPVIWvUZu4PEjw83Hk6Z6g57NR:DxpJsmxIW4ubjwWHkkJZj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651236313, "uuid": "65eacc9a-b7d5-45ef-b19c-f56cc53f18ad", "value": 415022, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651236313, "uuid": "f066bec7-e8af-49bf-ac16-398efe9c9669", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236313, "uuid": "c204b2b6-438b-4456-8670-82a440179f60", "value": "Remittance Advice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe535e2d-c7ce-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651245238, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651245238, "uuid": "d538bdc9-fe1e-4b1b-9a54-bacf1adebb4b", "comment": "Malware payload", "value": "4297011e681cb4f2736f2c20d69e02c5", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651245238, "uuid": "67ad39e8-7853-4cf6-aa79-015baba6dbc5", "comment": "Malware payload", "value": "b9c247ba51477c625c1c193e2272270c95eb33a6276ffba660eaf7fdfbd9f71e", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651245238, "uuid": "f788ac69-7cdc-452a-844d-11e90b6cb616", "comment": "Malware payload", "value": "c54cd404ec25964961ce691c7b6b7091c3575c9c", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651245238, "uuid": "57493ca0-7a7a-4471-aeec-6ef80e59254c", "comment": "Malware payload", "value": "4d7fb5a5112352a378ea8d4374e69ad0937b2d65c1ea34538e6ea388759c011a4c0ebcd5f1aa2bc47c220ccadf56c496", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651245238, "uuid": "6a57d38c-b29e-46af-b4bd-2dc5e29d1deb", "value": "T15F73290A3A896215D6E876F985F291824376BDF60212D15F9DF83E2C58733A3ECC570E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651245238, "uuid": "3ebebd90-42e5-4f96-8c31-b58a44678522", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651245238, "uuid": "d20b9164-8b44-411d-b292-ae9553021c3e", "value": "1536:qFy4tJS84wCmxvxFhOgp3S4pFfXNKp30VDP:GyGEmTOgU4TXAEVDP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651245238, "uuid": "58eb5577-4872-4a96-9ecf-8fea594ccfa8", "value": 77312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651245238, "uuid": "de29c8f5-0758-4a6c-a52f-d23de0649dde", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651245238, "uuid": "a7857bc1-73cf-4052-af54-2626ebb99e2e", "value": "AWB ORIGINAL SHIPPING DOCUMENT BL++.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b1fe75e-c806-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651269123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651269123, "uuid": "91655c29-73d3-4409-b98a-5c9ff3f8a526", "comment": "Malware payload (Heodo)", "value": "5d742c0ffc1748c70fb9800ba8eeb1a9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651269123, "uuid": "862d08a7-55aa-415d-a822-0fe463758106", "comment": "Malware payload (Heodo)", "value": "b9e661de64d121928e0e0c512c2a0d1a54418cfe0dca1c8a32d0aabe66767e77", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651269123, "uuid": "74616e57-8ac6-4fd4-96af-9b6fd8857157", "comment": "Malware payload (Heodo)", "value": "aad02383622b94af9ed166f2a2f350b95b98664a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651269123, "uuid": "d846c6bd-b82a-4b87-846e-61426bccf0ba", "comment": "Malware payload (Heodo)", "value": "6c677b24d8375c469e6ba559bba6abf204d0104b6e957cde82deef89846f7363f5007f6ab30b0e7aabad1082d441ee9e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651269123, "uuid": "4f59116a-46f9-43b9-8458-d923f62f568b", "value": "T138D4BF4376994DFBDA23833A45D7D3322336FA9063279B6B6951CA320F17AD07F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651269123, "uuid": "f97134b4-b80d-4057-97b4-2976e6a4c693", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651269123, "uuid": "fd15a7f7-ee3d-48d9-86f3-97b7a0e4f7a4", "value": "12288:JhFf5KRM4c6CeOFzLcQUZvqXmI4Foi1CubVnmn:JhxSk6CpF34vqXmI4Foi115mn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651269123, "uuid": "0e1cf742-12fc-46bf-a91b-ab4912a74fc9", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651269123, "uuid": "7f57b35c-e8f2-4244-9f27-9a8a6fa69396", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651269123, "uuid": "05dee6e8-f84d-46bf-9979-c43be03f920f", "value": "emotet_exe_e4_44eec69d98ee073607f9e1bf3aafc645d03b877a231d22f7e099789d57ca2719_2022-04-29__215154.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "057937a5-c7b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651235372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235372, "uuid": "5eb8be8b-684e-4902-b87e-d79be4e28246", "comment": "Malware payload (Heodo)", "value": "9829c86848f646d4ca1d03b324c531e5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235372, "uuid": "f82a09ac-bfca-4405-b468-9cc498171eef", "comment": "Malware payload (Heodo)", "value": "ba28dcbf72db1cd45895898866720940c75822ee91316688f5916786c6c54486", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235372, "uuid": "184c8b09-86fc-41c8-8d9e-f7216c83777c", "comment": "Malware payload (Heodo)", "value": "045bd45440ad7fdb59682cae995ec17679c03594", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235372, "uuid": "07671cfa-a3ce-41cb-814e-d6312768cb20", "comment": "Malware payload (Heodo)", "value": "a6cfef312bb42b99d49af1c3c044a22be6e5e282f3d520642862b7b9317cb21789516c69390257bd54ef56f5ee59b1dc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235372, "uuid": "213e3161-e17d-4132-809d-f3a574c7d7ed", "value": "T1D7C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235372, "uuid": "da323a15-61be-4d35-8aea-0866bd8ee663", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235372, "uuid": "3d6a28b6-0c81-40ba-9b75-f943359e0b23", "value": "6144:JhZ02GdOOgPY9KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfyKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651235372, "uuid": "3c6abf12-1a85-4781-8feb-9c19a773c922", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651235372, "uuid": "fbf51e6a-af36-42c9-88dd-0253be82cdd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235372, "uuid": "0e3e504e-d80f-4c14-81c3-08983d5ad673", "value": "9829c86848f646d4ca1d03b324c531e5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0850305b-c7ad-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651230652, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230652, "uuid": "959e229b-7890-4129-a890-e688add9e1f5", "comment": "Malware payload (AgentTesla)", "value": "77f0e464bb2d8a748f5ee746863ef4da", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230652, "uuid": "43b124f2-ad93-4ef1-8c97-203057434c64", "comment": "Malware payload (AgentTesla)", "value": "bb12a34eb8343652e07a8062252816a4c0518eb51f9f068ae7726bed9dc782f0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230652, "uuid": "92321413-2888-4838-857e-7a6319a759f2", "comment": "Malware payload (AgentTesla)", "value": "5c85fb154e7bf403cbd3182e119bc832332bb1cb", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230652, "uuid": "a6f72e96-9f1b-45d6-97ea-2c9f0713588b", "comment": "Malware payload (AgentTesla)", "value": "258a16b6fa18b02953d08b219dbe9dfc95e5d9510ebd6761fd4f7e8a651ecff497a396523b5404fba884ab7ffa9a6d65", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230652, "uuid": "5832369f-b61a-42d6-abfa-1e513a65ae8a", "value": "T17F7423D1D74B76A44E17832E789D16CC4ECAABE688812DE525BC5C3835E26DEC113ECC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230652, "uuid": "1ff0a893-b0a8-4a41-bb69-ffa0698fc9d1", "value": "6144:FHbZJEm6BezKNGKAnafevzTf5XWhE912QlY9+uOEPAhms4w3iaB2zCR+2:rJEpezCGnQeLVXW6qQlY9pOEPteiaB2O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230652, "uuid": "3d0cd4ed-71d5-4e8a-bbc9-8276ffecc5b8", "value": 369397, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230652, "uuid": "bff73484-5520-4d14-b8a8-acc46d165737", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230652, "uuid": "cd6e2bb9-fdaa-49b8-a236-677e7a026301", "value": "bank notice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "619e0890-c7a2-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651226077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226077, "uuid": "644dfdc1-f636-4723-b0a8-432042e6afd6", "comment": "Malware payload", "value": "ed30cd99ab33313d9e93cb95f7c4399c", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226077, "uuid": "3c296225-72fd-4591-9143-86bd5e9585a1", "comment": "Malware payload", "value": "bc14ccad4f7ed61ea3d92ddd41472c03c396ba8b7b506c81cc234ac1d5729ddc", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226077, "uuid": "b044e612-13e2-40f1-9950-603c454a58e5", "comment": "Malware payload", "value": "7cd62c6c81e925b8da977a480fadec55441921a3", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226077, "uuid": "1eb0a553-00af-4812-b721-909bd5fd0a41", "comment": "Malware payload", "value": "93d2074f3b667a3b47f7e778292e2e2f39d2258ebdcee1e460a16acd94c922836d83f651272121e3e451d2df3e3904be", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226077, "uuid": "15cbb799-d2e1-4a58-b6d7-8da3b833b424", "value": "T1F9A34B01BB071162DC094BB784DAA1044733BB8365F7CAAB78AD72999B937C31715B8B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226077, "uuid": "881f5e86-a004-4f44-ba9b-6fd7c8f9527a", "value": "768:Sbi5xbuYTMKsNErLLuSEtyUU6CB2G7S57al9h:2MCY+YGlsxS57", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651226077, "uuid": "88b4b9b8-ebcd-47a7-ab3d-9859bea5b84a", "value": 102400, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651226077, "uuid": "fd4688a6-c89e-4b9d-8c1d-e877ffb1c50d", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226077, "uuid": "85062379-b45c-4243-b187-6e89b8becbbf", "value": "P_O_784836334.pdf.jpg", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d013d73b-c7bd-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651237859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237859, "uuid": "54f0c8a7-e1a7-4cd9-9002-7eea017be6e7", "comment": "Malware payload (RedLineStealer)", "value": "0d656a3b3f6c19a56102903e17ebcf88", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237859, "uuid": "e2043865-c7f4-4772-b9c0-6acc9209f712", "comment": "Malware payload (RedLineStealer)", "value": "bce74b0f1453d17543c717d18aa5c5f7a2a3b03834585d8546005c7859e10f7b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237859, "uuid": "5f8154a2-0345-4e24-8fc2-ea3abc5a7245", "comment": "Malware payload (RedLineStealer)", "value": "45f23ce4c940479d736349b809143124cfb3fc46", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651237859, "uuid": "5f788c92-5aa8-4488-bb95-5f0c0b1513d2", "comment": "Malware payload (RedLineStealer)", "value": "b787e624f74c33bbaea830e502344c4a932c07ac55d3014f42805e4be818d65d22248dec044796f397600a81c02db254", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237859, "uuid": "1e8e15ee-b3a8-4e9a-9789-8821183e1cf6", "value": "T1B284BE10B7A0D03DF1B716F4B9B9D2A86539BDA19B3491CB22C53AEE56316D0EDB0307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237859, "uuid": "a0276636-4cea-448e-9906-c5490a675c06", "value": "d79cb663527e2640458e3c3d356754b1", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237859, "uuid": "023be7a8-7586-4f6b-b620-5c02c464e621", "value": "6144:lCQBMgL0tONCJI1r2l9UzfhD1/v2IvduJ/r4LoQyG20oIKLBD/6DY1:lCGn0t+SI1r2lqbhVuJ/r43wjV1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651237859, "uuid": "b761210a-42ab-4c53-bf1a-de7558e863c3", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651237859, "uuid": "f9faa21d-ea54-48fe-864e-4ade19b298b3", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651237859, "uuid": "9e87ca83-136b-49c2-b661-ce7c1e5d698e", "value": "0d656a3b3f6c19a56102903e17ebcf88.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60a1b831-c74f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651190427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190427, "uuid": "15232bb8-2d02-44fa-ad3b-052795cb5709", "comment": "Malware payload (Heodo)", "value": "ccc4b60483eed691252080b93f9eaa00", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190427, "uuid": "967325d1-a381-4f34-a7bf-ab9bbd7454f4", "comment": "Malware payload (Heodo)", "value": "bd0199aa21f4da1e6109bf1ba969e8eedb56a3ee4b41338b4bc87399b758ff7a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190427, "uuid": "82f76200-fd71-42c9-b016-2262f2a15575", "comment": "Malware payload (Heodo)", "value": "15376c17632d3206c45f6e0ba5f4337748b09419", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651190427, "uuid": "e7fe6aa7-520e-4ac9-aabe-4a888f0ca125", "comment": "Malware payload (Heodo)", "value": "1f2549807e083dd3022521a15469294b8a788e6a5fce53d8e718dd8241ba6788b04b91605b4294971f6eb6a91c50f4f9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190427, "uuid": "3c376a8e-4d89-4a63-9337-56f4e271397d", "value": "T113C4AD0BF7BC88A7D162E57984239B8AE7B2BC114771D35B4760572A3F333A05D2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190427, "uuid": "0ed097f4-4226-4212-b33a-442584c19469", "value": "1134f6be519e9c35b5478dccf9efcfc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190427, "uuid": "f13caa79-e55c-4a15-a031-2aa64de38482", "value": "12288:FX18uCYMUhDfWKN/QdXUaQkhS+W/uczzIEudy7JMv9:MuCcVNI5mMSLjQE0mJMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651190427, "uuid": "f0dd1551-d2a8-46c6-a3b8-8320d773ca51", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651190427, "uuid": "4e59db31-bdac-46e1-8124-f8145a463e70", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651190427, "uuid": "5eb73f66-6b68-44c0-b34e-0313908152ea", "value": "emotet_exe_e4_bd0199aa21f4da1e6109bf1ba969e8eedb56a3ee4b41338b4bc87399b758ff7a_2022-04-29__000008.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b024967d-c7be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651238235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238235, "uuid": "141738fd-07c5-4284-8da5-1ccd10c7181b", "comment": "Malware payload (Mirai)", "value": "2e0a82bfc71a05081f57bfc92fa413ba", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238235, "uuid": "9f768fc2-b3a6-4d93-af1e-371710355204", "comment": "Malware payload (Mirai)", "value": "bd69a8f5d895c72a532d762aacdd53df91f1bdde3c7244acb25a3279bdcc95f0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238235, "uuid": "542be37e-5f1c-492f-b8f6-49256a980383", "comment": "Malware payload (Mirai)", "value": "f649caf861e7b7394848d72882f69ccf9671e174", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238235, "uuid": "dcd949da-9125-447b-b61f-c40fa388a9ec", "comment": "Malware payload (Mirai)", "value": "a918a2f078205a26147ccd92c7b4c5fc66b676ced3bf65e5840580f67e9ab5a6aa8b84cf8bcbd8676f363de1868cb074", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238235, "uuid": "43da49f1-a450-4f0c-ab7c-232dc06db48f", "value": "T14CD2E1242E680BC5D939E8BD6AD553987D6836D6B203CD1E601D7FC3CB1E5A81903BC5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238235, "uuid": "6a378fb4-d4c3-4c36-8dcb-9c46c6ab4f46", "value": "768:G7W9lR3h4CibL1/yGgFVSYF41nDn3SJgGlzDpbuR1Ja:m0r1KJBnDnmVJug", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238235, "uuid": "fce4eee4-fa71-4555-b287-eb61a2cf3884", "value": 28932, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238235, "uuid": "43f950f0-1b05-4c2b-9b9c-b9bff341e161", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238235, "uuid": "b58495cb-9a3c-4c03-9ad3-462c9a1a9a52", "value": "2e0a82bfc71a05081f57bfc92fa413ba", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108b4d89-c7ae-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651231095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231095, "uuid": "9703423b-ed53-4a7e-9a9a-a9e9cd938678", "comment": "Malware payload (Formbook)", "value": "3b70ae1ce92f2f910fd19d6aca4acc6f", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231095, "uuid": "4f754cc5-9d21-483f-9f17-4c6219791a9b", "comment": "Malware payload (Formbook)", "value": "be3b8b7115b2bef083b50cdd32f1cc486ca480ea39f7cbc66f083e75924ee785", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231095, "uuid": "9b3c8684-ef6d-4a56-96b8-bba736435599", "comment": "Malware payload (Formbook)", "value": "4ae1bd84643239c93be1aff22414f028d6592a6b", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651231095, "uuid": "ee0f7d5f-f153-451a-b13e-faa10d12d210", "comment": "Malware payload (Formbook)", "value": "3f0ff925f2edf0a7872373dc246ffdc21b0d5e1109cd9b1009a9e29ab97b94d2fda9a73c295104f790cff7ec2d7a07af", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "RFQ", "colour": "#3BFA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231095, "uuid": "ca8cc64c-9aa3-4e68-a11c-faa7fcac5515", "value": "T14E62D049710E42308711BCD80BF574DF1196F90578A232E673C2D56E0ABBAADE3A1CAC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231095, "uuid": "dbd43eb4-f801-4ce7-a3b6-e60dfbb31f44", "value": "384:uGN2cN3h8xk8Q2vZjHVFTIM4q8HLG9prR8:32oYBQG9cLF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651231095, "uuid": "ed801da5-80ec-4ff2-bd5e-28dcac27a48b", "value": 14562, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651231095, "uuid": "b95fd201-0d62-4aeb-83fe-616a4a21558b", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651231095, "uuid": "1d9187f7-e1f2-4243-a5fd-178292dfd9bb", "value": "RFQ NO.25129-S-2022-JMP.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92200871-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651232601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232601, "uuid": "16309c3a-5f67-4b41-86f0-6bdf669279a4", "comment": "Malware payload (Mirai)", "value": "779045a63396114274be78c830d1c3f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232601, "uuid": "231f7e24-2d65-4574-b273-3fca4b606aa5", "comment": "Malware payload (Mirai)", "value": "be3f6ef08bea64f2f880cc428042b6f289098f88645d7ddabc041ebf6b12e428", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232601, "uuid": "031ca856-4ee9-4dcf-96d2-3f8d719657c7", "comment": "Malware payload (Mirai)", "value": "fbd3e0601c6394bf8ee3fe4236a4258f5fccac1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232601, "uuid": "8e2a3cca-3c87-477c-86ee-b5797e9e40d7", "comment": "Malware payload (Mirai)", "value": "f9fb8b69191715f57fed5d7ab0b2a3d6f3a8b78682664db30206da981f6763a2b2d5789c4055f11d61bd32a93803e3cb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232601, "uuid": "de94676c-e2f9-407e-bed2-d6f30949358f", "value": "T1DDC2C07C0C5545E2C59E80B9CF9A1BA06FAA1F82F443D95B3C46DA92EC589F078C3CC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232601, "uuid": "93019824-8f56-4387-898e-6f42088de13a", "value": "768:Rq4SpciEhe/R2mcEzcIzhnhGzU4NZ6kJgGlzDpbuR1Jj:glOQcEVzhEF/6cVJud", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232601, "uuid": "1e10b70f-26aa-4f18-9b18-dabf62930cda", "value": 26432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232601, "uuid": "99d7c49d-8e6f-4698-950a-5a90cbb8bac5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232601, "uuid": "35f8c35d-6ee7-42e2-948d-b98d8a0b429f", "value": "779045a63396114274be78c830d1c3f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c837d638-c80e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651272635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272635, "uuid": "c04647fe-bcc4-47e9-bbcc-0b4eae097d79", "comment": "Malware payload (Heodo)", "value": "27f937c74d5fef0fd99f621181501385", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272635, "uuid": "d0a9e6b3-74bd-45c7-80de-d15d5a9e02d0", "comment": "Malware payload (Heodo)", "value": "bf234e64a3a9e72af543197932078f067f130e49cf04b51697836e25bd945dd9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272635, "uuid": "f6c0b1f0-f411-4efa-b854-10f07b72b952", "comment": "Malware payload (Heodo)", "value": "be0baca243546630b4129f6c2f4a7c45bccc4955", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272635, "uuid": "ef03d476-d39b-41aa-b43c-6d006426c20d", "comment": "Malware payload (Heodo)", "value": "5ed002f63cc822a37bb1c473b0af0c16941694d32337aa1fac7ffcd7c54d4f6067d877723b79409bb09418f03f44cf97", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272635, "uuid": "d94b2a33-922f-4b27-b764-609f92edaefd", "value": "T18AC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272635, "uuid": "08404462-d36d-4e2e-b982-6d4c62ccfacb", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272635, "uuid": "607e49da-4364-4d33-81f7-5c823610f147", "value": "6144:JhZ02GdOOgPYCKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfxKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651272635, "uuid": "827c0510-016d-487a-a175-29e0ede1303e", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651272635, "uuid": "05f14b53-2e49-496f-9325-751080e1b415", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272635, "uuid": "6acabffa-53de-4cd9-9b70-21cecc30215a", "value": "27f937c74d5fef0fd99f621181501385", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8856f6e9-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651232585, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232585, "uuid": "4d7d1095-9071-47f6-b366-74d61587c5e7", "comment": "Malware payload (Mirai)", "value": "a363b6dd5f4e7f9bdcc7eda3691515b1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232585, "uuid": "f5cfd21c-7545-4aff-9859-15b550112393", "comment": "Malware payload (Mirai)", "value": "bf7c9e6d48f149c56ef4901ea7641f78512612cd1d0d7ec872ebee7120706304", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232585, "uuid": "73a9eb9a-3ff7-4481-a386-cdc4896f389e", "comment": "Malware payload (Mirai)", "value": "d1146b3a645a3b142054ed7075627c3814af727b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232585, "uuid": "25e58a52-c717-48f8-b026-f741d384ba5f", "comment": "Malware payload (Mirai)", "value": "56bb58573cacfdbfac65a7e8050022fbb45f9e73cda22b6f05ff8e1bcecc8489262389c63362afe152ca98413577c962", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232585, "uuid": "9236db82-af28-4a60-a256-e6d172d65bca", "value": "T106B2C1A1C8745B40DEEBBFB83D8565C17B255BCC37E69A4014825B0D562AB7D60CACC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232585, "uuid": "db8e8787-892a-4daf-847f-17e003f05223", "value": "384:LVm2lsZxbHyljOeBZ2KHYeb3WolV2UCfIIpQImutEGGQEk2rOXwcTSM4uVcqgw05:pmEcryb0zcV2UCf/m7u5GQEk3X14uVcp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232585, "uuid": "277ee253-3127-4a58-bc15-b3aa5bb6136a", "value": 24164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232585, "uuid": "a9798c2c-d1f1-461a-8d98-5d9a1ed6da90", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232585, "uuid": "aa8504bc-197c-47ad-b611-646ba7cc88b0", "value": "a363b6dd5f4e7f9bdcc7eda3691515b1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17d96492-c75f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651197177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197177, "uuid": "a4351a4f-4efd-4440-a9af-246577e89797", "comment": "Malware payload (AgentTesla)", "value": "153dc6d7f3ff4c8a66e4e8629da8fabe", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197177, "uuid": "b216de78-ff13-49ec-9584-e211acdb6fc9", "comment": "Malware payload (AgentTesla)", "value": "c092907f3fb2145cbbd485577313515075b23bf2f1db1720e2c4dfe9d8e7e922", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197177, "uuid": "0fbcef7d-aa0c-446a-9dce-0037d97c72c2", "comment": "Malware payload (AgentTesla)", "value": "229da938049c858335cb434515c591c16da238bd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197177, "uuid": "96488dd3-de9d-4d2a-8d6f-756eca1755aa", "comment": "Malware payload (AgentTesla)", "value": "94bffb58b62cafe9ba8f6cafde5628bcd9d6a6efaf75ee5376327b8f85bdba626809971ff94346d48264789ef7f135a6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651197177, "uuid": "146cf718-06f1-4b0d-b8c8-fe3cd3868c4c", "value": "T19D05BFD47A049AF3DE2DCA3697DB0E511DB415B69151F38B0F4AF3FA0A9326B12278C1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651197177, "uuid": "c31a78fd-055e-445c-be88-c507478e50d9", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651197177, "uuid": "02dafc04-52d8-4b0e-b88b-84c52edd6a86", "value": "12288:q01qa4VfXFRL8lITTJOZxN1tIoNQNhD0DeTqdWpSMgDP+XG7tyfCDMwzAu:oayfHLYITTJOV1K5D0D2BpgDmG+EX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651197177, "uuid": "848b76e5-7d58-4791-87ab-077bfc6692ab", "value": 844800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651197177, "uuid": "84759bac-723a-4eb9-b4a5-fdc5b2e4dd94", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651197177, "uuid": "0f84cf57-24a2-4396-b90c-0fdd8efd9cf8", "value": "Analysis. Xls.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d0df5e3-c7ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651258255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258255, "uuid": "6ae80861-2d41-4ec1-8be2-cc50184c3498", "comment": "Malware payload (Mirai)", "value": "50bec81e731a5f7dc9a30780df27cefc", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258255, "uuid": "fac6bee6-b116-4316-994a-ab0512fddf71", "comment": "Malware payload (Mirai)", "value": "c0e0355278dda55b2abbffb55661a864cf2d9009750a54d6fef3f70cdcc5f45f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258255, "uuid": "a4ef0c77-18d6-4df6-ab80-09d29bbb53b7", "comment": "Malware payload (Mirai)", "value": "27cdc3f5dc5de6ed096073a6aec0f68709d38463", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258255, "uuid": "a85fabe0-d4b1-44d4-ae28-e589daa62022", "comment": "Malware payload (Mirai)", "value": "f822a2963e595ef66548d5644c9f4d37be9d751a9da431af0793f857b4b38df6e875d5cf2522f588d727fcca01123e32", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258255, "uuid": "4c45da0f-629b-42e1-ae35-75e6a1be1d01", "value": "T1A3B2F195D7FB2BC3C291C332E0BC5A4DE5721AC10346451A210AB64F92A760F9BFB3B5", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258255, "uuid": "3ae17208-ea0a-4cdb-aa23-69233e002208", "value": "384:MvDKKQOcRpmYLdn6RBOFRFt5rUFW10iSelCo3AnupPFNqnrrd1NEZgO8UXWozPLN:i/QOC0Yhn6ROHWFGrcwNVFCnNBxcccci", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651258255, "uuid": "ba4b9d25-75b6-4e5a-8f99-ecd934173bb3", "value": 24728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651258255, "uuid": "111e66e8-9c66-4656-9031-67f784da3ff5", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258255, "uuid": "ef12e865-7b68-4900-a7f7-87ecad0cfec3", "value": "50bec81e731a5f7dc9a30780df27cefc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f60984d1-c7b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651235346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235346, "uuid": "d39882a2-154a-408c-a704-21b6979955c0", "comment": "Malware payload (Mirai)", "value": "936f372b449d1bc325eb149a605b7421", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235346, "uuid": "2ba93039-26f2-44a2-9158-2f03f7cc8db9", "comment": "Malware payload (Mirai)", "value": "c1a098e2f982a3329661241f337ae97c97c4f0b86728c18f7bcf6aa3507509fc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235346, "uuid": "e8add349-37ed-4d84-9911-8841e69f96c4", "comment": "Malware payload (Mirai)", "value": "af394a5fdfe311d82cf494a67585866e66fe566a", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235346, "uuid": "c71d6668-b3b9-4816-82f4-773ecdc2eb7a", "comment": "Malware payload (Mirai)", "value": "2b720c2fd71bfbfa1bb7e0f4993ee1c4216e757c756103a2a3ed3c716a635ac0d7d793dfd788e44f61f608003001717d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235346, "uuid": "cc731bf7-475a-4aa5-8b49-12b85414ffaa", "value": "T16793E709BF610FF7E8AFCC3709E91B05198C550A22A97B367934D868F64B65F19E3C60", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235346, "uuid": "8d60cdb0-f8d3-4ed2-8933-34ae774c6f5a", "value": "1536:nSITUINkErQWG6fZnH/zoSAkaI91rFSEZa72Pc5:nSITRNgWjtHUibSE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651235346, "uuid": "25cfc243-780a-47e7-8773-eff58ca0fd9e", "value": 97568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651235346, "uuid": "05150818-aa79-43f3-b910-372b3c15abc7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235346, "uuid": "00699f4d-a3c3-402b-bb61-5bfaa42ea985", "value": "936f372b449d1bc325eb149a605b7421", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8c8c949-c7e3-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651254141, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254141, "uuid": "946b063b-c86e-4b45-8058-c346a2d226fa", "comment": "Malware payload", "value": "0a8378484b0d5445dc091b5826a84f8a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254141, "uuid": "e49036fc-b900-4a9e-8b35-069697e9939b", "comment": "Malware payload", "value": "c2ebb927dee576beef41a64ec10aa8a8b02e15b3543109fabfd7a4dbcc6b9362", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254141, "uuid": "a6b0cbcb-fc7b-4fcb-9abd-9748779ae428", "comment": "Malware payload", "value": "46bfab4c3e0dc2ef43fcc359ba79b11ae359e281", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254141, "uuid": "a910e06b-2dea-4e83-b298-eba1c0726eba", "comment": "Malware payload", "value": "1979f5c068911a26afe6fbe4ecee2b7e2b448fdbc29c1ee87acd50e3384ce4eb60470b5b3205d5845c206537a22042f4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254141, "uuid": "5895c483-5637-4556-8175-9fa1b7dedfbc", "value": "T1EAD4AC177E9CB6CAE96C07B90826E17177A8ED892D21DE1A1AF03EDBF131741D500A37", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254141, "uuid": "1092f0cd-aef9-4337-aa3b-f24879be1889", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254141, "uuid": "ea1d03be-a580-4ff6-8b14-28e9f4132ca3", "value": "12288:x76v6Rm7TnauU4dicplt3mB/e6zie1AoghXPcy:R6v6Rm3I4xplYnfAoghX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651254141, "uuid": "0f32edb4-c47f-4864-96ce-4f3e5fadc33a", "value": 634368, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651254141, "uuid": "6fdd04d9-7dcc-4002-9418-7866cb292e13", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254141, "uuid": "e6c274a6-a0f9-4ba7-bb47-42ec7e51fc9e", "value": "SecuriteInfo.com.W32.AIDetectNet.01.3668.25093", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b453737f-c75e-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651197010, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197010, "uuid": "9a3b80ce-6272-45fe-8842-95c3577df2b3", "comment": "Malware payload (Mirai)", "value": "177b2e16ed97bb96eea23e9ede8625ac", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197010, "uuid": "3328f447-f644-4856-b88b-cd7f8dae1f9d", "comment": "Malware payload (Mirai)", "value": "c34447053a87d4e9b2004ec59cab7a0510e375255821b662aa4751c2e99dc4ab", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197010, "uuid": "31435126-5720-416b-ac3c-7c2648245b69", "comment": "Malware payload (Mirai)", "value": "c360b088d5ff6c30791b5be646b5c38d8e367f33", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651197010, "uuid": "dc191f4a-987f-4698-ac70-14548e0a7375", "comment": "Malware payload (Mirai)", "value": "44cd2321aebb2f3c2c5b94a4e5f6fd0dec6af4dbea002a20558f070000d89a323483a5c80f261c747935611d006374c6", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651197010, "uuid": "7ae5fe4a-c463-411f-9427-a770cd1f482a", "value": "T1184308817881A626C7D05377FA5F018D33199798E0EE33578C296FA07B8AD1F0D6B74A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651197010, "uuid": "6f8d702f-2659-4446-8cb6-6d7727d35237", "value": "768:30ESWRYSaG0wBXAy9abThYrB2dPsnjVB5uEBwLRLWmPrqph/8qkJSULwCVy/rCxc:dSaP0waejVEWYE0J8fhWfM5t0d7oHm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651197010, "uuid": "aebe39e8-2dcb-4b26-b383-eabddf261b6c", "value": 56880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651197010, "uuid": "86301390-9b59-4653-8292-feb0353bb658", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651197010, "uuid": "1463376a-e03f-4324-973a-e0246ca55afd", "value": "sora.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "741a29ac-c80d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651272064, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272064, "uuid": "61e06075-fce0-4837-a158-91a3d7c725ba", "comment": "Malware payload (Mirai)", "value": "3d28be4d4fecd4862a06b92f0ac5fab0", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272064, "uuid": "892e67a8-ce8c-40e0-89a6-26c05943f66d", "comment": "Malware payload (Mirai)", "value": "c381412d5c4d4c6584c7512a1605318b9e4c7ca8a656d3aa8597f311b1dc3881", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272064, "uuid": "d7485683-6423-476e-ba73-28426b71c0fc", "comment": "Malware payload (Mirai)", "value": "597cff4f06e6a177a0c8709d789e46c9aa22c195", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272064, "uuid": "a6742030-5c00-440c-8b8a-d316d50e3314", "comment": "Malware payload (Mirai)", "value": "03b64d66f574589513d2585ffc3aa892f99820d70c8531650a4fcce73450920c7510c6626b1239db3d671db8100dba1d", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272064, "uuid": "19421bb0-5c18-417c-807f-abe685a8eb10", "value": "T165E2E161469FB012C2B1457DEFAF014B13547EB9E59F60F4EA281A68BAD30F05FF4942", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272064, "uuid": "dbd4ec23-1134-428d-ae76-88fea9982990", "value": "768:6fKy3sWTW1S7dZmU4tP6g0Qt4EAx5wOEI86T3UT:qKEsWTWwe8g5jYwOEI1K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651272064, "uuid": "0e433420-bc05-4935-841f-087940866a97", "value": 32044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651272064, "uuid": "3363262a-e9ba-4ad1-8a0a-1ab5d79f1612", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272064, "uuid": "ac7d7e0d-c257-4699-b5b7-e2d946a9b53b", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "849b22b7-c7a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651225707, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225707, "uuid": "0dc1b87f-ef37-4a4c-aa07-b32fadebbd84", "comment": "Malware payload (AveMariaRAT)", "value": "a382370631d677d50f09b0b4825ae5df", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225707, "uuid": "fe1e88da-7fdc-41b5-a9d3-0f26b8410d19", "comment": "Malware payload (AveMariaRAT)", "value": "c53f1e5d7b904d5cb5297dc48d5644bf56fd81a8e8cbf0b7b89482ba7f0c4700", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225707, "uuid": "9c4f4f9e-4080-4653-a804-c1cd7fcf059a", "comment": "Malware payload (AveMariaRAT)", "value": "2221ebc4331e27ab5e5a95310c360a2dff8e63c0", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225707, "uuid": "496ecded-7781-43d8-a791-96af8b57556e", "comment": "Malware payload (AveMariaRAT)", "value": "67c8fc975a47bf8ac6aea258ed5ab0c902dcafb7f4f61c5ae9f12b030270bcc4d603ab7b1f1ddce78d0a2048b1ecf1f2", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225707, "uuid": "0c389c10-4e7f-4401-bdd9-4efe8ae649b4", "value": "T10D151294BA6BDD12C5290B33D5DB890003F1B78AE107EB5F2BE992AC55233EF0946747", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225707, "uuid": "7d95cfde-14f6-4f92-9061-a408c26d8131", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225707, "uuid": "c2c9796b-2ee5-471a-8fb2-388542f2635e", "value": "24576:5O7+kkN0kPGlhPq/EbmgqMSrzmbQ53ClWiFW:oakkykPmPqcbmgqXrz1C/W", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651225707, "uuid": "f4c7eabd-1d1e-4717-9f3c-3bead8f7d5c8", "value": 878592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651225707, "uuid": "6c388d69-97f2-4d1e-8d93-8a5305863022", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225707, "uuid": "32104ecd-f078-427f-b154-328a47f0ed68", "value": "SecuriteInfo.com.W32.AIDetectNet.01.6858.8855", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dcb3caba-c7b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651234874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234874, "uuid": "2cd303f8-88bc-47fa-8994-a2c9ffc2da5b", "comment": "Malware payload (Heodo)", "value": "58cecf77d67c34b50d0260a15a4f7768", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234874, "uuid": "688d0966-38b3-467a-bd58-095205a9d8b7", "comment": "Malware payload (Heodo)", "value": "c569d873f6b1856f239b975ed7fad8d4626a71fff1092e7c8cff03fd85501807", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234874, "uuid": "fe33c55e-edb3-4c88-92ca-caa41d74d897", "comment": "Malware payload (Heodo)", "value": "c687efccc79d6d69521126f101274d93c4ba73bc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234874, "uuid": "5ff98d5e-708f-41b4-a2f8-35ea05425cee", "comment": "Malware payload (Heodo)", "value": "cdd5851964cbaf1f6b2229c3e422448445314e4625af9d878805fe4badca6ea09d27be5f212c7dba2545fbd3111cb0a4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234874, "uuid": "2c57dcd8-a11a-439d-9744-cbff2e566e6d", "value": "T1A9C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234874, "uuid": "2f9d320b-9204-48da-9086-3d0863e47ec5", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234874, "uuid": "0822a963-a6f6-42dd-9c3f-6cbf36df703e", "value": "6144:JhZ02GdOOgPYXKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfYKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651234874, "uuid": "53d11b16-0fb9-40e7-a082-ac94d0330c03", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651234874, "uuid": "87265b33-5ed7-4d4c-b224-e34cc6d05670", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234874, "uuid": "47b18e7b-b58c-46fd-8280-cf3136b050e0", "value": "58cecf77d67c34b50d0260a15a4f7768", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1a92018-c76c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651203046, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651203046, "uuid": "0b23f593-9efa-46d2-84a6-37565ccbd9b2", "comment": "Malware payload (AgentTesla)", "value": "aecd680f75b06253b09d8da4e1c88d1b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651203046, "uuid": "af4253fb-89d4-4d03-8d2f-136d5a301cdb", "comment": "Malware payload (AgentTesla)", "value": "c606f8356a2ef2b333065a07c90636c3742cb943c911f3a9e20b2b43600d3fd3", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651203046, "uuid": "963c3f06-8721-48f8-bdb2-e3057acd38bb", "comment": "Malware payload (AgentTesla)", "value": "61a89a6614222ac3b0f451c6302c197ac0fddb6a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651203046, "uuid": "7e6789f1-d1bf-4641-8731-a6ec3432b4d5", "comment": "Malware payload (AgentTesla)", "value": "8feece425c89c5c045a640cf6f8d8306ab401d6cc01602dc2b34f5f2783803e9ffd65b7727b9e1532015d3806a921bc6", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651203046, "uuid": "a1e018f4-cc09-4626-9bec-3c6f12751b33", "value": "T14CC4124AE29C9B22EF7B8BF8A5243650837576693513FBCEDCC260D11D397E28811E53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651203046, "uuid": "d5b3b43b-9682-4ed9-a706-38805b6bc372", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651203046, "uuid": "7d365832-860d-4725-9b26-73f5a63bb9c6", "value": "12288:xLWJeUpgRK42fUEQZ3yUrro3OPdDtEqy/d6R:tQ5EyUbcUviadFgI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651203046, "uuid": "7b03bc88-a4f9-4c84-9f33-b3673d05350c", "value": 590848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651203046, "uuid": "9436f16d-5a66-49c9-81e1-3a8122bc80f5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651203046, "uuid": "608add90-54f4-45f3-b852-c56d6cb2c2bb", "value": "2022-SOA MAR.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9e0a00a0-c7aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651229615, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229615, "uuid": "2b3a70bc-a9ae-4caf-8390-86fae8b3c278", "comment": "Malware payload (AgentTesla)", "value": "04899e71611f195fbcc1c5b7cde32110", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229615, "uuid": "24c2b87a-ab31-4025-8a3b-5a5b9207569d", "comment": "Malware payload (AgentTesla)", "value": "c63e424a1c9db13f8f88169f947dbaea8c0ff4ed704b34dc7bfa030936385177", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229615, "uuid": "82e05cdd-7329-435a-828a-97a5bb669c13", "comment": "Malware payload (AgentTesla)", "value": "7455a706c4a296d97e2c0dcc20f9cac2c712322d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229615, "uuid": "b1c74210-96dd-440d-82e0-530a6af43c4a", "comment": "Malware payload (AgentTesla)", "value": "f063bf1a0d13bb2d6aee4d75353fd1ca03dffaf354da61635705491fdc8a37e633cdf099834e08b02e28e516bba89a4b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229615, "uuid": "f7406d98-728f-49a8-9b48-3917afb5bfbf", "value": "T1C97423DA25CD6C64DCA773A8030B1DF0243B262533BF676D1375AB0872B394BB53A261", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229615, "uuid": "8fcbe707-102e-43b1-80ac-8d69f994a113", "value": "6144:JX0LLgYkkRQeuqu+3IZvJy887gjJRHDkBF3n4+HXJ6HZc/xbxWqE33koq8:ig7Bek+3Ip07KfHDIzXsAxdWqEEr8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651229615, "uuid": "2fe0eac9-727c-45c9-b5ee-47a062908fa0", "value": 348274, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651229615, "uuid": "4ef74cc8-b75b-416a-9402-ee98aeaf0fe1", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229615, "uuid": "9694f6dd-0d8e-482d-b2a0-7d0b359071eb", "value": "DEBIT NOTE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa082122-c802-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267565, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267565, "uuid": "6c10424b-5208-4122-bbb0-52869ef16cd5", "comment": "Malware payload (Mirai)", "value": "0455cbb12faef2e546c14631d24f59b3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267565, "uuid": "83386c9a-c775-4921-ace0-2647ffe34c7a", "comment": "Malware payload (Mirai)", "value": "c6c4cbe8fb45b5df91e089889b83a9d9d8e760977f58ab3081caea506428ec87", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267565, "uuid": "cab62131-3de9-43d7-8d74-4090988108ad", "comment": "Malware payload (Mirai)", "value": "036fef9731a51bd231842106ca116b0391e07a1c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267565, "uuid": "1c977ad6-71a7-49c2-8ba7-bfc9820b9fda", "comment": "Malware payload (Mirai)", "value": "b85627e6738814b74e3eba82b612436ba3b996776a7f7021819b0d1c46b23b4bda21a6bed8793b8bffa5bf520fd4087f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267565, "uuid": "da899b29-ce80-4efd-aadb-82d1e299c9e3", "value": "T1B9B2C065C63688709BB20D31C97FCA557BA79ABC90C3B313256A20B04567E0568F6FCB", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267565, "uuid": "18a37b40-d217-41a1-9690-7c633dddcf88", "value": "384:efbkSogPjZCU7/iDdtzOwuf3OxRMCxpSk+J2m0kneUhymdGUop5hKg0:eQSok8UbcOwG3O1Pxm2HkneUs3UozYg0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267565, "uuid": "cbd3d9cf-2c7a-4f98-acc7-c0ca663f762e", "value": 23748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267565, "uuid": "7d6b52ba-59a8-46b9-be40-6ecfa6fe6e9c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267565, "uuid": "0b238d45-849b-4bbe-a5d9-9cb9f8e7b345", "value": "0455cbb12faef2e546c14631d24f59b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39f16fda-c7f9-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651263377, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263377, "uuid": "33e5a387-6ef2-4618-b55a-85e8f9711b73", "comment": "Malware payload", "value": "7fe14b8a19478273373ce7c4462fc5ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263377, "uuid": "0b478d1e-bfaf-4ea8-81cc-ad647059ee5b", "comment": "Malware payload", "value": "c9b7bfc0a61a2dad9749fea4842acd06b6a02fce643ea0bb8eba8b28ff9383f2", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263377, "uuid": "e0b4d25f-eae4-4cd3-bbcd-191939dd8807", "comment": "Malware payload", "value": "65fc8d1d58499bcc6a69cba8a22bce4d8fff2225", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651263377, "uuid": "63a92b5b-2118-43a4-88b4-fe8f5659c3af", "comment": "Malware payload", "value": "9f676d0ddbc442e84f96f7da566117b8bedb7fefe4108cd485ee1d44da6a189a70e7a7448514f51d46a5d30a44fb5205", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263377, "uuid": "a5bb7a53-aa3d-4aa0-ac5b-a26186cc0d28", "value": "T1A695F9837AC74EE6CAC667B896D343316378FD518B1A5F2F6608C2316D536C5BE4AB00", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263377, "uuid": "2beb118f-1f74-4246-bb13-2c6637eec127", "value": "231816e538bc739644186aba0bf798f9", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263377, "uuid": "bf7e7ef3-4441-46f8-82fe-893072fdebaa", "value": "24576:nkMqYEaI6jWLk0mXyfKdzjW+k4+P+Ec0xMke8JsU3AoKqqIpyBKuJ:kMqYEwjWLkkfKLYuqqIpyBKuJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651263377, "uuid": "d146c9f6-2529-4c76-9a44-4e39448bad47", "value": 1960434, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651263377, "uuid": "af609aa4-8fa9-4a48-8a81-fe039565642e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651263377, "uuid": "cfa6c9a6-c22f-4ffb-8956-c452f36c34be", "value": "OPENING.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51000135-c7a5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651227338, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227338, "uuid": "3dce19bd-f351-46da-98e7-1d009e178f19", "comment": "Malware payload (AgentTesla)", "value": "23babb5e46d290c17d046bfc0f147f57", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227338, "uuid": "f384e72d-a574-46e4-a459-149f86a8d04b", "comment": "Malware payload (AgentTesla)", "value": "cb329ffd899a9ab4aa5cb215f7842879ec70e8856f9f550b0b4849cb780da61c", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227338, "uuid": "8b26adc1-fc9a-42de-af2d-55872185e066", "comment": "Malware payload (AgentTesla)", "value": "0adb222f9391d2c17d20a1189616f6c8ebc4c8ff", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651227338, "uuid": "2fb75a10-ffb2-483e-bb63-b4eea63cfb3b", "comment": "Malware payload (AgentTesla)", "value": "9a3d3396d574bb124fddfd7e0b3104046362be352c01e97bd716d9ed584baca170510ad658ffe195d0fcc43393fa2be5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651227338, "uuid": "280d1387-6fbb-4371-8a9e-64e3f4e83965", "value": "T175B4331B427588DF4D7F78FBC13E3008BDCA9312B36A43D998FA3A48255C57AE2D9111", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651227338, "uuid": "e9f614f5-fe96-475b-a4bc-aa8169e5cf07", "value": "6144:xLGnogDs4j7QI1K/IbAoTwASRp0RQE55nVyJN8B4gHmBNaTzvhYZSGJJCrsvxE3a:xLuDsKz1+IbAo7ROUOWHve8OXLKwl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651227338, "uuid": "aa349012-129a-4b86-9f8d-30755b662582", "value": 523019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651227338, "uuid": "3ec423e4-618a-4170-a98a-19ccfc4f290c", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651227338, "uuid": "52d4e3ef-d6ba-4093-96e7-4e0555a429b0", "value": "statement of account.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cc2e142a-c7a8-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651228833, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228833, "uuid": "664aa9bb-e7a3-4d5d-abf2-e62adebaf379", "comment": "Malware payload (AgentTesla)", "value": "8f9097f0e3cfef0b62df1aeb712a6889", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228833, "uuid": "f36b0571-5852-4d4c-9a83-629f50463fab", "comment": "Malware payload (AgentTesla)", "value": "cba52a25568677ed2a232dfe9f6561bb0f886329b28240eab5d253558ab5cba6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228833, "uuid": "48798a60-9701-4aae-af21-4f869007a682", "comment": "Malware payload (AgentTesla)", "value": "40bd1c783060c09fe6866ad8851dc1d9d887921e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228833, "uuid": "2abc2705-efa0-4967-8ac5-53a947b33f5c", "comment": "Malware payload (AgentTesla)", "value": "7e79b7d92db3c20f660e961786c48088c7d2568615be71cd81633d57420712faa730363dd38101cdcb506797c3fc47f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228833, "uuid": "33466e6e-2c04-41af-9c32-9850302020c6", "value": "T1ED94235B386C3F51FBB85B04C5A9810B9A37F38E552825C7E2EC08E80513D2FAA97D75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228833, "uuid": "cf67eaa4-7273-435b-9073-50dec1ce8d1f", "value": "12288:DGDulkbUhy0R3B3ZIfVOTHBK+eiObmmVLSNRZFzA3vdpr:DSu6Gy0+wBNeiOam1SXA3vnr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651228833, "uuid": "96a6a870-aa7c-4339-8d90-c031e14e6f77", "value": 428387, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651228833, "uuid": "9c59817c-f140-42f1-a495-a588575be941", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228833, "uuid": "6e2fb0ae-3c63-4ef6-895f-065254d3afe2", "value": "bank notice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "613bfbcc-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651217916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217916, "uuid": "b7c6eb0e-505d-43a6-bd6d-18ca351fe9b6", "comment": "Malware payload (Formbook)", "value": "9cf5b53959da2a3429bd149bf1d50137", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217916, "uuid": "7df519b3-5dc4-471b-98d2-71a19ce66fbc", "comment": "Malware payload (Formbook)", "value": "cc39680d5e75432a7b9264cc91004f51d0a2ae76462be3633d6626cb1e71d902", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217916, "uuid": "d0a0a908-5e00-4050-9c90-c7a75eb13d16", "comment": "Malware payload (Formbook)", "value": "bb01257132b547e6aa2177b4a94064f1dcd9b26e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217916, "uuid": "c58f62bb-0e54-4a87-ba2d-474fcbcf5bb8", "comment": "Malware payload (Formbook)", "value": "ac17ebc13b3213a3f87612def704e6128dcf0b7ae056f1fa71655acee58d23c79c9520b99259beade0199590ef48270e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217916, "uuid": "efdb4b84-8fce-4a18-bd0a-3abe74fb5b46", "value": "T155E4992A38BA100DB272AD5C6BBCB175D15EF7F226361C7B0DF7060A11129F0DB9D626", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217916, "uuid": "4b51fc3f-c859-4232-a4eb-93b19db02be3", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217916, "uuid": "947c88f9-6eb1-420b-8a0c-5eb5d51e70b4", "value": "12288:hqiRxnR449Jk8boeVVWKUBmcFrw7HfIwRN71jdmESajnWjsFCk2fvSP:JoOD51jnSiSfg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217916, "uuid": "6f5f76d7-dc64-43ff-99f9-5da215d8b054", "value": 675888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217916, "uuid": "4b6de7cf-6da4-4c0c-aebf-6e27b1e7e0d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217916, "uuid": "3241a1d5-fe74-4fd6-9445-09f7b790f839", "value": "9cf5b53959da2a3429bd149bf1d50137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0bdc2f8f-c7c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651238818, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238818, "uuid": "8e6aaa26-b291-4b67-ae0a-0b7a3dc49ca2", "comment": "Malware payload (Mirai)", "value": "7f6427ff11953841ef5fe4120b8aefe9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238818, "uuid": "83f270c0-cbf1-457f-913c-09fd2f000bd0", "comment": "Malware payload (Mirai)", "value": "ccfdffc2101c48fab5dbdebc37aa1e2c699aa251a88c92be8208508d7583f023", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238818, "uuid": "b4f23cc6-64e5-4b0e-b893-fa55b68a2c12", "comment": "Malware payload (Mirai)", "value": "ac0c273369f3e7d035e0a240ab7dbc86e0f9eead", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238818, "uuid": "999445f9-f5bb-4a82-a1b9-8a331da504b8", "comment": "Malware payload (Mirai)", "value": "a024a77bdd68fe2d9809e7a67b6e42ddf8cdeea61736eb28bac73413177d67e18df0f5993ae30d2eb0281965170bb1ca", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238818, "uuid": "010eefad-1655-4f6a-aef4-c32917fcff49", "value": "T1AB33F2374818169ACF316A35AC6813C0398F4ADC829D362356ADE7AC4EC76173FF5D82", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238818, "uuid": "5f759796-fd2d-41e3-8d01-43b2ceb2558e", "value": "768:33TdvknEJHX4SsNzBk6b+Xo28MQwa1MzhA2fL2cMZQ9q3UELCFKoVHytRcB/LqWu:TSEnsN1k67n4a+PfdMXLUZStRcB+WxQX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238818, "uuid": "f0b57966-3e8a-43b4-b5f3-94c6febe6a47", "value": 51536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238818, "uuid": "18ddd94b-db6b-4007-bef5-670e58d2d24e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238818, "uuid": "dada1591-c217-4e74-9bc1-d8821ac18da3", "value": "7f6427ff11953841ef5fe4120b8aefe9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3db7255b-c761-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651198100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198100, "uuid": "4220d57d-295c-40e6-bb50-3ca41b813f47", "comment": "Malware payload (Heodo)", "value": "b838a6563de4fdd5a7c3d78b22912214", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198100, "uuid": "a912c19d-e72a-48b5-8af2-0f7bb2b523c8", "comment": "Malware payload (Heodo)", "value": "cd161434f6be865f8f65dd222fed46a03c6eeffdaebe43d867e410d889e39a1c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198100, "uuid": "bb89d06c-39f9-4dd0-bdc2-b62fdecc1a95", "comment": "Malware payload (Heodo)", "value": "562f54375eae31663dafbc574a53078da600eaf1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198100, "uuid": "7b605dee-8d89-4e98-bdfa-c06a7362dee8", "comment": "Malware payload (Heodo)", "value": "5acb6a464ff4e0bdb71e0280c9dbaba4fb9693c9baae7eb263b4ca257cf9cad00c0e5f943d3122ddbcd4fd4aea81fb7e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198100, "uuid": "c6cc1805-1d0d-4d1b-9f17-ddf3b943c071", "value": "T199C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198100, "uuid": "f87006ed-4da1-4f97-897b-8dfd855ca0a5", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198100, "uuid": "ce3ad799-e06d-4136-bd6b-d888d6f476dd", "value": "6144:JhZ02GdOOgPYWKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFflKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651198100, "uuid": "bb3fab0b-1d27-49c5-b91c-2737d7107f9c", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651198100, "uuid": "a0da022e-e253-4626-a0fc-bbcea8163059", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198100, "uuid": "0b74ba4e-cd49-42d1-ba5b-1369dc8c2284", "value": "triage_dropped_file", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54cf278c-c79f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651224767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224767, "uuid": "f6667fbb-ed29-4f10-88b4-e6007307c616", "comment": "Malware payload (Formbook)", "value": "b2854a0ded6ecaa2d5bf95e48cac1487", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224767, "uuid": "6980565f-2790-4ba4-8539-f5f43e0224a1", "comment": "Malware payload (Formbook)", "value": "cd36d02294b8ffd6ba8dfa8966dd74b69f4af77a3ad3e5e8688b22cba6d7802a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224767, "uuid": "7d304a2a-ecf1-4220-9abe-4cf6c9555c3c", "comment": "Malware payload (Formbook)", "value": "03455f7bf12f372a67c8c8063ed3ba4ed9ef5057", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224767, "uuid": "e9992e55-78fa-4b12-a94d-af6e9034c220", "comment": "Malware payload (Formbook)", "value": "3b196218a265bb72653089a985a9c4ae9291412dca418db6351ee9fad9b921b1fb5578c9a26929f97d56572b087b20e0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224767, "uuid": "5bb082bd-4dd7-47a8-8570-4f50a6d93a22", "value": "T1A11412983EB0C827DAA72B71153AB7585FE7D71E6574130F1B201E4A7872342EE1B322", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224767, "uuid": "0accc41e-3ec6-460f-b127-16384babab64", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224767, "uuid": "67b37fe8-dde7-452d-bcaf-98405ee6ef6e", "value": "3072:l1NjcVVnLpPunbbOH19uHTkbTe1MIaZirxNBmQTPQ30cM4Zb1bkHkFerwMoo69ju:HNeZmg1QzkbhnQIRM+JFQoDI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651224767, "uuid": "f92be04c-b3b3-4f90-be93-0585e2f26d87", "value": 196741, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651224767, "uuid": "7115b548-8673-4c59-9943-c0ff43054474", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224767, "uuid": "bc870d43-5ee8-4386-b07e-050464b037a3", "value": "Nueva cotizaci\u00f3n185225772.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fb38751-c80d-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651272057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272057, "uuid": "396d28ee-61b8-4ca1-8701-a16d45ff4d43", "comment": "Malware payload (Mirai)", "value": "cbec408c26d7a66ee1e12cd9dde4b0d1", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272057, "uuid": "1860c522-6713-4f3b-b9bd-8ccd17931938", "comment": "Malware payload (Mirai)", "value": "cd85d75e59dec767c25b23bf86f932d27820e4eadae1a20bb42691cd240b28c2", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272057, "uuid": "566c7db5-4266-48b4-b0a5-68c5aeffc47a", "comment": "Malware payload (Mirai)", "value": "c046fe2437575adfcd0a374d451c23fa83bcaee9", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651272057, "uuid": "c0448a7a-5de0-42fc-bae5-5fa3abaf29ed", "comment": "Malware payload (Mirai)", "value": "5d6765f2be6a52b3176437a7cbfca5f3d89148715a9d261b2ac249d516bbd9a877f353087f7c02a14ebcd5d003a2b0b3", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272057, "uuid": "45772798-e714-4df4-8a4b-377e869a8790", "value": "T1FDF2F1C2DF025971E471063ED6AF0413E65B5AA5C2773E9BE0111FA6FAC211ED0B3972", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272057, "uuid": "2580d4f4-0593-41aa-960d-a5582ae8dbe4", "value": "768:3evt+hN0mIy3vT4SMxeYa7DSuFhf0r3CoysnClPq3UIn5:3eFINv5vxKeYaPFg3CkClg5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651272057, "uuid": "95e61257-fc2e-4c1b-bd83-625d9e04a503", "value": 36652, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651272057, "uuid": "83591abb-8748-4752-a894-e35d97ddee2c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651272057, "uuid": "854ce961-924b-414f-a59a-7bd03d66a521", "value": "db0fa4b8db0333367e9bda3ab68b8042.arm6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8da8db6-c78d-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651217285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217285, "uuid": "a972d5e6-e635-4063-a916-d2548064a719", "comment": "Malware payload", "value": "82c87395c448b9f0b4c5c36ca3b5c582", "object_relation": "md5", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217285, "uuid": "0510f908-2078-48a2-a8ed-26ddd90d1e33", "comment": "Malware payload", "value": "cea1fec0b7c4253f7de02dc82d675da8514f12834ffa59fc80e8604af1a34a7e", "object_relation": "sha256", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217285, "uuid": "f5e92883-b658-4dad-9dbc-3214b81ee529", "comment": "Malware payload", "value": "045ecca3b998253bcebb1250639d74f835b53ca0", "object_relation": "sha1", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217285, "uuid": "2fcca553-97af-4514-831a-2c94de8cc015", "comment": "Malware payload", "value": "fe91b4f6f1487e51c529b8d7fc8a9ae1e2f38447c7721b4911817bcf7ab4a08c6c981e6efd0cdbb598027113b2a3da9d", "object_relation": "sha3-384", "Tag": [ { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217285, "uuid": "861f979a-f529-4cb9-b6b0-7e1e5d960405", "value": "T1BE23D7AAF2D9DC06D955033548DBD6FA3323BC225FDB96473284F71E5EB4A809A03513", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217285, "uuid": "00ad1dc3-80d3-4983-a87c-9651d83a6703", "value": "768:PqoMKpbdrHYrMue8q7QPX+5xtekEd/68/dgA1AoWsXIlCsSDldks3k73uOSHU/O:StKpbdrHYrMue8q7QPX+5xtekEdi8/dv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217285, "uuid": "f3704b5f-c301-48d6-aac0-4c77beddeaa6", "value": 45573, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217285, "uuid": "ddfc9427-8470-4712-af29-0571890fec13", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217285, "uuid": "e1b838ea-c6ac-4fac-afa6-d57c10ed65d8", "value": "payment_info444.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f26bea70-c7ec-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651258103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258103, "uuid": "c68ddb28-b3fa-4819-8578-462602134776", "comment": "Malware payload (Heodo)", "value": "2cda161e2493b34fb9c9de3d8977677e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258103, "uuid": "77ea3e8c-0325-4b2e-b950-8de03ad8a52f", "comment": "Malware payload (Heodo)", "value": "ced8e33d1976988545d61a9b1b7034c3fbb4ad755efd56f3e6ff4c0aad913e41", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258103, "uuid": "7db02dd8-ca62-45ca-9e25-5aae83a42090", "comment": "Malware payload (Heodo)", "value": "8259f69d230bad426399349546717fab754cafd2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258103, "uuid": "a2670d9c-33f3-49eb-ae37-9e3876cc0432", "comment": "Malware payload (Heodo)", "value": "4677a0279253b1349a6983531581b80fc12972a8de181d25881dacc4de128af98b83e7e7163a1b030c4c8d133dc7664b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258103, "uuid": "c6aa74d4-4e4a-4fb9-916d-62819f49f030", "value": "T1FDC48CD87584C672CF7B6BB98552C2601E3D7CE06BA0CF07AE58693D2F32E41D8196C6", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258103, "uuid": "3cba1666-e214-4fae-9614-a59956b5d718", "value": "6eb736b73a786957562fd323f3abbe25", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258103, "uuid": "fae1f976-6f16-41bb-bab3-0710ba6debed", "value": "6144:XbfQnyfAdoAuYqMPkaEeZ7fYX3WVpLQF5DTf18e2k6SV4s68dTcEgDAIpiWe97Tq:XoynYqMPkavIsLQFxfqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651258103, "uuid": "1d78e0f3-990c-499d-836e-306122760f6f", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651258103, "uuid": "97b7551d-58a2-4ce2-b128-bfaac1ad50a6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258103, "uuid": "84529206-ba91-4e2b-9dff-0726226e1d96", "value": "emotet_exe_e4_dc0a872dee8bf3a78c9f2df2d2374753dccd97684ec586af98c4f1a3e9ca78fc_2022-04-29__184815.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a8725c1-c76b-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651202336, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651202336, "uuid": "7c0d0b28-e2a2-41c1-811a-312177c44ae0", "comment": "Malware payload (AgentTesla)", "value": "e2381d87e4f53a5bb398f3c84fd3577e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651202336, "uuid": "c4d03c90-38b8-4491-a9bd-a4e18dc6618c", "comment": "Malware payload (AgentTesla)", "value": "cf36285793bbcf23fac97c4dd70c854ec07bb3092aaec4eda99acdb3dec1ba64", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651202336, "uuid": "366d4c35-f32c-45fd-8857-ee845aa9e8fe", "comment": "Malware payload (AgentTesla)", "value": "8251514843bfefc7dc23b89f35359ebf3527ac28", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651202336, "uuid": "9100d43e-820c-43cd-82f0-c018a4df6703", "comment": "Malware payload (AgentTesla)", "value": "826057003b3fc226e2a198a7fbd2f0f976ac5965d657a04cedcb7d7a6996cac8c91d047c03de4c204a1c141fe356ae85", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651202336, "uuid": "80c9338d-42ee-4bc0-b5fc-cf51c3d5514f", "value": "T11F74CFD1BE18D896EC631BF29C2BD1112174762D90ED9B0E32E26F1A55E3392141BF8F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651202336, "uuid": "bd406a6f-1afb-46db-b0dd-b5af80a1bc8d", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651202336, "uuid": "93053fe1-9ad5-4bec-92b1-0d7cb0df110a", "value": "6144:6NeZdfJFR9v29lKoUM24BUup9fSd4PLMHkZoS1Z5COg+qrxR1qKbyfZmbZ6Ol+:6No7v2np5DJSKPEkZoSDgvlR1qKbr4H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651202336, "uuid": "a6e56572-a795-44e2-8baf-9ba183875ef7", "value": 370691, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651202336, "uuid": "1154ab8b-0022-4be0-ad35-c2fcfb21498e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651202336, "uuid": "b0b57e40-9468-4f05-a3a2-bd410aaaa722", "value": "29057341.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8006d4b8-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651232571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232571, "uuid": "75e8c04d-23e2-4b4d-ba35-bd1882e6fca1", "comment": "Malware payload (Mirai)", "value": "2d2c4faf731def821a93b94822f86e59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232571, "uuid": "60b95969-9312-4f07-94d5-cf5d32109953", "comment": "Malware payload (Mirai)", "value": "cfb33334dab121aa64ad3723487ee80feb3e011da63e75814cfc50cdbdd0b43f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232571, "uuid": "35d589e6-242a-4849-abc8-8cbaa8c00299", "comment": "Malware payload (Mirai)", "value": "b61d7bd9595a5cbce9c3355f2035c03d5dbba8a6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232571, "uuid": "8a902504-a28c-4251-94ed-55752cbf4184", "comment": "Malware payload (Mirai)", "value": "871614e63bb63ff9beb98201513ec7bac1dedfa33a5c402fd219e9fb481cb4607e6a1e7fcfa4f8d3564fc8d74603d51e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232571, "uuid": "fb28afab-92e5-477d-8af7-8362ea23757a", "value": "T1593329DBB4029E7EF48BE67A405A4D0AF53122C11193172373EBFD93FE32154A952E4A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232571, "uuid": "fa0f77a1-d353-4f79-9893-7214ba6b2110", "value": "768:jvSPF+B8oMzLuRdQxbV8/gFHb1HAEuR8L8v8b97oVkfXKBfvob4c:j668l7bFb1HANR8L26oVkfaBfK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232571, "uuid": "39d5593c-f377-4f3e-800a-d60e791f3df7", "value": 53544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232571, "uuid": "a5acff4e-4b11-4bd0-ba4d-69329d21ea03", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232571, "uuid": "38410533-50da-447b-abfc-3017872b5d81", "value": "2d2c4faf731def821a93b94822f86e59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "017b56b2-c7d3-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651246961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246961, "uuid": "16648f5b-564e-42f5-a7e5-b00b3db9d8e8", "comment": "Malware payload (AgentTesla)", "value": "2f17a88ec6340118c087e500a02e2ae9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246961, "uuid": "4cfe1cbb-0187-4e4c-8149-60c5573841af", "comment": "Malware payload (AgentTesla)", "value": "d05bfd0a97e1329dc7067b9a8c1bcdfe8949aa3464b4946fefc5f70b766c63d9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246961, "uuid": "5d26926d-b0cc-4893-8a7c-eeecfa1b8809", "comment": "Malware payload (AgentTesla)", "value": "1772a5374767da18fdc660d16a65adff398b5e0a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651246961, "uuid": "3a1e0043-64cc-4329-9b6a-2d09d78aed5a", "comment": "Malware payload (AgentTesla)", "value": "08873638e95b7000c5e18827fdca26341891fe17ffdf04530519b32da77d5f46d37b4af031a75257e029cbb727ed8ddc", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246961, "uuid": "01aad92e-7273-434b-8cda-7e2fd5ca9545", "value": "T15194221F792C6982862A3178363E11A5074813D6FFA2E9D8F81FC8E795499ED095BCF0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246961, "uuid": "fc9abe3a-8637-462b-8537-f39f98ade9c8", "value": "12288:3766dcqUSgwUyQCZsD2W6aDmJmtQop443Qia:L66yxmUFa9a6kB3Qb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651246961, "uuid": "89476539-293a-48b6-ab3a-3c15237c54fc", "value": 418404, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651246961, "uuid": "371c3ce9-02bb-41a0-b608-9586d9c92d92", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651246961, "uuid": "2843a5f7-684c-41f1-b7b4-71e3c8f25858", "value": "IN02672Q583765NBOM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72f2febb-c7a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651225247, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225247, "uuid": "00b72ce8-00ff-492e-9e50-e3b497aef697", "comment": "Malware payload (Quakbot)", "value": "b3254ff7fcea70ce72485d9544f68ce7", "object_relation": "md5", "Tag": [ { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qabot", "colour": "#B954A1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225247, "uuid": "d0086ddd-725a-44a8-9701-2c0cb29c5807", "comment": "Malware payload (Quakbot)", "value": "d0887d642e76a433aa851590a13bbc777e00d7ec7b769df6258082ebdec6a504", "object_relation": "sha256", "Tag": [ { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qabot", "colour": "#B954A1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225247, "uuid": "a652182b-77d2-44ab-8b09-1c21f28dc689", "comment": "Malware payload (Quakbot)", "value": "97cdc65c4226f78ff7e1ba1bcdbe992ec8c5f494", "object_relation": "sha1", "Tag": [ { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qabot", "colour": "#B954A1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225247, "uuid": "d851f5f3-0579-47f1-a505-85dd69d749c5", "comment": "Malware payload (Quakbot)", "value": "c33453a9aa8d1ac18228dcdc35006de62eba7d7627acadfa5f38314caeb704c40857fdb718e3926530f95effdbf7e927", "object_relation": "sha3-384", "Tag": [ { "name": "italy", "colour": "#161A3D", "exportable": true, "hide_tag": false }, { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "qabot", "colour": "#B954A1", "exportable": true, "hide_tag": false }, { "name": "Qakbot", "colour": "#1EAC47", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225247, "uuid": "4217de96-d0af-4e87-aaba-c9b0a0ac4afe", "value": "T1CDF423BB68CE2568414C66678B530A62F1F1E4BE074EEAB10C017D7DA9E7305D1FB06B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225247, "uuid": "4009430a-2621-48ce-8c40-e3e1020d10e6", "value": "12288:3k3I00dZUGqKjZITjawy3TW3SsVQFqHfLc/Tq0okjPtjw1GmCHIlQfKpMGZob:OI1zzjZK2wwTWiSQYHTc/e0eLqIEKqGM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651225247, "uuid": "c7042672-0719-4979-ae4e-8b292f87f51c", "value": 786378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651225247, "uuid": "38837b6a-862f-4b15-8c65-5bd8daf7e653", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225247, "uuid": "d14593a0-c989-4461-a5c2-54b4ec22d210", "value": "W_3205734683.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c65d712-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651217854, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217854, "uuid": "e27a5d5d-9c7b-48d5-a081-bb099bb68daf", "comment": "Malware payload (Loki)", "value": "73d60b657ff1448ed43de6bd8a41d69d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217854, "uuid": "2a8a5595-8cf8-4e95-84ac-77d6f87fcee4", "comment": "Malware payload (Loki)", "value": "d0f779b3094169509081933a464adf6aded9401e2f5025659ae077a62490455f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217854, "uuid": "b20ac0c3-c552-401b-8783-d8e826496d32", "comment": "Malware payload (Loki)", "value": "ef55f2ffb2262ba7f7ceccc8c16bb1d6f520eca7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217854, "uuid": "5c504c75-5eeb-4459-854c-07eb0b1c6e71", "comment": "Malware payload (Loki)", "value": "c82de1ea964c26b4c5567cf5fec7eafe562de882fd5bf20eca2c72445a0d345ce4b419fce0d81513dae8238fbd1c8a46", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217854, "uuid": "f599d165-6ae6-438e-a5a0-dafd4f4c69ca", "value": "T17A9412643BBD8F62CABD07FCA43A56044374DA0A5603F75A2BD670EC6D733A04611BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217854, "uuid": "bdb9babf-4d56-4c38-9b53-fd5f2f920e04", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217854, "uuid": "47c41c57-27ae-4ec4-b396-9f9edf578acb", "value": "6144:xVE6hKE8eDM3tF3f6j2eT5ieaHbWLm9y50KRmYwNLQQwU1acjgE7:CtZ42bJWug3twNLJwU1ad", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217854, "uuid": "ed0a4296-a4c0-455f-b368-e96ef76caacf", "value": 428032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217854, "uuid": "02d84d54-e284-4bff-8764-6f5e6c1c4593", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217854, "uuid": "415b8bdf-4c41-4a60-a5df-ed7158f23522", "value": "73d60b657ff1448ed43de6bd8a41d69d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "379c62f4-c7ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651258219, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258219, "uuid": "417e3b2a-b1db-4784-8bc8-4a677d3eaed9", "comment": "Malware payload (Mirai)", "value": "29f4a91a3fa370bb95f7deb674905f14", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258219, "uuid": "62818fd1-365d-4c03-9be9-9ad2a8dd709c", "comment": "Malware payload (Mirai)", "value": "d147018d83751201cb5b6c77d31729ccd78e8155af0cb7afa8fc1786f5e4bd29", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258219, "uuid": "4aad5a1c-8d9c-40f0-80b7-aca29870dfc0", "comment": "Malware payload (Mirai)", "value": "ec1c6b43b58c038750d64b44cd5b67c275895174", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258219, "uuid": "9b0db73f-c1a6-4485-a768-721ef70aea9a", "comment": "Malware payload (Mirai)", "value": "051bdcd0021a7406a3221e1dcc921d4586993506c522d231dccc34670cf24d6c29c8501f080ff51ba67350f296943805", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258219, "uuid": "71dd25c1-5c80-4dae-a620-2c5887623d5f", "value": "T14DC2D0DFB48A79C5CD1C5CBC218D5AE11569A2C7234B9F0837203DCDA6B645EF89C8B8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258219, "uuid": "4b9e7d14-20fb-4bea-b65b-67f645f560dd", "value": "768:MuCUFskb2JgIs/E2+OocrfJiHNjfmQ2q7IoqdBkpWj:5CrJgHiOJrfwmQrct7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651258219, "uuid": "fb6aab66-b78c-4057-a81a-9ec5d2790baf", "value": 27244, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651258219, "uuid": "0a7d7176-91a6-4efd-b700-1ae57b00db47", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258219, "uuid": "a66c3af4-659c-4911-9048-7df2bb93feca", "value": "29f4a91a3fa370bb95f7deb674905f14", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d2c6249-c7a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651229184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229184, "uuid": "6889cb00-dc6b-4860-848f-f0907fd2b25a", "comment": "Malware payload (AgentTesla)", "value": "597e16680f998fd376fee9a584ce6924", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229184, "uuid": "2797b34e-0d2b-41d0-b7ee-8f1da79650da", "comment": "Malware payload (AgentTesla)", "value": "d176aaeb3b1547248d249f83da246397622bbd665c3d22adb68414fd053a4baf", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229184, "uuid": "c613ba79-9721-4f11-892d-932043ed5214", "comment": "Malware payload (AgentTesla)", "value": "2e01df4a541647dcc9703b490ca3d734c273f3f2", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229184, "uuid": "bfc0cf71-1917-4370-a9cb-b2770df2d74b", "comment": "Malware payload (AgentTesla)", "value": "a1179773e7b2d7107d31fdd621933d71c5452332601d85bff36c0849860bfb7e9796a5d8edd31f5c1d18552914c1bf82", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229184, "uuid": "d622173c-c108-4b0b-87a1-934230a04665", "value": "T1A6942334017198E5704C5F2B0087B73916E02016DFAFD9F46BB3DB9F456D29AAA3C0B9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229184, "uuid": "029c1b81-a858-4ace-8dea-d4e93838e68e", "value": "12288:hpBK14RGwVRnGZ1dleqIp1tFoXA1/mHew:TBKGUru3p1TBFw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651229184, "uuid": "938f4739-0564-481b-acec-fbdd1e15b890", "value": 423931, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651229184, "uuid": "55db66a5-7f83-4bc2-a3b1-edd0504941e7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229184, "uuid": "306b1da1-7117-4af0-a078-07ba9a299b38", "value": "INVOICE.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a5c53b0-c7f8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651262868, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651262868, "uuid": "fc9e41f8-2703-4bc1-8ff1-e5c5d0ca6188", "comment": "Malware payload", "value": "d3f4eb4ad0dbd0765230ffaa0c404dce", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651262868, "uuid": "e70f0d56-e8c6-4e77-95dd-531f9a067a80", "comment": "Malware payload", "value": "d1f87bd17bd1c361f0c3f83de63509e6f9aeff8344b2fddf4a91afd3c3de3cab", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651262868, "uuid": "b6b1eacd-2db9-4ae0-afae-e98e104e4816", "comment": "Malware payload", "value": "ec66fe23a788873540f7ba0f39b81007acc197ca", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651262868, "uuid": "c068fb9b-8f19-43d7-a7e3-53babcb82e43", "comment": "Malware payload", "value": "a871c6c241b506bfa1e6b583ce7626069b0f525975ae84f5cf0fee70ffaafadfa18735b939c4f5321cc3480f0e854d6c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651262868, "uuid": "52483f04-3986-4893-a097-bcf260d845e4", "value": "T1BC156B12FAFC80B5D02EC13AC582865AF7B17C50977587CB92519B2A6F733E15E3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651262868, "uuid": "cacf51e9-5eb4-405c-b8cd-9bd3909445f6", "value": "0f7b55ae9955d812fac6eb2e089af4f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651262868, "uuid": "e7e54aed-61eb-4d27-9b60-2f67239a75c1", "value": "24576:3q/YfxBhF98FdV4pDRUzUdk/Snv62d7h:LxLb+mpDRUzqCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651262868, "uuid": "5a238cff-7666-4ae7-9f2a-6d5f97173690", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651262868, "uuid": "a1450ecd-8ac7-490e-8604-5908a635c3b4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651262868, "uuid": "ffa742aa-433c-460d-b145-17dca631dbf7", "value": "all.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65342166-c78b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651216205, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216205, "uuid": "0c71aca5-98f0-47b7-a89e-20dfe578ab1b", "comment": "Malware payload (Loki)", "value": "7b1f5ae93c3a085f15fb6718407ecf98", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216205, "uuid": "f1f6a035-4dc7-49f8-bf7a-f9869358029c", "comment": "Malware payload (Loki)", "value": "d23e51ff23b2b21379805e9e9f270a1134d4ada4114d6fa1cedaf5f65bb6af37", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216205, "uuid": "16022f8f-7f0a-4955-9f85-47ab7fc104e9", "comment": "Malware payload (Loki)", "value": "e703da0507150250381302ad3f66729c17f40ec8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216205, "uuid": "ab022cf4-5fb3-49b6-ad8b-aef040a70779", "comment": "Malware payload (Loki)", "value": "250cc1eaa6438416ea72b2c48be4054707b5792ea0c707e05c0269efe66b1bfe121ca7311ac3cbedf800bbbc33e6116b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216205, "uuid": "9982ba2a-6866-4f3a-9ff6-4f8770e2129b", "value": "T11394121427B8CE23CAFD6BFC522A06020734EA165563F35A1F9590F93D7B3A05A11BD7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216205, "uuid": "481df167-5fce-46c6-bee0-4964641dc3da", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216205, "uuid": "1cec9639-719c-4095-a1f4-7b914cdddd73", "value": "12288:nyxFEXcZ5QWRB4gnvSiZ99lXZlGO6WIK:nyrMcZqWtnK0b8OFIK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651216205, "uuid": "2d40bc22-7f8b-4d3e-89f2-0cb17d38a5b5", "value": 434176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651216205, "uuid": "02c8938c-23f4-468f-9898-539cfcd99aec", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216205, "uuid": "369cef80-54e5-471d-a579-5e6fbbab9162", "value": "DHL_689567.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7969abb0-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651215380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215380, "uuid": "466da559-a1fc-4d07-b196-a04caf5cd740", "comment": "Malware payload (RedLineStealer)", "value": "a4ff62a821dc21f67663cfdae663a02c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215380, "uuid": "d91aa730-53cf-484c-a212-8b006e55e6b7", "comment": "Malware payload (RedLineStealer)", "value": "d28b1d5c1963f4341df8242ede617435c4ff311f68e7f20474288aa8c4f89b4c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215380, "uuid": "ef2e5607-12a6-4c1e-bbb7-a64af15d0272", "comment": "Malware payload (RedLineStealer)", "value": "2ae0d4037f6aaeacfdb6077d1e169903e4d90fc8", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215380, "uuid": "6416c2d9-11ea-4032-b670-d84a0c4e9554", "comment": "Malware payload (RedLineStealer)", "value": "47156b0af0c8881b40cdd5cc8c0a91dde04ec184d0b23f278c07d56b206e232d86c601b491ee12fc270db48128a69f9e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215380, "uuid": "9cfbe14b-264a-4cfd-b38b-a4ec46325dcf", "value": "T11584CF40BBA0D039F1B316F0B97993A86539BDA19B3451CB22D63BDE5A306D1ECB4707", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215380, "uuid": "741ad938-b40c-41a3-9e89-110a0a791cb8", "value": "a5e21eb4da4d713aa6e028b6a31293af", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215380, "uuid": "80eca43e-5794-4b6b-8d05-74f2aee60f35", "value": "12288:2OvrsLNcPwP2eNsn1/0CNWhaQAFdT+i+8X4:2Md8YnJKAjT+i+8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215380, "uuid": "d9245868-3f2a-40a7-8f8c-6677a72e6449", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215380, "uuid": "ce6037e9-ada0-40ce-8e50-727fe63ada30", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215380, "uuid": "385e8734-e0cc-4922-abb4-1f689d762a38", "value": "a4ff62a821dc21f67663cfdae663a02c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8e70e7d3-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651232595, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232595, "uuid": "4fe538e1-890a-4ce8-bef5-3fe4a0bfa4e8", "comment": "Malware payload (Heodo)", "value": "ca6927b65980b2714ddf07a3e0bd48ea", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232595, "uuid": "1f090373-e205-4739-b04a-df2d511be3fd", "comment": "Malware payload (Heodo)", "value": "d2a29e579a5a3a4a804f2ee7f36da98718cb75acd6f0d5b2c3ba3c9f774aa4e9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232595, "uuid": "af3dfb15-7953-45e8-b2fd-5f177ae3f3d0", "comment": "Malware payload (Heodo)", "value": "1174c7c16a3bacc315338fa837230c90ee921eca", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232595, "uuid": "ce4dc8d5-5e84-4e80-ba01-30812eabe2eb", "comment": "Malware payload (Heodo)", "value": "613b95fe0ff260cb2b25b1b7b3c0783c47ce9f42945d0c17fa84bd0bd29f92c4491820b38a1fcce248ff0aeb6ac1c484", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232595, "uuid": "8675a69e-f657-44d2-a4ee-b4c51ed7a3ad", "value": "T1DAC4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232595, "uuid": "c8aaaaf4-5c57-4298-bc2a-bb54e5f2dc4f", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232595, "uuid": "c913a901-87ba-41ef-8bc2-20871bf33002", "value": "6144:JhZ02GdOOgPYiKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFftKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232595, "uuid": "c989d216-862c-4a2c-8793-a86bd98e0b74", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232595, "uuid": "ee66bfd0-dc8a-42a8-a18a-e293193009ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232595, "uuid": "9395bf0f-3a0d-4fa8-89d2-3895d4800b08", "value": "ca6927b65980b2714ddf07a3e0bd48ea", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7eb90b7e-c7b7-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651235146, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235146, "uuid": "934fa3c0-4d5f-452d-8a80-0729dad29935", "comment": "Malware payload (AgentTesla)", "value": "d19f930b39ecc05d3f751fc297ae28a8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235146, "uuid": "f83fe787-b2e0-4461-8d42-7b511ea9b1eb", "comment": "Malware payload (AgentTesla)", "value": "d38bfc8e080a948b883fab6067d50a709fd488f67b5066dbfa5beb7461268dc8", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235146, "uuid": "3ab1f2d7-9497-4628-9f66-52f98e21b106", "comment": "Malware payload (AgentTesla)", "value": "47ce161a4027e873be95be6d83a49e97f629328a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235146, "uuid": "489ad97d-6e0a-4de2-833d-97f4ec8d7f92", "comment": "Malware payload (AgentTesla)", "value": "9bb2c77c9c067f322d749dc4398ee64149b9d8732971db8e1012f6f684213e5d0c7d1ca62ce5081592febef9d34752f4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r11", "colour": "#29469C", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235146, "uuid": "65eca572-9c36-4500-8e7b-8d5e0673b6e0", "value": "T11FF42395BB5BF6ED63D53DCC611926642C5201C0A325ABD2E06CB5BD384EF0CE6E86CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235146, "uuid": "1816af6a-caea-4226-9c20-1641e9dab7a1", "value": "12288:OGrjMmVw9zrQ9xFrElBkzxN+wHgHiDU05UPmk6xRUZl41e+xmziTeMx/35TRgU2F:OGPMmVzyluzxNrHkiD7UPG+4o+ciXx/k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651235146, "uuid": "d60ce4ce-b647-498c-8726-ceeda1cf912e", "value": 768551, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651235146, "uuid": "4fd8be48-4aba-478a-ba70-9e2b486d261e", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235146, "uuid": "4dd1d382-5783-4db7-9797-f37ee2e1e57f", "value": "QUOTE.r11", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3940272b-c781-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651211836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211836, "uuid": "7ed1ccab-349b-42ef-8818-2b9a23bd280a", "comment": "Malware payload (AgentTesla)", "value": "f4e6fe3cb4df23ba10e8a9d8685914c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211836, "uuid": "7ee52135-155b-4da4-abde-a9b5e73967de", "comment": "Malware payload (AgentTesla)", "value": "d3cf6ad85bc73fce3147f40e8adb72899b9752cccc18393b9ffb230979b414e7", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211836, "uuid": "e6ba7783-597e-43a1-b7fc-22b289639e5c", "comment": "Malware payload (AgentTesla)", "value": "331daf6382741ccd62e496e51aadb325d979200c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651211836, "uuid": "90e7e2b8-284b-416e-adda-4b8ccbf62489", "comment": "Malware payload (AgentTesla)", "value": "cacb7ebe5c06bc82b78d9347ec35a2ba87882ac9118724a30dc392a1735cd8c9a052b00541a156da85ac9a46704c4b35", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211836, "uuid": "35867a1e-de82-4d41-a130-bc3398692117", "value": "T1BAC41250BBAC8F67D67B97FC2510901147B57A892232DB4B8EC2B5C3183AF115FA2B53", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211836, "uuid": "dd553f27-8e9b-4a51-8a7b-3dcb174cc825", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211836, "uuid": "b463effb-2d83-40e0-90e6-16bb11a0145d", "value": "12288:gxKLWJeX6KMgSBJldqLIBZfLcyNd0/Whzynp2gKwNMU9:NQy6KaBJjxRoOenvK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651211836, "uuid": "4a1b26ea-7d69-440a-935d-983181969fbe", "value": 595456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651211836, "uuid": "fa619267-4b54-4185-a25b-fecd7d6e49fb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651211836, "uuid": "1516a1a5-1479-47e9-a826-ec052b6609ed", "value": "Factura y orden de compra.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34b4f0d0-c7c2-11ec-8e58-42010a9c0032", "comment": "Malware payload (BumbleBee)", "timestamp": 1651239746, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239746, "uuid": "09bba1a1-970c-4c87-ad93-0a26982e3b4f", "comment": "Malware payload (BumbleBee)", "value": "28681fefcfa45116730d7a9de2199680", "object_relation": "md5", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239746, "uuid": "65d50450-8bba-47cc-a4f8-d6024092f1c4", "comment": "Malware payload (BumbleBee)", "value": "d5f84837ec58879f2911b6834bb497d9b9ebba0b196ddf7e1f6b02dfccbc3276", "object_relation": "sha256", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239746, "uuid": "b43ea107-73eb-4931-b6fa-f3b64467c729", "comment": "Malware payload (BumbleBee)", "value": "893023a867ac2bc5d435c67c7a1191c39bbca636", "object_relation": "sha1", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239746, "uuid": "f003adde-f67b-428f-94b3-476e70c0cfef", "comment": "Malware payload (BumbleBee)", "value": "7ef93dd16fe303a978ba089f47abf3ea7c8c1df233b04984fdd72598b0950f6670edd948a033e2003ff2481556bf127c", "object_relation": "sha3-384", "Tag": [ { "name": "BUMBLEBEE", "colour": "#0D37AF", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239746, "uuid": "085e10ec-aa78-4529-80a0-e1bf7c3a7dbb", "value": "T134D5E1094F140D1AD6B40EB828DF3BCD02186757DC686D5B99B2A4ED277EAFB302351E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239746, "uuid": "34ffdf01-6591-421f-8ec2-44522af91283", "value": "49152:AcWp/NAvX+9SgH1ZDwRTLrVw1C3/ew15zqLomMi4+Ki:NWp/NAvX+9SgH1ORTLrVYs5zqLc2t", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651239746, "uuid": "dca3fb39-a8b4-4860-974b-df5e29a42d94", "value": 2826240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651239746, "uuid": "fd34cd06-c2ae-4e63-9c3f-1d2db024f9d2", "value": "application/x-iso9660-image", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239746, "uuid": "4bd5b976-80d7-457b-9b25-042ae5c48841", "value": "0421110.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "14b5ec53-c7f8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651262885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651262885, "uuid": "ce64b83a-3788-47b3-a05a-ba951e9b4e51", "comment": "Malware payload", "value": "cf4d98eb905caa9841b65b0dcee7699b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651262885, "uuid": "9c36b2d4-2413-4cb0-8536-1dc5b49472b4", "comment": "Malware payload", "value": "d797e20ce9dd24058412988a295b6cb3b8c2e84b2e7dbc3070e62487a393e5f4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651262885, "uuid": "02d2e241-aa9d-4c71-ab63-10956d0d8370", "comment": "Malware payload", "value": "226cb350e3190644d4076a3ebcd8919717157e96", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651262885, "uuid": "002fb908-61dd-4854-add5-30cbd369d83c", "comment": "Malware payload", "value": "1fad89ebb25f0ba74dcedee0f2b5925e501dbda0ad8d796ed7adc0a47139c6118a39ed60838230c976f5b92c69407ab0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651262885, "uuid": "94edf9e6-e9fc-4a85-a2e9-6f9f9155eb03", "value": "T1BB156B12FAFC80B5D02EC13AC582865AF7B17C50977587CB92519B2A6F733E15E3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651262885, "uuid": "98012a11-3e14-4e71-bb23-fd1f2248370f", "value": "0f7b55ae9955d812fac6eb2e089af4f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651262885, "uuid": "711f92c2-3fc2-4cb7-b1f8-2f00a061c658", "value": "24576:3q/YfxBhF98FdV4pDRUz5dk/Snv62d7h:LxLb+mpDRUzXCO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651262885, "uuid": "64a52300-9fed-45eb-82eb-08942d486787", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651262885, "uuid": "96f5684d-e9a1-4dbf-9b1a-8b9118f3353c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651262885, "uuid": "671950dd-b992-4910-9163-5ffc2205e778", "value": "the.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "84c9dc7e-c755-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651193065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193065, "uuid": "d1db866a-a79f-4505-8deb-6bdce9134016", "comment": "Malware payload (Heodo)", "value": "c06524d06a7c16ec76670a4fff194b13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193065, "uuid": "2ebd1a8d-4060-4837-a70a-848d0477df74", "comment": "Malware payload (Heodo)", "value": "d9820e9593fb97cd32bd8bac0efcb8ac688174f01af509ffdd01da3c4c434c35", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193065, "uuid": "b505ee70-e2a0-42cb-91ac-af251c2f8bb5", "comment": "Malware payload (Heodo)", "value": "0abb67ebbbb9a18d411bac2b7779075a2413738e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193065, "uuid": "1a21027a-42d0-422d-a2e1-b0e6495857dc", "comment": "Malware payload (Heodo)", "value": "a8e0b95344b91f625a71fc8c3ce4066481707c996b900b4df760106fbdb4f23f5968c281b49ab6805b30a7dc1c4ce02f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193065, "uuid": "b529aaa6-6114-424a-a405-041f3cee830a", "value": "T192C4AD0BF7BC88A7D162E57984239B8AE7B2BC114771D35B4760572A3F333A05D2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193065, "uuid": "d8a8d5ba-66a0-4861-95af-dc501338084c", "value": "1134f6be519e9c35b5478dccf9efcfc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193065, "uuid": "3ff8bff7-1d6a-484b-8885-a410694ee0d0", "value": "12288:FX18uCYMUhDfWKN/QdCUaQkhS+W/uczzIEudy7JMv9:MuCcVNIYmMSLjQE0mJMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651193065, "uuid": "f18a4ccd-3b79-460d-bf89-bdbd67a8e17a", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651193065, "uuid": "c38c7c1c-a30f-496e-b816-2060a5f33943", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193065, "uuid": "900a1bb5-a8b6-4f35-abe6-c4a18a7ad804", "value": "c06524d06a7c16ec76670a4fff194b13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c8513f7-c761-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651198098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198098, "uuid": "4b8cd964-24cf-40e9-b329-d480553214e6", "comment": "Malware payload (Mirai)", "value": "b79e7c4dbf7964e75923dce3138c7339", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198098, "uuid": "d889133c-15ba-43a1-bd92-52997c22b1f9", "comment": "Malware payload (Mirai)", "value": "d9911a111d664c030f749a5ed8860192c46998db3be4d1569b7b7ae3e18e3436", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198098, "uuid": "ced1aff5-218d-43c3-90ea-d8a6f6cc6c78", "comment": "Malware payload (Mirai)", "value": "addee4e751e06b6014dafeee081c38c731e76651", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198098, "uuid": "b9886242-a66e-4321-b3ad-d2d11ec87ecf", "comment": "Malware payload (Mirai)", "value": "049f5fdc8a8b9acc3a0d3f16084cc5fb68fee0e870162f460391601126a70b116f87185af43dd819a5d9e81cf88c0285", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198098, "uuid": "fbbd23ee-1dab-4127-951f-3fc9b3137881", "value": "T1E0332B427228094FF9D61EF0353F0FE093AFE98024E0B585694EEB458676F771586F89", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198098, "uuid": "8e0d5c60-8991-4698-98a9-78ba6bcb64a1", "value": "768:opgPdUwOe1Po/7wni3RiAPSnPfvPK3Ctjcxt8mizjrvVwipnpBX9Qev3:D1FOe1Po/kcE9mFomi6wvXe23", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651198098, "uuid": "ede715fc-76f0-41fc-9503-37873191e7a6", "value": 51604, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651198098, "uuid": "1f3c71fc-d160-4707-a189-17d56b1e5d34", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198098, "uuid": "6bd88ba8-b033-4c64-b927-06dc3811b4c0", "value": "b79e7c4dbf7964e75923dce3138c7339", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "05088227-c803-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267583, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267583, "uuid": "1d4988f6-169a-4093-adf0-140f1a4bc14e", "comment": "Malware payload (Mirai)", "value": "fba32d15eacfcaca263292e10ddaf2e9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267583, "uuid": "3ada557a-818f-44f7-b27e-a3294df52c1c", "comment": "Malware payload (Mirai)", "value": "dab220256487ed1f2028a697edb4ad6e0ad1015d512fdc3c7e315edb26372c96", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267583, "uuid": "cde6d01d-09dc-4b9c-8bb9-eb1babd2db70", "comment": "Malware payload (Mirai)", "value": "b03ca43b3ac141511676c6866b4b7c247eb98152", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267583, "uuid": "acb5d700-ec10-4ddd-8c6c-4d28af815377", "comment": "Malware payload (Mirai)", "value": "a19a37b55be67c959f6d033a5efebc50c4c63ded4ded74299280498f58ca61542168e1a5e4a77cae716d5a54b1f3ca93", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267583, "uuid": "83a3164f-97c3-4635-bb34-dba0c7c96a9d", "value": "T112C2E112DBEECD4FF51BC0F6DBBC845221115892CE9557D6A9ABC1ACA3504702DB8790", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267583, "uuid": "f2ee2edd-f64e-4bb0-8600-a815a1ee3f4c", "value": "768:A+xJN5GcRCnLcQXBQUpR+PdBliCF9AEgaTqvyqu6W1Kd/:AU/CnQNGydiCFSaOaqu6W1A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267583, "uuid": "6eb17cdb-32e0-486a-841a-ac76bffdd58a", "value": 27756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267583, "uuid": "9117b9bd-b298-40fd-b736-7bdc5071030f", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267583, "uuid": "8388d042-20db-4c2a-a59b-6290562abb57", "value": "fba32d15eacfcaca263292e10ddaf2e9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6ad067d5-c789-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651215355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215355, "uuid": "6df33a13-0389-4418-b2eb-0e4349c09558", "comment": "Malware payload (AgentTesla)", "value": "fb3c6a56e4940721a34983607c3d68c8", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215355, "uuid": "34b5a56e-de67-46fa-8042-8ffbbae15bec", "comment": "Malware payload (AgentTesla)", "value": "dad1686c55d2515b3a0d5245e914c48028a62a65f49b048eae9e5bb94c113f0e", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215355, "uuid": "3bfb2c18-6ea9-436b-8d58-bb0811972458", "comment": "Malware payload (AgentTesla)", "value": "2d06f5938ec85ce80c77c4f325dc741f3fc86572", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215355, "uuid": "21a3b329-ca4a-4043-a43d-d76404ad5478", "comment": "Malware payload (AgentTesla)", "value": "901254d34a613fe603d86deed0f25fbf64d42f23b1f8de47897a941f654769ecd613de4c06fcd6cef0f158b4f51a2069", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215355, "uuid": "1cf9fe80-8991-4889-b065-f7112b46aa6b", "value": "T173D49D98765171CFC497D972C9D6DCB0BAA074BB470BE38BB05347A86E8D896CE002F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215355, "uuid": "82b48f89-a412-402f-a73f-f02e0064b7fa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215355, "uuid": "dbc4796d-9b9a-453c-b0bd-92813bdfede5", "value": "12288:W4uRFN7WEfi1/VcbCgQ3e3kZLA+ZCRHtTxf6+5UYhw+nDqkxXXJrx:aRFNJKcn8rZA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215355, "uuid": "31e3ffa2-f878-4fc3-badf-4431cc861866", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215355, "uuid": "42c175af-48cf-442c-b997-f48ece1a96d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215355, "uuid": "5c1ca499-f2d9-46b3-9e41-970aa774c64d", "value": "Custom Duty.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e262fcfd-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651218133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218133, "uuid": "67018a92-909c-49b9-b6f0-a169be3a43bb", "comment": "Malware payload", "value": "5d9baed6a09d60f750a847e0cea239c1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "\u798f\u5dde\u8d85\u4eba\u5e2e\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8", "colour": "#D67A39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218133, "uuid": "bab189bf-636d-433d-8bed-9623b9f8c083", "comment": "Malware payload", "value": "daf89323d3abd752ceec2095ad2d955f65351156ebc42d1253815e5028d9e481", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "\u798f\u5dde\u8d85\u4eba\u5e2e\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8", "colour": "#D67A39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218133, "uuid": "ecb75755-9a36-4a11-93bc-9c4df1541883", "comment": "Malware payload", "value": "055fc9986e8b466425cf870be52bd4d8ad2054c4", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "\u798f\u5dde\u8d85\u4eba\u5e2e\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8", "colour": "#D67A39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218133, "uuid": "ed482937-376a-4e7e-8609-79518d6c4682", "comment": "Malware payload", "value": "ee7bdd49372f84f8c68e890b73616bed9068b8823a701fb5986999111e85085268cb2c4fd88d34566987f674b96344d9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "\u798f\u5dde\u8d85\u4eba\u5e2e\u7f51\u7edc\u79d1\u6280\u6709\u9650\u516c\u53f8", "colour": "#D67A39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218133, "uuid": "d183d707-c4af-4fd0-92d8-4ea451ef620b", "value": "T1578633736716208EC0D6CC365933BEE535FA132B8742B4786ADA6DC634626E5F743883", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218133, "uuid": "df4609cc-e210-4a2b-945f-e808b6142a44", "value": "da544416d426e0dcb548b041b3d45170", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218133, "uuid": "0e2139c3-c521-42b1-afac-8be80e724517", "value": "98304:b/84N2n1EVgCdzc2QK6ACV9bjQzaxy2aL/KwS9CpbT0YDv+ArzvNGzJt1omu1RkH:b/ZpvO2D0nof/KwNpbwYDvWbqmu/+d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651218133, "uuid": "30faa4b9-db96-4479-9a52-f790aea60bfb", "value": 8480224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651218133, "uuid": "8d0bfbca-a595-4d91-bfa5-acc414d9caaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218133, "uuid": "c178a060-e2eb-4f08-98fe-77c9ceee3ae6", "value": "zCrashReport.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44328d3c-c7ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651258240, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258240, "uuid": "8c6587a3-bfdb-422f-bc34-98ffafb005f8", "comment": "Malware payload (Mirai)", "value": "434abcbf7c1d0331cfbcd0a6919fea08", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258240, "uuid": "b591df73-db79-48c4-9cb1-12f84c1b2631", "comment": "Malware payload (Mirai)", "value": "db7b4d757e5b765cf62e3c90ae0d78907b1acd2ccf73f9093070d6c2ddd99d6f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258240, "uuid": "18ecd4ea-1136-4027-99b4-e995afb17a5d", "comment": "Malware payload (Mirai)", "value": "92eb4d2ff3306d732a51db7005fa3b85b95e923e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258240, "uuid": "815eed93-a248-492c-b5d3-1ac14a68dde4", "comment": "Malware payload (Mirai)", "value": "6228f5b7f7cd4ad314acaf141294f17d72cef47e0fad23baede916df5fea20b8f539a943b5d456971e9e95ddf8479ff6", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258240, "uuid": "15aad252-c5f1-432a-839f-a25932631ab2", "value": "T1DED2E1026681FEE1D1B00232E967899B72253D79D1D130FA973C0DF8A6E9A1D47F8943", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258240, "uuid": "df2f6cb0-a8b8-4c52-9c96-6c61bfed9309", "value": "768:vusHfRavjynNKnjFcZIhQzhKMXgAA9q3UEL7d:HRwynNIOQQ1KMwAJLJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651258240, "uuid": "ea8009af-0d5d-4ef8-b4ec-149ed35dd095", "value": 29464, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651258240, "uuid": "71790b8d-c3da-4ccc-b713-f923fb43d536", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258240, "uuid": "7681a2a0-6ec6-4abb-9309-414126b4ea69", "value": "434abcbf7c1d0331cfbcd0a6919fea08", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f03a975e-c7df-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651252516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252516, "uuid": "35249c1d-3571-4c49-90d0-527c644fe8c5", "comment": "Malware payload (Heodo)", "value": "1ee73d1ebcda95584fde4a4d451a5caf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252516, "uuid": "c5587a8c-bb47-4033-9f9f-32d5a38fa963", "comment": "Malware payload (Heodo)", "value": "dc5ae37abf652b57e196f830f295fe9b6889e4916cd443123c1355d757944cbf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252516, "uuid": "a6a0b402-d35b-4d7d-a725-c3c9e91b5ada", "comment": "Malware payload (Heodo)", "value": "9f94ffe0186ba83b5d607664fd1db591635c33e3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252516, "uuid": "40605d9c-1b40-46af-b4b1-3e7e8eca1262", "comment": "Malware payload (Heodo)", "value": "7b56bde76708bb77ee5541bc22b3ab88bee6cff611735a65f8a13664aab18f6ad3bfd06e64b26558cee11aa10dcbf99c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252516, "uuid": "5bf5b186-4c07-4792-9e18-9be34dacc6f9", "value": "T141C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252516, "uuid": "2b58902d-ed6a-484d-bed5-5699261f2b90", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252516, "uuid": "b61378f8-5772-48dc-a2a0-0a461e0e2f1c", "value": "6144:JhZ02GdOOgPYEKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfHKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651252516, "uuid": "a3dc346c-d97d-419d-82f5-e441389b6baa", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651252516, "uuid": "1357b0bb-0876-4884-8012-95ea21abd6d7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252516, "uuid": "93eac308-6852-44fb-ac0e-d32e4efd91aa", "value": "1ee73d1ebcda95584fde4a4d451a5caf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "870a2706-c784-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651213255, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213255, "uuid": "e7978944-dced-420a-83e3-08f526e265fc", "comment": "Malware payload (Mirai)", "value": "85ad3141e061965fe8d61636716e72df", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213255, "uuid": "b007015a-819f-49a3-a765-6f604377f659", "comment": "Malware payload (Mirai)", "value": "dc6b5921b4536be658ccbc69733ecca0ef097b681395162e4914c569a49b8c4a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213255, "uuid": "120971ee-9d5d-4545-8b49-364b329c432b", "comment": "Malware payload (Mirai)", "value": "4492ce4e8954a7fb960a62d06aa6fc2b9a8d1053", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651213255, "uuid": "b6339dfb-5ade-4ddc-9143-20e0c1999836", "comment": "Malware payload (Mirai)", "value": "a02fe8d6903ce75ee8b5204a18056f1cba6091613c2df780524ce87cfb1da8ac5d622a395906220f071570cfff0dd04d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213255, "uuid": "9df011b6-516b-40b0-a196-ba145c6a4134", "value": "T1B9533B25AD792E26C0D4B57E21F78710F2E2220E26B8C51E7CB21E8EFF04B5065577B6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213255, "uuid": "0d8037b9-c21a-458f-a45e-d519dcc7418e", "value": "768:VaYoQW1sgtq98oSWANyrk5K3YneVMAb6WsreAgOmdMcyPD5aO+neS6LS:VaYWmgtS8oxANMk5K3YeV/b6vr7LIngS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651213255, "uuid": "5b25de71-2cc4-4cfd-9356-a21b48cd8e10", "value": 61508, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651213255, "uuid": "e8b77f23-bfe7-4d2e-b69f-a573defe3668", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651213255, "uuid": "8f13bfc0-4714-4b4d-814d-e032611ab00b", "value": "85ad3141e061965fe8d61636716e72df", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b6eda3e-c7c4-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651240562, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240562, "uuid": "a78599e6-8852-4580-be11-84444d2c27e6", "comment": "Malware payload (SnakeKeylogger)", "value": "1e014a2e915d08e684d15decab3def0c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240562, "uuid": "513b6f6e-eef5-403e-bb1e-0858361a2c3a", "comment": "Malware payload (SnakeKeylogger)", "value": "dd04c24c348c4dfbf6830b8426563ddc60ea82a81e3ab87b693a24b8227e147b", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240562, "uuid": "3ca37d6c-efa1-4cb1-8551-63c2c6965b78", "comment": "Malware payload (SnakeKeylogger)", "value": "c9fef2bfc25a691b1a28da99fc82a374753b23cd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240562, "uuid": "93993351-1e33-464d-b362-054f7407f944", "comment": "Malware payload (SnakeKeylogger)", "value": "86f4a9d210484a6f8ba347e4a34825604981b10110c0a0f00ef2877c164ff8f5d1370a075317a356fd5c82570d7b08e9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240562, "uuid": "5cc6d69b-bda2-4739-b3e6-86857473c54b", "value": "T174C49DE5354C8AE3CE765977068F8E7113E34A221126F7336BD377F2254261BEA27284", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240562, "uuid": "ec156eeb-07d8-4250-a234-62a956dd9e83", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240562, "uuid": "d1a930a3-4f4b-41cf-94c9-169cdb2ea75d", "value": "12288:SjIjxsbdbcMyrWiIjt01WK0lWE+9uLjVj4VC9lv5uG7tOy:7j+JbcMyrWiQxWEAEj4VwBuG4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240562, "uuid": "4f89974e-5e7b-4519-bfa4-879582a6f2e3", "value": 560640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240562, "uuid": "acac6be1-3ed3-41b6-a4d6-bd1b440cb6f1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240562, "uuid": "10dfb1dc-ed16-4a33-8f54-0e13ebf4cc05", "value": "new shipment details.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8529d695-c782-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651212393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212393, "uuid": "60f6c823-02ac-43de-b93e-a940ed0d731a", "comment": "Malware payload (Mirai)", "value": "570ea436180c1d50b637dec88642be59", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212393, "uuid": "296df79d-e000-4da1-ad74-e759d8e65f36", "comment": "Malware payload (Mirai)", "value": "dd1539c1111fe00ca167bc96e06c7efe0c0bd4ee3b43b301eda0a2b673d051ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212393, "uuid": "0d945d39-419e-4d03-bc45-740747f4091c", "comment": "Malware payload (Mirai)", "value": "94bbdc26d4d19365280cc412f4b571e89bd2a81c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212393, "uuid": "1fae92b3-9799-4ed2-b8ae-105c08f9300c", "comment": "Malware payload (Mirai)", "value": "9c5658fd0bf35c03c61f05f5b19faceefdc17fb176c8cf230b71fce7935ab0cef01b288005419733383b656d91ffc34e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212393, "uuid": "c52aed72-0d9d-4826-bef0-a76a555eb803", "value": "T129333ADAB802AD7DF88BE6BE80124E0DF23123555053172767A7FDE37E331A49912E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212393, "uuid": "ae25efb2-e2ea-4289-b0e2-2cdd138b1aaa", "value": "768:jseDHFJlDnn5QX2kzj3pLkQPFmPAgFHupAu8WeTHpy1oJT9H/iH8IZ:owJ1n5QGMNRtm7FupJ8pVy1oJpH/o8s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651212393, "uuid": "c013214b-6bca-419f-8d7b-798cca2b9f59", "value": 54116, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651212393, "uuid": "5b4543df-bd12-411a-8cc0-0d457e56e44b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212393, "uuid": "e450e354-0932-46e5-a77e-32bdc8d59179", "value": "570ea436180c1d50b637dec88642be59", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10319e96-c818-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651276621, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276621, "uuid": "056085a5-a2e8-4e09-a3b7-030baf93460a", "comment": "Malware payload", "value": "b60a2e74020b582fb6a21f11b8831708", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tag:ransomware tag:Essentials", "colour": "#C45B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276621, "uuid": "a6b3133c-2f00-415f-8395-04662a63149f", "comment": "Malware payload", "value": "dd728b0aa7098652681d7bf66076c65f7cbe27fb57329c23065cd5ddf38f42db", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tag:ransomware tag:Essentials", "colour": "#C45B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276621, "uuid": "488defca-127c-49c6-8b3b-dbb8408e5c54", "comment": "Malware payload", "value": "7cdadc09f3b8c49621ea6a8656723ce61ee16429", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tag:ransomware tag:Essentials", "colour": "#C45B78", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651276621, "uuid": "e866dc07-b416-4940-948c-c033127245dc", "comment": "Malware payload", "value": "c7f95cd1f08591685886bd8dc5973a8fff87e8ff904c48ce5117652671a09c35234b4d4a3c361b2a276386a9c509330b", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "tag:ransomware tag:Essentials", "colour": "#C45B78", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276621, "uuid": "8435e128-7026-41bf-a614-c0465155af50", "value": "T1F0345B0067E5CA05C5E1067A8EA2D3702771DC5699229B0B3EC8BF9F3FFA7365D01292", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276621, "uuid": "cd8d54ae-6f62-4f1c-89a9-3bb52f3654ef", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276621, "uuid": "b9f6ffb5-8cf2-48c9-bed5-d6f10db8f612", "value": "1536:h3kjdpv+SO+z/DVb2SzAJC3kjdpv+UO+4:QddDOgb2nhddDOT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651276621, "uuid": "935cf284-400b-4148-b3b7-49fbd1957c71", "value": 244224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651276621, "uuid": "8bf9c65d-67c4-498a-806c-cd01dfadd5ed", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651276621, "uuid": "527f0a1e-b1b6-4a76-8732-e1777ca99886", "value": "Sample.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e10c370-c78c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651216569, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216569, "uuid": "99405daa-3190-443c-95ff-ca3a25616313", "comment": "Malware payload (AgentTesla)", "value": "4207d6aedae7b6445454f54a65c69b89", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216569, "uuid": "a2ef83d3-5c07-4fdd-93d5-c10e411103c0", "comment": "Malware payload (AgentTesla)", "value": "de924d3e791ce94778c1b89b195623b80768d49869c35a5085953d3416bbccb1", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216569, "uuid": "7bd55197-8188-4dea-8f3f-bc22c110720a", "comment": "Malware payload (AgentTesla)", "value": "338b870c3358279d7d24827df2b9170edde12542", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216569, "uuid": "e085a61b-efaf-436e-8ba8-d517226cf3f9", "comment": "Malware payload (AgentTesla)", "value": "a63b515dcdc242ea6507f6fef3a65b573ca717acaef01fc12a3b2eaedbc3188f627b95eb185fdc2c871de2e720556cb1", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216569, "uuid": "678b87ea-10a3-482d-877b-56538b33f953", "value": "T1D413D72A78969619C9D47BF859B0618326367CE10134C14FECF97F29A973323DCC26AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216569, "uuid": "3527672d-4bec-4037-a87a-d3708c8c82b1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216569, "uuid": "24cbb4b9-ec00-438f-9cda-7267d778a70f", "value": "384:eBPrpSE+sA5NS170a/KQQhbbX2AaBZ8ejAfffffnQaulaipMwCKzH2S3dd0hUADJ:euSt0aiFbj2geIGlbMwCKN3deVDJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651216569, "uuid": "fa3de2d6-18ac-481a-9b19-4b158c9c81d9", "value": 44544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651216569, "uuid": "23c97f4c-f584-40d5-9de8-d07a3572ee80", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216569, "uuid": "1345c0fa-2fde-4c91-a98e-bb4e670e0334", "value": "invoices.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc90f2c1-c800-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651266710, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266710, "uuid": "68424e26-c6db-4dc3-9842-ac75bab6dc92", "comment": "Malware payload (Mirai)", "value": "e6abc8924adf8d188e3e2dc04ad6f537", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266710, "uuid": "4a8a1c29-26b2-44e7-b768-e868293e8321", "comment": "Malware payload (Mirai)", "value": "dea4afdcc8641aa94c051de350f030c37c15fedcacc662f2b859bfb8e8b27a5a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266710, "uuid": "07cf216c-b11e-48ed-8a53-37892a369b7e", "comment": "Malware payload (Mirai)", "value": "b997d38b2212e627e546e32f99158c1953bd2cd6", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266710, "uuid": "2c5f1055-d388-4b74-b835-45c1038357f0", "comment": "Malware payload (Mirai)", "value": "123da1f49b4b63015e214af157308984b3db545378c24a20009c28db0015328866df951530a782c641e625dd4bf5e3a2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266710, "uuid": "58f2e6f5-3ec5-47e1-bcbc-48baed638f64", "value": "T157330796A800BD2CFD5AE6BA81160F1CF5303B6410734737A6B6FC9B5D723A49D1AF81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266710, "uuid": "e097957e-3455-4377-81f2-77802cf58ffd", "value": "768:zreOjp9lwpL8a2dfJOw40Rcp/u5WeMEvpaqMJTXNa4H86Yn:nNjpspQ5p402p25ptaqMJ7NaG87n", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651266710, "uuid": "f7c54f42-2723-4b45-aa8a-215cf80319f5", "value": 54632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651266710, "uuid": "4fd1c1c6-b5e2-4375-84e7-bb59f3ec2d07", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266710, "uuid": "b75a029c-fdcb-4f85-a360-f03c0fbd56b2", "value": "e6abc8924adf8d188e3e2dc04ad6f537", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bc91060-c7ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651236456, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236456, "uuid": "9ca01c9e-4541-4f14-a26f-554b4a7953a5", "comment": "Malware payload (AgentTesla)", "value": "1a851c3fdba3a45b5814299203b0a2cb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236456, "uuid": "9a24c3ab-7b35-4ee2-a0eb-aeb0163787bb", "comment": "Malware payload (AgentTesla)", "value": "deb684224bf2ea56e1498214080926f57cf2985c615d347603fe2a951d7f8c51", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236456, "uuid": "3b042ac5-6682-413a-84a3-8db90cc478e6", "comment": "Malware payload (AgentTesla)", "value": "5a5852cf287a0468e3823af676eb91bee89f5ce8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236456, "uuid": "2425762a-7adf-46d4-b83b-5118a647d483", "comment": "Malware payload (AgentTesla)", "value": "ebedaac08f7086e2d02e250858faf05ef3c781303970d9f11adc88be7c2f77a2a6a89f2239c4b86575eaa0eac15b978e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236456, "uuid": "250e3a97-58b2-4d23-9cdb-1ea38c6288c4", "value": "T1945423ACC67C0BF0D098BB977BB29014F05F01FC38E1A069BD656AF4756B4DC26925CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236456, "uuid": "c65bd8c7-5629-4c57-85cc-10623cc3fb77", "value": "6144:V1JprWI1Qtp/34vNfvsWENzQYgwcxHzdi/1FEAoZRNEI/j3ViDAtOmXmmx:Vjphgp/CvANEZwcxHE1y9RNEI/4Axx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651236456, "uuid": "23b53d6b-db1f-4a57-824a-24c8ba5071cb", "value": 279179, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651236456, "uuid": "f017319d-a5e4-42de-9195-5f9a4e2af20b", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236456, "uuid": "7aa01aba-36ce-4c40-8e87-daae72b8e5e3", "value": "TT COPY.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "21e6f358-c7aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651229406, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229406, "uuid": "93972218-c2b2-4453-b153-4f7cd0e75575", "comment": "Malware payload (Mirai)", "value": "a28e8b69ca7bf29ba7deca0c3184a855", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229406, "uuid": "4f44d2b6-7fbf-4e1b-a9bb-17e470c8c1f1", "comment": "Malware payload (Mirai)", "value": "df33930185ef2dd864472ac26018a45f8da26d0f4ef377ab569e28ee2f4584a3", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229406, "uuid": "4fd9fc79-d95a-405b-a61d-b8c9a78992a9", "comment": "Malware payload (Mirai)", "value": "cfb9e7d757404230fbb65a767c2edb08e28f4e91", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229406, "uuid": "8cd020a8-1ae2-4bb0-9fc9-c6ecf6f44372", "comment": "Malware payload (Mirai)", "value": "b7870aa58f40a8d411bebf5ceaa459712d92066925863173f47649a47b0c301291b9c64c42c135a4e361ee2499d070ab", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229406, "uuid": "2658e58f-30c5-4e13-b693-d72acb8c1b29", "value": "T1C2B2E14EA2FB170AC44F117BB36E069F5C7578F3858BE361166B8394C35AA9D4A33C09", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229406, "uuid": "4c20eec7-f28b-4967-8702-cdf3bc2b9821", "value": "384:MJT44eyTGkYNxGdfVlZVXTkNi6iLvG6pYLbWII4i7Zt+7DGeXMslSfLv1Rv:Gc4VTqxufVlzUULO6iLCII4Ut+7KyCv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651229406, "uuid": "2f0e7c88-a471-46f7-9735-4953804fad01", "value": 24756, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651229406, "uuid": "02574cce-c35b-4bc1-b9f0-e220ce35caed", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229406, "uuid": "433eae10-a842-434b-ae9e-7c88a0a2e8c0", "value": "sora.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9db0cb5c-c7d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651249371, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249371, "uuid": "cf9cdc2c-d77d-40f2-898c-6c6851500e90", "comment": "Malware payload (Heodo)", "value": "1b2d43d55f38981f06278b2dfe28de52", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249371, "uuid": "d31d8fa0-fc91-4577-bde5-007461fca8c6", "comment": "Malware payload (Heodo)", "value": "e008c5f0e8d994e8f66432bf0c214bc98e90959175cb827ca428ddce14edf320", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249371, "uuid": "2a6cc998-51c9-4967-8774-6ffc7249b431", "comment": "Malware payload (Heodo)", "value": "0c2ac0e502bb2ff7eb639d34af6ad0280e00791c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249371, "uuid": "28e1d2db-f485-4127-a161-306fe8db055a", "comment": "Malware payload (Heodo)", "value": "59678992871ba63e5f0adbaa0d170785d497dd4af298a1d2f3fa29616eb49806b60eb29bc319c2e69dc0f17262ce49a4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249371, "uuid": "8a631100-4ce1-4565-9983-8ab7bd8e6214", "value": "T1D9C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249371, "uuid": "36c2ca86-e6ed-421c-ae7c-771d4968ea5d", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249371, "uuid": "f50860f6-21c9-4115-85db-075323ae11a7", "value": "6144:JhZ02GdOOgPYSKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfJKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651249371, "uuid": "0f93171f-9b9e-484c-a912-5dc9f72f94ab", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651249371, "uuid": "ce33cb41-f060-4839-ae23-114c753259f7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249371, "uuid": "c06a4674-a57c-4878-9dda-de8721b64f54", "value": "1b2d43d55f38981f06278b2dfe28de52", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46ba8bd4-c7c3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651240206, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240206, "uuid": "1efac4ca-f4a4-4d2e-8659-a7db9a50e26e", "comment": "Malware payload (Mirai)", "value": "d04e6bd624dcb526acd49280d2e349fd", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240206, "uuid": "e5a61b2f-41f2-4ee6-ae28-c12428b604ee", "comment": "Malware payload (Mirai)", "value": "e074578b9194b371655c8a9b693b1bd79b67128ab978cd9f874a210802be9137", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240206, "uuid": "a1afbba7-ee0f-4fbd-ab17-2151a0a0f135", "comment": "Malware payload (Mirai)", "value": "de0010f162e9542a6f530bfab27abc513308f44f", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240206, "uuid": "f0551ce2-75f1-4a79-893c-82b1ad82c865", "comment": "Malware payload (Mirai)", "value": "06f33e85d7914ce9df6c1ee098d9ca981690ad9053eef5345e9aaec883a9dd788114253fe62b18c76ca41cdb1deb1711", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240206, "uuid": "e9f5f867-63c6-4f60-99b8-b614ce0fa7b7", "value": "T11A13F12A219A59B501F5A0794CB5E99B27A773F1C4FDCAEF7220BC15BB80B4368E4701", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240206, "uuid": "02b13f75-11ea-4a7d-9521-b2f9f18285de", "value": "768:xxkGqKlGFftZ66CaFDrnTHBEhA+9LZ5kfLRGteM072Ktt3adocmQs3UozQ:xxk5j9FDHBuAO7yFGtHu3aUFzQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240206, "uuid": "8e8c4e04-b858-4e76-8cef-f80d3b6c9572", "value": 43428, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240206, "uuid": "dc5ab013-c001-4885-aec2-f7be6dbf0db7", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240206, "uuid": "b5d3ee84-6f7b-4bc0-b2e6-af35484fde73", "value": "arm-20220429-1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "09961e36-c7b8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651235379, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235379, "uuid": "cdf503af-8a4f-4737-9ff0-28ea566885a3", "comment": "Malware payload (Mirai)", "value": "9576b367c176e2a6e8bc39b4c8d6a96e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235379, "uuid": "5aabffd5-b953-4269-9a02-9c58ce717efe", "comment": "Malware payload (Mirai)", "value": "e0c867b2a08a28cf189bcb253d73eb90a587d37899a4838a5915070680ca772e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235379, "uuid": "7ca74669-1dec-4a01-aadb-be4468f93249", "comment": "Malware payload (Mirai)", "value": "af6cf7e3bd73c96dd675ef0d69970db5646e6013", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651235379, "uuid": "47827400-8f0b-41a7-96b6-d70f4bec2c0e", "comment": "Malware payload (Mirai)", "value": "b36954a6a434c5974746d51bc3eec8ccf8123d18d047c783ec3d2cebac537cdfcda8401addc379d5c8d4db8c5b0da899", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235379, "uuid": "4055fc36-f5c5-449a-920c-27b773b91520", "value": "T154534BC0B643E9F5DE020674306BEF324E37F6F6211AE987E3E49573AC425419643A9E", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235379, "uuid": "9895058c-b251-47a6-b973-9ececa0d8615", "value": "1536:mX23TSwlS4keBfrtOVqlQzYnnmKBPKlo2UWmsvnt05nFEiC:1jSwY4keBfrtOCQsnnFkmWBV05F3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651235379, "uuid": "4a2f6023-54ed-4047-aaba-ab261db270e3", "value": 66320, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651235379, "uuid": "84c709ee-776a-4dee-8814-58618cef7f39", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651235379, "uuid": "ec891fcb-51b9-42e8-8ce5-22e3052f9aae", "value": "9576b367c176e2a6e8bc39b4c8d6a96e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87db4752-c755-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651193070, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193070, "uuid": "deaf3e73-4a86-4a47-8dc5-bbb4ebb2ea28", "comment": "Malware payload (Heodo)", "value": "2e0f88ab28d2099b6a3d8a5b473bc7f4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193070, "uuid": "320b858a-5b25-4255-9d88-bbf273e8fcda", "comment": "Malware payload (Heodo)", "value": "e13ddc58f3dabdb54d191f6de75f0e2a8c2b43e1850226c470aedb516f376e01", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193070, "uuid": "f2c48b46-617a-4e70-993e-dcd59d4d86f3", "comment": "Malware payload (Heodo)", "value": "a836261dcc4d4b339f7881f4717bad6feb1fab84", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193070, "uuid": "82d61c1c-5224-409e-be6c-dfdee56944bf", "comment": "Malware payload (Heodo)", "value": "54baeeaa73d5534b8de213b06151666e811ae8e50cd817b1dc7e81ad1b1080d8d7f4007ef4f4e65ef87927b25dc3eb4b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193070, "uuid": "46a185a4-0de2-4683-9494-a26602bced0a", "value": "T1C1C4AD0BF7BC88A7D162E57984239B8AE7B2BC114771D35B4760572A3F333A05D2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193070, "uuid": "2cd48c5b-d544-4efc-9681-03f0185cb889", "value": "1134f6be519e9c35b5478dccf9efcfc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193070, "uuid": "afe52606-d16e-44c7-b7b2-5e1ecb205c7c", "value": "12288:FX18uCYMUhDfWKN/QdrUaQkhS+W/uczzIEudy7JMv9:MuCcVNIdmMSLjQE0mJMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651193070, "uuid": "b19e4b4b-5172-40e5-a3ff-64560f2a26db", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651193070, "uuid": "7636ee02-fe8c-4d49-8ee5-ca76ae84230e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193070, "uuid": "508ac6aa-b65e-4777-844d-d8618de41fcd", "value": "2e0f88ab28d2099b6a3d8a5b473bc7f4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "31135230-c7ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651258208, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258208, "uuid": "762d1f7b-ce6a-4715-9dce-39e7c1d4e053", "comment": "Malware payload (Mirai)", "value": "a5d1ddae9e51cc860e69e036a7479f7d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258208, "uuid": "3704c466-ecc5-4278-b8d9-7b9b87c1af3a", "comment": "Malware payload (Mirai)", "value": "e26640c837a0a802ee400bf3374cd2ea46847c3c51f5f8a08ef6800b41634cab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258208, "uuid": "5fc5e305-6dff-4e79-a3d3-b2e2328d2bf9", "comment": "Malware payload (Mirai)", "value": "65a56db6bb9ad8bfa4d38db2d595e44266200369", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258208, "uuid": "0861080e-8782-4b72-8edc-f705229ef397", "comment": "Malware payload (Mirai)", "value": "756b884a0841b8c0edaece1c35aee589fb7ab978d217a82c456d8c394307ff84245bf048063a7b8321f8a5f2f6e05092", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258208, "uuid": "afe49b5a-d51b-41da-9f88-5a913e7d5fe9", "value": "T1ED333BD6B902AD7CF98BEA7E80270E0AB53123541053073777EBFC937E321949956E46", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258208, "uuid": "b9681dd4-2c8a-4a0b-a7f2-3e6b7ab345eb", "value": "768:8CeKEfhe5Xdrben4I1fN5KQnaodgFHx+iPuvWeffpqmUJT6r6Lu380DP:dsfIBZeXl5nKFx+imvppqmUJQ6Lc8e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651258208, "uuid": "65e74a8f-1cc0-47b1-a1ee-5813077119f1", "value": 53052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651258208, "uuid": "25cfe689-21d8-4841-868d-c655df91de60", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258208, "uuid": "8ac08b73-fe19-43e9-890f-89dc7389a1d4", "value": "a5d1ddae9e51cc860e69e036a7479f7d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b84d01b3-c796-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651221069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651221069, "uuid": "f42a6c5a-c699-47cc-8271-a9e38c6628d4", "comment": "Malware payload (RedLineStealer)", "value": "81ae1d3bd0cd4b85e424fcf086823360", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651221069, "uuid": "a66d3b8b-27d2-4829-ab62-da26903c35d1", "comment": "Malware payload (RedLineStealer)", "value": "e32609aa520319c816ccb2d360ea865722d21ff75244e476a7d65d5c408f011d", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651221069, "uuid": "ef755234-8ced-4517-8d59-be123b354378", "comment": "Malware payload (RedLineStealer)", "value": "2ac1f9c28aec1c1a2348be2e79ad0da06dc68767", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651221069, "uuid": "fc0f7bdd-0202-408c-930b-d95b70c96bb3", "comment": "Malware payload (RedLineStealer)", "value": "0b41af6056f9f9f1abba507ec4dfc716eabc964fbe5d0265a6cd9451756dd83607ba010d532dae0ff69ed7c3a40fd437", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651221069, "uuid": "ecece230-ab9a-4afc-ba84-ccb9303f7f2f", "value": "T12784BF10BBA0D03DE1B712F5B9B5C2A8653ABEB15B2451CB22C53BEE1A346E0DD74347", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651221069, "uuid": "37afe42f-02b2-4add-8a07-6c7739953fc6", "value": "afc01618e0df309805fa06d056c565e3", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651221069, "uuid": "fb9342d2-54f8-45af-a363-b4fcef871b58", "value": "12288:6ChqhvlsriS/pfjDHvJ6qTbqW5dVdtKW:6WaSvpLTcqPh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651221069, "uuid": "ac2c26bf-1fdd-4335-b65b-5237432c358c", "value": 402432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651221069, "uuid": "57cebbdf-6fa4-42c3-889f-20565be3c8e4", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651221069, "uuid": "24d83caf-5df0-421e-8af5-692b228e21a5", "value": "81ae1d3bd0cd4b85e424fcf086823360.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fda588c5-c804-11ec-8e58-42010a9c0032", "comment": "Malware payload (RedLineStealer)", "timestamp": 1651268430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268430, "uuid": "9f267c9e-a6cb-422b-a635-0ce973164b3f", "comment": "Malware payload (RedLineStealer)", "value": "cb82c8282ecb5f93ae44dafea0cd74aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268430, "uuid": "b4463be7-90e1-46c5-b912-32be5f70e326", "comment": "Malware payload (RedLineStealer)", "value": "e38c9659025e053cbeaa7deeec4020bd6576de36303cb270d6fb11b2b0f652ce", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268430, "uuid": "eddebfa4-d526-4500-9b3a-1e46512ba9ce", "comment": "Malware payload (RedLineStealer)", "value": "29c04e674c4bdc5eeba5b29847dec5fa882fbdf9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268430, "uuid": "02886521-5cc0-4f93-89ba-f4401f6302a8", "comment": "Malware payload (RedLineStealer)", "value": "e5ac7488f13b823dbcc468836d2cd47c4add1011be80f8643ee7ae279e6ea7ca18df207e042bcb6132a295cc7e887d33", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268430, "uuid": "a083c99b-4f5b-4c9e-904e-3e38a1436464", "value": "T13584CF50B760D03DE17316F4B9B9D3A8653ABDA1AB3491CB22D63ADE5A346D0EC70307", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268430, "uuid": "db0507a2-b746-4894-afaa-1260636460e9", "value": "dd713e86f79f24fed8f0b30a6d67c702", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268430, "uuid": "6ea75654-8f18-49bc-bfad-14b8b8216b38", "value": "6144:CwzvtA7rgwItCQ81A9Mjs6HnZFDW2yZ6vUMK1wr5K6Xb7fwgmblAJHR1l6:CwzC7rgLP81A9Mjf7a3wswUo47Z6R", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651268430, "uuid": "ddad802b-9f86-4165-8176-3da80cb11e89", "value": 401920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651268430, "uuid": "7318d8b7-b6d7-400c-bb0f-11eb11f850b6", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268430, "uuid": "f5cfd2f2-f729-4a25-b55d-27f6a019e138", "value": "cb82c8282ecb5f93ae44dafea0cd74aa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22ad8c08-c7aa-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651229408, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229408, "uuid": "89cdc86b-5b5e-40b9-8c4c-22c5e45631b0", "comment": "Malware payload (Mirai)", "value": "018db318853ae1fa9db732b84fbf281c", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229408, "uuid": "ef5d11d5-9247-4e27-837e-6879b2529acc", "comment": "Malware payload (Mirai)", "value": "e3a9b38e6e508dfb71eebdfdbdf7b3efa5bd6ffc67d92158254341fa13e21176", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229408, "uuid": "bc8aaf7c-baad-4884-ac6b-ec8f79b2fccb", "comment": "Malware payload (Mirai)", "value": "c5591b2370fe739ee93bb36dc7a93f312c94bfbb", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229408, "uuid": "f15c53b7-2d4c-4f05-ba17-f3cda4323cdb", "comment": "Malware payload (Mirai)", "value": "0d14d27fc61e103944848af88e276750913af801dd5f64e176963da2bc3cadb73f265dbf73d0902b6dcee5e7bbd8588f", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229408, "uuid": "e28afd1d-d267-412e-9f96-88833912b4d1", "value": "T1AA2301A1E31EE0C3C63BD8BAC87F4780692E1C5AE1FB701A45DA7558B39188B1B78157", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229408, "uuid": "b5be07b8-6f38-41de-aa42-749c971caa30", "value": "768:65lpPa7beMGLDtWFuCLImiVKb0rmekqlE2UA9q3UELuyTQPvfaYvCinHpF:6JPa7bQ8BWr9+2gLNQPvDvCiJF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651229408, "uuid": "ec779631-b8aa-4af5-8e45-35c8287a67f1", "value": 49000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651229408, "uuid": "593a06c2-4285-4187-ae83-99c1b4bd681b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229408, "uuid": "8bf50ae6-b5a9-4fdc-86f0-7ebbdb6675fe", "value": "sora.arm7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d0fdbc6-c79c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651223412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651223412, "uuid": "10c85ee8-f7b2-49e8-ac40-16498315f2e6", "comment": "Malware payload (Quakbot)", "value": "9d961627266e2e766ede4e5fb64d5e92", "object_relation": "md5", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651223412, "uuid": "f8ded1bc-af22-424a-813c-a7a5145323e7", "comment": "Malware payload (Quakbot)", "value": "e54aa8ec8fd7e12981bbf0a0c54da1a6eac427b86b221979f5efb576d8bc0d32", "object_relation": "sha256", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651223412, "uuid": "f40b281b-feab-47bd-a8ff-502ce0a2f5cf", "comment": "Malware payload (Quakbot)", "value": "652cb243c3880516ec7f507a5c129ec8fa670acc", "object_relation": "sha1", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651223412, "uuid": "dfc9421d-5cc4-4873-a1e0-a3f9adbe0102", "comment": "Malware payload (Quakbot)", "value": "2797af1f3b257341a9a956887dd70b9125088570a41aab9254cb94333eabb42fa4f828dd8ed90dbf0b81a92eb6c02a9f", "object_relation": "sha3-384", "Tag": [ { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651223412, "uuid": "0a8e45e5-3b8f-42d7-9b2a-25ed4a95c0ad", "value": "T16C4512A2C1E144A3E8F46734134485D182BA28AFF83CEC454BD77DFF2E990FA6E91594", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651223412, "uuid": "dcc118f7-e061-47a6-8a2d-ac8068c8dcdf", "value": "24576:aD1PzyzYQW98VdaKPSmDVvIB1PzyzYQW9e1PzyzYQW9972+AQcNq6s9d:aDNz+zfTqmFIBNz+zDNz+z86+AQW1s9d", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651223412, "uuid": "f043fb0d-fd05-4b3e-b154-f8f3686c7999", "value": 1255518, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651223412, "uuid": "ad38fd84-bb5c-4ca0-a2c2-4d2ab0210abe", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651223412, "uuid": "55509506-8635-48fe-8ba5-767971d389c3", "value": "SW_815154313(2).xlsb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16fbc816-c7c8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651242273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651242273, "uuid": "c5947a10-dbad-46ff-8cb8-8dad43cbf50f", "comment": "Malware payload (Formbook)", "value": "e616aff714de3c8543f078ed9963e6b2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651242273, "uuid": "52e6fa2e-a4d8-4266-a058-b75fa362fb1c", "comment": "Malware payload (Formbook)", "value": "e592264af9dc5a315a39141424c35add4f99b7b8268e1d73a2ac8471916d96b8", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651242273, "uuid": "aed216f3-19be-43c6-bb83-ccf2f9fe02ef", "comment": "Malware payload (Formbook)", "value": "e7a7ada4eb0b68921f2b0a321d823516ce33bc0a", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651242273, "uuid": "544ebdc2-94e9-4fb2-9def-5c202364889b", "comment": "Malware payload (Formbook)", "value": "25a7feedf433765d90194e542a07cd50e9987220c2fc97e85c050b982249241ee0095120d8ce82d83c9dfe21e15c2901", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651242273, "uuid": "2aaff055-1ae2-4644-a61f-d4bc9b9c71e1", "value": "T1D213D51A6C96951AC5D47BF858B16193663A7CE10024C18FDCFDBF29ED72223CCC62AD", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651242273, "uuid": "568fbfb0-362c-45bd-965c-861139231cff", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651242273, "uuid": "7cd27d38-37f8-4598-af9b-05a9d5da86e9", "value": "384:uxssp1ffSd2hHTeHPlGDQXulaiAMwCKFH2S3dd0hUADkar8:uxTqexlmMwCK/3deVDi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651242273, "uuid": "b0624f9f-8742-468a-a8cf-002de526da59", "value": 43520, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651242273, "uuid": "5ad901a9-06da-4d5c-bdee-bcdd72abd315", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651242273, "uuid": "f0820f57-055a-464b-8a33-f7a25662b9cc", "value": "AWB-#150322.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38d129bf-c788-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651214842, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214842, "uuid": "d0d33f6f-6d8d-4eb4-9834-c4dec72b42de", "comment": "Malware payload (SnakeKeylogger)", "value": "a566c84840a82c05b7432773e582f70c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214842, "uuid": "007abb90-471b-4b1b-8a3e-c81f83cd3ead", "comment": "Malware payload (SnakeKeylogger)", "value": "e69049c5285da1733ae8f0794036b5e896e3453312c6ad38f1ed52add66731bc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214842, "uuid": "6ff56f6f-8c78-44e9-b048-3b29fe7dfb4d", "comment": "Malware payload (SnakeKeylogger)", "value": "8dd7c48d8bbe9c35b57ff5e7dcf65583f0766da4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214842, "uuid": "f9be344f-c4ae-4166-a5d6-d566fd252005", "comment": "Malware payload (SnakeKeylogger)", "value": "ddf595bc50645e31174758488bb35e5759d0fee38feb3a7230f61d040cc5908ac16aa7cb65de2548514f174f3e5cadbd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214842, "uuid": "580e6900-76e2-40f9-aa3c-390eb5f06400", "value": "T1DAC4E118BBBACB46C3A95B33C0E055501FB1E643A582EB4FA9C522950D0336F6C57B9F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214842, "uuid": "4e3c7c22-5aef-48ba-88ff-05712af00ad1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214842, "uuid": "eabf1cf2-1f81-45cb-bf3f-c8846ccf8a16", "value": "12288:nx52WdYcgNLWJeU1BtBhTuTqcwF8PhPaCvjT2K8Vs8:nghQ11rBhPFOhP7LC1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651214842, "uuid": "d2e06557-4a37-425c-88b7-b0e04554e931", "value": 589312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651214842, "uuid": "642036fb-01c5-471d-9895-76c47c95a154", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214842, "uuid": "627b977f-3d51-4a77-96b7-dc9be43123bd", "value": "a566c84840a82c05b7432773e582f70c.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "369ac430-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651217845, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217845, "uuid": "11ffaf65-69a7-4927-a91c-977891b740e8", "comment": "Malware payload (Loki)", "value": "edc01eaf106ed877af968801fb1a23d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217845, "uuid": "1dbef6d4-f1f1-419b-94e4-8e49120c6c75", "comment": "Malware payload (Loki)", "value": "e6ee6179f1b77b055f0596c6cbcbc34d1d2e81188777059d5bd62bb0e6ed0f4f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217845, "uuid": "a44f6f5e-d73d-410c-a5a7-bd38a4882eec", "comment": "Malware payload (Loki)", "value": "20824e94066523b43ee1b779246d25d690fb4234", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217845, "uuid": "fdb7db72-c2a9-4447-bca5-85221d8e977e", "comment": "Malware payload (Loki)", "value": "ee408686e569e4af3552e205dc836c4d0495ed0919b456aab151875c23b6152deb2d7386e2081646682876c3bf0c6386", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217845, "uuid": "5dbeeb16-a8bd-44d9-bbdd-ed23be4b26bd", "value": "T1BFC302346BA2CCB7E97255722C7AA777AFF96B120134925F13101F4D7D222C2D60D3A5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217845, "uuid": "6c6f9319-5b3c-4d6d-a71f-2141964b411b", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217845, "uuid": "acfae723-21d7-4b11-9711-199bd4f273fc", "value": "3072:l1NjcVVnLpPunb2MXpIAhRjqgSnIGSfiT+wAg07QvpRu:HNeZm2MXpIAhRjqgS42+JgPu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217845, "uuid": "f46bada2-8d66-47a2-a865-561248e850aa", "value": 126529, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217845, "uuid": "34d12790-72f3-453c-bb4a-100cede62480", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217845, "uuid": "e0d96e03-77c0-4641-a620-96710e005f5b", "value": "edc01eaf106ed877af968801fb1a23d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3b1489a-c7b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651234885, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234885, "uuid": "a579dad3-87d5-4723-a5d5-b321273a7d9e", "comment": "Malware payload (Heodo)", "value": "8b88c1108128eef15ad523cdef152895", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234885, "uuid": "57a8fa02-5c45-4244-af1d-449a48737a82", "comment": "Malware payload (Heodo)", "value": "e72513c970113953aa5afd137b556231234ffe3cad785efc37f4af497035ceb3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234885, "uuid": "8c27a740-0ad2-473e-95de-0a9f173f2072", "comment": "Malware payload (Heodo)", "value": "d5baf39c77731519ba91e0a7f5154d4a28bf7903", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234885, "uuid": "a27e7a4b-4ca8-4100-a72b-4eca5b1d2c5a", "comment": "Malware payload (Heodo)", "value": "236c09ea2ca9903d9199285fe9b7011a81878a45903a10f1c93240cb013872aaf370ee11366b3673443aa572b22eb15c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234885, "uuid": "f54af475-de93-4c3a-b29c-aade7582945a", "value": "T1F1C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234885, "uuid": "8bdbd9f5-57ed-425f-bb0b-33c8744567b2", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234885, "uuid": "11a8071a-f048-4d78-850a-19214daf604a", "value": "6144:JhZ02GdOOgPYlKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfKKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651234885, "uuid": "ad016ea5-eea4-4c6a-9fa7-fcfda296787e", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651234885, "uuid": "94247315-38db-47d8-81e7-608535d4a180", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234885, "uuid": "9a94f357-824a-416b-9771-4fdf384e8a68", "value": "8b88c1108128eef15ad523cdef152895", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b71726c0-c75a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651195297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651195297, "uuid": "d7a58585-5451-404a-aec1-7e817f15130e", "comment": "Malware payload (Formbook)", "value": "546e3fdda47c21b7d39fa451f427028c", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651195297, "uuid": "1e5694de-c56c-4b77-9cb3-6e863fa7ef0e", "comment": "Malware payload (Formbook)", "value": "e72cafd11c50d46e2b93507caddbe497d741bd6ebfc9117448cdff20985aa262", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651195297, "uuid": "3d6c4e49-092b-449c-bc6d-bd370c4e0b5a", "comment": "Malware payload (Formbook)", "value": "52f79b6b1a5089cb7e3c131c92f8bcff7a5b50f0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651195297, "uuid": "65b702b3-f73a-421d-9351-b90ef2782b6f", "comment": "Malware payload (Formbook)", "value": "4ca95bb56452bc56c3ba4e779e52dd8448783b7304e8beef6e6e9e4257364a88cffc16d7fe21f6c834a2eb9dfe51bcc3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651195297, "uuid": "d33d2e9a-b2db-4ca4-844e-ab087d6328c9", "value": "T18EB4AEE832819BE3CE66C83B57ED5F9111F012729125F7436F4063F407A3AAF6A65AC1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651195297, "uuid": "4399bcb1-5ae1-4c59-8041-4ecb806f47cb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651195297, "uuid": "866736a7-7cb1-42dc-99e7-ad4f59a91fc5", "value": "12288:xSQTg6P9KkQcihwNN7blpmZS2z4X/JG7t:/t91Q3wNN202sJG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651195297, "uuid": "9d1cdb85-ab58-4ac9-a26d-0d62442e195f", "value": 536064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651195297, "uuid": "b8fcd828-54c3-4ffc-921b-2f2712a73b26", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651195297, "uuid": "708c6873-6678-4558-9b15-8a792742edc0", "value": "Confirmation Transfer Ref_MT103_002345689109920098.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78032686-c790-11ec-8e58-42010a9c0032", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1651218384, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218384, "uuid": "8d91c38f-0672-4bed-b02f-0bc18fb50d0f", "comment": "Malware payload (SnakeKeylogger)", "value": "1810d5330f793e22d81f85e83997033e", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218384, "uuid": "155f8c88-706f-4176-9134-ffc8f9416791", "comment": "Malware payload (SnakeKeylogger)", "value": "e7e6fa2315fdf9ce0c69d3c3963ca7ca78a0824434521d31bdc5cfb8b5f83586", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218384, "uuid": "cdebe6a2-74eb-4e68-8e76-c124c70d50d3", "comment": "Malware payload (SnakeKeylogger)", "value": "eed99f7ce179cd830b10784bef004608d034a559", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218384, "uuid": "41e4cbee-d9db-4558-a3c6-5fdba0bb8dfd", "comment": "Malware payload (SnakeKeylogger)", "value": "b2291e5c29e7424bb209e29ecc766cb915a187cb1d927ca381fcd1e56da0e71cf517e809e6833529d15786f2760cfe64", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218384, "uuid": "9f9750c4-3949-4ec2-bd30-fcab1308ede4", "value": "T1DEB4232F6023CB294507D925ADF6706A1FC158DC84AF6986CEBBB3329A974F4C01B817", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218384, "uuid": "e47e773a-f7e0-4709-9c48-d316cd6b0eb5", "value": "12288:QNnk7o3T1UPXse+5XmPIpVeoIBBZWHgZwFRRjMEQgH0:dET1+DcWPeVeZBjWAZ6bjMEf0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651218384, "uuid": "04cbaaf1-0040-40fc-9915-cbea3c4d7768", "value": 522297, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651218384, "uuid": "cb51cf94-d5ee-46fc-9991-6c1e5ee3f52f", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218384, "uuid": "c051c156-ba6f-4f88-8c45-862efc96aaed", "value": "Product Inquiry.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4546c23e-c761-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651198112, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198112, "uuid": "e38c84e2-a7a5-4a35-9911-29722751ea58", "comment": "Malware payload (Mirai)", "value": "7cee002af6b540d0bb1ee04d72e30afd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198112, "uuid": "9ece533a-3b3f-4542-97bf-ade1c4f6a0d7", "comment": "Malware payload (Mirai)", "value": "e8701124caf01c3805d4247cb606af6e5d34ce2979e11b4666121bffab86d383", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198112, "uuid": "4791df9a-e19a-4ee9-a7c0-82b7508b7603", "comment": "Malware payload (Mirai)", "value": "7bf7a0efdca2ba65051816509c0002222088b5e8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651198112, "uuid": "5cb2ae59-0cf9-4d2c-b4a5-48463718a047", "comment": "Malware payload (Mirai)", "value": "82457be3180589cf8006809d182d63d9c55aff19d36f02cd254b0d375557b3937d897eaa023c91ccd2fc666fd47505d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198112, "uuid": "e86544f3-d71c-4873-9019-d523226d0634", "value": "T17C63A50ABF214FF7DC5FEC3745A91B06259C640A21A97B397E34D828F64A24F19E3861", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198112, "uuid": "4bb66cd3-a27a-4ee3-b595-80206f79f861", "value": "768:pxNCJ0EYlDYhHuf5qsFSqwLX3U6OEAN6PNoUyO05jheleWTeKrmoNDpkdJLXirMu:pxNCJBYl5kqwwcAwP8O0fEfT9rmXLZS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651198112, "uuid": "6fa98de9-2efb-430e-a6b9-869b964cca57", "value": 71528, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651198112, "uuid": "6cc0986c-71a7-403f-8fac-316365bde75e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651198112, "uuid": "8f59b379-d55f-48d0-b4ea-3dc75e18643d", "value": "7cee002af6b540d0bb1ee04d72e30afd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "02781e82-c7e0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651252546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252546, "uuid": "270d1f72-7f86-4ae7-bce5-af59096607ae", "comment": "Malware payload (Heodo)", "value": "6d42dbd4f82d2ec374a83a180c45aa94", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252546, "uuid": "9b9c913f-4c60-4204-8a46-0c49b0d635a8", "comment": "Malware payload (Heodo)", "value": "e911bd8bec0c91d0055ed48069c43dc90c6f41890407dfb934ecbc96479e9b3f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252546, "uuid": "79d59157-bebd-482a-9579-8d5b1131cf84", "comment": "Malware payload (Heodo)", "value": "28f56a6695447df15a7dcb0b0b2d7b70d20013e5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651252546, "uuid": "fdb86d8b-7b61-42ee-9351-b029cbf5bec1", "comment": "Malware payload (Heodo)", "value": "37b444a47bf909268654d1a71d5c8706fd68b6cbf6e81912400e229ba4d2037a52b26ac04953b28f6878c5a01512898a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252546, "uuid": "96fb9d0b-c221-426c-8519-d9bb93e3fe15", "value": "T1B8C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252546, "uuid": "74dbea55-6147-4dcf-9594-504167d88100", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252546, "uuid": "d1c60195-ee65-4fd1-a2cd-05b0ef793cad", "value": "6144:JhZ02GdOOgPY5KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFf2KRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651252546, "uuid": "23567dc0-3b3e-4560-b5e1-976c79de1746", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651252546, "uuid": "4332f00e-782c-462f-958e-e44cb796adaf", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651252546, "uuid": "6fd54fd5-9c09-4dc7-a8d9-ada861d4cd17", "value": "6d42dbd4f82d2ec374a83a180c45aa94", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f26ff74-c7b6-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651234744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234744, "uuid": "142bbec0-f960-4fef-b862-adfbe2793bc3", "comment": "Malware payload (AgentTesla)", "value": "bf03763056f103b3222b850fcc951b9a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234744, "uuid": "391c4cf4-d19b-4d9d-abdb-21017ad73879", "comment": "Malware payload (AgentTesla)", "value": "e99d86ee0af14f5584ba0bc9e1d2a89698743c752f65581891e3c0677db64457", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234744, "uuid": "86abe1e6-f5f1-494f-bd4a-e8ecb8ac7a62", "comment": "Malware payload (AgentTesla)", "value": "e1178d372973c954a1fa9d4c8b70b1d08f56b49b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234744, "uuid": "5ecfb425-6ccc-444e-981a-0118ad735407", "comment": "Malware payload (AgentTesla)", "value": "810b659ba34286a84ed0d2e66e54d95037e94de0163b8f29886ca8ed8b5fc4a404f1897f4b8fb5830c794a1896dc994a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234744, "uuid": "57085724-cdd8-4cdd-bda5-ffc4074d7d78", "value": "T1198423FB253FDE4786DC0C3193A7F511A870E214F9075B5DE8E55202479E29CA8A0ABF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234744, "uuid": "263d7ade-96dd-4e39-a16e-dd6e168537a5", "value": "6144:L1I4cw299WKQ8YczaZkTodGEZZ0hlg1sJ2ZdNkZs4ISz6tH87tKQf:L1I4f2+KQ8YMQknLTcxMnWtH81", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651234744, "uuid": "28ba5c5b-7824-4acf-8194-3af20f92cb24", "value": 396983, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651234744, "uuid": "52a6692d-403d-439f-b805-6a17c9189af7", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234744, "uuid": "2392f3d7-2618-4c3d-884a-42896f8a6b2e", "value": "bank notice.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7af9efa-c7c0-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651239080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239080, "uuid": "0de1c202-b397-4c2e-b866-6f451f4d8413", "comment": "Malware payload (AgentTesla)", "value": "ccc4a7f0a1a90aeed8870e7782acf0ed", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239080, "uuid": "a4331e55-723e-46ba-a9b6-09f1205424b5", "comment": "Malware payload (AgentTesla)", "value": "ea00a47cd62c7a477eb7326fd81215a33e4436af6f0e4d6b8a959478429a2db6", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239080, "uuid": "e9f75ff3-6fb9-454b-b113-77e4e58fb3b2", "comment": "Malware payload (AgentTesla)", "value": "656a9532125a18711154d89eaaa1cbcfee1d3559", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651239080, "uuid": "5ba67929-5a1d-4c94-92b2-3a97de269e30", "comment": "Malware payload (AgentTesla)", "value": "a904f26f220fcf3059b3af950e2c94bbf0b8f87e3009695a4b08e34b22f13c7595b4a4523614008dfb76270d2aa1da16", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239080, "uuid": "7416ff89-075d-46bd-89eb-579eefb4d45e", "value": "T18D740D91E8535838CA244778BA7396B01CF9EC70C907E6716B207EE6F13BA20ED75572", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239080, "uuid": "71f2cc2a-db5f-40be-a6cb-8d6527962a9e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239080, "uuid": "c1c99af7-be5d-477e-aad0-6abfa3237093", "value": "6144:L/XnmtWrnngnnnKnanlywwwBwwA5wwwwswww+wwwGwwwbwwwLwwwwwwwwwnwwwjT:L/WtWrnngnnnKnanxXY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651239080, "uuid": "ac324dd4-0960-4686-b58f-ad129177ce2a", "value": 365056, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651239080, "uuid": "c0b94d86-3089-4939-9522-d8dedb357f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651239080, "uuid": "9e924c4f-1091-4af1-9119-77e62555325b", "value": "SALISBUSRY ITEMS - PO-1128-2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5cc19086-c7a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651229076, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229076, "uuid": "6d516da7-fe05-45f1-857c-4630f768a5e6", "comment": "Malware payload (AgentTesla)", "value": "7276a7f7694ccb44e7c354ad22019b4a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229076, "uuid": "2ae29c0e-7952-407e-871c-97017a459903", "comment": "Malware payload (AgentTesla)", "value": "ea89bda34a1f1eab43d709027fcc5edd6865c3ad7f24c207af91a92a8d421344", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229076, "uuid": "0eddc4c1-bd65-493e-b49c-c053c3fba48b", "comment": "Malware payload (AgentTesla)", "value": "194d6028226801242a5cc142ffee0f231d5bf4cf", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229076, "uuid": "e6daa412-85ed-41e9-bc23-12902ecd75d2", "comment": "Malware payload (AgentTesla)", "value": "f279877de42cd7158661a304ec3ef7ae4797094f7159bf4bea3e885ca937bccbf6054b057e126c89dec4b2326bc77983", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "arj", "colour": "#A79FA5", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229076, "uuid": "57cc8320-85e8-40a4-aeed-101ff9341c07", "value": "T138B4232D69ED7B3981E3B2A49D0E440D944EB9AC8167CD7B49498F38100FDA592E0F7F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229076, "uuid": "a915b30e-4385-4c6e-8398-36d93aad98db", "value": "12288:mCjzTaThpCt/xAEhXQpmddMlowWhIkcf6wrr:NjzTaThpCRuEOpmzMJWmkw6y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651229076, "uuid": "04b43996-b5a7-4524-9951-8a88f25a3b4d", "value": 515607, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651229076, "uuid": "883eb810-2c88-4d9a-a345-287666fec257", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229076, "uuid": "c38d4d50-6dfe-4056-8823-13272876ae34", "value": "Cotizaci\ufffdn_Prysmian Group.pdf.arj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6637d8fc-c7cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651244124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244124, "uuid": "571e243d-657f-4ca5-82b6-cd22f40e30a0", "comment": "Malware payload (Formbook)", "value": "b1573666c4e30baa2fc068eeaafe3901", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244124, "uuid": "1d489109-9a96-46c3-9d28-af9a8efdc47b", "comment": "Malware payload (Formbook)", "value": "eb26b47f9aa3033edbc2d791075f85fcc7894cd7dc3bbaf31974024b9695a52f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244124, "uuid": "4a2a1ba8-b573-41e5-a461-906d127877ad", "comment": "Malware payload (Formbook)", "value": "60fa41f07d88c6315bdb74cd15e35b85c2ab33d3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244124, "uuid": "b1a82df2-8ad2-4631-972c-d4e17d07f31f", "comment": "Malware payload (Formbook)", "value": "79746bf046e8aa0e81ba2ca9b6136d7ee37e480166479610f314800ba86b464ff79d399ae29936c662231ac6fd785223", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244124, "uuid": "ef968e1a-0fec-4e2c-be01-90f4cbf5f03b", "value": "T1A9E4BA2A38BA100DB272AD5C6BBCB175915EF7F226361CBB0DF7050A11129F0DB9D627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244124, "uuid": "b6c982bc-b58d-4b5f-b95c-dec0f2713458", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244124, "uuid": "a259a953-29ba-48fb-ab43-3a5ffe2daba3", "value": "12288:HqiRxnR449Jk8boeVVWKUBmcFrw7HfIwRN71jdmESajnWjsFCk2lS/R:PoOD51jnSiSA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651244124, "uuid": "2d2a3961-dbe7-4a8b-a1e1-7746149ac91a", "value": 675376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651244124, "uuid": "db8cfdfa-1739-4fb8-94d2-211efe529447", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244124, "uuid": "383e3b5c-8fbe-444b-ae14-78f1ee81104a", "value": "b1573666c4e30baa2fc068eeaafe3901", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9f99bd57-c7be-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651238207, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238207, "uuid": "ccac0b68-3b3b-465c-8348-b182641b4d7c", "comment": "Malware payload (Mirai)", "value": "61dcf4f65563b4647b532f7b3426ecde", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238207, "uuid": "2007c460-ac8d-49e4-9c0a-f99f865dede1", "comment": "Malware payload (Mirai)", "value": "ebcc4204cd7d7954ff690b5f7c4e185c9efc2b5992b5fa7dd48a90ce0b657851", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238207, "uuid": "6d0041ec-7173-4377-9e4f-cf2dccb7f6fb", "comment": "Malware payload (Mirai)", "value": "25dfdcafd8c23dfb4c71aadaa829429e44288815", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651238207, "uuid": "d5903cf6-6f3f-4bc3-a3f1-02cb669719b3", "comment": "Malware payload (Mirai)", "value": "ee9e208afad4eaae0b43d67a146c0d72c9264bef46154b3aa2ca1a0da522793f470a62d4376ec0eb26bba35295fa1afe", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238207, "uuid": "0981d793-440c-4ef8-bc9e-39cd6358896d", "value": "T115735B31B9762A27C1D1A43A11F74B10B6E117CE3AE8C61E7E720E5EFF216506503EB9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238207, "uuid": "7e7c93c3-c48a-4437-95ef-05b12e8d3dee", "value": "768:Uoao+BTVXvoaRq9/ZPjrglLgABJ7fZo4lJLRmMLGBZSGizO+DksDQsG:3arBTVXvoaRS/ZPjrgtgg7fOMauusG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651238207, "uuid": "666bbb16-341d-4a1b-b061-229c8f99f77b", "value": 76192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651238207, "uuid": "2b1bab14-0af1-47c7-b871-995adca7510c", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651238207, "uuid": "24206a45-de3c-4e02-8688-d6f9e7f9ce2b", "value": "61dcf4f65563b4647b532f7b3426ecde", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d611eea6-c787-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651214676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214676, "uuid": "6548f4b7-d06c-4909-be4b-49c452ddde88", "comment": "Malware payload (AgentTesla)", "value": "d6751958f8868a65ef9fed6140e47fe9", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214676, "uuid": "80ad1eaf-444f-4392-bacf-72302a147bc3", "comment": "Malware payload (AgentTesla)", "value": "ec001504c4f262b56ed86b8768411e99634c300fd91cb8635a869ba8c25ca601", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214676, "uuid": "67849818-56b2-41b3-a6b3-8f7cec146063", "comment": "Malware payload (AgentTesla)", "value": "0cf6516df27918da1aa01990ce9fc17656b62ce0", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651214676, "uuid": "cca0044c-0ab8-4497-b15f-b36cd0c0d284", "comment": "Malware payload (AgentTesla)", "value": "6c53db5215df7a7597560075d4a01c19c558e484308a9cea67bfc27cafe034d7be85b25edeab5af036bba00cec380d1f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214676, "uuid": "004d8ea1-c591-4dd4-8ebc-1bfc16905767", "value": "T18C9423528E020347FDDC28F153E056A566A60754EF97E318D4E04CFC2E9DBE6DB28C9A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214676, "uuid": "8bd1c108-0506-4e01-b8e9-f412d84320d2", "value": "6144:+GvwHvStGZ4ueS52lfjoc4iDkHsVoYvP1xrbEy0ts3kn31ut5mjhqHYSz5m0hxN:+swPSF+Y7+NeomP/HEzwudgD5fhxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651214676, "uuid": "0f28ce2f-1737-48c5-947d-cfb9d5a2125a", "value": 413372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651214676, "uuid": "dce78a73-4941-4a3f-97de-0b9486ebeb04", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651214676, "uuid": "d741c002-79db-46bc-bab8-923fdd43955e", "value": "SHIPPING ADVICE#ASEAN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "92a95f8a-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651217999, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217999, "uuid": "b1492a78-a3ea-464b-8636-99b082a1a70f", "comment": "Malware payload (Heodo)", "value": "46ab18e07a0be9cc466a404aa053d4c4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217999, "uuid": "91998fcd-15f7-494f-8e56-3b9acc57e099", "comment": "Malware payload (Heodo)", "value": "ec60d9fa1c9e687a9a3da38d27b100464a2e7d05272a0aa56129e20939a9c885", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217999, "uuid": "986f76b4-c071-4a32-9e0c-29cfd724a5e2", "comment": "Malware payload (Heodo)", "value": "bcb5eddc3cddc65e0c25c94a7ed05094b3ecce0a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217999, "uuid": "2ca31893-9134-4a64-a30e-2a543216e6a8", "comment": "Malware payload (Heodo)", "value": "2cedd4fdae10c1cf1ea899f22a21cadcf0ed501262c5b82cbb3a163cfd74a259b730a9d1b322a91ff7d9d3a67be96e5a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217999, "uuid": "6abfeeca-7486-4589-8739-2baf0e2a541e", "value": "T195F4AE1231A3C075DEAF11744A566FA9A6F9FA146B708DD3A770CB3CC9309C68B36217", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217999, "uuid": "0bb4ab46-9037-4aea-b844-2dacf3677d3b", "value": "078cf8e17700d87242408b8588acd2dc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217999, "uuid": "322836da-45d0-4b03-b702-2354e4a05d87", "value": "12288:y7pLgbqIjZbwqHUM6AyIrYj2azO8BOg1s3F2r/:y7ssqeqYtzbO53F2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217999, "uuid": "fd29fbc5-bc6f-4307-8216-7aef4f058615", "value": 786432, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217999, "uuid": "657c3a40-5e78-4bd2-a780-07fc4ae25742", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217999, "uuid": "56887b90-6b15-47a0-9749-578dd87d4e6e", "value": "emotet_exe_e5_7976324d8507b09cf54549d7ccd15415d9b84d90bdef80287c6027bcd92d0031_2022-04-29__073952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5bcfaef4-c78c-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651216619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216619, "uuid": "01e205e9-ca5d-4838-af34-167a6b0d914a", "comment": "Malware payload (AgentTesla)", "value": "7fd8c999f2ca0dd90629ecd8de7c798b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216619, "uuid": "587460af-b244-4116-8ef6-96904d5cf276", "comment": "Malware payload (AgentTesla)", "value": "ec97548e395764b4c1f96a4c6eaa9b063dec7da0bca5960ec63e528f24f1765f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216619, "uuid": "8c719cbb-805b-4bdc-9f2f-9cdfd4a04b20", "comment": "Malware payload (AgentTesla)", "value": "2267a4243b00b0449eca288abfe2af10740e7c97", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651216619, "uuid": "d0138f0d-f770-4d16-bccd-392071cd90ce", "comment": "Malware payload (AgentTesla)", "value": "709101114d73990a5935625d51071cb84260857969b00eb6714b834000adc9b1da118f796b24b3a2a2cbb68459293a52", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216619, "uuid": "09006f6c-4d2e-47ee-a260-177283ac3517", "value": "T180051282B55897F9E97A0FF77E87910E9B432CF5A505CA4AAAD3F1420974B311C702B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216619, "uuid": "4a18cf77-7c10-4c6e-b211-22e2ee19ec70", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216619, "uuid": "495a9dff-1e85-4863-956b-674da8ab807b", "value": "24576:QQ5Vd5Ux8o/MDOmdvVXFo7/wgY/syc5ITe2Bn2J6:r5Vd5Jo/Mz9Xa7s/sjCK2Bn0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651216619, "uuid": "c186ca0a-39d4-48d9-91a7-860573cfe692", "value": 865792, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651216619, "uuid": "6e881a4a-8372-4f03-b614-a105532dab59", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651216619, "uuid": "014e80a6-bf00-4be0-bea0-d4cdff8ef5bd", "value": "5550004_-001004020220428.PDF.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "833bb867-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651232576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232576, "uuid": "a501e7e4-086d-41fc-b82e-2a347f427104", "comment": "Malware payload (Mirai)", "value": "5e0216df23325556c9c8bccff14f3536", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232576, "uuid": "7b6fcf2a-a4cb-4c83-91f5-ea519a14c702", "comment": "Malware payload (Mirai)", "value": "eceb6d42a6aaca7c87128bc6216371087f3a127d202dc1663f17341be7808c51", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232576, "uuid": "656e0cfe-fc42-4789-b3e6-712c96bdae2e", "comment": "Malware payload (Mirai)", "value": "2224eeb945cf6cabeb26f25dd10367906a809e6c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232576, "uuid": "369ca50a-07ec-4a00-96b1-452bb0d678b8", "comment": "Malware payload (Mirai)", "value": "39443e0df63adbad04ce554f6152dc12d300f01a9bac602855b42ec52952735942d95aa12f3eda1c8cf17ebad43364f4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232576, "uuid": "5a29e188-1a25-499b-bcef-7d6f9c2b9e69", "value": "T17ED2E018B26056E2EBB51C76EEA1824DE40F4FB470DF31116AA0A774CED262E5B358C3", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232576, "uuid": "d6eb1d70-d080-4d32-8fd8-47a792fa123d", "value": "768:Fh9XbjWynxFgIBvypZZ4VNmozzwr3o/4yUBaNP6PwFO9q3UELln:FbuyPBnEoc2Sa164FzL5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232576, "uuid": "4965b9fe-53ec-43ec-9cb0-3707e578224a", "value": 29468, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232576, "uuid": "d16002ce-e252-4ef8-8e14-79b8390094b8", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232576, "uuid": "fe096d25-dc59-47ac-8b22-f76a8444550b", "value": "5e0216df23325556c9c8bccff14f3536", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0c72cde9-c7ac-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1651230229, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230229, "uuid": "3a21353c-a6dc-46f6-8ac8-5b81e8d4f2ff", "comment": "Malware payload (SilentBuilder)", "value": "292792e499a3c7a53a251b412fc436e8", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230229, "uuid": "e4da7f4b-d9b6-4d8f-9573-69fba275c3ce", "comment": "Malware payload (SilentBuilder)", "value": "ed0f091de6dbe943f51a656266e87530e51fefbe8d0145e04d6888dd9d57522c", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230229, "uuid": "0516ff4d-5330-4739-8bc7-b57d43dbf66c", "comment": "Malware payload (SilentBuilder)", "value": "1993bd97d6f3708c480ec6ae5cc097179e76ad13", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651230229, "uuid": "3485e590-b438-4d80-8c36-97661659e999", "comment": "Malware payload (SilentBuilder)", "value": "eab7881fa38ab3f2542501ece0d10f33f0e5dbf147d77547d8b2ededa7a4f1c1fa8246d82d9131354d8b0c1749b6613e", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230229, "uuid": "1bf39f32-282a-4831-b835-22f20db43766", "value": "T1FB633B47B589B46AE916CB3D4C974F95B613EC104B960B83BB09B3597FBE9B04E0310B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230229, "uuid": "4cdc7311-83bc-491f-91c6-d62cb55065eb", "value": "1536:5+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgZYW/ESKQHS1yXJFaGqEkc:kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dgd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651230229, "uuid": "2a6b6fb7-591c-4a13-b7de-3223a5ae9c3f", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651230229, "uuid": "4e263b0e-9003-433f-bf86-319078a5eae3", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651230229, "uuid": "82283cd6-5693-4754-baf9-8a0478c791ec", "value": "Details 2022.29.04_1243.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3fcbef3-c800-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651266696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266696, "uuid": "d20ea656-ced9-4a85-b6ff-afbbaaeec9c7", "comment": "Malware payload (Mirai)", "value": "4295164018af9f98d2d9c9b4627762e6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266696, "uuid": "f6a4ccbb-8a6f-45fc-a0bf-4a07f381b4e9", "comment": "Malware payload (Mirai)", "value": "ed76cef8d14ca6b609e7f4127f9b7c249b922ed1bb1080b0bf58c732b77a4ab2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266696, "uuid": "32caabca-bb0c-4657-996b-2f1fd2e8df1f", "comment": "Malware payload (Mirai)", "value": "5f960e5f6f218a053f9cfd0389a46b35d8b381a5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266696, "uuid": "8610d59d-dfd1-4827-a2c4-46cc3f315bbc", "comment": "Malware payload (Mirai)", "value": "39996408dff38679a1c287c3153fd01a96ca06c7de316455e78fff98b6e2b216fc5471d3b2b923d6fa79112675dcc317", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266696, "uuid": "1d4f4143-4f22-4faf-8187-797bb3adfdec", "value": "T1E4333A4332280A07F5A65EF0BD3F0BF083BEE99125E1B184654F9B564235E73198AF9D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266696, "uuid": "8ec454bf-311a-4472-94d1-a8c4de06ad51", "value": "768:ffQOM1vLx13THWDKlRE4hs3fU+1z3YDnBm6g94zHdsYVyKlRfWXXfiSXAmOz:mZLx13THMqfpT9mDWkGRuXqs1Oz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651266696, "uuid": "9d2d9240-065f-4dfa-bdf5-2f3b26120e2c", "value": 53164, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651266696, "uuid": "d3246a95-ccc8-42d2-b26a-c1876643822a", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266696, "uuid": "88ceb840-5471-47d6-911e-fff4f94feab7", "value": "4295164018af9f98d2d9c9b4627762e6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "456156c8-c79f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1651224741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224741, "uuid": "91f3a524-e58c-4fd1-abfe-13a3da45064a", "comment": "Malware payload (AveMariaRAT)", "value": "41f0350d1477f5f00874e7f3181e9e5f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224741, "uuid": "338a5651-6b2e-454b-8697-44d9eba75f99", "comment": "Malware payload (AveMariaRAT)", "value": "ed9d9893db1983b87bf603c49c44bb7ddc81ffaaa9acd8cea57881563a37410a", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224741, "uuid": "244cec3e-1f1a-43ce-b968-28281bb550e3", "comment": "Malware payload (AveMariaRAT)", "value": "615d38a4a2747ee85acff4af4154a4ec9225df82", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651224741, "uuid": "22dee3da-2c78-4dae-9ad7-3a315becfbdd", "comment": "Malware payload (AveMariaRAT)", "value": "c8ff5bfcff1a5a7cba5ea565e7a4068729ec3efb680bf00aa9890ce45c0c838e323a8caf4bfa26423da49fb3f39ccdbf", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224741, "uuid": "3a70d7df-a506-42b9-83de-cdb3b2fbffb2", "value": "T18D32D04EEC6D144DB04BA2D6A125ABB8BD6DC16E11D27CF611A2407B056A74C536632C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224741, "uuid": "c9b680b5-067f-4480-8fb7-aacbf93e410f", "value": "192:sFDGWMmYUirig3WEsD6LMp3TolvO2SkjL+2ByYncR++tT3gt3T6CZLS20k6K02vh:stImtEsNDoxO2Skm2ByYncR++tTwt3hd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651224741, "uuid": "1a43cf89-6c22-4c18-97e5-0e6e7bfc5941", "value": 11879, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651224741, "uuid": "2d0ba948-f04d-4e41-8620-176a4c36f411", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651224741, "uuid": "c198acc6-9d35-408b-bde7-45bf8206d428", "value": "IMG2_33218895.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6198b6de-c7cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651244116, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244116, "uuid": "6db9d4f1-83f3-40cd-9c04-5ecfe08611ed", "comment": "Malware payload (Formbook)", "value": "ebcf72ef907fa0a9ffe786476d37cc35", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244116, "uuid": "6e094bfc-667d-4cad-8c67-41c7316636e3", "comment": "Malware payload (Formbook)", "value": "edadbe7cf0557fdede01500da1d161ceeac3fadd16760f325da7938d25cf2b6e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244116, "uuid": "7047280f-5ede-4d34-98c6-3741eb7df3bd", "comment": "Malware payload (Formbook)", "value": "004dff609707bc3f3c5775d9ba84b08a68d3ba89", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244116, "uuid": "35ee53ae-d107-4f1c-a128-e483e1ff190c", "comment": "Malware payload (Formbook)", "value": "2af160da65af7a835f7b13c3181576a538f59c76895d61086cdaac6e9b9f78bdd2b4389ca30418ed361b4c64bcf4467b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244116, "uuid": "1cd20a99-cd69-4214-ae6f-9ac37837d042", "value": "T16BB4F019B2BBDD02C3AD4BB2C0C79D040332A746E113E79FB7E962A559933EB0942757", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244116, "uuid": "22557307-fb88-4db8-a8b8-297014ee0fd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244116, "uuid": "5e28cbe7-b3f6-43d2-aab7-5a310c91250f", "value": "12288:q9ZW5Pk2HpqOjP1kTMPDzGjkcvjH/a0KfGsCq/v1mH7OnI/:3JB9kUnIH/a5CqX1E6nI/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651244116, "uuid": "40da626b-e7f7-4f7c-b0c6-8b60f7d66d31", "value": 518656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651244116, "uuid": "0b8d33ce-5061-4bb2-8e58-2fbcc5ce21ea", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244116, "uuid": "25c339e5-f8d9-417e-af99-d292d859426f", "value": "ebcf72ef907fa0a9ffe786476d37cc35", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe0ac744-c802-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651267571, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267571, "uuid": "559a8428-389c-435a-9272-c01e99a9f520", "comment": "Malware payload (Mirai)", "value": "0d635d066da4a2adddd75aae8be593e3", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267571, "uuid": "3a6297c4-5d28-46a1-82ad-d00cb56576a3", "comment": "Malware payload (Mirai)", "value": "ee474564e663f9fffc27bc55925bb636622b18f5fb0a30db373f531a578df1d2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267571, "uuid": "dc759c50-c34d-40b4-9a34-abc5de9f3500", "comment": "Malware payload (Mirai)", "value": "72f63effc65c1880048890a1aaf94a7e5faaecf8", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651267571, "uuid": "a5149ee3-7163-4b2b-b162-41a0003605a3", "comment": "Malware payload (Mirai)", "value": "d493f5aa6f5e42245013ba3ee9840486708e02e0ccc0a25c89e5a8db4e410102cea34e64d7246c3bc359371f9ae7cbed", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267571, "uuid": "72c8ff98-44f2-405d-bf71-5eac37fc3a29", "value": "T167E2E1B1633DD9E0CD612437CC660C031619EEF952FAB0962E68CF1D36E54C965FAA83", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267571, "uuid": "e17f2761-1550-41f6-a30b-9ed37ed1ada5", "value": "768:R/2iW4P+Ej1jMPcmaK5X43WJdY2wB9q3UELDp:pS4WES7w3WJdYgLl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651267571, "uuid": "faaac97c-919e-48f9-a18d-8fd5516a4213", "value": 31952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651267571, "uuid": "09c35502-b346-41a0-a0d2-2dcd1519bed1", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651267571, "uuid": "2b4cd07b-7f86-47b4-a75e-7df590ebf6d2", "value": "0d635d066da4a2adddd75aae8be593e3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00b9b670-c79b-11ec-8e58-42010a9c0032", "comment": "Malware payload (DBatLoader)", "timestamp": 1651222908, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222908, "uuid": "ed615913-128b-43e2-b868-dc607d1065c0", "comment": "Malware payload (DBatLoader)", "value": "6097b769d09e204449f6078876f9b17e", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222908, "uuid": "c314ee89-307d-4e34-99df-d3c5546c6ee1", "comment": "Malware payload (DBatLoader)", "value": "ef01d3891c05f7aa29a855eebbe64ec94b5f81f44f891de1f3b4fecdbf0b836d", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222908, "uuid": "29b291ab-fc5c-4813-a3dc-359176c3a94d", "comment": "Malware payload (DBatLoader)", "value": "f3066337e30d200ba4081b356003a604efeaf4e7", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222908, "uuid": "22df52bd-0791-43cc-a500-5fd4c4544f93", "comment": "Malware payload (DBatLoader)", "value": "8b0c68bc459378192a6c8b4dca458203d82d4dab5df9fbd06769c030afdf2be1168c7242f08d9026d7c10ea0004d5d7f", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222908, "uuid": "a33d9efc-fccc-475a-be20-1ef68897bb10", "value": "T105053831A1F158F2E0A25E768D26A258FEA7BD407D24DD0ED6B03CD85A37780E4191FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222908, "uuid": "3bc3ad63-044b-4350-89c3-16dbd16690e5", "value": "8c0d6281ae935c82cbbaedd26def6d10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222908, "uuid": "db5d6b74-8023-4b35-98f4-92ff3ad45c5b", "value": "12288:bjc7mWfpt1qlm1F9ptIa2ccGmYhMQaRqgiibggGPX:bmdflqoFaaTlMls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651222908, "uuid": "2cc31c53-28be-479d-8f7e-be43f00d2f55", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651222908, "uuid": "b7712666-f03c-4f2c-a4e0-b0acc31a27a0", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222908, "uuid": "0278ffce-fbe4-4960-bced-43aeb1ec6bfa", "value": "Megrendeles visszaigazolasa.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6d1a13d7-c790-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651218366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218366, "uuid": "feebcc78-0f13-4076-89d6-d2861f74f82d", "comment": "Malware payload (Heodo)", "value": "06496a80459ea442202cee93f7b9ffe4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218366, "uuid": "05e22f79-4fd2-438b-8359-f15ae27e11f9", "comment": "Malware payload (Heodo)", "value": "eff3a298ab9c69b64c6a509471a73c2d89775d119c1cdc4c6f36cb1843a3f905", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218366, "uuid": "c1a2154b-ae10-44a4-8885-75b377d53ea1", "comment": "Malware payload (Heodo)", "value": "e2f19c72c44eceff4c6b9e58914daac91ba3232d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218366, "uuid": "e1a445db-73e2-4711-9ac1-8ea2bac0ddc1", "comment": "Malware payload (Heodo)", "value": "db95ddc12139ca8957ab72fa548be3074b03d16412c534b7faafecf0ca92cee9f26b23b13cfdb48dec47259a6f675da9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218366, "uuid": "8b14b772-1be9-448e-b6fd-735a56236483", "value": "T158C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218366, "uuid": "55747743-cd63-4d3a-ac14-6789d97cfb0d", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218366, "uuid": "6dacf5d4-fffc-4a6e-a3e2-ad9dad4fa159", "value": "6144:JhZ02GdOOgPYkKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfvKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651218366, "uuid": "f41eb4a8-6fff-4f25-9ff8-7b9a7f20b7a8", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651218366, "uuid": "ce35ecdc-b028-4e20-ac5c-f59c6d964541", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218366, "uuid": "b7b3e683-f1d3-48c0-9fa3-c89afb5901e2", "value": "yvdn1nVUquDZwirINzxXfd.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75cb05c7-c7b1-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651232554, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232554, "uuid": "b9c2f4dc-05fb-45d1-aa9a-2d92e1ac982a", "comment": "Malware payload (Mirai)", "value": "1c83ba47edfeb37d6f38b5bd9e53864e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232554, "uuid": "7d4c5ffa-84b3-473a-adff-1d0da1c6ae8f", "comment": "Malware payload (Mirai)", "value": "f03c98fabbb2fda491c9e398ad9cde1c8e8770e40d9b6bba6406d4c27152d802", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232554, "uuid": "4963b8ba-7f87-44d4-84d6-d769b6bf3912", "comment": "Malware payload (Mirai)", "value": "a61b3561b7f120920fdf56a8499d9c6b15ff3985", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651232554, "uuid": "9dbc543f-eaa8-41b9-89d3-341251f23fbb", "comment": "Malware payload (Mirai)", "value": "935bb10ca342fd9926780071104c5a1e297815329e8e7c5bf8de86f0a6c9a1c080ff09b675885944731e5b618fc6aa15", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232554, "uuid": "a1a7c1b2-190d-4291-8558-761b9a08e1e9", "value": "T1F492D0514299A872E4B004399FA9DD03635A43FCB1E6316139640F74FF1692AFEBD0CE", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232554, "uuid": "32aa527a-fd00-4e29-9361-e55f0a58c33f", "value": "384:53bJx4urkhTMifTUS0UF/H4gxfu/Kb2Os6DfCpZXOAhymdGUop5hu7O:J4ueIyF/Rb2Os6DIoAs3UozM7O", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651232554, "uuid": "a77a2114-7b34-4ca2-beaa-d04ed13b63ef", "value": 21032, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651232554, "uuid": "7aa04d7b-92f3-4076-82c1-21edb2e29578", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651232554, "uuid": "bf8b5ca5-b8d4-4e07-a019-798f1f1d9931", "value": "1c83ba47edfeb37d6f38b5bd9e53864e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efa48882-c800-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651266688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266688, "uuid": "1695767a-7e80-4a82-8cc0-93107cd2b16e", "comment": "Malware payload (Mirai)", "value": "4c25f72cd3119a90386237d55b13e61a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266688, "uuid": "91f2c079-9821-4838-84c6-7d137dc6ac94", "comment": "Malware payload (Mirai)", "value": "f0c9a17289f1fbad9fbba89c7ab76899ab6ca8dd509086899330d06de300e90f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266688, "uuid": "54be7723-fe0f-49d2-be77-4537699f24cb", "comment": "Malware payload (Mirai)", "value": "0bdf384095c7bd45799bbf21d1bfb5ab439ded4e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266688, "uuid": "7b15fcf1-3a93-45af-937d-4688e9d0fa34", "comment": "Malware payload (Mirai)", "value": "e2f12f2c9cf37f474b545f8e4ad62d0b5ec9de82b67f42117952e6b0027dfffb0207b51d9afdda14715604a63d4aa22b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266688, "uuid": "96430309-f3cb-4bc4-acbe-9a855883e2ab", "value": "T117C2D191DA06CFE3F7DEE9204A63D7C263910A5F3D239D94A4D6DB160433A199D01DC8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266688, "uuid": "e1cc6c25-9f22-4081-8a6b-07fd0e732e32", "value": "768:rYz60p0/ToXsPBOapk4jlwI3WvrRUJ5MM4uVcqgw09e:rf0M0sZO5EWKJ5z4u+qgw09e", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651266688, "uuid": "2666ba87-e142-4bb9-b8a6-9b32a18ba009", "value": 26252, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651266688, "uuid": "d0187683-4873-47b4-9a39-0765b2e40941", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266688, "uuid": "43c1c303-543e-4b7f-a954-42dfdb0ce216", "value": "4c25f72cd3119a90386237d55b13e61a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4e2c197-c795-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651220714, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220714, "uuid": "a885cd8f-8a43-41f8-8f22-4817bacb5e31", "comment": "Malware payload (AgentTesla)", "value": "05d9ae7c7b9d06836071928c8878deb7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220714, "uuid": "f87318ae-527f-48d3-8fef-b395d2537d6c", "comment": "Malware payload (AgentTesla)", "value": "f1bcf46c43fe56fa52c42c92468b4a4f21510e035a07ea2c2d0fc9e0259dc35a", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220714, "uuid": "9c74fbbc-afd5-48da-98af-0358bd04a477", "comment": "Malware payload (AgentTesla)", "value": "fc6b8eee4e2f23666c166b30c69b8550b34441fa", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651220714, "uuid": "62bc3437-d048-4ef7-8254-c259652b326c", "comment": "Malware payload (AgentTesla)", "value": "1c3e7548cc2e13dd708ace3f4b31b60cfd7d3a20864a663239a4581ab5f6ea27c541519f9217dcc54d4a1cffb05f296e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220714, "uuid": "65558c53-3745-4a72-bc7a-507a67ac0344", "value": "T1F9C4F114B7ABC912C29D4B37C1D798080730ABC5D112EB8F3BD5979D6A2339B0E46B97", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220714, "uuid": "fa4e77bd-0bed-4259-8aa6-06012d17d70e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220714, "uuid": "cc663c18-7519-42d3-97d7-ac89f34276db", "value": "12288:1QKdCHNQh5KmHKCcCzq+r5cWuQJzb2mEMh1hAI0bC:1QKdCPsKh+tTz2mEMzhN0b", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651220714, "uuid": "c4715c80-d4a5-4488-a582-cb07bcc70f75", "value": 579584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651220714, "uuid": "2f21c1af-1ab4-4367-99a7-b5b5b2fe725e", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651220714, "uuid": "8adeabb6-727b-4aba-a123-82f6c457ca47", "value": "2022 QUOTE-RFQ-22-03794.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "635e87cd-c790-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651218349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218349, "uuid": "5430db61-f168-4af3-b441-ffc9c46590a7", "comment": "Malware payload (Heodo)", "value": "bbbd7ae4321d86f9ed8d56feadc2aa1a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218349, "uuid": "032e1d77-388a-45e9-81a7-1eb255404c07", "comment": "Malware payload (Heodo)", "value": "f250ff049bc4c2a817543c514bd3d2fce75bee1e41a9dd7af8e7e8d1e9a3a624", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218349, "uuid": "c1055183-82c6-4e14-a213-2d0db5e6ac12", "comment": "Malware payload (Heodo)", "value": "9b3e12ddc9892d64d76284f5d51c30579f251fb9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218349, "uuid": "a6b0bb15-b73c-4bfc-8d1a-ab444deea75f", "comment": "Malware payload (Heodo)", "value": "de6c38da7c84415e65e38c281340762c0b244283bd411a2b004a0ea0e96d3b241766447919ef37c11624dffb3b0f89dc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218349, "uuid": "ecb71a6d-1015-49b7-8058-663cf53d8325", "value": "T173C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218349, "uuid": "1086f4da-1790-4535-a68b-44dc466da9b9", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218349, "uuid": "917afaa7-8b6d-4f69-87bd-f572fe7e3715", "value": "6144:JhZ02GdOOgPYeKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFf1KRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651218349, "uuid": "89edf83f-e3c6-4bcd-b7c4-36019670d99d", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651218349, "uuid": "b46b4a11-f000-4eb9-b9de-92cefe659f3d", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218349, "uuid": "99579503-0da7-4903-9d85-84ce01f4c21d", "value": "Fxx0Daq0zRZfvpur3rAAXlO.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcdd7a3e-c7bb-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651236968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236968, "uuid": "06df7dbf-74f7-47a5-8cb3-dbe669079353", "comment": "Malware payload (Heodo)", "value": "34839b281f5bb762d4969e5f821b7e54", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236968, "uuid": "3ed55574-9af7-45a6-9640-a3cc314328ee", "comment": "Malware payload (Heodo)", "value": "f262e8fcc599706ec5e7b169ff32e5246336322d21b21092847f8eb6cfdbb9a0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236968, "uuid": "bf7bce76-5467-44e3-b7c6-d3f3af3eaf76", "comment": "Malware payload (Heodo)", "value": "d6bb77bc6c3469ddb01b408621d17087fc9a8fa6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236968, "uuid": "ff6a76fa-201a-41e9-945c-952eec0d755c", "comment": "Malware payload (Heodo)", "value": "601cbc525e06cd28b0fc869b9eda57c14f043ad0a7a7a33aa5d868746b6a3852eca9a434313ab974729c43bf3fd8aa71", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236968, "uuid": "dd586bb7-68fa-4749-821f-51ef3a75d68b", "value": "T1FFD41950735AE1B7D0429CB58D1A82B5A90F6CA14A2471F3BBDE371DEB789B017213CB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236968, "uuid": "df4c69e7-2dbf-4481-88c2-792969ca445d", "value": "463401f61c44b0d918f1e23374db995b", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236968, "uuid": "054a807f-3772-4a77-a099-9b9df8e92aa8", "value": "12288:DjN/Z2wkRrA9CRDCWElAjHDsndSyHOrNvEP0Oua:dEHR+CR2yfsMyHOpJL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651236968, "uuid": "82e9a663-b9c4-4ffd-9c58-2cb60ad9876a", "value": 613888, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651236968, "uuid": "d2c5798e-e2d4-4143-b6bd-8ed2df623b84", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236968, "uuid": "4d397bcd-519b-465d-996c-80f8f4d661f3", "value": "emotet_exe_e4_288f385a194968db6539d4d91130d24cc8799522339d7b1fc9bc05fcbc1bdcaa_2022-04-29__125600.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad8a3fc0-c7a9-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651229211, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229211, "uuid": "8952ff1c-ce60-479c-8190-5022633b1dca", "comment": "Malware payload (AgentTesla)", "value": "1097642517543d99afb22fcfe7a9182f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229211, "uuid": "200e3b71-a098-45ed-b3c8-5ce73c1927a4", "comment": "Malware payload (AgentTesla)", "value": "f387d398a9cf08d318502dbf3ab12bd27c9ce30b7632948f369d32ceb4166863", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229211, "uuid": "b8e0b2db-410e-4d7a-b74b-b41c53a1079e", "comment": "Malware payload (AgentTesla)", "value": "3d3df5f96972e3e8123185abe2a7bd91939b6456", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651229211, "uuid": "47deda65-1966-42bd-bf69-3dfd45c67783", "comment": "Malware payload (AgentTesla)", "value": "2ed86615f1a37b56ebd06268d1a2aa1b65a98e51ade3eecb704e2fd48ec3012d2fccc6ed30df066e920a6ee30045edc7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "payment", "colour": "#E8DAD3", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229211, "uuid": "bf12b215-4493-47ac-988c-678f881ad21f", "value": "T1B1C408E8315876DFCC27C5328A9A5D74A7922476431BF323925337FA6A0E85BDE130E1", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229211, "uuid": "ca5cec47-e07b-49ba-8dcb-eddc59503fd1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229211, "uuid": "d8130c27-8432-43a3-9a93-1793d4e3725e", "value": "12288:tEbNK4XaNkUpqZFXuEpUpLpfJMPThG7tsuoW717vxgCE/zSAcc4eTQsXvw:tEZFa/mFYaPThG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651229211, "uuid": "da9f7f2a-0ca6-4dd2-a33b-56c0c26bb733", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651229211, "uuid": "333980ac-c01d-4cc4-ac99-4c0e7c2c6c89", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651229211, "uuid": "0e5adef7-8ea9-4964-a4ba-d0f5bd792a51", "value": "SWIFT COPY.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a4d9b060-c757-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1651193978, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193978, "uuid": "251e4bd4-1d90-4557-8667-aed451dfc687", "comment": "Malware payload (NanoCore)", "value": "4bfff22fc777b71952de017ed61705c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193978, "uuid": "0058a510-52e9-463c-9548-cd6bc9d3cd59", "comment": "Malware payload (NanoCore)", "value": "f3b01f92fd6445cf6aac18d7a43be297d55c7531a2d0a3309c7bd9131c3b1aad", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193978, "uuid": "0d9630ad-e276-45df-9f7e-7bbe3040b9f0", "comment": "Malware payload (NanoCore)", "value": "607b7d1e49a8d5daafb133874af4095ee725c7e5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651193978, "uuid": "98634a40-207c-4f6c-9461-96a72575368c", "comment": "Malware payload (NanoCore)", "value": "7f4f4fb4945abc1cc1ec9fceb907e97effd317dd8f1ff214ca8fc371df78c6f81238ad14e39663a9a29372a3790a6a73", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193978, "uuid": "f6563632-ff74-430f-9e47-735375b91d77", "value": "T14DC4124C97AD9F03EA2FC7F86834625483B53A667413EFDB8CC520D50E39BA14990E27", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193978, "uuid": "fe2236eb-1886-4376-b0fa-0f58ed125646", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193978, "uuid": "1bf36599-6982-483a-b5f5-3a3998b01245", "value": "12288:OLWJelxHJ67gy/OjDIdFIPnBWnieNM9Bw5A8DWnhK:KQ6dJ6DGRPMieNM9BtrhK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651193978, "uuid": "e3fd5498-dd12-4fb9-81a6-4910d3c09eb9", "value": 585728, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651193978, "uuid": "a7ee0f79-20eb-4187-81ab-bced35d7d439", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651193978, "uuid": "cad222ba-b7cd-4b61-855d-2a48355aaa9f", "value": "Letter of Authorisation.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d6496ba-c7cc-11ec-8e58-42010a9c0032", "comment": "Malware payload (NanoCore)", "timestamp": 1651244029, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244029, "uuid": "b016452c-71b5-4d4c-9aef-d77afbd6b56f", "comment": "Malware payload (NanoCore)", "value": "0e1292646d26b3a02767d2de34aaacc7", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244029, "uuid": "79ef829f-a6b6-455c-af14-766f90abf19b", "comment": "Malware payload (NanoCore)", "value": "f43ebb03f83354ff4fdbeb1e19fa6a4ac5081e23d7d2f8c0f7eb844e710f65e7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244029, "uuid": "71f67323-9273-4b0b-a912-2c8fe89b7d29", "comment": "Malware payload (NanoCore)", "value": "fd5c28920eb0467efe2653e937f5c52519c0d1dd", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651244029, "uuid": "e37b8baf-6374-4eb7-ae2e-6c10942097fd", "comment": "Malware payload (NanoCore)", "value": "9e643eb8b3a63a67c6d35a59b0028f3580d762f5be674699b8ed03c5a90a7478625b9fcf0c089839612b600218556cd9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244029, "uuid": "c709da91-1678-4c67-a2f1-8aa79cf3a57f", "value": "T184E4399A3A0C75CED81A89368954EC74B610ECA65F0BDE0350E33D9BF93D686CE145F2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244029, "uuid": "ed1e0a9e-39df-4644-ad54-c654c4aacfaa", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244029, "uuid": "3bba8b40-4bef-4e13-badb-7a15fb924049", "value": "12288:uovLJ4KCFEKRoujoz/2C1hmyvQjhZj2n8Ioc+sfsp8KwIxTlcDmh/0pnAqbSaZ:ud98D2GdvIhZjq8Iops", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651244029, "uuid": "aea7dc58-8cf2-4dd1-9cbe-185139428f8c", "value": 689664, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651244029, "uuid": "6b970c02-86d5-419f-9de8-2bd85b768efb", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651244029, "uuid": "95d5ed5b-2a0b-4408-a246-6b5ee805a278", "value": "A898974.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "359de256-c783-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651212689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212689, "uuid": "c83de0eb-58e9-4abb-aab8-ebd5e98314ca", "comment": "Malware payload (AgentTesla)", "value": "3475d4431afcd9c6262eff9ea2158f0c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212689, "uuid": "4996cfd1-6ea1-466e-ae55-0b8e38886fe9", "comment": "Malware payload (AgentTesla)", "value": "f450126e36db8236a9dc2339c3f87e4e2dc14e2a3a21dda89bf65ef678a50229", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212689, "uuid": "eb95b3c2-c1d0-48e8-bc2c-b97dbf89bf97", "comment": "Malware payload (AgentTesla)", "value": "03dfe84384131762538747faffe8e866dc7a56e9", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212689, "uuid": "bcdc9025-19ab-483a-9a35-37ebdb4f046a", "comment": "Malware payload (AgentTesla)", "value": "f2f0a6375526a6e8f8870cbcaf82378b3f4b465481b6b5c2e6b57f63fafba25d1d0d9f0520383b214bec60ef26f54f87", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r13", "colour": "#F07CDF", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212689, "uuid": "b8fd3871-d6be-474c-bcee-afcf12d284b0", "value": "T12EB4230B68F5D389B7279416CB657FD99840D06372C3B812E1CC5B8A11BFAD92F29932", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212689, "uuid": "e3a62ddb-c434-41de-be9b-91b3106b645e", "value": "12288:ofnD4b+T8dv5IpAxnc5+EvzP/NFEa/4v5aYsjE0T/:o74b+IdvISO+EbP3Ea/+a7Aa", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651212689, "uuid": "54fd5b15-d160-4c9d-967a-010a8e1ffed7", "value": 534527, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651212689, "uuid": "88f8f0ab-0439-4a0c-bf08-2dabaca0bc72", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212689, "uuid": "6acf8032-5934-4bb7-9424-b22bda24199c", "value": "PO121879.r13", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "042e051b-c79b-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651222914, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222914, "uuid": "7701290d-bbb2-492e-9e11-d0fc8589461d", "comment": "Malware payload (Formbook)", "value": "7ce7abf5061d046a460c7d09384b140b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222914, "uuid": "dcdb8fdd-bc90-41f6-b572-812ab3106fa2", "comment": "Malware payload (Formbook)", "value": "f45631af90cc92248765d036f48dc97b24475874b91d86b761d4aefb69c307fb", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222914, "uuid": "e7e8c954-61e7-4dd1-b2df-18dcbf4f05f5", "comment": "Malware payload (Formbook)", "value": "db2c01e873a8be903b914d8d6d6aa1d75f5fc049", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651222914, "uuid": "36a6f259-ad19-4172-849a-f736b740de40", "comment": "Malware payload (Formbook)", "value": "a570987aa4b7528d85e0cd1c07cdcb0c8e3a96c7baf28604914fff52ae2778511e5991a32d48ace529e6284c156054bd", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222914, "uuid": "a4c92841-f802-4801-8f7e-edeb4d248069", "value": "T1D8054931A2F159F2E0925E768D26A258FFA7AD007E10DD4EE5F039D85A37380E4191FB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222914, "uuid": "18f09c33-fa57-401a-8b9f-80cae72363ca", "value": "8c0d6281ae935c82cbbaedd26def6d10", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222914, "uuid": "bed1ffd3-4650-4477-8cd6-ae4ae9593f42", "value": "12288:bjc7mWfpt1qlm1F9ptIa2ccGmYhMQaRqgiibggGPX:bmdflqoFaaTlMls", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651222914, "uuid": "4d4b7155-10f4-453d-bb39-86feb0ffe0f6", "value": 800768, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651222914, "uuid": "252a2cde-3510-44db-8358-7434bd52104f", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651222914, "uuid": "2f3af46f-7233-4d6e-b744-c90633f19774", "value": "scan02424526628.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85c5a6af-c7a1-11ec-8e58-42010a9c0032", "comment": "Malware payload (DBatLoader)", "timestamp": 1651225708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225708, "uuid": "72da17e9-d08f-43ed-b1ec-635677787fe4", "comment": "Malware payload (DBatLoader)", "value": "ea8825ec387aa57cdb448686bff3aa1a", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225708, "uuid": "bdbb51a8-2151-49e3-9278-b3fc5b461bb5", "comment": "Malware payload (DBatLoader)", "value": "f4ec04cb1edb890bbc61499cb05c08c097af275e92c4902e82cac60b2a244f71", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225708, "uuid": "ef9b95b4-e4e7-46b1-8b4a-e4da88798d73", "comment": "Malware payload (DBatLoader)", "value": "0dcf2e11bd2606923f0327b60398efb590938d07", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225708, "uuid": "8a154166-3942-45a0-b733-e6379f94718a", "comment": "Malware payload (DBatLoader)", "value": "289da34ef04d8072777e495314b11fc5fca7491549f002599770c809b2c4ccdd0167493cfa2a898d7b64b596b04887b9", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225708, "uuid": "ab19cf24-dbcf-4b5b-a730-6624d9dd42dd", "value": "T1AE35AFA5B3D0D439D02215388C179EBED635FE52BD2CDC0B66E87E8B6934DC1361AA13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225708, "uuid": "594ee340-9754-4aa7-99cb-38127d630fca", "value": "ae0da78d3861b6795f71573be7d51e79", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225708, "uuid": "0548dd3a-0a04-429f-96e3-3e232b98b4f9", "value": "12288:EGUcVVor5R/zIYHigWIVv3s1D/Ok79NyAiibggGPXEtFvDgWB9rzocM1p45Q:2c3W/9HigWC8DWkDXtFvDgIFKc5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651225708, "uuid": "42990365-b3c2-4539-ab3c-4a595a96780f", "value": 1085952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651225708, "uuid": "0119b6e5-8b16-4a0d-adf4-dafa95419a0c", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225708, "uuid": "9f66d7be-ddd0-4bd9-b316-6811730545d7", "value": "SecuriteInfo.com.ArtemisEA8825EC387A.4124.13986", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c75b26fa-c7a8-11ec-8e58-42010a9c0032", "comment": "Malware payload (CoinMiner)", "timestamp": 1651228825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228825, "uuid": "3479dc96-72cf-4368-a027-76a80dca7527", "comment": "Malware payload (CoinMiner)", "value": "052261452e1738da3400e50b75c1e1a0", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228825, "uuid": "37cb67ba-8743-4b94-9b73-4be479c3762e", "comment": "Malware payload (CoinMiner)", "value": "f5201022495929641ec8f23327dcb08696356608f1a64223e684e220d49cb4fe", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228825, "uuid": "f16f6db0-2ddd-4bb8-9efc-ed4609502473", "comment": "Malware payload (CoinMiner)", "value": "112da3ebb3708b132413a3776dabadb2b219cc70", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651228825, "uuid": "6e320c4f-88cd-48e5-bf49-ecf1f07f4581", "comment": "Malware payload (CoinMiner)", "value": "52208683eb428f92182056c5b9ef1fb6414f1f8a1674301226bb10e69a7f5539b533a4d72646d8b34df12f82b7e14d05", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228825, "uuid": "5eb8bde4-705a-42ed-bc76-409ff8544158", "value": "T14DB533A0556E8154E15FF2F949E43A8A76F12C0F49E0B19AE6C803205E31FF7573AED2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228825, "uuid": "62c2e1bf-e026-497e-b6b9-a24e4e00427c", "value": "7dbd2319b33ed25eb7ad7d0162c2bb3a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228825, "uuid": "aaeccec2-f2f3-4a5f-b4cd-ffd206f4fd6e", "value": "49152:YAwHZ/p8SmylW2MaH2Xs7NCC4arDLERgadfAo045vZ6grNgj:7SZ/hm0WXmbfSgkfAofvZF2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651228825, "uuid": "2387a4a4-6faf-44e4-9140-6379b2da4709", "value": 2430976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651228825, "uuid": "657905ae-00bd-423a-82a4-d9ee6f7dc147", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651228825, "uuid": "4eaaf409-04d1-4ca8-b600-a8a20a13d9b0", "value": "WUDFCompanionHost.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "533f5ca0-c7e5-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651254829, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254829, "uuid": "22a3e2ff-80ed-40ee-b2fa-e8f8fd4ce4ed", "comment": "Malware payload (Heodo)", "value": "52edb6597dd5d178f8445b6edc8a6bea", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254829, "uuid": "28e82d67-5452-4fa9-aadd-5562a2755258", "comment": "Malware payload (Heodo)", "value": "f557a10ca8aac9e9c3c294f7627e578a2e6954057d948b4e9b156f7d6ed7a6f6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254829, "uuid": "81aed36b-59e8-41e8-963a-3ba6648e026d", "comment": "Malware payload (Heodo)", "value": "e5c2a352c79de26d04fb4d9f27525e9e7f4f9610", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651254829, "uuid": "f847422b-46c2-4c7e-937d-bb1fea25c541", "comment": "Malware payload (Heodo)", "value": "9f1237cda9d418aff447dde40bd57e73fe9ee7e1b60f22a1f7ab38d5df5cf18fe89923f01edfc7b61876ef8473b583a2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254829, "uuid": "b6b9e5d2-09e7-4d44-bfc1-eb198c3b53c2", "value": "T1DBE45B0273C390B0C557657C841EF711A8BEBC3C6B24857EA24772EF4AF699099346BB", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254829, "uuid": "9125d234-8dac-4da9-b23f-ef6835497c4b", "value": "c7be10fff3b5624b64714e5733abbf40", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254829, "uuid": "80ee924f-93b1-45fe-9323-51772f004f72", "value": "12288:S54yM33d3q3Z7BogyreNmF+U/9JckIAGfUebMx:SKh3831Bo4N6+ADckbebG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651254829, "uuid": "23650602-e093-4afa-b0e1-39889021c14e", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651254829, "uuid": "53383a54-951a-4612-8190-4d93b5b6f60a", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651254829, "uuid": "50d9c116-fd37-4088-94ed-5e3d28810c7d", "value": "emotet_exe_e5_71af1fba6b58bba953836032cff1cb6f06771d19096ab5c33ae607ff5c0ad9fc_2022-04-29__175345.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "541076b2-c7ed-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651258267, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258267, "uuid": "9183cea7-3bd0-45d9-8a78-6f90d05727d3", "comment": "Malware payload (Mirai)", "value": "e289adfb34e741d2ed57e5a7b12b26a8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258267, "uuid": "cb6352fa-4469-46a1-bbc5-4fe7df059c71", "comment": "Malware payload (Mirai)", "value": "f55a01e99f93c0ad2fcea1c089139052dfa9a166c2915f3113167bc6efefd6cc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258267, "uuid": "92c87d65-b41c-409b-82d4-0622cbb455da", "comment": "Malware payload (Mirai)", "value": "b037f899ed05e354c91624c6e72d5c3a0b61c6d2", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651258267, "uuid": "ffd8b066-4787-4227-9505-88b1682f0fac", "comment": "Malware payload (Mirai)", "value": "87661105ab4cfd06d6c75a364e88aeb2ba5b0b1f88cb66b8fb5ee2e24d32e2bb76091cfdd52a121cf726b569ccaca672", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258267, "uuid": "3fc91a81-5984-4301-92ae-ca7bcc896c83", "value": "T198C2E198174519E9D2F8C27C47B81B6C2DB40B96F809EC8678ECF7629D8E4753027ED8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258267, "uuid": "607fb57c-f4c4-4935-ad1a-0caf4622276a", "value": "768:I2G214DFyosXqgvV9o1ndB08m+JgGlzDpbuR1J7:I2GdDgosaaO1ndFVJuV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651258267, "uuid": "2db536c0-c2a0-4e61-b2d8-3179f242733a", "value": 26184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651258267, "uuid": "2d589919-72d8-4046-b1a5-69e4bf4dad6b", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651258267, "uuid": "73294452-c564-4677-9c6f-b50c0476a1f8", "value": "e289adfb34e741d2ed57e5a7b12b26a8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecb27927-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651218150, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218150, "uuid": "f7c83f1b-04a6-4886-bf48-d1bd23541dad", "comment": "Malware payload (AgentTesla)", "value": "7bb751f25eeba77ac0a358f6f27ed4c4", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218150, "uuid": "5134686a-d20c-4b41-904e-5ab2a80c7e59", "comment": "Malware payload (AgentTesla)", "value": "f57b8022c8ec8647fc3ed3d7bde548519f112c9faaed2f01acbac4bd84408426", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218150, "uuid": "14fdfa6c-bdb6-446e-9964-d982fef03920", "comment": "Malware payload (AgentTesla)", "value": "0df17554c8683d6a0230536de2db23f822e9043e", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651218150, "uuid": "b4dc4146-7ecb-4308-83aa-aff623505b3a", "comment": "Malware payload (AgentTesla)", "value": "3e72008b16d6aadb7e83af557343af8138660ec4263f1769c636574107afd9a15e60400332bdf2af78dde70d22c04107", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218150, "uuid": "63fac68b-43e3-4d04-96d5-5b592511a0a9", "value": "T1A0441209B764E0B7D8F18B322DB31B172FB99001A6F09A0F53259F4D79679A3D64E342", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218150, "uuid": "7c0e08a8-50ce-406a-8cdc-b07e034b68dd", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218150, "uuid": "d8fab2b4-5ee2-4017-818f-69e41a223ec9", "value": "6144:HNeZmx3TwTDlvwN0lWcWbEaj2uTmzTYDz9buu30zJ7igWE:HNlxDmDlIyWL4rnvYDz9yM0d7iLE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651218150, "uuid": "7f6042cc-f1d1-4724-b642-1283d55cd6f1", "value": 269584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651218150, "uuid": "4a7ed42d-7ab5-4bd1-b0e2-8b7a2ff4c408", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651218150, "uuid": "8202e2f5-a89c-4ef6-95cf-83c915641a18", "value": "Documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90764534-c792-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651219284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651219284, "uuid": "6f03612f-2367-4b67-9d37-b55c6b223a35", "comment": "Malware payload (Heodo)", "value": "661f38029e46f5e30bfef5fced1892c9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651219284, "uuid": "4f7d58be-dada-4cd6-a1b4-63983eb2ff41", "comment": "Malware payload (Heodo)", "value": "f59991e6049f4df8276bc88d64c3350d078efc56af42d9352423ec7b2620bb35", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651219284, "uuid": "518dc86c-24d3-4867-9425-920644f249c6", "comment": "Malware payload (Heodo)", "value": "89ed37bb7a5f7d558af8743e5cab7118822d3721", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651219284, "uuid": "f7684068-9b92-4331-a862-ae2cfa2d386c", "comment": "Malware payload (Heodo)", "value": "f0234627a30dcac4cd63a457ea7ff89100357e066e34977649cf551c37a5924adc5d196f4d1c6372039096b019dfdcfa", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651219284, "uuid": "c5759602-1c8a-417a-b72a-49cbe789560b", "value": "T152C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651219284, "uuid": "3f21d709-ae2c-4943-a185-e070866688cf", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651219284, "uuid": "29975431-3b9c-40e4-9044-cbbbe76285b9", "value": "6144:JhZ02GdOOgPYcKUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfXKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651219284, "uuid": "67c01cea-2e88-46fc-a469-1a9cd7776044", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651219284, "uuid": "c5364744-4824-4dfe-9b7f-8aeeed4bdbe1", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651219284, "uuid": "9a725881-4334-4a4c-9aee-3642121f8fb1", "value": "StEbwXszsGwlgLthJCGMJjfCR.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bf28e9b-c7cb-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651243758, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243758, "uuid": "d011cfe2-73e1-441e-9864-f799d7d09286", "comment": "Malware payload (AgentTesla)", "value": "9c1a7f649758da9fddaf6e326499fe88", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243758, "uuid": "5a360c2b-7be4-4ecb-a9d2-e58d6bf62210", "comment": "Malware payload (AgentTesla)", "value": "f6a927a827b83107cf52043daa6cb5ee55fadc9443943d67a471159134b83a58", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243758, "uuid": "541e13e4-fa62-4889-b742-215bfa19f6fd", "comment": "Malware payload (AgentTesla)", "value": "b324e061f22af2aa9c631d7d76018ba7ce2bd533", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651243758, "uuid": "dd9f75be-b6f1-40c3-b8b4-2fb5996060b8", "comment": "Malware payload (AgentTesla)", "value": "58219b423cb0d81cb0b4ce92348800a91986c42e7223d68c0cb5fc5d006b30786ec42b121cb192b42e99a6f6ae43cb25", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243758, "uuid": "70388a02-f5c9-440c-866e-49039d5cbec5", "value": "T13E5423ACC67C0BF0D098BB977BB29014F05F01FC38E1A069BD656AF4756B4DC26925CA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243758, "uuid": "e4a89e09-87de-4967-9547-5a3cdde77c1a", "value": "6144:F1JprWI1Qtp/34vNfvsWENzQYgwcxHzdi/1FEAoZRNEI/j3ViDAtOmXmmw:Fjphgp/CvANEZwcxHE1y9RNEI/4Axw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651243758, "uuid": "40033f40-3193-4af5-a199-873ae99a0d01", "value": 279191, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651243758, "uuid": "aedbbcb2-d53b-4ce4-99b7-a97b89cc7af8", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651243758, "uuid": "4fd08afc-03b3-4219-849f-79d1ebf68558", "value": "QUOTE 4521890.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e5302be8-c7e8-11ec-8e58-42010a9c0032", "comment": "Malware payload (SilentBuilder)", "timestamp": 1651256363, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651256363, "uuid": "d92faea4-66b9-4f0a-9f9e-407b448a763f", "comment": "Malware payload (SilentBuilder)", "value": "f3152ccf822c32ce900fccdad0d656df", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651256363, "uuid": "cd49ff8e-32a0-466a-85d1-7dc004a7d957", "comment": "Malware payload (SilentBuilder)", "value": "f6af3bebbda4ef8ff95517b01b34fb606de79bd1697cf38560d54320905b0dd3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651256363, "uuid": "08b46b91-26ce-48f3-bb26-56523dd83eba", "comment": "Malware payload (SilentBuilder)", "value": "ba53ebb9e1f8bf19aa09bbc289fa861ad8b84bce", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651256363, "uuid": "7104119e-9cb5-4773-9945-b48dd88ab9f0", "comment": "Malware payload (SilentBuilder)", "value": "20229a263fcba636c5b4202a45dd451601eff9a9046cb3bd12f68b5c6b0066c9f27422a8d2e93d71cb7f96d5e29a57c1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651256363, "uuid": "45bdac1a-bb3e-453c-8f0e-7526a87f0574", "value": "T107633B477549B86AE916CB3D4C974F95B613EC104B960B83BB09B3597FBE9B04E0310B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651256363, "uuid": "591d9b4e-a927-402f-879d-4096d09472b7", "value": "1536:5+Kpb8rGYrMPe3q7Q0XV5xtezEsi8/dgAYW/ESKQHS1yXJFadK0lB:kKpb8rGYrMPe3q7Q0XV5xtezEsi8/dg/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651256363, "uuid": "dffbb1e1-8209-482e-bc45-8bf80b88b1b3", "value": 71680, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651256363, "uuid": "d55f1b5d-4b48-48e4-b083-b6ced806d656", "value": "application/vnd.ms-excel", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651256363, "uuid": "9cd229c1-0c00-491b-8047-e1d7282fa0ad", "value": "Payment inquiry 2022-04-29_1248, USA.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63171c07-c7a2-11ec-8e58-42010a9c0032", "comment": "Malware payload (DBatLoader)", "timestamp": 1651226080, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226080, "uuid": "9c123f06-3dd9-4c2a-862d-d2c48a2a12f3", "comment": "Malware payload (DBatLoader)", "value": "ad54226d7ded0e2c3c49a1a92ef9fc95", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226080, "uuid": "515aa31a-eb5d-4bde-bf11-69a5207a667b", "comment": "Malware payload (DBatLoader)", "value": "f6cae91cd0b80a4ac59a965baba0d156df61355ac69ea20cbd8273914663cdba", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226080, "uuid": "0052969a-3749-461c-984c-3eb446a3a4fc", "comment": "Malware payload (DBatLoader)", "value": "f0987f7276b513ca28e1bc18ac33a4a5b8feb859", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651226080, "uuid": "7531c04b-263b-4082-8d47-e0dbd94cb13b", "comment": "Malware payload (DBatLoader)", "value": "d8984c70c1d63cf3a9ce9098ba6253fd7a5d0a278de41d7752c332460d47beca733e743ad391334401a9181d420e66b2", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226080, "uuid": "a79c4b35-ba75-48b9-b40f-8df403558aec", "value": "T186358E22AF485433D4331E789D5FA7B81826BD02FA2494462AF59D4CFFFA7D13829643", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226080, "uuid": "76560166-8a52-4032-903f-c26b02ff59a8", "value": "d4cf2d38c8388bbe93ed7c0af7fb2d41", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226080, "uuid": "f4b3c2de-e065-4695-8e4b-4543f32f1018", "value": "24576:NODWeYzvYu8Qtm12YI/vrnqpM5mxY5pIOBz:NSWNcY3tl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651226080, "uuid": "fe456017-cbbe-457e-9521-70292a7e8684", "value": 1064448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651226080, "uuid": "e88f28b1-79b0-41a1-b775-23d6a88909f8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651226080, "uuid": "e114f417-5e34-457f-9f70-ade8549dcaa0", "value": "New order is attached.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "419b2464-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651217863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217863, "uuid": "ebfb5147-66e1-4bc2-89c0-ab1a08d92541", "comment": "Malware payload (Formbook)", "value": "33e26957f6ec3e497738c2f2e80d49d7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217863, "uuid": "7fdd9ef8-65b8-40d1-abd0-3a1285e75ec7", "comment": "Malware payload (Formbook)", "value": "f6ed4bfe516873bc9ddf7488a23b7a776279b8cb0293bcc9f4481a5bdafb101b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217863, "uuid": "9ee9045b-ee2e-4e7c-9641-4200554c3b25", "comment": "Malware payload (Formbook)", "value": "9912c16d873dee09104372b56b857d83a8111fce", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217863, "uuid": "8655f0f7-af5b-4d65-bf5a-88844f2d1b10", "comment": "Malware payload (Formbook)", "value": "ecd1ef877af0711b1ef359a3af5ff036138a1dfc4ce2ab8c4ddf9f1f8214db9442e5e2da8f56e1f78b20f41332f72323", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217863, "uuid": "9159c57d-e703-4049-9e1e-696aab850ef9", "value": "T1FE2412445768C497DDF35930793A621BBFF6AA1220A00A0F2B518FEF3D36754A20FB55", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217863, "uuid": "b71671fe-6cfb-4946-91cd-cc607d0fb329", "value": "56a78d55f3f7af51443e58e0ce2fb5f6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217863, "uuid": "865c3812-6b98-4197-adb5-62c63b0b7ac3", "value": "3072:l1NjcVVnLpPunbTB+zUFfy+6W+ZK83qoNhXkccUD1ZaKwU5CdqVxVd0GbGSQ:HNeZmTAzeF6Th3JUbUD2s5Cdq/Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217863, "uuid": "edc6036b-ab9b-4098-9596-428901026ee5", "value": 219403, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217863, "uuid": "09055dc3-b69e-4af8-b934-c563b106a8a5", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217863, "uuid": "ec3d0fb3-28a7-4772-b69a-bc2826b46067", "value": "33e26957f6ec3e497738c2f2e80d49d7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12f1c764-c7ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651236253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236253, "uuid": "6813cf15-0721-44b5-a0b0-5ba2fe86e171", "comment": "Malware payload (AgentTesla)", "value": "30c89de162fdd14e2e9edb9d010d564c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236253, "uuid": "77fa61e8-fa9a-486f-a32e-5eb81a43e267", "comment": "Malware payload (AgentTesla)", "value": "f7032e955c1f29906640a3b7dae1a43acb646784cadcd939bedac97e15900179", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236253, "uuid": "165a59fb-2270-4c88-872d-01842c7f6020", "comment": "Malware payload (AgentTesla)", "value": "18b581b3a62fdedf6e478c51cef867e3d2db9701", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236253, "uuid": "365a961a-bf99-4183-b984-6863333c9234", "comment": "Malware payload (AgentTesla)", "value": "1d23ddd3bb96bbf3941d8f7433eabe08f307fc9ab04cc5a69847fb159453e0bc82c05eb7e28b441cf7f27b872795e49b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236253, "uuid": "f856ed83-0be2-43a7-b12d-a3b97f4d4740", "value": "T1429423E2EC9D4A66DDF3454026F22447B05220C59E7CCED790685C6D6ADC92EA8C0BFF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236253, "uuid": "a2b0546e-a620-4cbd-a0e2-68559da1d21f", "value": "12288:RxAGq41ittm8fGPVIWvUZu4PEjw83Hk6Z6g57Nx:RxpJsmxIW4ubjwWHkkJZb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651236253, "uuid": "8f34ea48-da5b-416f-b757-3d968db1c5ef", "value": 415024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651236253, "uuid": "658131da-db50-4f90-bada-e7ce3b6ffc3c", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236253, "uuid": "a06025fb-89a8-4f36-b5de-0d69b63ee3ce", "value": "IN02672Q583765NBOM.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6925ee59-c78f-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651217929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217929, "uuid": "b2641f05-9835-4f68-9957-3057ccedeb00", "comment": "Malware payload (AgentTesla)", "value": "f870d216fab297edf6a6a2f9e08870d1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217929, "uuid": "3fac7d86-8148-487c-bae1-82bed9ec5995", "comment": "Malware payload (AgentTesla)", "value": "f77fecc8b9559f6280014094e4173081d223404a449a3663491d27ec240e3d69", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217929, "uuid": "6494bf9d-b935-40a1-958b-da3be8453010", "comment": "Malware payload (AgentTesla)", "value": "a06743b4ce56fbd86826c08f32624c3895773c78", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217929, "uuid": "5fe1cfda-acf7-4f2a-be85-e4b6316bdbbb", "comment": "Malware payload (AgentTesla)", "value": "775daadeec01be68edbd0b01457ac11101f9af2d9dfc09e2200d9b4eb0802c228cf37620f75ad72d89293dadd9dcedcb", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Telegram", "colour": "#80D9AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217929, "uuid": "1a1e7137-bd68-4238-bb2e-4e983628f2d3", "value": "T189051242BA588BF4E5384AB33E93910E87933CF57C02C647AAD3F2564CB8A216D515F7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217929, "uuid": "67e3ff64-a5be-4f7c-b076-5a9ed121fce7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217929, "uuid": "4ab41fbf-31f1-4ad2-9e09-66188e2b695f", "value": "24576:ZQYNee3ZIh3y3ieokQbf3SBsbMphZjFO4Rasvh:2Y0CZyy3FoXiBsIzFE4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217929, "uuid": "887f982d-21c4-4edf-85c9-559849e208c2", "value": 823808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217929, "uuid": "94d11301-d857-4eb4-82d8-9270253a0254", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217929, "uuid": "19d5b8a4-28ea-415a-8069-50422ece22d4", "value": "f870d216fab297edf6a6a2f9e08870d1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "44f23d58-c7c3-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651240203, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240203, "uuid": "751ac431-545b-4073-90b8-8fd632ebdac7", "comment": "Malware payload (Mirai)", "value": "76423113525b97263e4603fe64e7b30e", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240203, "uuid": "c39e6206-0239-44e7-bdde-26f8d2c7c2d1", "comment": "Malware payload (Mirai)", "value": "f869f7f017352e41da4912798107bd02f434c3d71ce1b6d10b32dadb64df4f4f", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240203, "uuid": "9744a9d0-8b88-4fe4-b228-1ea618514f88", "comment": "Malware payload (Mirai)", "value": "7869ec6c755d921ed43480e5a94cec4300aeb670", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651240203, "uuid": "41ad0725-f663-41b6-8098-64aa576ac045", "comment": "Malware payload (Mirai)", "value": "f2079f3f2900676f9be1a4db55a9b9a589b52a952729d370444baefd3dab6501b93bbb4532ade7d597e4f53d1641cc76", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240203, "uuid": "01adc2a3-7fbe-4fd0-900e-8e542dac7bce", "value": "T17563F2F0B6536A36C7D109F7C8E080D61D3787F8D016E5133B914CA9B696BAA3BB4D81", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240203, "uuid": "77719a81-86d4-4993-aa92-bf055e232b44", "value": "1536:+dJjTDCz3MAL9l1Pb0IxhLTQDv3DZ2zEFtUv2LTmXhGwu/GYUA3lv9:+3nCzFhr0IxhLTQD3DZEEDUv2LyXhFdY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651240203, "uuid": "e25263e0-9fb8-4434-88dd-f9bf54205383", "value": 70044, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651240203, "uuid": "51eea3a9-f644-4593-9fef-4ca5293e940d", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651240203, "uuid": "411f98a3-65f5-478b-a1c0-324284156f68", "value": "arm7-20220429-1350", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "01cec380-c78a-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651215609, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215609, "uuid": "d122845d-931c-4012-b288-3e631d1ebf07", "comment": "Malware payload (Loki)", "value": "c73464e3c49d8ce48b57069c9e057197", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215609, "uuid": "f6ce02d3-fefa-4a5e-ba71-71b4dc1cf981", "comment": "Malware payload (Loki)", "value": "f8e128a798068a3d16d207059b8679ae37d75acf636e85a440a653f352699736", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215609, "uuid": "da3335e5-5677-4cae-a5a3-236bf0d44507", "comment": "Malware payload (Loki)", "value": "04976b1944d055b919c3c86dd0e136c22d33a6a7", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651215609, "uuid": "bfd07cbc-a640-48b6-b54f-07b97eecaefc", "comment": "Malware payload (Loki)", "value": "029559035bb1ebf0baa3bb86e7ecaaba0f68875bf93fb18f166c4fc12ceda08c4d36f56909a738c46ba4b858317aadb5", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215609, "uuid": "625ad081-720f-4225-af9d-4d8973d57fd2", "value": "T1CC93F1293EE1B436CC59023BF9B3246844B7BC20F709A7935A263FD907B35621794B75", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215609, "uuid": "9eea5a24-52d7-4696-853f-9c4e294f9449", "value": "1536:SsQssD7qaPPX/wQYwdZmEyuVBVfwztAVgQadIt/WsI4XWSHQR6R:Ssrs/qmPX4QyEjVXwzSVT/buER", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651215609, "uuid": "b75f4be3-32e6-49b1-a541-2508eb85e494", "value": 95744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651215609, "uuid": "d5a06aed-fe05-4360-a9b5-2729bb9af303", "value": "application/encrypted", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651215609, "uuid": "8a0ac894-9ef6-429d-8666-5ec0afd8c180", "value": "pre-notification.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e33fa64f-c7ba-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651236603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236603, "uuid": "20ba027c-af9e-4611-9252-ce594045c8b9", "comment": "Malware payload (Mirai)", "value": "a796c6269c238d9e9b943de983b49b24", "object_relation": "md5", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236603, "uuid": "77f432ee-df21-4b62-b88b-48da1a4bba70", "comment": "Malware payload (Mirai)", "value": "f93d73f94113345c923ce61199aa9e0e8aec57660f1d85bcfc578b6afe708aea", "object_relation": "sha256", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236603, "uuid": "784648df-1aa1-4873-ab9d-705e9680d5a6", "comment": "Malware payload (Mirai)", "value": "7d3ab082fb3232edda5c5cb7e56168a78048e12c", "object_relation": "sha1", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651236603, "uuid": "0a63832d-4f9d-45f4-a527-c451f4d0e8a3", "comment": "Malware payload (Mirai)", "value": "c5d15406a0383a49effb3efc1b06201c721f2e5676f0ce1a3121762282b5f748871486bcd47f2609e681a0649b383d6e", "object_relation": "sha3-384", "Tag": [ { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236603, "uuid": "a6f6804f-2f48-41d9-bc30-9de8d81677f3", "value": "T1F8D32A4AFA408B13C5C61776FA9F41463322DB94D3EB3306991C9BF43F8669E4E63606", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236603, "uuid": "688e49fd-8442-45e3-997f-68c5dcd36c9f", "value": "3072:qOlY2laLNRaBesnRRIYmHXJ+pQRb+7srM/9IV93a:qOldgYesnRRVsXRb+7oM/9A3a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651236603, "uuid": "98fd02e2-a2f8-48c8-b983-b776ddf6a8a3", "value": 135586, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651236603, "uuid": "201ca976-f0bf-424f-ac2e-1f79b41b529e", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651236603, "uuid": "418a6565-a73c-4ff7-a868-561ad0b09d4d", "value": "arm7-20220429-1250", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f4ad0941-c7b5-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651234484, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234484, "uuid": "6ebcd8f5-b409-46a7-ac4e-6cd9fdd9148b", "comment": "Malware payload (AgentTesla)", "value": "9fde327598bfa512efed92e5b13374c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234484, "uuid": "006aed45-84c4-44b4-b14b-dd56eacc2d75", "comment": "Malware payload (AgentTesla)", "value": "f942533ea113fed3aab2cd46e93e4fc35e842949e108e8814823ba5bd5b714f4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234484, "uuid": "b678b9c9-8e7f-4daf-b347-170082bb6f61", "comment": "Malware payload (AgentTesla)", "value": "df68a9fd90682c0cedf9e8f8286e08124ddac0b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651234484, "uuid": "dc6fcdad-57eb-4d77-8f1d-55e575097942", "comment": "Malware payload (AgentTesla)", "value": "28e06213799755aa0cef221f799d2e3f6af5958258c3cefdb568455da4d96fa924335c675e7341462a72e451e1c7b2bf", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234484, "uuid": "01787c15-9530-4ee7-acd2-6cbd0862f436", "value": "T17E8423FB253FDE4782DC0C3593A7F511AC70E214F9075B5DE8A55202479E29CA8A0ABF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234484, "uuid": "83e76f28-6bfd-4255-98f4-ea60000e0da5", "value": "6144:n1I4cw299WKQ8YczaZkTodGEZZ0hlg1sJ2ZdNkZs4ISz6tH87tKQ/:n1I4f2+KQ8YMQknLTcxMnWtH8J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651234484, "uuid": "888304e6-ba03-4ae0-b4ff-73efc65633cd", "value": 396977, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651234484, "uuid": "454095d1-5c3b-43bc-8b03-b739e6917fef", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651234484, "uuid": "8f4afd1e-9c60-4a5e-9e29-9d52ded136e2", "value": "SOA. PDF.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "258f1a1b-c79c-11ec-8e58-42010a9c0032", "comment": "Malware payload (Quakbot)", "timestamp": 1651223400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651223400, "uuid": "60a74d59-6e37-4c36-ac78-88ac81d88453", "comment": "Malware payload (Quakbot)", "value": "942911249cf6a81d585b033c3302c9a5", "object_relation": "md5", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651223400, "uuid": "a2c28fcc-780e-49d3-9216-fd075e291505", "comment": "Malware payload (Quakbot)", "value": "f9499dbb7ba8d067b7b423541c3e87f01291a2e4d340f94872a2e1a90745cc14", "object_relation": "sha256", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651223400, "uuid": "7439b8f5-84fd-4cba-a554-32dddd72cafd", "comment": "Malware payload (Quakbot)", "value": "9410cc8ca56950bf453e9fe2d1a5aa5b1d9671e7", "object_relation": "sha1", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651223400, "uuid": "d0f73171-e60d-411e-9f91-bd6945ac9704", "comment": "Malware payload (Quakbot)", "value": "b9ce704cee4381982db02eea29169ce761f109a1dda612e4e7e4a1ecb4ad25cc197340c10fb4a4b8ae70ddb8d7edcaba", "object_relation": "sha3-384", "Tag": [ { "name": "qbot", "colour": "#ED7622", "exportable": true, "hide_tag": false }, { "name": "Quakbot", "colour": "#9FC18F", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651223400, "uuid": "d0d177c8-e7d8-42c9-8df7-f5a8e5900abb", "value": "T1A5F423BB68CE2568414C6A678B530A62F1F1E4BE074EE6B10C017D7DA9E7205D1FB06B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651223400, "uuid": "0a4a4dc6-7860-4bd8-880f-05d4e3d71975", "value": "12288:uk3I00dZUGqKjZITjawy3TW3SsVQFqHfLc/Tq0okjPtjw1GmCHIlQfKpMGZoy:bI1zzjZK2wwTWiSQYHTc/e0eLqIEKqG5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651223400, "uuid": "27e702d1-2da5-411e-ac75-c71678c5bd00", "value": 786378, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651223400, "uuid": "52727f6b-ae88-48ef-b4fa-efcf4ddf95b5", "value": "application/zip", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651223400, "uuid": "c82ba936-940d-4810-913c-e580f570b7d7", "value": "W_2372649835.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89917b9f-c777-11ec-8e58-42010a9c0032", "comment": "Malware payload (AgentTesla)", "timestamp": 1651207676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651207676, "uuid": "1bb0bfd4-f67b-4118-abd0-29544520ef90", "comment": "Malware payload (AgentTesla)", "value": "87ccca16484db18f6475fd96840035b7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651207676, "uuid": "f809ebf9-e13d-4108-9581-8afb233e0878", "comment": "Malware payload (AgentTesla)", "value": "f94b8d4c6950e4c39a86d8cc1a201fef416fa81a2984d4306f576f858c1be9eb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651207676, "uuid": "f4d4ee86-c6a6-4170-842b-3e35cef6d4f2", "comment": "Malware payload (AgentTesla)", "value": "83cb0465f718aab64940ca5ab691a185cfb7b8b7", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651207676, "uuid": "efe940a4-d1a9-4cce-9be6-d88017e15ead", "comment": "Malware payload (AgentTesla)", "value": "f9ef2b55c43a12b8b41dee97bad4f22fcde9ac40fce8f7d2c65dcb9b1a2e92300f6f539ad0867653565af02b6b4dd7e4", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651207676, "uuid": "01a90003-69e0-4647-8fd9-a6e3b653deac", "value": "T138C41250B67C0F56CA7A9BF81430922547FA7E062921E78BCDC275EB1C2AF151B60F63", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651207676, "uuid": "a2ca79f7-3f67-49ee-8641-687cedadc68a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651207676, "uuid": "2f227ef4-6fb3-4a99-8375-ffa40fbd9608", "value": "12288:bLWJeJNpNHFQsjDR7w1dskyMW9FhLJhI9PlRBftd8fjZFzt4OLmZNGrBVz:HQittjDR7oryMALJMFftd8Nv3EOVz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651207676, "uuid": "d0ed6103-c682-47f6-af73-d37442a53a74", "value": 581632, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651207676, "uuid": "16d3f250-27d3-4c65-a067-4b4a762bd475", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651207676, "uuid": "b2ee3cd4-3f49-47ce-a567-7b2f2097396a", "value": "SHIPPING DOCUMENTS.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9998ef16-c782-11ec-8e58-42010a9c0032", "comment": "Malware payload (Loki)", "timestamp": 1651212427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212427, "uuid": "02c78599-95c6-4d68-b8e5-e319583ca0d6", "comment": "Malware payload (Loki)", "value": "0a1467a257bee63ce2a381c08265e27b", "object_relation": "md5", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212427, "uuid": "0f5d40f5-d627-4a63-b606-d77bd5e97d85", "comment": "Malware payload (Loki)", "value": "f9d31ceab4db890241e0229869c34dd81f1b792797adbbf4e777de1abc242a73", "object_relation": "sha256", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212427, "uuid": "851e273e-a3df-4f6a-952a-ab1a6aff3090", "comment": "Malware payload (Loki)", "value": "381baadd249375856e11d255751fc942defec933", "object_relation": "sha1", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212427, "uuid": "7bc403c4-872f-4cca-976a-ba281cba5261", "comment": "Malware payload (Loki)", "value": "cc0d64ef787f80bbbcf2e11ae33958bbeade577a9f5cff10b5aaf169eb735166a842f420d167de19c94351ce94d4876d", "object_relation": "sha3-384", "Tag": [ { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212427, "uuid": "93c4d1c0-34c7-4446-9da0-8f0298fc3782", "value": "T14A9423F96F124CC9E33E97C6E50E9165752EE487D034AE17A2C40D636EA94C33B3187A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212427, "uuid": "0366b6b8-3906-43e6-a071-b9c6be5042df", "value": "6144:EZG+cHK3ildBYAL8UK+1HzHu5NqgCunr3KpP6xVXUBsZC5cIs23DVr:IcCmtLRnHzHcNqg5reces8m6Jr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651212427, "uuid": "91d25a67-4855-4d45-87ee-241920c62942", "value": 421356, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651212427, "uuid": "444e367f-848b-4814-acc9-b246a1cb1d25", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212427, "uuid": "3b6c26ae-6a3b-4fa6-a6f4-daeaaac8affa", "value": "Purchase Inquiry_pdf.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4426900-c78e-11ec-8e58-42010a9c0032", "comment": "Malware payload (AZORult)", "timestamp": 1651217626, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217626, "uuid": "e06f08b9-ffb8-4fcd-8ab6-5e71ee892395", "comment": "Malware payload (AZORult)", "value": "f451fcfbba3200d90bed8064ad56bcb0", "object_relation": "md5", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217626, "uuid": "156da1e2-c593-4a52-aadb-2365e0c56378", "comment": "Malware payload (AZORult)", "value": "fb0c67170432a370e0c244a6dd21618a61c4d9a56bad0400cc7dca93063676cd", "object_relation": "sha256", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217626, "uuid": "8038e397-9fcb-41b4-bd68-878cc0ab0875", "comment": "Malware payload (AZORult)", "value": "a41804c64acc34fc16d66455fd06200d65364c60", "object_relation": "sha1", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651217626, "uuid": "51af2050-c1de-4442-bfc7-d1eadd377b36", "comment": "Malware payload (AZORult)", "value": "945ce8a970000cb41d484014df7a2ef8a4946da5bf80803a57abc50b443772b22b1b0afcfa06c6fb595f944c164b1947", "object_relation": "sha3-384", "Tag": [ { "name": "AZORult", "colour": "#403640", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217626, "uuid": "b0267862-f8fe-4ea2-8202-42cf20c3e274", "value": "T1A0C48DE1364D8AE3CE365D76068B8E7013E346251122FB336BD37BF2354265BEA27185", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217626, "uuid": "550909b6-677f-4cf4-bc88-ba287735db78", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217626, "uuid": "73d06e0b-4631-40e3-9a98-95d9384545fa", "value": "12288:a8vS1E6rg7nU3fURae0ZBEBcovM6oPZUG7tWbr:JS1E6fvUROCrvWZUGEb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651217626, "uuid": "1ef0d461-f696-4c86-8c60-35f0992ea5cd", "value": 560640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651217626, "uuid": "495de173-7658-4e48-bb86-0aa0297bd450", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651217626, "uuid": "232c51b4-d393-4ef7-b35e-eb950fc12104", "value": "SecuriteInfo.com.W32.AIDetectNet.01.19588.26839", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "063f09ee-c753-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651191994, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651191994, "uuid": "6a1b22ca-6c63-4dd0-805c-c47b1660e3b2", "comment": "Malware payload (Heodo)", "value": "5732a64133778192ec7d5c5eee4b38f2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651191994, "uuid": "3e9e3f0c-f08e-495e-be4a-1f36b2ee68e3", "comment": "Malware payload (Heodo)", "value": "fc2273a8e09756dd54bcca9bce9d256237cdbf8010e12f7b3dee6421aa126212", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651191994, "uuid": "7d1415da-7e8a-45c2-a996-82318103c79c", "comment": "Malware payload (Heodo)", "value": "18f2fcdf6f56f48b80c47f92e2de2cf8e2fbf333", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651191994, "uuid": "2b6619a5-255d-4bc5-93dd-bc97ad951b59", "comment": "Malware payload (Heodo)", "value": "cfbfc9242b87ea6fdcef058c4c0ad60f5fb3793658294a3b6c8c188ad843596e0fe030f953d8443c0338f9ea9f9f90e7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651191994, "uuid": "9b94f62a-da58-4c6e-aa6d-b5d038f1dadc", "value": "T1E4C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651191994, "uuid": "ba2b07df-d994-4392-8f0e-fdbf31617e0f", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651191994, "uuid": "f73e70d6-754f-4336-9d1d-a4368bf1a249", "value": "6144:JhZ02GdOOgPY7KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFf8KRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651191994, "uuid": "1d8d4b05-b3cd-4e7d-8583-2f6160e3371b", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651191994, "uuid": "4a5331b7-8779-4b0c-9cfb-8bc820701b91", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651191994, "uuid": "ca625839-26ba-4b92-a361-24524629e05a", "value": "emotet_exe_e4_fc2273a8e09756dd54bcca9bce9d256237cdbf8010e12f7b3dee6421aa126212_2022-04-29__002628.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e8599d7-c7f8-11ec-8e58-42010a9c0032", "comment": "Malware payload", "timestamp": 1651262901, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651262901, "uuid": "38e9720a-3daa-4799-8511-5116b5e1c0bb", "comment": "Malware payload", "value": "0b5b0ad6907d8d0f97b15ff1561117ad", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651262901, "uuid": "34ebc30c-78da-4e66-a58c-beeb361effb3", "comment": "Malware payload", "value": "fc2cdd60a6021eecb3e9084cf3b082ff27a02745797ac9779992b48fbb40ecfd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651262901, "uuid": "aa108e2c-ab50-4c90-b731-d195f65a8752", "comment": "Malware payload", "value": "0ded2b375e0fc39710a4205bf4c9f92faeba6782", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651262901, "uuid": "d58b61a7-f861-4255-aee0-4adc2b804ee3", "comment": "Malware payload", "value": "df7f538d56a5e0b0378b01d981234321de038e33b374172db1686035d96087286930226f139b8108d76df8b2aeebc3dc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651262901, "uuid": "e18a5ed9-3bcd-46bf-a742-6f82e5e33d7e", "value": "T1F6156B12FAFC80B5D02EC13AC582865AF7B17C50977587CB92519B2A6F733E15E3A321", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651262901, "uuid": "3658163c-40aa-4b2f-95ab-60e8b5fc2092", "value": "0f7b55ae9955d812fac6eb2e089af4f4", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651262901, "uuid": "44d8fb24-3c92-411f-906c-2b4871a997b7", "value": "24576:3q/YfxBhF98FdV4pDRUzmdk/Snv62d7h:LxLb+mpDRUzICO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651262901, "uuid": "80e36598-af80-4726-b98d-eb00f0cd450f", "value": 911360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651262901, "uuid": "25e28189-493d-4460-bf6a-f30427b57cd8", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651262901, "uuid": "ae5f051e-082f-4652-b48b-be68c47ade0c", "value": "same.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2b15bbd-c7a0-11ec-8e58-42010a9c0032", "comment": "Malware payload (Formbook)", "timestamp": 1651225327, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225327, "uuid": "056898bc-febd-4fc9-8e21-9eb9f54fe163", "comment": "Malware payload (Formbook)", "value": "8d624bcf58b2467bba65b2822d84ae5b", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225327, "uuid": "70551fba-8536-423b-b9e9-6322333c94d4", "comment": "Malware payload (Formbook)", "value": "fc4ef2e222208120be1cb49befdb9da454583b5eb2da15f1d5c9a1bb3a25421e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225327, "uuid": "98777ed0-37f8-464b-a6b2-b3789cc0b40e", "comment": "Malware payload (Formbook)", "value": "48168855e9419da1b6c5daa7232546b7610ffe05", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651225327, "uuid": "a370b77d-e92f-4d73-8995-eccb90eb442c", "comment": "Malware payload (Formbook)", "value": "aa36e15a986925fffefc5dff887e690ffb7ec38b46bc685447c55b20d9028d716f2ba1a5e77600ad779dafa7bf083245", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "r00", "colour": "#8408D8", "exportable": true, "hide_tag": false }, { "name": "Shipping", "colour": "#83933F", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225327, "uuid": "42ec2e5b-7096-4a16-bd98-8dd8539922db", "value": "T15F642377F3575EA4DC4660F70AB289D16F36AD0A3B94E0FBE4E034DFDB025468418A62", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225327, "uuid": "c73dccf6-6609-4043-a4a3-23c0393d5ab8", "value": "6144:ElR+oaPtd2cwxwCZQQxVj2APXsmunGTCqGNi:ElYoQhpCqqVyAinGT3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651225327, "uuid": "d6e035fa-da52-4d25-b526-4e9ebcdcacf1", "value": 314887, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651225327, "uuid": "d856a025-258d-40db-9bde-1b9837892fab", "value": "application/x-rar", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651225327, "uuid": "721fd429-5758-4a22-94e6-fe0412a4ee6b", "value": "Shipping documents FDW11341-6 .r00", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "008d9ee0-c801-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651266717, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266717, "uuid": "6620da66-a9de-466d-8b8a-d4ac5b893358", "comment": "Malware payload (Mirai)", "value": "05fe4817a3c526b74bd448de70a11b99", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266717, "uuid": "76623314-4ea6-4dd4-b4fc-add95b06c48e", "comment": "Malware payload (Mirai)", "value": "fc89c2279bb213f380abf31d080214b2defdcc3b88b1715921d6fabc96a450cf", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266717, "uuid": "a8f42450-106b-4981-bf79-1a7aa166cced", "comment": "Malware payload (Mirai)", "value": "e94c74973070d046b8d7f95ed1206966585f4b46", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651266717, "uuid": "b5dfa9f3-bd80-438e-a478-e4a3faf0645e", "comment": "Malware payload (Mirai)", "value": "e1bd563503524dbb825d76057e5392e770e5c36daafa6b678c2ce563b26e0f35299063e42f424f63d8cc26d589cc427c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266717, "uuid": "6e8435a8-9dd0-443d-97e7-aa1008d854dc", "value": "T163D2D06F6B57A699CEDFBC30904A07F15E8461D33A766B4A4F454C40B12820EB99CEFC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266717, "uuid": "613e4b26-a72e-4fc0-a180-14261d723517", "value": "768:vVYLMI+v86bUI3ad8L3wbwPu+42yETV1M+JumX5NC/DxEWK:duMk6YmauL3wbj0M+JRX5gtE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651266717, "uuid": "34f96dc9-89b8-42fb-9cb3-4d97af7b4f05", "value": 29996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651266717, "uuid": "82ffbb95-4452-4f39-9487-12d08c6a29dc", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651266717, "uuid": "f0415c9e-aeea-4819-b1af-4049d7fe6fb5", "value": "05fe4817a3c526b74bd448de70a11b99", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536be23d-c753-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651192123, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192123, "uuid": "d0236fab-0ec0-4ec3-bbd4-b24fab728a68", "comment": "Malware payload (Heodo)", "value": "dde2ec8c681dd77c4a167224cae901a7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192123, "uuid": "f9610486-c3aa-4d91-85cd-cbdb5e90d5c2", "comment": "Malware payload (Heodo)", "value": "fdef3828e8db07aaf2e89480d111a7235f6129e3dae7ab89a0dd5ce2935b2aec", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192123, "uuid": "b43b942c-54ed-48a5-819a-561ada9cf29c", "comment": "Malware payload (Heodo)", "value": "d100e61ff2dc606d678bb923c3dae76b3db89ef4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651192123, "uuid": "e3c96d92-8cb2-42d2-9981-f6ba2a72ab72", "comment": "Malware payload (Heodo)", "value": "f99e919dfa008708469e7c733b570dc2617c7c9744ed7f5b89f6864ff6f9419137961837996cb3ba6bd911b1f5d9c781", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192123, "uuid": "1bf734f6-ed38-4e66-8a1b-84782c526448", "value": "T128C4AD0BF7BC88A7D162E57984239B8AE7B2BC114771D35B4760572A3F333A05D2A721", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192123, "uuid": "99657f29-f348-4661-bf79-b3bc002b3c74", "value": "1134f6be519e9c35b5478dccf9efcfc7", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192123, "uuid": "e28d8910-662a-4f96-a6ed-3c1392c9fc6b", "value": "12288:FX18uCYMUhDfWKN/Qd2UaQkhS+W/uczzIEudy7JMv9:MuCcVNI4mMSLjQE0mJMv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651192123, "uuid": "a341bc03-499f-4f07-acc0-1e9adc727c93", "value": 562176, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651192123, "uuid": "6df788ce-c91c-4710-9167-e44fc823bcd7", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651192123, "uuid": "f5ac688e-bf1c-4ef2-b0b1-dbf120c57a49", "value": "dde2ec8c681dd77c4a167224cae901a7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "974a65e3-c805-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651268688, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268688, "uuid": "57e3adc1-a925-4d94-b225-fc4c609a0d33", "comment": "Malware payload (Mirai)", "value": "a60172dae290bac655294b0fbda26fcf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268688, "uuid": "6b11fb97-2df4-4fea-9bc2-43f3c6af6599", "comment": "Malware payload (Mirai)", "value": "fe7fa746b7429e5a1838d1a5c20e279cbbbec895faf7c099bb0024147776597c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268688, "uuid": "19267e14-ee4f-4b5f-b393-3fe37b1bac82", "comment": "Malware payload (Mirai)", "value": "d31541eacf07557e22a28f7a0b2641f397f51b07", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651268688, "uuid": "8a04d890-326d-41f3-84c8-5cbde7c6d2f4", "comment": "Malware payload (Mirai)", "value": "73afbd142b26dd004912498af3b1713dba094b8d3f38209df69546580112ab999b559bee25afd7e33a81f2531a89d94e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "sparc", "colour": "#77E303", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268688, "uuid": "b821f296-af37-4267-8774-9344fa7ba3cd", "value": "T131733A25B9791E36C0D0B57E11FB8B01F6E1228E26F4C51A3DB20E4EEF247406952BF6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268688, "uuid": "54192ee7-2e70-41ed-a952-d68fe107ec13", "value": "1536:1gfq/SnNLlYfpDFQS2OX+msMmsRoe6vfL7rLQU:mE2Md0rvfLb9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651268688, "uuid": "ccb67ad4-33d5-48de-9730-f9707084ffe7", "value": 75504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651268688, "uuid": "7bc2ee73-ebef-488b-9094-f6473d13ec45", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651268688, "uuid": "cb7eb802-0569-432e-b92c-e620f74fa071", "value": "a60172dae290bac655294b0fbda26fcf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "acfd99ed-c7d8-11ec-8e58-42010a9c0032", "comment": "Malware payload (Heodo)", "timestamp": 1651249397, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249397, "uuid": "e63dc311-ce77-4b76-8e74-009cb61182fc", "comment": "Malware payload (Heodo)", "value": "0f90dcdb50474effbc4b1bac836e99f1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249397, "uuid": "b71b1c55-2521-4f9e-85ba-834ee0216921", "comment": "Malware payload (Heodo)", "value": "fef79fa86b1036440bbc950c1423a88d9a329e6bee9a73164aa64c5e5c38f103", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249397, "uuid": "e661fab0-b671-45f1-abcc-9f16810da2d3", "comment": "Malware payload (Heodo)", "value": "4d1eabb55379576acc55f235c9fa33c0dd162bae", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651249397, "uuid": "6d68d31e-d7b3-4b38-9d98-b7ebb1f97e2c", "comment": "Malware payload (Heodo)", "value": "c19654c8d3734ce26c0f1591d6811f579ebe34d2d8bfa644044c77fef3ac1124837845d7bffc071764e9f09175e11d77", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249397, "uuid": "518b524d-de0c-44ea-badb-79af0c238e00", "value": "T1D7C4AF4776994DF7EA27833A45D7D3322336FA9063139B6B6E60C6320F17AD06F85242", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249397, "uuid": "3f9f276d-e9ec-477e-828e-1982f065e688", "value": "be3d2636432f5d8554b19a530d555ba2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249397, "uuid": "11d96380-777f-4f92-a093-ee4a1ab8ea84", "value": "6144:JhZ02GdOOgPY+KUUAKM4cLuCKhS4OzJ1fyoogcK1GF2sD18e2k6SV4s68dTcEgDX:JhFfJKRM4c6CeOFzLcQUZvqXmI4For", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651249397, "uuid": "f4d74ab4-11d9-476a-ba77-6dbaba36c6a3", "value": 556597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651249397, "uuid": "7b23e8e2-2739-49aa-a4c4-b367672db1dd", "value": "application/x-dosexec", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651249397, "uuid": "8b820af6-6431-4e9c-a865-d65792256e15", "value": "0f90dcdb50474effbc4b1bac836e99f1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6af85df8-c782-11ec-8e58-42010a9c0032", "comment": "Malware payload (Mirai)", "timestamp": 1651212349, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212349, "uuid": "926f5f05-6cd4-457f-a420-7e11a920cbf7", "comment": "Malware payload (Mirai)", "value": "e8b9814f404502faee4588619f9630c8", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212349, "uuid": "c9835c6f-b630-481a-8d6f-78a35c67a420", "comment": "Malware payload (Mirai)", "value": "ff949e050b439430238b8e22e721e66466750f7efc55f7fecd58eb8ed7e246dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212349, "uuid": "48437caf-9c73-4206-a979-5fd25d45e006", "comment": "Malware payload (Mirai)", "value": "9cbe52bed9103a69a3e4f74fcb9466da9111924d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1651212349, "uuid": "8e4e85bf-b9b9-4c21-a66b-9946b696c393", "comment": "Malware payload (Mirai)", "value": "bc8aa62fe39e207783a8cfe18c9ff3b32a978f60dddc846d513a1faf910233ed5e7b539552894e87a01b8f05c36f9a23", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "arm", "colour": "#0BD886", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212349, "uuid": "b1cca9ed-164d-4c77-abda-4aa896e12a6d", "value": "T146631985B8819A25C6D553BBFE1F008E3316576CE2DE73128D141F647BCB91F0E6BA0A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212349, "uuid": "35faa198-e332-4569-8606-f7af76a037fe", "value": "1536:5InB0sYwqT2fRSBKl4iAr5FpEPDyAMW1/M1E6LeI9ibIRIKWg:gzY125SViS542XWhnIRIKWg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1651212349, "uuid": "ab0baf78-57ad-448a-ab2a-70ca094d63e9", "value": 67416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1651212349, "uuid": "758cd19e-e82a-4ff4-a3d1-73eebaab0e66", "value": "application/x-executable", "object_relation": "mimetype", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1651212349, "uuid": "095db8d6-2db6-46ae-bd66-ef230652ab05", "value": "e8b9814f404502faee4588619f9630c8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" } ] } }