{ "Event": { "published": true, "date": "2022-02-03", "threat_level_id": 2, "info": "MalwareBazaar malware samples for 2022-02-03", "timestamp": 1643932981, "analysis": 1, "event_creator_email": "bazaar@abuse.ch", "distribution": 3, "uuid": "f91b2966-071e-4666-a83f-57b14ff4cb84", "Orgc": { "name": "abuse.ch", "uuid": "9b086132-8588-49ed-97fd-8578a777822c" }, "Tag": [ { "colour": "#004646", "name": "type:OSINT" }, { "colour": "#fffff", "name": "tlp:white" } ], "Object": [ { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "34c52fb2-850a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643903942, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903942, "uuid": "26b40b39-79a4-44cb-b3bd-56ccd8e4e67a", "comment": "Malware payload (Heodo)", "value": "9ec5eb0d434eb84d310e459361e61a10", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903942, "uuid": "50d6fae4-cab0-485b-9f9b-05eb3f95e9f8", "comment": "Malware payload (Heodo)", "value": "000b0b9c575059a2ed9e380a63a06474b244cede406d118f1b0bb65f84e62e69", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903942, "uuid": "72131e93-bd15-48eb-ae3a-96164ad602f9", "comment": "Malware payload (Heodo)", "value": "c104047fc7f46067733969c928f6e0481d72896d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903942, "uuid": "da70cc91-4954-48c8-87bc-80493e71c194", "comment": "Malware payload (Heodo)", "value": "6907d04fe70d6d71a9126980ceb063477067d9c0239514f3b09c172b6c0a312088fa4eb7c56edecdba33767f8e5aff58", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903942, "uuid": "c92686a5-30a3-4128-a010-86f168565048", "value": "T12725BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903942, "uuid": "26fea7b3-8a8a-41a9-b40f-6b8da341b355", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903942, "uuid": "6a0ec797-93da-4222-a3f1-c854e9aad919", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2ghFIIm2mlg:kBiaa4powXiolDS2ghFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643903942, "uuid": "f9146258-2a75-4d80-b54d-71bf2f4e1704", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643903942, "uuid": "9e484134-70aa-42fa-803a-75268b76fe84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903942, "uuid": "b134a533-8701-4603-8638-3f1ca6527c57", "value": "9ec5eb0d434eb84d310e459361e61a10", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "229a02c2-84c4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643873847, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643873847, "uuid": "93d1f900-5981-42ea-bb25-a5e6939b6125", "comment": "Malware payload (Heodo)", "value": "13360af61366f53104cfbfb7a8cd8932", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643873847, "uuid": "15f21779-5ec3-41ce-8555-27e95b4fe459", "comment": "Malware payload (Heodo)", "value": "00672c54314a94fcac090c44abc3e2ee4dd3abbde40e58347484e6efb5f392a8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643873847, "uuid": "3a3e6f76-f03d-4efe-9486-cb609c71a68b", "comment": "Malware payload (Heodo)", "value": "973cfb38eaab08d1870deb9fd45f5255e87016d7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643873847, "uuid": "6aca4c24-b36a-4414-ac23-781775e9a2e2", "comment": "Malware payload (Heodo)", "value": "591ba14cc4e7ce15ee79418fdd03aa519c1ef43b2a39ae9605926c0dc480003585d5230a943e72536fb1871d5600403c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643873847, "uuid": "d0bfe73e-5968-423c-bdbb-a18035cd7ad4", "value": "T121E36B2576C5D9CADB0822350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643873847, "uuid": "fd1209ce-8a57-4fd0-92a2-94b6b8a288a4", "value": "3072:ecKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0P:ecKoSsxzNDZLDZjlbR868O8KlVH3dehF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643873847, "uuid": "a309c1b0-3815-4505-ae15-46cf2cc6ea7d", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643873847, "uuid": "803da1d8-769d-46a5-8fb1-1ff3292f65c6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643873847, "uuid": "33f2bb61-05e8-4548-8b5a-205957e5f910", "value": "2022-02-031532.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7928314-851b-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643911543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911543, "uuid": "c989af34-9ab8-42a1-8681-62a3ee172899", "comment": "Malware payload", "value": "d0dabb680a0d51872f2576754a4a891a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911543, "uuid": "b5c08ce4-9912-40e1-8d14-9db1356ba2f5", "comment": "Malware payload", "value": "00708c9a80d006002c3eedbee040c6d6027d148173374eba05fe6f97951ea4fc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911543, "uuid": "7f33d36f-18a6-4e7d-951e-5eb0dce467a3", "comment": "Malware payload", "value": "1b7f3054a563fd8f183dfaf137a47ab295be224d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911543, "uuid": "fe5efa2d-a39a-4647-81ea-edf7a2595546", "comment": "Malware payload", "value": "526cebb7d90dccd7dc9b2b47729de2ddbab203d4c25e2b0c890adb9fdb80723c7ffade6b861db0ac718383b654ec9cde", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911543, "uuid": "4ce397f4-cdd8-438e-bd17-c31331dfc98e", "value": "T15E94E1B0B1FB86A4F96B87B57578BCA0063132E398C5CA2C076861884FF5F15AF4465F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911543, "uuid": "4aabfb76-284b-46eb-b128-be6fe3b4b5f5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911543, "uuid": "64b45453-11aa-4fa6-b26a-e55094222693", "value": "12288:a7dvs58eEAVLanZk7xwoO9Yxy0TyqiQ6:B3IZk7fhTyxQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643911543, "uuid": "b97e4e7e-5527-4897-a354-fd33d4665e50", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643911543, "uuid": "dd1ac9a5-493b-4833-954a-f648e35dc730", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911543, "uuid": "c0a4ca16-2e17-4a91-ba60-e8ebe6a3864c", "value": "Catalogue-Qingdao Zhengdexiang.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f39bc6e5-852d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643919294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919294, "uuid": "243399e6-e8d9-4f83-a61d-2c754da22b08", "comment": "Malware payload (Heodo)", "value": "ba96cb72e60b13fd3533fe6542c0ae57", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919294, "uuid": "65cda7d2-77f0-492b-a447-4ba022a5aeb9", "comment": "Malware payload (Heodo)", "value": "00859c32c9de96886f8aeb25acd48bf27cf69c24318b10203e6866ce1beafb18", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919294, "uuid": "b3346a0d-1c92-4c21-8de5-3e6785cc1883", "comment": "Malware payload (Heodo)", "value": "707d1acb31a57ccd464701a13a23aa090f7d8228", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919294, "uuid": "d5b5ac29-51e0-459d-b804-725801f039f0", "comment": "Malware payload (Heodo)", "value": "70e874f9ab833156031636c99e6c998803621044c9609374df369fb912c94de397710ff63bb213b13f88bc997d63fcdf", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919294, "uuid": "a0af6d5c-5784-4d51-9bf5-533fa72444cb", "value": "T17E25CF103ECA40A1F64B153E006A73584FDD6A1507E1EADFDF44F8A7AB15CC2AA3946F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919294, "uuid": "96496fa5-1c3d-47c6-a143-b740aa74fb99", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919294, "uuid": "338286d3-f3c1-4861-a58e-30d08ac7e340", "value": "24576:aKzjU3EJ7mCRpnAOxxmd3uIqUUvoq116OzvMyv8FIIm2m+l7:al3g74mm9uIqUUn1xT8FIr2mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643919294, "uuid": "1d0d4b4e-8619-4a96-87fa-2c1b07f5961b", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643919294, "uuid": "37e673c1-bb8c-414f-98bd-3282d3a34c1f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919294, "uuid": "64fc18f0-1c42-4ba3-8e0b-13d2d6c90db4", "value": "emotet_exe_e5_00859c32c9de96886f8aeb25acd48bf27cf69c24318b10203e6866ce1beafb18_2022-02-03__201441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cb47a088-84de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643885296, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885296, "uuid": "7ce424a5-731a-431f-ab95-fa2ff4570546", "comment": "Malware payload (Heodo)", "value": "827a20828455c918472bddc643c01c8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885296, "uuid": "54d6909b-649b-4cec-a0a4-d1998531eb92", "comment": "Malware payload (Heodo)", "value": "00db6e6dcbaaf9af8a5f9332779c6e000f8296d65c9ccac46de939c38ec0357d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885296, "uuid": "6d73a45b-31bb-4f66-a14a-4c1e62a92694", "comment": "Malware payload (Heodo)", "value": "efb2d4e1676a351c3b1399dcb448ee4abffb7b5f", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885296, "uuid": "80cd6f25-b530-486c-a609-9f749477fe99", "comment": "Malware payload (Heodo)", "value": "d4cc2600d14a983f77b469c8539b10b20e5a71492e05df07f27526475a55fcfd5ade0927ce99ac965c5cf2dc8b0eb7d2", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885296, "uuid": "ff0ab809-bc07-4a98-b31b-c11332cf9e06", "value": "T1BB25BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885296, "uuid": "84aed280-64c9-4c9f-b5df-c96c0bb6acbd", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885296, "uuid": "5c2e2e61-706e-45d6-91cd-1cfd5261b036", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2g/FIIm2mlg:kBiaa4powXiolDS2g/FIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885296, "uuid": "021f4ccf-4aed-421d-bc4a-e2d7f3699f2a", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885296, "uuid": "2b30c601-949a-4d69-9b08-08fc37de7bf0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885296, "uuid": "1de8b5a6-28cd-4bc2-8ed3-7dff72c10b06", "value": "827a20828455c918472bddc643c01c8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fb6568-852f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643919775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919775, "uuid": "cf2e4ebb-788b-4d82-ad12-ee9b8d2f474e", "comment": "Malware payload (Mirai)", "value": "6959ce863bc362d5f5099b408cc0d212", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919775, "uuid": "266d27fd-3f72-4d4e-8408-977b8ab88e61", "comment": "Malware payload (Mirai)", "value": "00f76b8186c5f4afd8dde0590244f18de377a0054d5c8d0b5f861280f7f24f5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919775, "uuid": "2e6473ff-d44d-41d7-93d9-c8920c61babd", "comment": "Malware payload (Mirai)", "value": "b7b1753740d2fa9feb380355b7972ea5a7c70893", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919775, "uuid": "a427e98b-fd65-414b-b956-534834dc4271", "comment": "Malware payload (Mirai)", "value": "53b81dfdd30d42bacc456c9dbcb979217b0622e6b99b2c2312ce0c23a64978e711dbe28b9ad272b82923aca6aab1f4c9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919775, "uuid": "8ebd3412-cb17-437e-afe8-9df12e622c43", "value": "T19E13F13DB31A1875E4224CB256B697F29FB85FFB7833A5455660D2AA8E130FC18C3E40", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919775, "uuid": "f503082f-0e9c-4de1-9158-717e38fc2455", "value": "768:01KuALliT90hRCpVtuyssWjciPfafuKYxfmUUP/gCN4JgGlzDpUYsye:AKFhiTCjCp/r0tXaxY3UP/KVqYg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643919775, "uuid": "9404b729-c2ff-46b2-8ffd-5fb836b1f1a4", "value": 43388, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643919775, "uuid": "a8b1d385-4402-4d61-86cc-71f87f79d737", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919775, "uuid": "52eed8b4-3308-42f0-bb33-c6ef22a944ef", "value": "6959ce863bc362d5f5099b408cc0d212", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9987d8c2-850c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904970, "uuid": "8c7ec6a4-3356-4154-a8d2-f9fe1cfac85e", "comment": "Malware payload (Heodo)", "value": "944686c9b6b129374e6a9edf152fc4d5", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904970, "uuid": "a2b029ea-e972-46bc-a0b0-36c856c0822f", "comment": "Malware payload (Heodo)", "value": "010338dd62545a08d983e615c215ad897338b2d08d707bbdd03cb050a4689fc5", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904970, "uuid": "a9626e50-9320-46d1-99c8-617b6279fafb", "comment": "Malware payload (Heodo)", "value": "cee109f08ce410a83ce436003c496c4ad52ca8cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904970, "uuid": "605e67a4-101d-481f-abfe-79374863309c", "comment": "Malware payload (Heodo)", "value": "f5e8be0f68d14144dfc298970b7a24db760980b8e98efc1a14af555ba07ae1be9ad159f9260ddcb8bee8fcd69fdefe72", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904970, "uuid": "44289244-2b8c-417e-b50f-e0814f860595", "value": "T1B2D4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904970, "uuid": "477b2e79-850a-4ccb-9da1-7567c899fddb", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904970, "uuid": "943a79f2-5829-41c4-8ff5-a1839909c516", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBPb7+7/Q0xIop1KpR:JynoxcCOllFxBP27LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904970, "uuid": "6f3af552-8305-40df-b39c-933390518228", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904970, "uuid": "b9407f95-17a3-4680-a979-9576dfb312ce", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904970, "uuid": "1c70693f-2228-41d4-8a8b-c0ec4637ffe6", "value": "emotet_exe_e4_010338dd62545a08d983e615c215ad897338b2d08d707bbdd03cb050a4689fc5_2022-02-03__161601.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "756acaef-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856376, "uuid": "beeeb926-77d5-401a-9793-832f4c0c11b6", "comment": "Malware payload (Heodo)", "value": "47e6695ec403ecfd3bf1602dc75e0720", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856376, "uuid": "477ed5fc-af61-42b0-909e-11cb71290d41", "comment": "Malware payload (Heodo)", "value": "0119d5d26c0ee166211677f5ebd38350bb350512a597962d185946a06391a397", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856376, "uuid": "72517ceb-941f-4808-8f8a-f17c7b2f1a57", "comment": "Malware payload (Heodo)", "value": "4a6b7f983807db827662aeba6b423167ddbf47a1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856376, "uuid": "6c9f5a94-e07c-40fa-b6de-40c433efcfde", "comment": "Malware payload (Heodo)", "value": "e921a956c7e9e83cad6e5d19be9aa2d17b99b789764874a60afa84e711d8286b3687f74b70a8ab300d35e977748e639f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856376, "uuid": "7fa864a8-050d-43fa-bf50-614b5c5085a6", "value": "T194E36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856376, "uuid": "c2a59926-1da8-44aa-99a1-13297ec5c10e", "value": "3072:8cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0J:8cKoSsxzNDZLDZjlbR868O8KlVH3dehL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856376, "uuid": "8f0e5f28-4fbb-4ed7-b3e6-a60a64485af8", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856376, "uuid": "cbfaa39d-3531-4bf9-bb97-3db0dd3e1e7f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856376, "uuid": "0180397d-4149-4da2-ae9f-2bb26ddee3ec", "value": "2022-2-3-47e6695ec403ecfd3bf1602dc75e0720.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3fea418-852d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643919295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919295, "uuid": "4e5c2b83-6a19-4cf7-82df-43c00bf3f6cf", "comment": "Malware payload (Heodo)", "value": "788ec4ef2bca0562b39aac50b03e55bf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919295, "uuid": "09a8288e-4b47-4397-b6ce-dd5138a9aefd", "comment": "Malware payload (Heodo)", "value": "015ab8ce9cc5d08362f5788a813eafa4d0ad343960547d44f346e0f987edbf5b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919295, "uuid": "87211519-a5ef-4e81-88fe-9d496141029b", "comment": "Malware payload (Heodo)", "value": "d0c9ce7324847385d22d049bcda7efe9463ac6ff", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919295, "uuid": "11b8999f-5b75-4ab2-b787-e659eb81b656", "comment": "Malware payload (Heodo)", "value": "e2ad33a898c53314300f968ba842332c3bea7dc00eb6f5b36af69c80f990aab452f477e521e8264659ff583ff8febc54", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919295, "uuid": "5b5a929b-68f3-43e1-ad19-c2aa362cf1cf", "value": "T12F25CF103ECA40A1F64B153E006A73584FDD6A1507E1EADFDF44F8A7AB15CC2AA3946F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919295, "uuid": "948e1c5f-3582-40db-9106-b2493e352319", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919295, "uuid": "372ad243-9ac6-4c78-81db-59130609fd83", "value": "24576:aKzjU3EJ7mCRpnAOxxmd3uIqUUvoq116OzvMyvVFIIm2m+l7:al3g74mm9uIqUUn1xTVFIr2mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643919295, "uuid": "17aa423e-f66d-4447-a10e-38c3dc9e0e4a", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643919295, "uuid": "3b6ec618-4602-4243-a779-9d45c5f669ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919295, "uuid": "2d8c1fe0-3900-4322-a5f0-6cb5905c1755", "value": "emotet_exe_e5_015ab8ce9cc5d08362f5788a813eafa4d0ad343960547d44f346e0f987edbf5b_2022-02-03__201441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "be4101de-84de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643885275, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885275, "uuid": "cdd6a6f4-71bd-4fd7-b05f-09683c5f4519", "comment": "Malware payload (Heodo)", "value": "ae0474b5bd06a23b91ef6aab8cee5ff7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885275, "uuid": "62f95d36-00dc-4864-add1-4daa8f708932", "comment": "Malware payload (Heodo)", "value": "01b10978d7411db451aac75187f64631be01e026c99b543599c8e898275fc4ab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885275, "uuid": "d91bb68e-c48f-4bb6-967a-2d43760c3dff", "comment": "Malware payload (Heodo)", "value": "d679c96cb60db1ed7520492a0e27de5de0d6d154", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885275, "uuid": "889817bf-6b18-472d-a4ef-89894ee9aa1b", "comment": "Malware payload (Heodo)", "value": "52bba1d638a846c482a6de54b77b3846e91a5aa458066462b72c85f236cb9f472b5e2ba891f676204b6230faa66a88a4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885275, "uuid": "7e9aaca1-f41b-4757-8f79-204bcdf730cd", "value": "T1E725C0216D8A40E6FA47193E0069B3544FDC69050BE0E8CFEF54F9A66F12CC25B785AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885275, "uuid": "f6d74418-667e-4aef-a2fd-74bc68d87b68", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885275, "uuid": "30787182-b1f9-4e4e-9ded-3dca70dac603", "value": "24576:vyj4pucLsugl4zCy9fG+OVE+cXcs2vUHFIIm2m0:vzfnl9fYVoDvHFIr2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885275, "uuid": "d6ba86e7-ef45-4e59-bc5d-1eee5219e048", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885275, "uuid": "e408ab1b-7f7f-4b29-91aa-ece6514e9920", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885275, "uuid": "efccdbca-180a-46ae-8b7a-e7077a2dc565", "value": "ae0474b5bd06a23b91ef6aab8cee5ff7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b1bf08fc-8507-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643902863, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902863, "uuid": "603f7321-dbae-4aad-8567-e5cc3c8a9cea", "comment": "Malware payload (Heodo)", "value": "24efc7df263f2c1535d24cbf99a8e69c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902863, "uuid": "f898394d-77df-42a2-aef3-2e3e0ee2f41d", "comment": "Malware payload (Heodo)", "value": "0206283dfe3a18f60bda83a38321807e97bc3fb1546c44f4134e81696873d1f4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902863, "uuid": "8e05b24c-32bc-4f0c-b669-b7306c16be3a", "comment": "Malware payload (Heodo)", "value": "0ff3fdd3be9876a42a2c3314bd58c76ac0efe4a5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902863, "uuid": "cc275fae-07cf-4e65-8eeb-b06f58c6acfc", "comment": "Malware payload (Heodo)", "value": "2d859c8e6cf2d01d918d69c4921dd77207f1779d28413f5e7ae6218edba5f2611f5294924607b4978de8beea48a4384f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902863, "uuid": "f88d9333-3a26-450e-80d9-6686347a7b73", "value": "T1BAA3BE4DE1130DB8F2D6D43AC1485E107BB702CC88827B57B684896DBF9C2F9569F17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902863, "uuid": "3971fc99-06de-4699-a213-cfcb67145fd1", "value": "3072:d7vj5qu8hahYIfiQOVOveshVf4KwJQikmGo:d7vj5rbtO8eOaDPk1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643902863, "uuid": "2dc76230-79f9-448e-937c-0046e4f49d6e", "value": 105969, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643902863, "uuid": "dffcdbb2-d27a-47af-820a-ff9dc8b00b05", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902863, "uuid": "c79eba5a-8d4c-4607-9101-5007824bc5ea", "value": "tmpbg1a2a8f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0f90487-8484-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846705, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846705, "uuid": "9a5f1101-a09e-4b7c-82db-98781a8c56df", "comment": "Malware payload (Heodo)", "value": "c6675631afd0fc261a70073038c2fd53", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846705, "uuid": "4cc66341-a296-4ebd-908b-c2d7e51a315f", "comment": "Malware payload (Heodo)", "value": "02198395405a68eaaf600ef6cb50650985d5bebcc2944cc785d0bf23847dc6ba", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846705, "uuid": "53eef055-00aa-44ea-b00b-35817bd53436", "comment": "Malware payload (Heodo)", "value": "710a2bfd75ca8f2c976e6e1a5137586b89371ec4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846705, "uuid": "a1c99e4c-32bf-4cad-ab76-224d2ca68b10", "comment": "Malware payload (Heodo)", "value": "641ef9af0d592ef8d8a654fef14ad4d172f235bca4a2d9a3261275bc619b065ef097cd1c203f4a82bf75d5a5390e1b64", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846705, "uuid": "3f331ad7-b5ad-4732-805e-e1d8b00dddfb", "value": "T10FE37C6576C5D9C6DB0822350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846705, "uuid": "0c9292a0-e7e2-4d1b-a8d9-44bb0a375859", "value": "3072:acKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0h:acKoSsxzNDZLDZjlbR868O8KlVH3dehb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846705, "uuid": "59ab10e3-2a96-4c82-9401-363fb44037a5", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846705, "uuid": "2ca933ff-7f39-4676-84d1-3837df9d5fab", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846705, "uuid": "9365f7d4-dbe4-4b9f-9188-691d170c6547", "value": "2022-2-3-c6675631afd0fc261a70073038c2fd53.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d8f05831-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883601, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883601, "uuid": "a9ac36f5-dbc2-47e0-8235-5173de6032c4", "comment": "Malware payload (SilentBuilder)", "value": "87045aecf09e6a10c0ba7ac85ac9e77a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883601, "uuid": "8eed6b76-48e5-40d9-808c-a80463b27d95", "comment": "Malware payload (SilentBuilder)", "value": "0259a96a1b4dca90747584147fec6953a09d8bf7b73353cd393b7887f0cab812", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883601, "uuid": "ab3e3212-ba1b-401a-aa35-564d87c73914", "comment": "Malware payload (SilentBuilder)", "value": "ac1401feb085c6a3b8484515fbc573ab8643f2a5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883601, "uuid": "a0a6904a-5f87-419d-b0e4-e5c44e847482", "comment": "Malware payload (SilentBuilder)", "value": "6f0c6ff91be3e1d7d7e60da0333f0a0358b75b50518523a6d47fc2fd5a6b7d7997730ff39b74cd716057cf63d6688c2d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883601, "uuid": "392fad24-516a-4da6-b375-8a2a0cf4053e", "value": "T1EBB37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883601, "uuid": "b0790755-5d3b-4000-bd7e-65a76f29eee5", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49X:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883601, "uuid": "a03408cf-0000-44c5-94b0-cae8b231e663", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883601, "uuid": "bce59d91-9764-4284-be2a-0c9157ef62fe", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883601, "uuid": "dd0fefc3-e587-4816-99af-bb7ab4482707", "value": "2022-02-03-87045aecf09e6a10c0ba7ac85ac9e77a_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8acfcc2f-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855983, "uuid": "acfdca9b-c621-47d9-9573-773adfce7ad6", "comment": "Malware payload (Heodo)", "value": "bd8bd218005955b3f2ec2b35e285ca7b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855983, "uuid": "0e36d8b5-d789-4f9e-aaa5-5ce1f2c43f75", "comment": "Malware payload (Heodo)", "value": "02805bb4db3b9287884321f9afabc3af7251f2d0331fbe5f4c5b5822d9616b2e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855983, "uuid": "9b3a0537-30e4-46c8-a3dd-21f28da8c3c5", "comment": "Malware payload (Heodo)", "value": "d54d5369edc76797718a8b2fa9813ede634b6e92", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855983, "uuid": "463b8007-3752-4f83-a43a-01283406c5c4", "comment": "Malware payload (Heodo)", "value": "633ca38862c09dc95dbee6dcfa3d9e349d58c2d2fba484e20241f0341bb0671f6711936f4d21716a3b10f1c806a4f60e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855983, "uuid": "61edfc0d-9e00-48e5-b0e9-bbd86b6ab3ff", "value": "T12AE36B6576C5D9CADB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855983, "uuid": "521a21c3-e658-42fc-b458-c08122d12a2e", "value": "3072:/cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0l:/cKoSsxzNDZLDZjlbR868O8KlVH3dehf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855983, "uuid": "13ec29e1-9f1c-491f-8e5f-93ac1d624d76", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855983, "uuid": "ee15c643-26c2-4125-88d7-9742bfe5119a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855983, "uuid": "c6909425-ce4a-45ce-a8ae-3e6b42ff455c", "value": "2022-02-03-bd8bd218005955b3f2ec2b35e285ca7b_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a89f88fe-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856462, "uuid": "66463597-af42-413b-a42a-d32deca42f0d", "comment": "Malware payload (Heodo)", "value": "552d4cef341a46918d91468fdedfe027", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856462, "uuid": "3b00caa8-4aca-45e8-8253-bb638a7b4b96", "comment": "Malware payload (Heodo)", "value": "02970942f42c4c63b2e5d2292e9aeebc98ac480289c763a00ffae961c652f9ca", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856462, "uuid": "833eb011-093a-4da5-890a-ddd7f60bc58a", "comment": "Malware payload (Heodo)", "value": "ade27a1b06abb240afeabd423302294f4db24142", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856462, "uuid": "ac631d29-382a-47df-8aad-e814975ca3a1", "comment": "Malware payload (Heodo)", "value": "38821842fda248f63ef9131bb86b3982b8ba5928e80357cfd784ca6831491c6956ddb8e9c0b73985d41019653c2cd6c0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856462, "uuid": "1a1c3042-5313-4a66-bd22-ba2b4d826698", "value": "T19CE36B2576C5D9CADB0822350ADACAEE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856462, "uuid": "8bc09a13-fd00-4338-a6e1-d939b850889e", "value": "3072:zcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0Y:zcKoSsxzNDZLDZjlbR868O8KlVH3dehS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856462, "uuid": "8b944a18-9f77-4436-9a69-f8660b4629fb", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856462, "uuid": "ad8d2736-4bf4-4d08-a48c-4de8a23c0a3d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856462, "uuid": "022cfb2f-4cba-4f79-8101-662a31ecf1f7", "value": "2022-2-3-552d4cef341a46918d91468fdedfe027.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6c0c5219-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883848, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883848, "uuid": "7e1b9cb4-95a6-4be2-82fc-1ec09a01566d", "comment": "Malware payload (Heodo)", "value": "8bd2793f7eb29bc1cf70cdd4cd54c522", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883848, "uuid": "c14a9a79-707d-4617-8f6f-c90e1ca35531", "comment": "Malware payload (Heodo)", "value": "02d4cd21af85e8d6bcda28389a5e90724f493160429af74fea44b13ebf25c9bc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883848, "uuid": "d129bcd9-618d-4d5e-84bf-7bba4ec83aaa", "comment": "Malware payload (Heodo)", "value": "2b0a6e0e4a4ce780cdcb7d237ea1dec59aae50ab", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883848, "uuid": "bf21dba8-cc7e-43fa-a167-f195c2229a01", "comment": "Malware payload (Heodo)", "value": "b4f887e50420e3838b3f015a1867f9fe87e3ec65549c6274dc09555c5a5bbc19ce6e93f5417a383e8b1039af7133cbea", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883848, "uuid": "d8b7acda-5f14-4552-a26b-12b3e03044b4", "value": "T11BE37B2576C5D9CADB0922350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883848, "uuid": "de4704b2-4c75-47f5-b151-c8a353eaff34", "value": "3072:jcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0W:jcKoSsxzNDZLDZjlbR868O8KlVH3dehi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883848, "uuid": "e5b33948-e1ae-4ed8-a057-ab4a15bf8d4a", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883848, "uuid": "aca97c2c-cd62-4a56-b07a-6bf1896f85e9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883848, "uuid": "9385901e-9b79-4741-af15-9901c80122f6", "value": "2022-02-03-8bd2793f7eb29bc1cf70cdd4cd54c522_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35c1a12a-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856269, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856269, "uuid": "bca90b7d-e21d-47a8-bb54-646cc7f7cd85", "comment": "Malware payload (SilentBuilder)", "value": "98ef64bdc1b66706381f81000c85f21a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856269, "uuid": "1f2f0424-12b3-4ac5-9158-dc5284673a23", "comment": "Malware payload (SilentBuilder)", "value": "02ff93a7b02f0d22aec8586e0114dcc091fc0e714a1c0a24d621c239e0b146ee", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856269, "uuid": "d51d1fee-19d5-44ec-b0ee-5d046dacb946", "comment": "Malware payload (SilentBuilder)", "value": "d9b975f55eeb112ac9f8c3500d11627097ba7fd8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856269, "uuid": "e0513638-6bb9-4bd3-bdf7-df50bb7b9da1", "comment": "Malware payload (SilentBuilder)", "value": "af941b524fa68efc9639db20207005bb7d8f2d7fd9ee1a82d185c41b6456a8b4dd63cddd6885108f94d95c7bf0e1a35f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856269, "uuid": "9d4122bc-df16-4a4b-b0c8-8cf4737fa6b9", "value": "T176A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856269, "uuid": "bec38a6a-bc49-443a-91ef-e5d9802327be", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4N4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856269, "uuid": "093250f0-3115-42df-b7a2-c98a681c2669", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856269, "uuid": "a00dae25-7137-49e7-aeec-6b7f51510bf1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856269, "uuid": "d5db389b-a847-4454-9d66-a1b5c0b01db4", "value": "2022-02-03-98ef64bdc1b66706381f81000c85f21a_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5fe33a3-84fc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643898253, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898253, "uuid": "a3a5a3d7-c7f8-4a37-ac1f-9004f91afb50", "comment": "Malware payload", "value": "4b1c4c8befca2b00fb584edf5e1fd119", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898253, "uuid": "3c51443f-11f5-4791-b352-35479041a298", "comment": "Malware payload", "value": "0380bb16e0489358a9c8920e7ba3c5d82ae57529b69b767ee7d305f88bb69395", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898253, "uuid": "7f52f5a4-c454-49b5-a378-43b65fd3c307", "comment": "Malware payload", "value": "ed9b607dc2f1f65ffdd1679badce9ceb4c0043ad", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898253, "uuid": "d8bd610d-21d3-4250-ae5e-d4774852dd3e", "comment": "Malware payload", "value": "1c75fd0e96f972e8f859291fb079ae4d423ec6e42bf908c20ffd191da5aa020a54fc752356bea74e54c720233235364a", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898253, "uuid": "7c4a86a6-831d-445e-a57e-2fbbfb6d870c", "value": "T16214121F3E49A135EE7357B2A038515B22BEFE208E21D188765E3A55BC3725D80912FF", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898253, "uuid": "b0385c61-59bf-45ec-a593-55d6bbe25b03", "value": "3072:Tg4Oe6HPk2bOPRx8m+9opHroKCOEiof3/lIj9Ng6hrHDk7SQPtcD2ovy5lgesuuw:Ye6vk2KPR7+9QJEioPlIj9q6lH/eU/1s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898253, "uuid": "7cad5622-f456-4cb0-92b7-fb0fc18c90cd", "value": 191864, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898253, "uuid": "ed261529-b90b-40b7-a962-793df1a37b11", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898253, "uuid": "d53c5de9-fa38-4ea2-aa8b-3dc651124d82", "value": "PR 87001 & 87002.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea28e872-84fc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1643898233, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898233, "uuid": "4d7815a9-2ea1-47c9-b9a7-5eb3f1ae4124", "comment": "Malware payload (Formbook)", "value": "8bd6ccac65e8b2d071748df2ea006dfd", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898233, "uuid": "8a16d0ca-e37a-4db3-861d-6561f5b23d42", "comment": "Malware payload (Formbook)", "value": "03b47580bc50ec16ca78e7f5519cfa278f6bd36c4f1a826008931882b5212f7b", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898233, "uuid": "cf1e7f03-5d78-434e-a435-a821e4a0e0c9", "comment": "Malware payload (Formbook)", "value": "6a84ba74c8f372d5deca471a87bdd40555f55d5f", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898233, "uuid": "f12aaf85-6e62-43c6-9f97-e55eb9d50c0a", "comment": "Malware payload (Formbook)", "value": "f8bf9523e274a9f7b7dd108e7e119c82be737b994f536fb8d80cca115a620104042fd163b7212ea048d335338a2ebfee", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898233, "uuid": "deeb898f-1452-4f22-8a44-c1b277d4cf03", "value": "T1CC14024AED66A533C1DBEE3168B161CE1AD2DCC08B2165E2E117B80D3D3DBA5523139B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898233, "uuid": "4e83e4e6-cbb6-42fe-a6d7-f18655be20c6", "value": "3072:WnpXbpTj2nIrEkwY8sXSqIl77XKDZN21u8x+hWiG2QXesWCbnb0xFj8Dw9henwuH:WpX9TKIrEHaXwl7LqN981iGdpWunb0X+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898233, "uuid": "c1bab504-9883-4b35-99b9-be0c3acce074", "value": 191912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898233, "uuid": "3591bb4a-d06c-42a2-9c7c-3f85522b1506", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898233, "uuid": "c41639a1-1fab-493c-b87b-90b9375a24eb", "value": "Purchase Order SJ24758 from International Electronic Design Group, Inc.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3818400-8504-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643901685, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901685, "uuid": "edae4011-b5e0-4b3f-b913-13fd9e34b17d", "comment": "Malware payload (SilentBuilder)", "value": "0635c32e7d5d1c5ef0af45cc211275c4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901685, "uuid": "4ad8fdfd-2bfb-46d7-b9e4-77868296761b", "comment": "Malware payload (SilentBuilder)", "value": "041b0fe5188d02dbf25d642eeb2bc492a906a0fa8efdec03ab41f4e0d0e6b26c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901685, "uuid": "facad301-7d4a-4053-b5cc-149d79fdda11", "comment": "Malware payload (SilentBuilder)", "value": "39ab1f9ed969b48890a591e8795159789f712487", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901685, "uuid": "c3d09cf4-0b3d-47c2-a89e-cb3af7e3fac9", "comment": "Malware payload (SilentBuilder)", "value": "4acbdbc64b5533c6977d5de4e580606cf9ecc6cb2d49d462fb41ae31a252181f8e2d62c7d106a65257f01fd7a3def0dd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901685, "uuid": "557c9e8b-9ae9-497c-84ff-ab10c9f8752b", "value": "T101E39D8AF25B0D68F192CA3584DA4B1437B39CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901685, "uuid": "db29d595-da80-4062-8566-332b223f763c", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgfquZha9YILiQaVObeshRTEKwJQiQmGo:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643901685, "uuid": "f5b35818-3792-4015-8bfd-cf54ee817427", "value": 148484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643901685, "uuid": "13f6d9cb-9404-4367-808d-19d5014dbc88", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901685, "uuid": "8c586370-b4e9-49c3-9063-636dc0646b51", "value": "tmpjtkh6puk", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1169c98-84ff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643899533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899533, "uuid": "e01e6b72-c13a-447a-9e29-5ec2fbed67c4", "comment": "Malware payload", "value": "73313044a840c09dca71efa90b8cf5cf", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899533, "uuid": "9db37005-182a-4cc5-a35f-855c21d71d2c", "comment": "Malware payload", "value": "043384896fd11dcafe84b2107a20bd2d1ac458e1fb37ff4337f649e3814cff83", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899533, "uuid": "5f2acf46-4308-4525-832d-2376ec92b9f8", "comment": "Malware payload", "value": "1ca4e6e896102ceca599cabfdbd4c271641ffcbc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899533, "uuid": "18404889-3883-4fdb-a096-62cf28203ece", "comment": "Malware payload", "value": "4563522fa830be2ca6122c8907479ae8fd801a9c71ba2e347d7e6314b36472c83b90630418b52ba1a0f4097f27f93153", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899533, "uuid": "92c31474-3ecc-4ab6-84a8-967c8b793712", "value": "T10BC39D8EF11B0D78F1928A3A84964A5437B35D9C4D5B17437748B72EBEB82F0461723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899533, "uuid": "603b3264-65ed-4648-a911-cc9bb9a7567e", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgfquZha9YILiQaVObeshRTEKwJQiQmGo:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899533, "uuid": "dd1a5c66-495b-4ad4-887a-054d960c9c12", "value": 119581, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899533, "uuid": "8546e1dd-02f1-4307-878f-43d9878899a7", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899533, "uuid": "3a0effc4-26e4-480e-90a4-e6ce052904c2", "value": "tmp38v9p6cy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c677492-84cd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643877890, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877890, "uuid": "83bfe5c4-d61f-4523-94fe-ccd86f84db23", "comment": "Malware payload (AgentTesla)", "value": "bf2a1c9e4ab0e36cb2e2bf6cef012263", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877890, "uuid": "5979d0bc-50ef-42a1-b9a3-84b867b84965", "comment": "Malware payload (AgentTesla)", "value": "0435b333a42d5d94011aef9467d6a579e6610aba05a1f56dfa07baced8e5615f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877890, "uuid": "8ba6c612-28b0-4f3f-a2a2-a05261ac2b42", "comment": "Malware payload (AgentTesla)", "value": "692a7f67c9cb3b9d23e72cfd8c8cbc24729078dc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877890, "uuid": "a519d3b9-cc87-44ac-abbc-afec68858b60", "comment": "Malware payload (AgentTesla)", "value": "14f5c6ea7527288d92cd45e1f68b921b3f4340a28a7b0ff10b95a3028173ed2ca0d14a4adf77690ca8d7886ef364600e", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877890, "uuid": "d6af2f16-23d9-42cd-ac74-adc06808ab55", "value": "T1BC257CB8312031DFC99BC4719B5C0DA8EE507C3AA30B591F5053796DC96DAA6CF181FA", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877890, "uuid": "d393e2c1-06a8-4306-b583-100819515dea", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877890, "uuid": "41cff264-6bf8-402d-95de-c184555ebdfc", "value": "12288:O+lfTQoOyocDQkjdh0BK/SQeNuo0pqOwBO8GvCpkUF7wDaSwzU8tW90WiccFW1M+:O2r8bSQGgQ8L0pMB/GqXejAF+g0Gwh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643877890, "uuid": "00e88f17-b613-4005-9bb4-a8ce74b226f2", "value": 1006080, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643877890, "uuid": "0acc1bc5-d287-4f92-a148-e4e1aa0ae700", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877890, "uuid": "a6bbd8d3-4420-4e14-89be-801ad209b19f", "value": "Invoice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51b280f1-850d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905279, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905279, "uuid": "c7e14810-3ef5-44d4-9f72-6250dcf37998", "comment": "Malware payload (Heodo)", "value": "c297fdf76ff5584f7c66f7df05b2629c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905279, "uuid": "9df135d7-39c6-4aa1-addc-57b235f99d92", "comment": "Malware payload (Heodo)", "value": "0442d993321f5c34b7a1ec6daee83e8c2ab848731b60aec426a7736fdf6b567a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905279, "uuid": "bbe69f30-1ecf-4cf7-bcef-1fa1031b0c55", "comment": "Malware payload (Heodo)", "value": "e93dff32145f021594ce18ddc1abe50307bcbeb4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905279, "uuid": "ea93abc8-2e9e-484f-8f1f-edc2cf4394b1", "comment": "Malware payload (Heodo)", "value": "8c69e791c84040871e9539133f09e5f6e401a3711bc2e85a38f43b9127e8401f35c73fde15e449fbe1aa90d026b43efd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905279, "uuid": "0096ad44-415a-4536-9ebc-f27c38bf659e", "value": "T12AE39D26B695C95AD91407311DD7CAF7333BBC818EB683433289F71E6D7B6908A23247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905279, "uuid": "3b2a8d38-af5c-4265-9bbd-276872a2c7a3", "value": "3072:zcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcs:zcKoSsxzNDZLDZjlbR868O8KlVH3Ueho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905279, "uuid": "564c0bba-30f2-4885-8411-ec4d8c738caf", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905279, "uuid": "d49ff56a-3ec2-4aa7-b9ea-adfc53584024", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905279, "uuid": "fc9a5779-69ac-49ed-848f-77047776b1d5", "value": "tmptlgts6l0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d612e20-8520-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643913405, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913405, "uuid": "263a1200-a5df-4f55-9820-67354c00af56", "comment": "Malware payload (Heodo)", "value": "b263127a623f3ce1ff49e2f08b274a62", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913405, "uuid": "cda6bafa-0eb4-41f3-9678-21d2dbb4fe87", "comment": "Malware payload (Heodo)", "value": "047a4fc50c346aa35c6cc19133b5421ab27bae8a03d334004977cfa3a9a47e05", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913405, "uuid": "7e6d8180-063c-4982-9424-e54be818d7fd", "comment": "Malware payload (Heodo)", "value": "65af14cdf70e22e1f6489a138b6db199d9dc0aff", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913405, "uuid": "c8d14e3e-6ede-4ca1-9f47-aeb19ceedcde", "comment": "Malware payload (Heodo)", "value": "efa65db3e5b09e328bc694a2eb0bda522ac2e7a6f62557837e7f5b557adfca99df66fdf09df12440afa8b448ba5e4089", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913405, "uuid": "46337c3a-4394-452b-a158-bb424e838d73", "value": "T191E39D26B685C95AD91417311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913405, "uuid": "e2d11364-bf54-4c5e-bdca-01b0817da10b", "value": "3072:XcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4LcW:XcKoSsxzNDZLDZjlbR868O8KlVH3UehK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643913405, "uuid": "92517ed0-5f44-4111-b41c-49ef6112372b", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643913405, "uuid": "5e5fcd00-ffbd-40f1-90c9-e0550f04cfa2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913405, "uuid": "0add6064-fe3d-4d75-a1ca-520fcc1aa265", "value": "tmp1y6c_51v", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2241a770-851c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643911642, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911642, "uuid": "2befa268-fad5-484f-8558-2c260bd2abae", "comment": "Malware payload (Heodo)", "value": "cfae615550d59a3eb368106fff7a85ab", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911642, "uuid": "dfdea01e-5fe1-4ab2-b68e-cfd97fc12976", "comment": "Malware payload (Heodo)", "value": "049ab888d63d2aa06b36969575698c262adffafd7b8959076cd33e7f662e3b2d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911642, "uuid": "e89e5067-f69c-4f13-a36f-2d2293f6ba65", "comment": "Malware payload (Heodo)", "value": "8cd4e3f241c7d22268d91785d325a075f4480bfb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911642, "uuid": "1a3cbb1c-1c69-4363-afd2-4ea0bbf2a7a7", "comment": "Malware payload (Heodo)", "value": "545d6d3a539a96aebbd234664d52768e3aaf9a4e1648844cb1fa9e521260b7ab61a54518f4e138bbeb8c449f407a0a89", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911642, "uuid": "58c64e2a-bab6-4f2d-a686-fe5fd12ca792", "value": "T1FAE39D26B685C95AD91417311DD7CAF7333BBC818E7683433289F71F6E7B6908A22207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911642, "uuid": "d16a0e07-6ff0-410e-909b-aa84c2b2984e", "value": "3072:ucKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcu:ucKoSsxzNDZLDZjlbR868O8KlVH3UehK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643911642, "uuid": "c9a774f8-a18b-4a54-b446-ea44ba12ac13", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643911642, "uuid": "47d0fa27-ab29-4410-adb7-224bf02cc84d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911642, "uuid": "34b8d347-078c-4cb9-abc6-41f75ae4d634", "value": "tmp_qqc5tkf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23828545-84c9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643875996, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875996, "uuid": "ec1b87ea-aa92-4668-9529-6ba28ad8d754", "comment": "Malware payload (Heodo)", "value": "81c4e38a5354bee332217987789dc7a4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875996, "uuid": "41b2b3c1-9c49-458e-8c94-ad0edc3cb587", "comment": "Malware payload (Heodo)", "value": "04bd1d2d1969099e78c029c8874df9cabe801614d881a94c3d4d40fc294ce2d5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875996, "uuid": "c9c5c028-b8ab-47fa-942b-ce87ff0f9546", "comment": "Malware payload (Heodo)", "value": "807a4bff6156b00329fb7b15d2de3ab0f92643e7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875996, "uuid": "933c4547-1875-4332-9906-4101b9a2bd6e", "comment": "Malware payload (Heodo)", "value": "b5d2c0ce24ccc49ea8f9a6731b9517ee1776a645878fb0bf473de3e4fc8d20280cc47140ba6c26f639990f7cea3e9236", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875996, "uuid": "da00139e-5224-4f12-ac02-62c45e6cf474", "value": "T108E36C2576C5D9CADB0822350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875996, "uuid": "d0bef559-00c0-4cbb-8ba2-3df00dce9249", "value": "3072:vcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx00:vcKoSsxzNDZLDZjlbR868O8KlVH3deh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875996, "uuid": "cb828e4f-e850-4c41-8b9c-eb70db3b8111", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875996, "uuid": "e07cda90-eb86-43e4-9889-6acd68287cd5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875996, "uuid": "ce795a00-f3fd-4871-bd3e-b69f3b0ae1ea", "value": "83594880529865427391.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19fd6da-84d6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1643881898, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643881898, "uuid": "58a5176a-be74-45f8-b8a9-0bd95b338499", "comment": "Malware payload (Formbook)", "value": "006b707ab9cb500e9041b34e05b3558e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643881898, "uuid": "478da326-0ad0-44d4-a19c-4d48c50d0a7a", "comment": "Malware payload (Formbook)", "value": "04be32d668503594c7ea4d919cbc77216f0353fba1c22d451c95150542c96bdf", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643881898, "uuid": "36feacef-0e40-4098-9c44-f8bcbcd2a8a9", "comment": "Malware payload (Formbook)", "value": "a299fe0122dc2a90e050db2ba1ac8e1742adc833", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643881898, "uuid": "c8c39dc8-850b-4ffa-9d74-7bfbffcffb7b", "comment": "Malware payload (Formbook)", "value": "d969e0525339229e52800b8e5e5fb02176896acd6a9073c11f59c48cf2c549f5b373960f916e69e5d59bedd1da3e8e6f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xloader", "colour": "#EA12D8", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643881898, "uuid": "3f0cd4e4-9206-4fa4-af21-e48bfd843665", "value": "T106B4D1A0F6975592F51F9A31313AB85106363EE3AEC2DB191368F2080BF36505F76A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643881898, "uuid": "0b715d29-65c9-4f0d-b683-e18794701d45", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643881898, "uuid": "91e07de0-9cb2-4d9c-9706-f53d5f46a54e", "value": "12288:5F7p3IjJhY0r1nzRkcCq1/+1rCeufYprL7s++2K0J:qjJhY0RnzGUICPf+rs+W0J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643881898, "uuid": "7079d04e-043f-484f-9092-c2ae1f66c40c", "value": 524288, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643881898, "uuid": "c533d974-a508-49c0-a31d-fdd063f6a047", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643881898, "uuid": "3747b846-3f49-4327-ad05-db5bcb696a55", "value": "Quote order#098799.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae771db3-84fe-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1643898992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898992, "uuid": "bbb0c50e-eccb-47ce-81a1-b2e998163285", "comment": "Malware payload (AveMariaRAT)", "value": "3d56d1a594878a948d7215c3b5f369e7", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898992, "uuid": "ebda99c7-206a-4a45-8ea1-6076b4d4260b", "comment": "Malware payload (AveMariaRAT)", "value": "04debc66c23d0532b90c4e70c00d4e1b16cb4a1a1c840495809dc9aa46afaee2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898992, "uuid": "632f2919-f68b-4289-a2b6-2a2cb3f4e9c9", "comment": "Malware payload (AveMariaRAT)", "value": "c091f8f626dacbde38a95a063d2300d6d339a6ce", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898992, "uuid": "c13b230b-85e2-48a4-a7cc-8e335b3bcb46", "comment": "Malware payload (AveMariaRAT)", "value": "15e9fb66231b22d3180abc497ffa18bf691126169883b290a29619e7851a6eda1f99b7158ca6694a2a1c9e7925041ffc", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898992, "uuid": "04cb7afe-490d-4a0a-9cda-a42d54a0df47", "value": "T1A81484823145DCDAE04329F258AFD57060787D9E8165CA0E3743BF2BA5E734234AB79E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898992, "uuid": "a9ef65f5-7553-4d94-a0ee-e3ca9661ba4e", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898992, "uuid": "31f956f8-33f5-4486-8040-ffb7edfbf7f7", "value": "3072:Vob4NnCDDRvLGurOAOkGt6+duWA/t/SHUebbxCbGgKk12qk/VPYm21KLbDoUQsN+:6bMstvLGlRLbMUgKs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898992, "uuid": "b0648f8d-0402-4988-a642-b4abac6ccfcf", "value": 200192, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898992, "uuid": "5f0d59c6-e089-48ef-a4ae-1b37fc502180", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898992, "uuid": "a92c9100-a45e-4c55-937b-616ed0b1032b", "value": "Yeni sipari\u015f _WJO-001,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8944a46-84fc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643898177, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898177, "uuid": "d9e91646-4598-4a42-93b7-7002bab94690", "comment": "Malware payload", "value": "45c9a8981c31caacad3188b3508dbf8f", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898177, "uuid": "dc097b05-ad4a-4eef-9e96-fdf405542edf", "comment": "Malware payload", "value": "04ea014907f8abca90dbe27346d98edc76c6552dd98db418d59d44d6c03dcf55", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898177, "uuid": "dc657a97-ff19-4680-94a2-3a8418de00cb", "comment": "Malware payload", "value": "7f8b5f61ce8246805dc4dfaa652f0e6b50e45568", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898177, "uuid": "5bbf4cd6-5d8c-4d22-b2d2-a958d2e6b36a", "comment": "Malware payload", "value": "55b29aa2748228e405383bd207503899db9eb93ac7efc2bc30ff744554fe32bc1a1efda2a7b1deeb3da4e73266a13eb7", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898177, "uuid": "bc203e67-fc2c-47ac-81fa-20176075dc72", "value": "T11B1412383F198584D8E75576B84B979E89F4FEEDCE1977375498B00B80F4809C888EB1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898177, "uuid": "5856c773-43bc-42a1-8d64-640d183a907d", "value": "3072:t7ZATaQl+T/VTa9jwHrOqIROKVRUc3s2MxTXkDyMqAArurTTm/+lSk:NeXQTha14SdXVRUIs2MxTXFMqARTg+D", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898177, "uuid": "3e125f76-3d5b-4e66-9b2a-ca2c8ea18580", "value": 191912, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898177, "uuid": "ad64bda5-8871-4ef1-bb9b-44343dd7974e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898177, "uuid": "aeb73ef7-8df1-4153-b3c9-0a254c5f7e99", "value": "Remittance+Advice.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "99b30174-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883925, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883925, "uuid": "68832afa-8ec8-45f3-be12-2cdbbce1efd7", "comment": "Malware payload (SilentBuilder)", "value": "bcfe74a08ab366fd97e7aa6a48e443a4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883925, "uuid": "d3905544-4289-4dc8-b519-6784f66fd6b6", "comment": "Malware payload (SilentBuilder)", "value": "04ff3b6cd0e25010259433ed0c6fc240c779781b1831b59bacae300afbcf9252", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883925, "uuid": "b63a24e4-6c33-4d89-b5b1-9dac7b967bdc", "comment": "Malware payload (SilentBuilder)", "value": "58e78629206118f073fedd9004b09d6313ed49ab", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883925, "uuid": "cf4d47bc-6425-4467-bfcf-f988cbe3f741", "comment": "Malware payload (SilentBuilder)", "value": "944fbbd0835e6b6f3365a83ed04b34ce630f9f703079074eaa773b5c39b2672cb80ecf7684522906dc4b0bcf6fcd2e1d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883925, "uuid": "0816ec1f-3e3f-4409-82fa-365a75ee7c17", "value": "T179B37C5A7365884EE55A8B3488F707962333ED208B5F06477115F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883925, "uuid": "6a81f99a-a56a-4c64-9122-3bd9f966c922", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd496:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883925, "uuid": "3baf83aa-eb0f-426e-bb0b-6938ad0da5d6", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883925, "uuid": "abe5955b-ec0f-4775-b51a-25bd2cebbf78", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883925, "uuid": "13293121-f753-43d9-b518-2d540fb9b7d9", "value": "2022-02-03-bcfe74a08ab366fd97e7aa6a48e443a4_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d3e8057e-84c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643874574, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874574, "uuid": "7ebe0c66-1b28-4146-a4ba-5159458822cc", "comment": "Malware payload (Heodo)", "value": "798a723780cdefa2e93c6705924c9f8c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874574, "uuid": "75cb2a3c-0ef7-4762-8c07-df38b6b34eb9", "comment": "Malware payload (Heodo)", "value": "0534876819680eff4056ac850db103ce56e03f7bdaa93ba88dff4d57f6d3ae40", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874574, "uuid": "70cf2028-99fb-4b24-b998-9e33d7c74641", "comment": "Malware payload (Heodo)", "value": "aa28b93e8a0511ccaf6860c62652d1f0335cefb5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874574, "uuid": "f750d91f-dce6-477f-89fc-e87982197887", "comment": "Malware payload (Heodo)", "value": "13ed38af6a7f1b6ac856296684ee626bfeaa566bcd899f78803efad46f7e6004d1c15cd465839654ea956b5d42bc9bbf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874574, "uuid": "c75c224c-6b9b-40d8-b862-6360dc915a5f", "value": "T135E37B65B6C5D9C6DB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874574, "uuid": "d88e5254-a074-4a71-9581-dca9eefc1c8d", "value": "3072:7cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0A:7cKoSsxzNDZLDZjlbR868O8KlVH3dehG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874574, "uuid": "53ac63d9-92a5-4f12-82cf-cb2abd79e840", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874574, "uuid": "dacbdf34-883f-442b-b0bc-026614027814", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874574, "uuid": "995dd5e7-de6e-447b-8bdc-fed64c67990c", "value": "CB-1428 report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f02979ad-8506-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643902538, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902538, "uuid": "1c3113f5-7b9f-4b50-8b24-4cd11eb70b98", "comment": "Malware payload (Heodo)", "value": "229affd64b66f51759c1da4120baa2d2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902538, "uuid": "18cf9235-890e-4461-9f7a-c2d728321d12", "comment": "Malware payload (Heodo)", "value": "0536b517959006dc6e7c3a27ed60407d06a577dc9b6142f8c6e8d2ff3e7832ed", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902538, "uuid": "a41a0995-f5e0-418b-8e8f-7824d9e20e83", "comment": "Malware payload (Heodo)", "value": "cce1c32d4d3950b6c670c9935a74b7d39da74543", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902538, "uuid": "2e5318ed-c9ec-4688-adb5-9f24d534a278", "comment": "Malware payload (Heodo)", "value": "3a6ff213480ffa39e08d17292680b1a2e6a7863dea8761131666c8b40c94857ab031406e1187944882bf274a16a59fef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902538, "uuid": "047329e3-643b-4dd9-9ce4-4fa48e6af26d", "value": "T1C6E39D26B685C95AD91417351DD7CAF7333BBC818E7683433289F71F6E7B6908A22207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902538, "uuid": "4c67e17b-c8d6-41ad-af6e-afd350f0699b", "value": "3072:UcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4LcC:UcKoSsxzNDZLDZjlbR868O8KlVH3Uehe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643902538, "uuid": "8c87e970-4a02-4a6f-b845-b2e4bea2c081", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643902538, "uuid": "acbc4efc-28d4-4017-87d8-49770f8535e5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902538, "uuid": "59bae208-67fa-4616-b4e7-fb7637366a5a", "value": "tmpy48_z7yv", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b72b9287-84ec-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643891276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891276, "uuid": "43545770-89fa-40c2-adaa-78900dd1d630", "comment": "Malware payload (Heodo)", "value": "d1795d710732bfe38b5a6203068d8a4b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891276, "uuid": "fa12ea96-e908-4643-ac60-5df8a41ff6fb", "comment": "Malware payload (Heodo)", "value": "056461d4fc48b5b8ddfa2d485a05ae70e24b450765d9b3ca8e08dce0e1c785da", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891276, "uuid": "20e13191-f743-432f-bff7-35ed097578ec", "comment": "Malware payload (Heodo)", "value": "4b8194ca0b8ce3bddfb08ad6abf913c9e8230183", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891276, "uuid": "48c6a4e6-e542-458f-834a-8fdc5c19d460", "comment": "Malware payload (Heodo)", "value": "9bf2bf98ac95a445a6a75d07fef3f379f4521d74712b9e12fccc3e2941d5f1d9d93596a2e4d04761b5a4bad488acd28f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891276, "uuid": "90a1386a-0129-4af2-b23c-afac9554318d", "value": "T18BE36C6576C5D9CADB0823350ACACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891276, "uuid": "1b3708a0-dccb-4fd8-b678-7002e9103460", "value": "3072:fcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0u:fcKoSsxzNDZLDZjlbR868O8KlVH3dehY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643891276, "uuid": "10df89b7-581b-4a59-8656-2c9fea852ae5", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643891276, "uuid": "be296c4c-9ddc-417b-b042-441c38ab7238", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891276, "uuid": "15c88bdc-440a-4df7-ae7e-6b33003d63f8", "value": "Fattura N 000011-19 WSO 03-02-2022.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a74f94f8-8516-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643909288, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909288, "uuid": "983a0882-13f1-4e82-b1fb-42e29dbbdc95", "comment": "Malware payload (Heodo)", "value": "c276751b150be935591a74bd854ef355", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909288, "uuid": "bb3122ff-a7e0-4b33-92ec-867908479952", "comment": "Malware payload (Heodo)", "value": "05c348206d33cd01deb26434da4a616e15deb330de0341b868d20a9cada9eee8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909288, "uuid": "d1bc1cfc-c8b7-4d08-ae28-8e9fad45e43c", "comment": "Malware payload (Heodo)", "value": "b9fb3debe00c8b0b6f664bf911216f7cf659239e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909288, "uuid": "86cf6e8d-22c0-4ae0-93e1-b65d4f29bb58", "comment": "Malware payload (Heodo)", "value": "a9807ccb7d7e06c1e642a4a238ee371c665333e95b109baa64f013311983254db1921f9a407d94782b7de4126f65890b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909288, "uuid": "1c3c727a-19a4-44c6-91e7-129c6840aa13", "value": "T1E7E36A25B6C5F996D70436311FDEC6EE3227BC834E6543833249F71E6D7B6908A62306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909288, "uuid": "a3c35e1c-b459-4ea4-a411-b26c82a2c71c", "value": "3072:vcKoSsxzNDZLDZjlbR868O8KlVH3jehvMqAPjxO5xyZUE5V5xtezEVg8/dgL4Lc0:vcKoSsxzNDZLDZjlbR868O8KlVH3jehu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643909288, "uuid": "3587ed34-b9b4-419b-bcc6-8c712100006d", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643909288, "uuid": "c3a495b9-060a-4231-a4b7-ca8e720f1444", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909288, "uuid": "21e3668d-a1b4-49e0-b569-b6aa281db91a", "value": "tmpnx4866g5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7198f68-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883088, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883088, "uuid": "ff34c574-0ee5-4f39-84a2-ae926c8ae8a4", "comment": "Malware payload (Heodo)", "value": "56e201b62814139fa1c48d888ad78b6c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883088, "uuid": "8cbfbeae-d82a-4437-9301-7ae9faadcf98", "comment": "Malware payload (Heodo)", "value": "05c4f023ab95d7f455cfa0167c0b5d6b6c71429252a649355ed852faf971dc45", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883088, "uuid": "366b45b0-1a47-4f18-88f2-01086378e852", "comment": "Malware payload (Heodo)", "value": "75dabd28a52032c5383ff63e2d899921e29dcf7b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883088, "uuid": "beba5721-961b-4db3-973c-f1f03ff0ca12", "comment": "Malware payload (Heodo)", "value": "751634ebf200303b73c6bca58531374175a9ea000a3620a6fa5cf24c53a7d85c530907ea54bf402a392d6dd971a5ed1f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883088, "uuid": "4172de07-e790-4dea-82f2-b746aa925020", "value": "T19C25C0216D8A40E6FA47193E0069B3544FDC69050BE0E8CFEF54F9A66F12CC25B785AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883088, "uuid": "3f83c9b3-1b6f-4d58-a2f7-778e332fd61a", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883088, "uuid": "b5168368-abaa-4575-9e53-1a92ef8d83be", "value": "24576:vyj4pucLsugl4zCy9fG+OVE+cXcs2vUvFIIm2m0:vzfnl9fYVoDvvFIr2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883088, "uuid": "a7f21c2c-b3e8-4d03-8f29-43efe84c16b3", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883088, "uuid": "e86893f9-2c13-452f-a014-47daf61b322e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883088, "uuid": "c96ca823-36e6-4804-a657-58dcc0bace35", "value": "H5om7QvXN7.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "696949ea-84c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643874395, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874395, "uuid": "909194e8-8c84-4bd5-82c3-cfd99c5cef99", "comment": "Malware payload (Heodo)", "value": "00e205a81bbd8924ed4704f1a6b7d950", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874395, "uuid": "a7aaefb2-df64-4c5e-9010-55ca2e382f67", "comment": "Malware payload (Heodo)", "value": "06171ea1912f8e36b5205fad0068a254c9771d89081bfc68aa4414050f448574", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874395, "uuid": "09ae9680-0071-40ed-b58a-a59b206600a8", "comment": "Malware payload (Heodo)", "value": "d72c2ba3d9fab8c0bce2882227ac4f94ceaa375a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874395, "uuid": "4f30739d-525b-4ac2-b789-f43a249e390c", "comment": "Malware payload (Heodo)", "value": "6d4fc4e7339a459223c0a14f8f45f734ee97a620b34bd39a4f10018b9366bf49755781be6659215203c8acd95ca1601b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874395, "uuid": "a4592bc9-d9c8-4f79-be79-575333242baf", "value": "T103E36B6576C5D9CADB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874395, "uuid": "cfe2732f-6332-4ed8-aa46-6ead60188d03", "value": "3072:acKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0h:acKoSsxzNDZLDZjlbR868O8KlVH3dehL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874395, "uuid": "c3450252-5cf4-4c74-9a32-02c1641f3362", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874395, "uuid": "58132302-ca74-4213-b824-24ef0a47c85d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874395, "uuid": "14e3ad1d-5bc3-4084-8583-ac569f725f29", "value": "39396651433775828576.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "54e22fe3-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846873, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846873, "uuid": "98fa047b-7768-45fe-9706-2f1fbfafac5a", "comment": "Malware payload (Heodo)", "value": "ce8e17082ee836d9ff10863cd6b7bbb1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846873, "uuid": "18c7839c-54b0-43d5-a90d-ac9f49e4ffab", "comment": "Malware payload (Heodo)", "value": "0621516031b8ad83222b73653d4105965b49cea8aeaf1afe56f1208e85f011e4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846873, "uuid": "1409d1c9-bf18-44c0-ad4e-1525f1b9bc50", "comment": "Malware payload (Heodo)", "value": "19b78bff1d2c8163c2bf0cf1a7a72190bcd1515f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846873, "uuid": "9bf7f596-417d-4c66-8a3c-f46ac325cfb9", "comment": "Malware payload (Heodo)", "value": "dc0f0ab2c5f6603847ba817378f4734790c7f8c05c9304f598ca94743ee5449c46e71b3ab55423d666f450ec289ed6cb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846873, "uuid": "df2d8f8d-acdb-4af7-8dbd-fcf87071c410", "value": "T174E37B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846873, "uuid": "84419ef1-d412-4e65-9395-f9cc32dc4ebe", "value": "3072:1cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0H:1cKoSsxzNDZLDZjlbR868O8KlVH3dehZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846873, "uuid": "e41780ca-0517-4ed1-b7e4-a8a1d0835cbd", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846873, "uuid": "a80d9ae7-c52e-4154-8567-6caddc3f05ee", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846873, "uuid": "c722a9ec-f983-49d9-8fac-f7ed2e9b8e38", "value": "2022-2-3-ce8e17082ee836d9ff10863cd6b7bbb1.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d50bf7ec-84d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882306, "uuid": "9690ce7d-616f-4028-bf0b-209cfdfa7d9e", "comment": "Malware payload (Heodo)", "value": "a61f2e2b2ba6fbbdca1c818b8957bd49", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882306, "uuid": "6af0e9cc-0fdd-4d30-a873-19cd22f5e8b5", "comment": "Malware payload (Heodo)", "value": "0627bc3cb7471167023b16a582841f6b7e249182468cba86adfb35482645f415", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882306, "uuid": "ab5787e0-58ef-495f-a663-c9e9becd02a6", "comment": "Malware payload (Heodo)", "value": "0986cf186e4f1b3d4de873a8e97f994bdada2a02", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882306, "uuid": "a31019bd-9c9a-40e0-8c7a-f7b4bf0553d6", "comment": "Malware payload (Heodo)", "value": "22be154d5da4f41d58dc045f6e1a965e00a0b395dbd88655351683f72dae287cee2738e3578d24496f2df21dad76cd0a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882306, "uuid": "3839340c-0710-4f81-9513-5b6e62350142", "value": "T18B25BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882306, "uuid": "c27582ec-6395-4012-b607-de9b1fc33d43", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882306, "uuid": "31f41c2a-0ef0-47c5-93b4-19b10f0b85f1", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2g9FIIm2mlg:kBiaa4powXiolDS2g9FIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882306, "uuid": "1e19bb6e-b034-4674-9429-9dca61e45101", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882306, "uuid": "a8687a51-1112-4479-b20b-8fb41a139197", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882306, "uuid": "255b143a-b802-4bda-80b8-38538e3585da", "value": "a61f2e2b2ba6fbbdca1c818b8957bd49", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76aafdaf-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883866, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883866, "uuid": "a2b875db-5995-432c-9a5d-cbef3be0d302", "comment": "Malware payload (Heodo)", "value": "8f249b08a35fe65c0d9910fc39c3c424", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883866, "uuid": "e01049ce-e1d2-4eb6-b882-fcc290664780", "comment": "Malware payload (Heodo)", "value": "064d1017568578b9c238dbc6b6b25b6652fcf36d145cee395536c533846ea9db", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883866, "uuid": "0b6df7c9-844b-4a96-bc55-643a6561f898", "comment": "Malware payload (Heodo)", "value": "5c81438440bd36e9d468f7b33cebe3011a058225", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883866, "uuid": "bf65e07f-8609-4cef-9b75-381eeab24f47", "comment": "Malware payload (Heodo)", "value": "d78e9da8619e6ddad2bc2a092e896896b4c5af0608c63e037f0ae3cb41cdc2afaa11b16c6f19629e485de8fc330d631b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883866, "uuid": "2e944377-ad41-485b-bcdb-028024a21773", "value": "T1C7E36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883866, "uuid": "5b0fe993-c00d-4086-bff7-2de297396909", "value": "3072:kcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0x:kcKoSsxzNDZLDZjlbR868O8KlVH3dehv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883866, "uuid": "322c722e-5ddc-4e8d-94c8-875a06907005", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883866, "uuid": "f7558021-0cd8-4724-8c1a-0317d29feda0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883866, "uuid": "6a2faed8-dab1-497d-baf8-8b22bcb152ec", "value": "2022-02-03-8f249b08a35fe65c0d9910fc39c3c424_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3130056-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883618, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883618, "uuid": "9d6cbc55-8e59-40c1-810f-395257df15db", "comment": "Malware payload (SilentBuilder)", "value": "8c8775e5f4d291de0c79673d4268021a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883618, "uuid": "3259ae11-34ff-4962-a845-8deba85d72f3", "comment": "Malware payload (SilentBuilder)", "value": "06856caecdd5be3b34e4c36eb256333e9d4181959bc68cd549f3ab01d93c6934", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883618, "uuid": "61d45442-5b6a-4efb-ba49-a56ecefe4170", "comment": "Malware payload (SilentBuilder)", "value": "14e22abaf58c88cce6bffcde57686a5546a75676", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883618, "uuid": "f33757df-8b12-4c62-8b08-f571f7d800d3", "comment": "Malware payload (SilentBuilder)", "value": "16dfa68d69566b67035efb2670f59a4a05757b2121fad28420d61c78ebab587d83674bff4945196957f94c79ec1405bf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883618, "uuid": "d8b57f7a-5ca2-445a-9317-c455fc509579", "value": "T136A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883618, "uuid": "b39368a0-9894-450d-9f5b-2aad294f2559", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4N4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883618, "uuid": "92346ae6-e0b7-4d81-9f26-621b62b17277", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883618, "uuid": "db63284a-a5f9-4e9c-a7f4-0e34f53ae645", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883618, "uuid": "31793306-5b72-4689-89a9-92d9907e2438", "value": "2022-02-03-8c8775e5f4d291de0c79673d4268021a_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1f55142e-850e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905624, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905624, "uuid": "b57ead7d-d2d5-4bd6-9a69-7667d76fb51f", "comment": "Malware payload (Heodo)", "value": "429df3d41326a4713e19cbb0a470dcf0", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905624, "uuid": "6fbaadee-2bcb-46ce-8b94-8bcf78ca0753", "comment": "Malware payload (Heodo)", "value": "06877913e6e3e15f348e2b92ca6a1cd8472e29ce7dbe8f162d146f187752fd33", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905624, "uuid": "cc3091c0-1a50-4c6c-8401-b49d65a15cd5", "comment": "Malware payload (Heodo)", "value": "0110d453cbe74a0b995c07ebabec47b75147eec9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905624, "uuid": "21989c6c-94bb-404f-a5a0-1c061d515cf2", "comment": "Malware payload (Heodo)", "value": "efddcd97df5a2b0d305eea5d7a372c47688c5c2d4a54dbb0a73edb74dd9c152e351d4ad813fe5855ef38494bea38dd2f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905624, "uuid": "385cb192-0fa9-439b-9a8b-740cfe0aa81d", "value": "T180E39D26B685C95AD91407351DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905624, "uuid": "c01f67d9-268f-44ef-8e9e-bbcf3ce66afa", "value": "3072:AcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lc+:AcKoSsxzNDZLDZjlbR868O8KlVH3Uehy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905624, "uuid": "203f2479-f033-4e1a-8809-07efe3fd32a0", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905624, "uuid": "47515eed-7346-4ee5-a8bd-b388e8055f67", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905624, "uuid": "2a3a1cc3-d324-4c01-b09b-616a50effd5e", "value": "tmpkd6xt2u_", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b19708c-84dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643884169, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884169, "uuid": "c53d8cb7-dfbe-4e2b-942c-885ba6f953db", "comment": "Malware payload (Heodo)", "value": "ca608f4c34f28a15f758d015f29726f3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884169, "uuid": "944f1ef2-94dc-4dd2-9962-173229e06de5", "comment": "Malware payload (Heodo)", "value": "0689512dd4863c1d45b1adaf68f4715b5f955d774f1351c548d4fec935d811e4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884169, "uuid": "405d0bff-478f-442d-a447-5409a8d4b675", "comment": "Malware payload (Heodo)", "value": "700ff056c8a54301c50fde650a94596e3b2e1102", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884169, "uuid": "9230a531-844d-4ee0-b4f5-02aeaa869f77", "comment": "Malware payload (Heodo)", "value": "7a114e2a57357021867bcc1417ac5a75d48e9d3046b216239cb33bbb30102b731bdfa3b336c0c35e5cbd2e28c02c8039", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884169, "uuid": "68f0f84b-4f9a-40f4-ab5d-64502838705e", "value": "T1D7E36B65B6C5D9C6DB0822350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884169, "uuid": "985c8ea7-f7a5-4eff-90e0-9691ca5ce0cd", "value": "3072:hcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0d:hcKoSsxzNDZLDZjlbR868O8KlVH3deh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884169, "uuid": "10c72852-c8d3-487f-b034-4f306c91dd1f", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884169, "uuid": "ae9b1251-8f26-4f2f-86b6-5bef727b5217", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884169, "uuid": "ab5e6a53-b178-4676-9ba4-437932ca9245", "value": "2022-02-03-ca608f4c34f28a15f758d015f29726f3_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a11e5fed-84ed-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643891668, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891668, "uuid": "c9a68571-15fc-43ef-81f0-fed6a2c1fd09", "comment": "Malware payload (AgentTesla)", "value": "d7c3ff5af0dbdb16bb64038995806e2d", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891668, "uuid": "2b720645-cfaf-46ac-8498-8debf2663527", "comment": "Malware payload (AgentTesla)", "value": "06b8e57256d15c07db138e519afee6429d64b239b22ff9776d52a92e09cbd55d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891668, "uuid": "dd74e37c-0484-4778-ac6d-8f955ed85654", "comment": "Malware payload (AgentTesla)", "value": "cf75242b584e0cab7e536e194ae264d84eaeacbd", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891668, "uuid": "eeab871e-3672-4942-9e3e-7fa8210fd778", "comment": "Malware payload (AgentTesla)", "value": "e474e9a08dff49c404aa46951fa21b5294992b810560ec5aba27110a078da76d6a5e28604f7a9b55f4f3822e225dfb89", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891668, "uuid": "15a2327c-7d4a-4bdd-a0a1-9b94fcf2b1bb", "value": "T14953AF3E17A8C5EAD715E175E043F312232B6EA2D741451F33A03E8F2CBA6858DEE491", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891668, "uuid": "0a155837-a375-4362-bd1d-cc742628b628", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891668, "uuid": "0125d55b-00a3-4f0e-acdb-86473bd528ce", "value": "768:HqrdbxZnP5H2YKcYeFehyJrkcvPhOS4/Vi3xnehErtX+GsMEq:HadbxXHJKcYesQzPhOvVihneW9+M", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643891668, "uuid": "3603773d-1c0c-40f9-ad51-a3f980ea4a36", "value": 61952, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643891668, "uuid": "d2cd4cf7-4459-4a56-a8c5-2f82b72ea0df", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891668, "uuid": "0e13af88-8a61-4bb5-90b4-c9c22022afce", "value": "Bollettino di rimessa SOA_pdf________________________________.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb347748-8484-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846695, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846695, "uuid": "3b298abf-dffc-45f0-841e-4d3f5d500b9b", "comment": "Malware payload (Heodo)", "value": "c5bcd41391c11b6f2c644badd025751f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846695, "uuid": "a6187e34-49fd-4d48-b261-8c384ba39aa6", "comment": "Malware payload (Heodo)", "value": "070bac83398ec17da0ab57d16a55895ced3e8236fbcb5f5e282d404233b3a1ba", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846695, "uuid": "77b8ea3b-b584-41d5-a8ce-67628e5b203c", "comment": "Malware payload (Heodo)", "value": "0a45299df68f7da167db6e60f709b883d3128c90", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846695, "uuid": "a9048889-dccb-40e4-aa26-4d522357757c", "comment": "Malware payload (Heodo)", "value": "ae420f38ad306377d2ed2285f1c707b83fb32c52072753ed1ddb795121c6edba90dcde19078d52e802e9c4d4c28a651c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846695, "uuid": "23a9a43d-ce68-4661-8996-06f4acfdeba0", "value": "T1ECE36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846695, "uuid": "100faba9-bd21-4220-a645-69af75527040", "value": "3072:3cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0Q:3cKoSsxzNDZLDZjlbR868O8KlVH3deha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846695, "uuid": "b1c9eb0e-81f4-4d94-a1a6-961cac954082", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846695, "uuid": "4bc152a3-1593-43ac-9e25-c3401ee83a78", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846695, "uuid": "a992a071-4389-4a51-9d2d-2894d896e1d2", "value": "2022-2-3-c5bcd41391c11b6f2c644badd025751f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e4c567bb-84de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643885339, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885339, "uuid": "36fc1ba3-44f6-4b79-b6f2-be54820a6705", "comment": "Malware payload (Heodo)", "value": "73e95f1b68d44e7a5eceae58f55c21ad", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885339, "uuid": "648398fb-fe60-44f9-8284-f7c70f4b6677", "comment": "Malware payload (Heodo)", "value": "071ca7e5a4e2146a96246e4bc5956096abd9910712db497ba52fe5679c4ed409", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885339, "uuid": "0735adfc-4645-4b9d-b844-295bebf84270", "comment": "Malware payload (Heodo)", "value": "b5aec6fd37019eec2142d1913d1f7d594e26f480", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885339, "uuid": "9a0ae924-7c99-4b2c-a4f5-fff7abee0d37", "comment": "Malware payload (Heodo)", "value": "b6b808a87eb26319d3d1a91ef9df61caca2fdb35604a61aead5df45ce17ac63e73efd67ada6470aba8aa21f186fe8e4c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885339, "uuid": "9168fea3-601e-4426-bb1f-cb415c621191", "value": "T126E36B2576C5D9C6DB0822350ADACAFE2327BC479E7643C33158F30E2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885339, "uuid": "6dbf82bc-60bd-4239-a492-2ce6d5f90f4b", "value": "3072:jcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0I:jcKoSsxzNDZLDZjlbR868O8KlVH3dehC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885339, "uuid": "df9699f7-e22a-4bd1-820d-a1af640f116e", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885339, "uuid": "9ca93ede-ce22-48a8-967a-167b7abcfb42", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885339, "uuid": "cb26800f-934e-480c-be2e-5cb3d735bb5e", "value": "2022-2-3-73e95f1b68d44e7a5eceae58f55c21ad.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "19c6daf5-8521-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643913775, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913775, "uuid": "c1a8e259-8b25-41e8-a5be-58f9398f141c", "comment": "Malware payload (Heodo)", "value": "8b540abeea7c95bdc64ecedd01e1a384", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913775, "uuid": "d16c38bf-ae81-4046-896e-1de91600e4be", "comment": "Malware payload (Heodo)", "value": "075ed862ad8cd5653b3a185e6753b2bf3958d2bb87c8af33f1d80b343fee3d8c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913775, "uuid": "3e1be9ad-234b-4ff3-9af7-495f2f38b602", "comment": "Malware payload (Heodo)", "value": "de027778e562441386a9cc1786f1c1e76b1a0bda", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913775, "uuid": "7efb6f48-7cf7-4796-9e0e-cacb8a2e80f2", "comment": "Malware payload (Heodo)", "value": "76a512c7118ffae8bbfbc287ff2b427943ee3c605b1deb427e1398a4c400b8e132dbd7354a3817a02e5ecf99e949e968", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913775, "uuid": "abe2e9fa-d043-437d-b503-eff07f49980c", "value": "T143E39D26B695C95AD91407311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913775, "uuid": "693e8034-534e-404a-a4a6-fe36134a9688", "value": "3072:UcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lct:UcKoSsxzNDZLDZjlbR868O8KlVH3UehR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643913775, "uuid": "6d4a4144-4a83-4c7d-a25e-528cfcd3bdc7", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643913775, "uuid": "4cddd44d-ea29-40b3-946c-f27954b732e7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913775, "uuid": "1dbbbba6-3240-4372-ad75-040234223f8d", "value": "tmppdrz0urx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba64ba0a-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883980, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883980, "uuid": "5dab41db-2600-4e42-b684-d4f1b93e1d6b", "comment": "Malware payload (SilentBuilder)", "value": "c4b844c6c24c5a3403963b4fab551aab", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883980, "uuid": "5cb38797-38d3-4511-8592-ad7b9a44e40b", "comment": "Malware payload (SilentBuilder)", "value": "078e349bf0703e6f1f21719aca0aa9008cb0f52d5dbff72c9646ded55b254f50", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883980, "uuid": "c3a24fbe-3089-49f4-ad1a-ed1b5b4ada3a", "comment": "Malware payload (SilentBuilder)", "value": "45b168b9eea7ecb9ffe5f326d8272b68394a85f5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883980, "uuid": "c1d29370-9a49-40f5-a809-df89cc5b0bc2", "comment": "Malware payload (SilentBuilder)", "value": "4f40b8021dd19d3365a348f206bd9f6150cd99164c68adbfee1d93ba6b597802a1ae340edf9124beb34a7caf5bdfa0ef", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883980, "uuid": "2284dea4-de68-47f3-837a-c7154980845d", "value": "T1E9A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883980, "uuid": "1a1c1197-e1e1-497a-a504-7b6d0af81f30", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4d4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883980, "uuid": "35af29b6-5555-41a2-9d93-7851a52a6c08", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883980, "uuid": "d7ffcbdf-3067-43fa-b92f-a9faf4958e98", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883980, "uuid": "a967ae0a-4ed6-416f-8caa-b15c17b4a8c6", "value": "2022-02-03-c4b844c6c24c5a3403963b4fab551aab_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ccb4cdce-850d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905485, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905485, "uuid": "e5db1796-4f6e-4bf5-9e05-99e54642d5cd", "comment": "Malware payload (Heodo)", "value": "c577e89add140a0a3d07221727f58f51", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905485, "uuid": "b56c11e5-aa8a-4145-8cc6-f0f1885a66ff", "comment": "Malware payload (Heodo)", "value": "07955bf7c341a8a19dce50c3e3e353bb6105f23eefaec5b7721e2e2e447f924f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905485, "uuid": "7b5f3d0c-c972-41c7-a88e-7ff29e5bbf0a", "comment": "Malware payload (Heodo)", "value": "aa14630d94a9fa78665dddffe4472b07370ced05", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905485, "uuid": "d151f36c-811b-48ee-883e-95d5570f094a", "comment": "Malware payload (Heodo)", "value": "63bd5bcb3c806965fa316624550d0b3e1ef996a847cc064bc1f01bc787ab054962e4d8eb215cc009d374329fb24b85dc", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905485, "uuid": "2c50f218-4b78-4a0c-af79-b52033fa49b7", "value": "T13EE39C26B685C95AD91407351DD7CAF7333BBC818E7683433289F71F6E7B6908A23246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905485, "uuid": "0c91ce70-56e8-4396-b0c6-98a1b4ba5d7f", "value": "3072:3cKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4LcV:3cKoSsxzNDZLDZjlbR868O8KlVH3Ueh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905485, "uuid": "d7627ddb-2807-4295-8499-5b2ed96b473b", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905485, "uuid": "b6e77297-66e4-4d82-b1aa-2194b96c130f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905485, "uuid": "476146e7-7252-409e-ba27-ad09e079a142", "value": "tmpj78f74oo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcf12cd1-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "87a7e220-8e41-4f95-bb63-cb362d789791", "comment": "Malware payload (Heodo)", "value": "6711e19e39be134d2a2a2a7c71d4c781", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "6a56e2a7-3a43-4912-bc5c-aac92a04f9ea", "comment": "Malware payload (Heodo)", "value": "07a39de48aefdb40fc2a662f78eac4c99ecfc8cf0ee67568753869293cdd1dde", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "456520fb-5b10-457e-ba6b-4c4946ae626e", "comment": "Malware payload (Heodo)", "value": "a27778102a51e2d6a184fe222f90773231fb37e3", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "57329ac1-9e0c-4d5b-aec4-5a5c42b08d22", "comment": "Malware payload (Heodo)", "value": "a630c64f61e17f79b0fb5458ce125581fef30162f15018d399246df799184f56e599b155938ee87f7542505f6d2eda8a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "659e3e94-4a8c-4cba-a37f-863c7b42e62c", "value": "T1B564E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "9d19121f-baae-4971-a7d9-dd6d3c74313d", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "b19b5adb-415c-4ba5-9cc6-9aff0f123020", "value": "6144:83DvZRFTFbksYyljaMYDM1T7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMYELAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910291, "uuid": "f51d3a4e-01df-491a-9f22-265d3dcedc68", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910291, "uuid": "a940f672-7e12-4390-873e-6ac5e80cd859", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "6dd78857-874f-49eb-b1e4-081b1024cdc5", "value": "emotet_exe_e5_07a39de48aefdb40fc2a662f78eac4c99ecfc8cf0ee67568753869293cdd1dde_2022-02-03__174436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcfbdd5a-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "f95743c8-31d1-4957-9be5-8b1a86d14223", "comment": "Malware payload (Heodo)", "value": "220865a7d2249b55537b0c46f2a6f01c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "6173054d-11ca-4ab0-96ce-37d0b86a4246", "comment": "Malware payload (Heodo)", "value": "07ad82623db29e8792b24147941e6813f555f315bf28f319c6b637f5ea337b6b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "1837b81e-214f-4e7b-92a8-1cb3009368a6", "comment": "Malware payload (Heodo)", "value": "19b380ad08521e8955bc3580cbed61959e19b1cd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "86a59c1d-9a03-4d66-b1e5-4a31cc7ea006", "comment": "Malware payload (Heodo)", "value": "ed409881cf35dfaec18be3ae638a5e52acf9f143c9987306c874cf6a5570fa53988b7c0ee65f00d46b203d251a3d96d3", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "10d28123-52ff-4b29-908b-b98bbf054ec6", "value": "T1FC64E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "1e653c18-74db-4d1b-a8d8-4c6a005ac744", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "a341f415-df89-4094-b33a-d73887c7a388", "value": "6144:83DvZRFTFbksYyljaMYDM5T7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMYYLAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910291, "uuid": "c39947e9-ba31-4a6a-a67c-ac168d05d39f", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910291, "uuid": "25564e3c-de57-4444-a297-7bb53dd871c0", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "4f0b38f2-e099-409f-bdbb-eb456cea0db7", "value": "emotet_exe_e5_07ad82623db29e8792b24147941e6813f555f315bf28f319c6b637f5ea337b6b_2022-02-03__174435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9969b18e-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856437, "uuid": "1c330829-f067-4c71-b1d5-efac1a254f4d", "comment": "Malware payload (SilentBuilder)", "value": "b63cf9b2ea45832a93ce405c34c0d9d9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856437, "uuid": "a5c1dff6-fc75-4159-8106-322c6c9589ac", "comment": "Malware payload (SilentBuilder)", "value": "082764ed09efaba3db12225e759a07b5058f18537021029e0d52b530adc0afdc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856437, "uuid": "15394e3c-6df2-4cc7-9901-ae34c0f3213a", "comment": "Malware payload (SilentBuilder)", "value": "373f0719d959f7ccc10b31efac0ed9e340214531", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856437, "uuid": "ef8c10f4-73cb-40d3-bfdd-134d980f7619", "comment": "Malware payload (SilentBuilder)", "value": "21ca0f5bc181f18e43bcb1fec964a203bda0d73a8f677cd6930a13b688eda150d8a5f0c1cdcf2a547c084dc3f3718717", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856437, "uuid": "6bbb9cc5-a1c9-4535-8262-e79f1fde5c4f", "value": "T165A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856437, "uuid": "558361f9-4815-4c5c-b52a-a4eb9025d4d4", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4N4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856437, "uuid": "c363bf82-565f-48ee-999a-c2e67c0984cd", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856437, "uuid": "ce2ef98b-e536-43be-aeed-fff6d3d5db4e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856437, "uuid": "2eb80b3a-becc-4ce7-9e5c-d28f4857469e", "value": "2022-02-03-b63cf9b2ea45832a93ce405c34c0d9d9_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d896ab2d-8537-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1643923544, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643923544, "uuid": "e4c1b870-ffb4-4ce2-a72b-9e8cffcc0bb2", "comment": "Malware payload (AveMariaRAT)", "value": "c8da947a72f02c6596a30a45f1636e34", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643923544, "uuid": "aec82941-eb37-4ff7-b7c6-fea812d91819", "comment": "Malware payload (AveMariaRAT)", "value": "083dc5ebf6674d203409e7651586f1d854a6a717a33ebdbc0aa1442b7942e7ba", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643923544, "uuid": "76d99626-8bee-48a9-b8f2-277ffd6bc909", "comment": "Malware payload (AveMariaRAT)", "value": "b392be109baa6946c15a1198e299b8a079cd4e7a", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643923544, "uuid": "4c401410-bbe2-47df-ab5e-4ea8575970e0", "comment": "Malware payload (AveMariaRAT)", "value": "b4e11d2dd5e5411f97c121f20bfba889e3d3b2f31b8acac7a7cd6675d395b73a32e48a9de3ea4cacd201df91c47f56d7", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643923544, "uuid": "8b014060-ddb4-4a8c-809b-4e5dc464a1a5", "value": "T1BAA57C0453E44A2BD1BF4BF9E0B244256679FED32B4ADB4D0990BAAD2C73762DC11633", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643923544, "uuid": "d5d69e98-7130-4f82-b619-54180571cf58", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643923544, "uuid": "8a9893d2-1478-433c-86c5-5030cfac2cb9", "value": "24576:++ffdVuFREXMi6oziDoblDyOH7PCR80co+YgIgtum4NYxjI:YIMi6oRblkS0co+xIgIKxjI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643923544, "uuid": "b64662e2-9869-4137-af6c-e90e96d2615b", "value": 2266112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643923544, "uuid": "6df71d45-f82f-42b5-a7ab-aabe2f4ebf03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643923544, "uuid": "56004945-933a-47a3-83ff-5bf541f79980", "value": "Order_PO EM41170402.pdf.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "110b6530-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882837, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882837, "uuid": "f60b6111-c9d8-4d3d-a048-92b81c0c469d", "comment": "Malware payload (Heodo)", "value": "6bf962dc01040872cf4bea3f1b886d3f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882837, "uuid": "050673fc-5738-4055-af61-d3ec2a231e51", "comment": "Malware payload (Heodo)", "value": "084c2b3bc4b07a26435b951b7880b4f7501c0e0e22326daebf8685d8946587a7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882837, "uuid": "f9fa0590-172c-416f-a908-75a777990e46", "comment": "Malware payload (Heodo)", "value": "a739c17e2998819b1851cd49eaf0d972372ac3f4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882837, "uuid": "5c7ac4a4-bc69-4329-9df3-47157cceda9a", "comment": "Malware payload (Heodo)", "value": "278bde6155a63a14a3b55c427e8045b6ac8c641da2c8b88123f1c11995cf1ab8aad3ceb7e59d3bf48e6a5992fb1db662", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882837, "uuid": "ef7d0324-3422-4eaa-96fc-8956acc79480", "value": "T15CE36B6576C5D9CADB0822350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882837, "uuid": "5e94efd0-f63f-40e2-8097-01135d29f346", "value": "3072:6cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0k:6cKoSsxzNDZLDZjlbR868O8KlVH3dehi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882837, "uuid": "cd36a7d4-ef89-41bf-84f6-d4f2d16e4fc4", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882837, "uuid": "f6dbadb5-e4f4-40a2-a3fe-cb2e47068528", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882837, "uuid": "564ac514-8750-4880-a30a-8b0ae62798ec", "value": "NT-1268 report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d68cc882-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856539, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856539, "uuid": "43d52c5e-2b44-4c15-93b1-a6a3a07d22e7", "comment": "Malware payload (SilentBuilder)", "value": "d3b1be959a2f365eec30a2bbc4511624", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856539, "uuid": "b73c4c3c-6466-451f-a9d0-8d2c41fc8544", "comment": "Malware payload (SilentBuilder)", "value": "088b4ffe1a1f85fba4f2b46c9d3cd771d9b12b39521368ab6c6fd217c790a992", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856539, "uuid": "ff2a1678-017a-4846-b7c3-b9e474e44b70", "comment": "Malware payload (SilentBuilder)", "value": "f41f00a5304953025a2d67dd0028708b6233ae14", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856539, "uuid": "57c05d46-d49c-4acd-8b48-005bd48aceb9", "comment": "Malware payload (SilentBuilder)", "value": "0d6f97d9de2ceb160dd0e15c54ec98bd157e295d75476baf9b020c908b80cfba84b88455f99b6bba3fdd3d56467ee46d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856539, "uuid": "3c77f214-caf3-4a1d-ba93-03a4815bf546", "value": "T165B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856539, "uuid": "c201b4d6-7b51-4772-acd6-4ad32d2e97de", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49O:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgm6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856539, "uuid": "a8c38106-45bd-4c29-9bed-99cdd2331d5b", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856539, "uuid": "b94a9e5b-0efa-4f32-bb2d-7ae4c3d2b37b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856539, "uuid": "afe86172-b27f-46ac-a94f-a3a738ef5d78", "value": "2022-02-03-d3b1be959a2f365eec30a2bbc4511624_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eb232fc4-84fa-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1643897376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897376, "uuid": "3aa0141d-6c99-4908-a135-c9708bf899a0", "comment": "Malware payload (IcedID)", "value": "8082a1d01bba4815634b0c7c0d061deb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897376, "uuid": "6e57bbf1-c9b4-4ad3-8b9b-9b1314ee6f4b", "comment": "Malware payload (IcedID)", "value": "08c02a6910d57ccc617f6953f23279de3abb6b3a5e5501931af2e5a171fb4b70", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897376, "uuid": "112c353f-e658-4f19-92de-4d01256e0fae", "comment": "Malware payload (IcedID)", "value": "e6e39c6aa4b945af4023ede227504e98e71a4366", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897376, "uuid": "225a63b1-a98d-4a0e-80ca-40995e963232", "comment": "Malware payload (IcedID)", "value": "9245feb74ab9d7b0243ee42c58ad8c937564d5ec2db44ce0401e4be0fdfcea2261a80225c64416bbdc1187278fec0e2c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897376, "uuid": "a9c53681-bae3-44dd-8832-d4ac60c8583d", "value": "T17BC4BF6972750BF9E0639434C8630903DAB17C62137195EBE7A1324B4E3BBE8567BF12", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897376, "uuid": "33c168fb-6564-4203-802f-835d9c6e2a6d", "value": "7d92749d0838ef8b8f49d5c4976e0faa", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897376, "uuid": "e77bcf41-8e33-401e-90a1-f0b7d703fa0b", "value": "12288:7nhIt854fUB25Q0Ixvfoflje98ac3q4DK8Z3P:7nh+854q0Q0Ix3Ee98aahPZ3P", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643897376, "uuid": "95c2f8c8-d167-4c94-b547-d9a37e80e61f", "value": 592255, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643897376, "uuid": "c9539f7f-e670-4ce8-b8c3-5ed374f8b5a4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897376, "uuid": "5162d545-6964-4df2-bcdd-8191544b9aea", "value": "08c02a6910d57ccc617f6953f23279de3abb6b3a5e5501931af2e5a171fb4b70", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00050922-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855320, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855320, "uuid": "0be6ed0e-3b49-4393-9c3d-50c52931868f", "comment": "Malware payload (Heodo)", "value": "05247fe8cfe41e8776c1163fcd4de10f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855320, "uuid": "cca230bd-10b0-49f1-a288-3e35bd5f97fe", "comment": "Malware payload (Heodo)", "value": "08cec03658903c30243fab84d3398fa2a40e828d3633841a5c5eda6700ccd41a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855320, "uuid": "cd9c7c28-c20c-458a-8729-62256752b867", "comment": "Malware payload (Heodo)", "value": "0cb7284077ca7073b95898ef226d066cb16abfeb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855320, "uuid": "63fdf76b-f6c2-4520-ae46-2e8c4b17a443", "comment": "Malware payload (Heodo)", "value": "a9bff15318e8becebf2aec40227c1dcee24a1dab29a2e78a780bac999471d5373b51e8b3a6801044ea38cfdf2de2dfcb", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855320, "uuid": "b8f40a24-6f6a-42b8-8c16-e071e8c8b7ab", "value": "T1F5E36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855320, "uuid": "83169938-35b2-4a3a-a2b9-0e472f63555c", "value": "3072:0cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0a:0cKoSsxzNDZLDZjlbR868O8KlVH3deh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855320, "uuid": "78fdc1fa-8f3b-430d-87c7-b51a451dfdaf", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855320, "uuid": "67986f50-8297-404b-b7f3-5effedbed586", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855320, "uuid": "81575a61-eb55-4889-a82f-56098c68e4d2", "value": "2022-02-03-05247fe8cfe41e8776c1163fcd4de10f_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9191420c-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883482, "uuid": "49257a60-5c00-45ab-b05d-46b136a9731e", "comment": "Malware payload (SilentBuilder)", "value": "6bde272dd724cb321279ab4d6f4b9ad4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883482, "uuid": "a65beff9-8aec-43e6-a8bf-e3a0617e33df", "comment": "Malware payload (SilentBuilder)", "value": "08e0fbc382c15e44dbde7bf9f1aa7c008d142f42deb59f68c1191eaadfcca249", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883482, "uuid": "d0665fa7-e6b3-46b3-83fe-6b8c9db2fcd9", "comment": "Malware payload (SilentBuilder)", "value": "3486944c9d305b410f0885371d0c64f245837e30", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883482, "uuid": "3121edba-2524-46a8-95da-51d2eae2fea1", "comment": "Malware payload (SilentBuilder)", "value": "ae13a8bd46b75df23ce7e42e5210b8c2e2f2b7e95f30b6989ffe30fcb31e887893f8f47b4d27b0138e3ce315836e2a0b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883482, "uuid": "231e0155-df83-455d-8c78-5a3f44268aca", "value": "T19BA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883482, "uuid": "81c14b3b-19e9-4933-a932-7cd2b5dd4034", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4Z4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883482, "uuid": "0e29ce5a-b454-457f-afc4-713feeb06a83", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883482, "uuid": "b74bcb57-2bfc-4f79-988f-dfea2a46dca5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883482, "uuid": "c1fe0f38-66ba-4375-9135-3ba5150fe71d", "value": "2022-02-03-6bde272dd724cb321279ab4d6f4b9ad4_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e8637eba-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883198, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883198, "uuid": "2bda1e84-94a4-4921-98d9-d0d343333f60", "comment": "Malware payload (SilentBuilder)", "value": "1cd81ee0a0ff05559a5067719060f781", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883198, "uuid": "dced81c6-2a06-4307-b03f-5c94da340b6c", "comment": "Malware payload (SilentBuilder)", "value": "08ff1a0a75a40f5aca459c6a5646c8fd6e248c0e7d9db4d103d8ba3441c1a8a2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883198, "uuid": "db1ec9d7-ec96-4b5f-ab3c-624009c67499", "comment": "Malware payload (SilentBuilder)", "value": "08424663978a928dc2ac08c151f6608ca6bd577f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883198, "uuid": "5549fad5-df4c-468c-b0dd-b9350c8d6a58", "comment": "Malware payload (SilentBuilder)", "value": "61a352e95d0d987e22d50f7189a9c8d612e1aa26003ba608125f30d2b606f01bfb08dcac05c1cf97d7d8c8dc42b70b8f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883198, "uuid": "718ba142-55d0-4e78-842b-6465c872e901", "value": "T1ECB37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883198, "uuid": "646a1f08-c2b7-406d-8e4e-c0a450c74735", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49F:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883198, "uuid": "1f19a5d0-f27b-4eb5-b652-c3102bf7ccd8", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883198, "uuid": "bd79b91a-e3a7-405d-84f7-87728576d693", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883198, "uuid": "701131e2-51e1-46ce-b177-a490e8da2b0a", "value": "2022-02-03-1cd81ee0a0ff05559a5067719060f781_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557d5399-8521-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643913875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913875, "uuid": "e78e4d8b-8807-4233-8f81-d8be4489fbe6", "comment": "Malware payload (Heodo)", "value": "e5f7ed19757f2da778bb4624a638bc92", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913875, "uuid": "9440f485-9445-4ab6-9b6b-359129b44458", "comment": "Malware payload (Heodo)", "value": "0925647821ffd7f053fee61a3683d3ca82199854de32ae5d59c1c49d50de1883", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913875, "uuid": "8640f8e0-0dcf-4467-bd9b-5b18f85e4ace", "comment": "Malware payload (Heodo)", "value": "7f2de1b498d42a5091e1477ec70ff2a17062b791", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913875, "uuid": "1c584a1d-8666-4473-9041-03ae13e57dac", "comment": "Malware payload (Heodo)", "value": "741f1d780ba1bfb43d89c93157e4e23f37ec857c113cdbd223fc7cca35750c8c8b9502bf7f8025dd6149293061a6a7e5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913875, "uuid": "caf565d3-4aa3-44c8-8c81-badb1f7ea3ac", "value": "T1C5E39D26B685C95AD91407311DD7CAF7333BBC818E7683473289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913875, "uuid": "9781b99d-f869-4953-aa9d-ebe162ca7565", "value": "3072:GcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lct:GcKoSsxzNDZLDZjlbR868O8KlVH3UehZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643913875, "uuid": "47cc7d29-c2e4-4a18-b8ec-62cfb5b9a4cf", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643913875, "uuid": "5286582c-ae6a-4fb3-9dd4-5f6748637820", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913875, "uuid": "892de3a0-771c-49cd-9992-e5ed2d8e6f3d", "value": "tmpkj6k_zhu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7606201f-8536-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643922949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922949, "uuid": "158e69a3-b035-4d5f-a470-62a20e06bd35", "comment": "Malware payload (Heodo)", "value": "c0c765da614b1a444d872a33e263f223", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922949, "uuid": "85885a70-99b2-48f4-9342-f22d9737225c", "comment": "Malware payload (Heodo)", "value": "094224497ce965dba5dd2c9bcdfce643f8e311196adc7b40b92d3bb04340b383", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922949, "uuid": "e44bb888-51bb-46bb-a622-18c1a3cfa3ba", "comment": "Malware payload (Heodo)", "value": "ecc926a6a2f9e258a083e553a4c292777b23e722", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922949, "uuid": "06a34ce1-4876-4cf9-a886-066e0ae70c8b", "comment": "Malware payload (Heodo)", "value": "25ec769aa8b29b9fc27b8ffe0824ae232f9cce605b86e14aba7cae30f603826a1375d3923a4aa7dd197ab857ed32c187", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922949, "uuid": "3b4b5703-85b7-4d5d-a468-d9278affafa6", "value": "T16825CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922949, "uuid": "d049e20c-b596-467c-b34c-74ce595d568d", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922949, "uuid": "fccc249c-4170-43c7-b4a6-c5a15764d5d3", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyP2FIIm2mHv:exyq2kpWGWRCLWeNWO1tyuFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643922949, "uuid": "544d9099-b127-478c-b6dc-966bd7ca2c71", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643922949, "uuid": "205b39b8-0fed-42d0-b425-582cfe21a43f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922949, "uuid": "80171842-1721-4f04-9ae3-3b6df855222a", "value": "emotet_exe_e5_094224497ce965dba5dd2c9bcdfce643f8e311196adc7b40b92d3bb04340b383_2022-02-03__211532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a026fde9-8513-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643907987, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643907987, "uuid": "d96faebf-2090-4aac-8766-bc1315b85463", "comment": "Malware payload (Heodo)", "value": "1b5d3f6996158f5b0996c2b91a449081", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643907987, "uuid": "37e85346-76c0-436a-9226-66a11e6afc40", "comment": "Malware payload (Heodo)", "value": "095497d85aa060330013e0f99facfb67c35bd44ba03c7d05a86f9f326140b4b6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643907987, "uuid": "5277c3e6-9c54-4680-9595-606ba3a55ce1", "comment": "Malware payload (Heodo)", "value": "75fdea1bd32dbdf09fb66cc0c74d6473c8f639be", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643907987, "uuid": "26c57dce-765b-40d7-a21f-e9c3b6148f2b", "comment": "Malware payload (Heodo)", "value": "819b400cf5a483d3a6239ecd53a47ff90306634dd00b4efa5c1fc97fecd7cc2e3cddc2e5d6801bbd2e627ab0dc6d6dad", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643907987, "uuid": "df98597e-4cbf-44a4-9a44-d0b96d99aa34", "value": "T155E35A25B2C5F996D71437311FDEC6EE3227BC834E6543833249F71E6D7A6908AA2306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643907987, "uuid": "8162cb63-f11b-4ff8-89a9-8791d937e45b", "value": "3072:QcKoSsxzNDZLDZjlbR868O8KlVH3jehvMqAPjxO5xyZUE5V5xtezEVg8/dgL4LcC:QcKoSsxzNDZLDZjlbR868O8KlVH3jehM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643907987, "uuid": "2066e49c-993f-4147-93ea-fbc497ce405c", "value": 148996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643907987, "uuid": "d1bda519-6a2f-4e8d-b00b-5b58f6bc034f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643907987, "uuid": "fa4f70b7-e9ac-4e48-8a2f-a264efcaa2f5", "value": "tmpc876m01y", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1cfc0c33-8510-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1643906479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906479, "uuid": "e8144276-4600-46fb-af6c-a9a0c52ccd68", "comment": "Malware payload (RaccoonStealer)", "value": "ad22204b0dd1f88b7cdf417dc60cbf92", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906479, "uuid": "1088e6ec-7d5e-481a-abc7-3afebbb3866c", "comment": "Malware payload (RaccoonStealer)", "value": "096a635c297ba142a4605ee1dc6f6fb9ff2c6f84670ca938d3ca26cfdb6915b7", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906479, "uuid": "d36d7831-dff1-4de8-9882-8a0914acc930", "comment": "Malware payload (RaccoonStealer)", "value": "c37fb4e3b6b209acd7ec8e13b32b424dffc6506c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906479, "uuid": "00fbcb67-e3d9-47de-b6ea-46d6e8d0e336", "comment": "Malware payload (RaccoonStealer)", "value": "b55a23405ae6af81d56da77bf7daa7d338330bdbf3d2309f477d5bdeba538df502856e57d597e4e1150d19bb1fdea309", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906479, "uuid": "2df049b9-0ce3-4497-9f0e-bac97ca8475e", "value": "T186B412D3BA90D473F08731B44975C6F1863FB82DD461CA4A3B39526F9E602D09B2E726", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906479, "uuid": "0d8ed471-f71e-4a1e-a9c7-00e34168e246", "value": "4d7e79e83c0c7ae55f5b30d8f7e15bff", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906479, "uuid": "6ecf95d4-0445-487e-973e-e7ca36035386", "value": "12288:PeVYgn2rBPFYbDmL3z+OMx512VoGNEh7:2zOFTz+Ju", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643906479, "uuid": "22e71b37-7c02-4899-8669-bb1392725d08", "value": 529920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643906479, "uuid": "9f183354-87cf-41ed-809f-c177f14234ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906479, "uuid": "94d57bbb-4ce2-442d-9df5-122da043ab60", "value": "ad22204b0dd1f88b7cdf417dc60cbf92.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0dc193d-84ed-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643891721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891721, "uuid": "bc443183-a15b-434a-8ec5-b7f6c9d6c045", "comment": "Malware payload (Heodo)", "value": "f081f1643d02362476577f09e8845a3d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891721, "uuid": "277d64eb-85fe-4caa-bd08-9c6c35045859", "comment": "Malware payload (Heodo)", "value": "09901ec702eca9e2e7d87d24285d586b946c150e133b398f45760d21a20db81f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891721, "uuid": "4c4bace3-1851-431d-ad7e-8923e260cf52", "comment": "Malware payload (Heodo)", "value": "f604b78db9985b335b106e083a32bab72b5ab577", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891721, "uuid": "d3660ca2-a04c-4952-b4a6-fc1638e6cfd3", "comment": "Malware payload (Heodo)", "value": "16b76cc6ba1d0021c768545a27744c13019d52c416ae506c29bd3b6006ce19bb7f4240d041f1517b9efe4b7d1e3d655d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891721, "uuid": "1d67e98e-dafa-4304-9e9d-5c8d468918d0", "value": "T14625BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891721, "uuid": "50f086f9-28a9-4b45-9ea5-8c8baba1a86e", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891721, "uuid": "ace6119d-29d8-4073-9e96-bdd4e22929c9", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gyFIIm2mlg:kBiaa4powXiolDS2gyFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643891721, "uuid": "23dc0a53-6e57-43f5-8d56-060ac58d8732", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643891721, "uuid": "818bd611-387d-41eb-85f6-7e5ff2933b7d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891721, "uuid": "78348d21-bb7c-47c6-b4f9-e1b421ae6512", "value": "f081f1643d02362476577f09e8845a3d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49af00f3-848e-11ec-9275-42010a9c0029", "comment": "Malware payload (Sugar)", "timestamp": 1643850719, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850719, "uuid": "8b5e0079-0917-46f9-84aa-85d623fea65b", "comment": "Malware payload (Sugar)", "value": "9b22e10431fe7b9bacf7781326cc31a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850719, "uuid": "e1eb6fcd-5bf7-4e01-8c58-7581ddd6ab3e", "comment": "Malware payload (Sugar)", "value": "09ad72ac1eedef1ee80aa857e300161bc701a2d06105403fb7f3992cbf37c8b9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850719, "uuid": "26abc924-ba1b-4ff2-ba17-0808842ecf9c", "comment": "Malware payload (Sugar)", "value": "737457effda8ffe27dbdf28423f471c5574478f4", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850719, "uuid": "4a97dfa4-2bc7-4603-9f98-11e82b99b198", "comment": "Malware payload (Sugar)", "value": "c02b3b8763c938ca8bdec54545c75e12588b3e8ab2440cf079862948fe059d94d32c4ae63593ae5be66acad06e251933", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850719, "uuid": "938cd5a3-1ab7-46ad-8b17-0e6e495b50e2", "value": "T1C04301773D3928B0E7C717302917D8BAD6DA4B9455380A77A5701C8E3FB2BEA4133A14", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850719, "uuid": "4974bb37-e134-44ff-9b8c-993ea9959ce9", "value": "29dc79e4c9ab8bfa299719f434758791", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850719, "uuid": "95f17e82-90b2-4519-81c4-fa92afbba5cf", "value": "768:RHHVVSK0sK8OxR6SkYZwjMuuZalFOGc5ZQKkCcU9Xlupi4LrKmvTJ9VxGkwFelX:RnV4mmP2jI0OGbjCcUtlujLPxGkwAlX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643850719, "uuid": "b7a49531-faaf-4d1a-944f-8a1cae85e16e", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643850719, "uuid": "d73ed25d-fab6-41ae-a583-7bcad536a13f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850719, "uuid": "ca29f8e1-7fce-4955-8f6f-107f1aac2eef", "value": "09ad72ac1eedef1ee80aa857e300161bc701a2d06105403fb7f3992cbf37c8b9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f441f892-852d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643919295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919295, "uuid": "0a44bfeb-a1b7-4d2f-a47b-9357f5c41718", "comment": "Malware payload", "value": "e614fbd15c155b6e3f91bbe91644653c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919295, "uuid": "92035140-e3ad-4bad-8ad0-6579b6e436ed", "comment": "Malware payload", "value": "09afed5e23444bd11317f82c3f5b94d51147f186e8346ee59fafcf3497b6ff16", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919295, "uuid": "7899afeb-5b99-4f85-9869-82513dbf934c", "comment": "Malware payload", "value": "d3e7b702a551b85cd6309f7f9c3b4506a20fc2cb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919295, "uuid": "95834c88-6117-4e84-8855-e2581037c07f", "comment": "Malware payload", "value": "6eb4a91256bc0fb4c98344817323a627629d03357d2e4bfda92e8778e2ef349822215c1d386c70eddcbb148e2a94de10", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919295, "uuid": "0be03846-3b47-4dd3-96d0-4ccbd652572f", "value": "T17825CF103ECA40A1F64B153E006A73584FDD6A1507E1EADFDF44F8A7AB15CC2AA3946F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919295, "uuid": "67cb0b01-eb85-4155-9f3b-8cbe8e50cc57", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919295, "uuid": "dd662dcf-5501-48d7-a2c5-040361bfef78", "value": "24576:aKzjU3EJ7mCRpnAOxxmd3uIqUUvoq116OzvMyvQFIIm2m+l7:al3g74mm9uIqUUn1xTQFIr2mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643919295, "uuid": "bc31c6f4-7ee8-4fc6-bda6-f3760ce37fc5", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643919295, "uuid": "1cd9bbbd-2e22-4a63-8a36-d33d4fe5db74", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919295, "uuid": "9d9f7ae4-7cb7-4fa8-a23a-acbe0593409a", "value": "emotet_exe_e5_09afed5e23444bd11317f82c3f5b94d51147f186e8346ee59fafcf3497b6ff16_2022-02-03__201441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e19f30ef-84ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Smoke Loader)", "timestamp": 1643899507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899507, "uuid": "4ce94a66-c043-46dc-84bd-bb73a01cd6ab", "comment": "Malware payload (Smoke Loader)", "value": "7534dbec27b929c2ecd76499880fd560", "object_relation": "md5", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899507, "uuid": "06446fa4-c816-4b82-b10c-ec8c66197d34", "comment": "Malware payload (Smoke Loader)", "value": "09b9283286463b35ea2d5abfa869110eb124eb8c1788eb2630480d058e82abf2", "object_relation": "sha256", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899507, "uuid": "04f8389e-04c0-4aac-86ce-15eeb1c35100", "comment": "Malware payload (Smoke Loader)", "value": "6f2d63f7f122a1b946bbd68962d76c9ae2612a33", "object_relation": "sha1", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899507, "uuid": "ce9d46ea-e0f5-47c1-91df-bc20be349614", "comment": "Malware payload (Smoke Loader)", "value": "7b75796f0fcda0fae5d41ec816c320beaa5cf394ab9d743294b6e1c23373be787d788105c05b4f206cea1ebbe0eafbd2", "object_relation": "sha3-384", "Tag": [ { "name": "Dofoil", "colour": "#47EB3E", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Smoke Loader", "colour": "#164A24", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899507, "uuid": "c2dc3ab7-b679-40b1-b027-02e84ca66f04", "value": "T111649E10BA90C035F5FB52F8457A936DB93E7EA25B2061CF52E52AEE46346E0DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899507, "uuid": "dc60f1ee-8b88-4527-a7b0-6ceb497872c6", "value": "6f6aeb6fc382a28ed1adc7823a20786d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899507, "uuid": "c2408812-6d26-4a78-ae41-02f7cf584234", "value": "6144:iYXRXgwctuZ0oD00dgnn3N+UE1DhCD9YGDeDS6evIUKov:pBwfojDH2n9+UE1MDOGDeDhU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899507, "uuid": "dc28dd9a-3364-4da9-922c-6df48d778c76", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899507, "uuid": "985e8902-c696-4d09-9c3c-a9925108c9db", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899507, "uuid": "3c2be322-77f9-45c3-824e-e8aa1b7b9e07", "value": "7534dbec27b929c2ecd76499880fd560.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb563a90-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883552, "uuid": "e8263052-69ee-464e-ac04-8893dfc0a2de", "comment": "Malware payload (SilentBuilder)", "value": "79fc6047aeccc8c33d684c34e52eb9fd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883552, "uuid": "1abd630a-2f3f-4c76-b88e-7063ac3ae0f7", "comment": "Malware payload (SilentBuilder)", "value": "0a06b3a082dd5cc8bd276faae134dc0ffa9cc08e7d33646d7c20b383049b51eb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883552, "uuid": "8481c31b-8215-417d-876e-a12d2a6df7c9", "comment": "Malware payload (SilentBuilder)", "value": "f6376b61faaac355f0aeb4fa8d938568b6ecacaf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883552, "uuid": "3ea3f214-2c6c-42ca-badb-d9ce165a1bc7", "comment": "Malware payload (SilentBuilder)", "value": "8d41ecc5fc91d9186de6c06973b39f89f8f7c803eafb622522bd73828596da2320a60a7bccd6877c66f103fd7419619b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883552, "uuid": "4d57d3b7-e5bd-4b18-b211-accbe67d8817", "value": "T19EB37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883552, "uuid": "82a153b4-dd3d-4278-9eda-21f25d2eb4fe", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd497:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883552, "uuid": "440831a2-acad-48c7-853d-0f2df2555859", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883552, "uuid": "9f12f6cc-0096-4107-a666-683c4ff14a3e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883552, "uuid": "057bbbe9-9a2b-4d90-8616-cf8a8c581d9b", "value": "2022-02-03-79fc6047aeccc8c33d684c34e52eb9fd_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00a23f4f-850b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904284, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904284, "uuid": "aab8fd8b-d5e8-46d6-86b3-2a57ca286da8", "comment": "Malware payload (Heodo)", "value": "f9750830358ed9f3fbf18d9157ae259b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904284, "uuid": "1ceb9fb8-8bc7-458f-9152-30252a37f660", "comment": "Malware payload (Heodo)", "value": "0a1299f695374a8ed135ade2178f7e25acba99fada4dd0e12cd2edf49536de6f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904284, "uuid": "70075674-7efe-4030-a1d9-94159fbb502b", "comment": "Malware payload (Heodo)", "value": "31ff7d38afb1ee667322796fc5fd083faf8dfed2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904284, "uuid": "86c7cb3a-bc94-407d-b8cd-4dbd077c177a", "comment": "Malware payload (Heodo)", "value": "7204b8c2a00eb427f94a1e2ab13605a8cb7094350705d5cf9e27392e71866babc77891b83255ccd100af1f1620955659", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904284, "uuid": "9db437da-9c93-441b-b8de-2743655d155c", "value": "T12AE39D26B685C95AD91407311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904284, "uuid": "683ae292-979f-4c9d-921d-757ecc996c20", "value": "3072:acKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4LcK:acKoSsxzNDZLDZjlbR868O8KlVH3Ueh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904284, "uuid": "51800f23-9280-4ddc-a952-0963193a89ec", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904284, "uuid": "4947197d-d6e4-4428-8a94-936508ee603f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904284, "uuid": "1d0336d8-6563-4c3c-a943-45580b4109a1", "value": "tmppt7l0ft3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c43c8f8f-84d0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643879272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879272, "uuid": "8990aaf5-9edb-4a33-97f5-65f08d2fd6cf", "comment": "Malware payload (Heodo)", "value": "424dcb89e94ed0ef8164ba0d64d90a02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879272, "uuid": "240cc999-a27c-4180-8fb1-f99bedb69a71", "comment": "Malware payload (Heodo)", "value": "0a48398a3509ccd4faa819d4d0a6a27951514e6ed80b858b52658d8a5e17263b", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879272, "uuid": "ba6462d6-4be6-46c4-8daf-68d491e37e82", "comment": "Malware payload (Heodo)", "value": "5cbba2af540b412cf647afc464c8c91cc783abf3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879272, "uuid": "872126e3-8721-4225-8e9c-6a04a2812fe8", "comment": "Malware payload (Heodo)", "value": "e150667f96b96fce98de450b02a7d8b4278f9f7047b200ca1a5e61421b96bf109dfd490d41fb25871319c6e575e6704f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879272, "uuid": "49c85e16-cadb-4323-8731-4da9ff542378", "value": "T17725BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879272, "uuid": "de243723-84f0-4bf7-8665-f6c9427121ab", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879272, "uuid": "364a0677-5fcb-4e54-9dea-284a23f7c90a", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2g6FIIm2mlg:kBiaa4powXiolDS2g6FIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643879272, "uuid": "a2471f9e-0ef7-4d0e-94aa-30a713cba715", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643879272, "uuid": "a6607fba-a04a-4d9d-9577-385f7f90c234", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879272, "uuid": "df0c449e-fdbd-4309-b500-17b9e789672c", "value": "424dcb89e94ed0ef8164ba0d64d90a02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d0a8dea-849d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643857087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857087, "uuid": "14f877ab-cffa-4440-a473-2030a7cbc619", "comment": "Malware payload (Heodo)", "value": "ea91f4cd6b2d88139938e98954d17547", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857087, "uuid": "a49dcc38-cdc9-46de-b510-4a1722283f7f", "comment": "Malware payload (Heodo)", "value": "0a4eca238424b5bb49457d702da98d2395ab3583d675734482e08ac75ff0d363", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857087, "uuid": "9654336f-68b2-4910-8894-1198eda0d910", "comment": "Malware payload (Heodo)", "value": "d0d53878c881a3b48d7da2b106172fec1f41632a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857087, "uuid": "514fc19a-eff1-4fea-8035-0dd6b02b4811", "comment": "Malware payload (Heodo)", "value": "23447b4f20a1fa9accf17966cf5d9f99c8ef31f8bc1b9133dde295d45c319bc7e83c503ad326919b49f1b480cb8489ca", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857087, "uuid": "4638a6e1-0ad1-4c9a-a400-43eb42438e6e", "value": "T1D8E36B2576C5D9CADB0822350ADACAEE2327BC479E7643C37158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857087, "uuid": "2e8a38be-ae89-47e8-bed3-669fb2a5ac37", "value": "3072:JcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0C:JcKoSsxzNDZLDZjlbR868O8KlVH3deho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643857087, "uuid": "ad8e6989-c9eb-40df-bf87-92d5fc21de86", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643857087, "uuid": "495f3492-1d2d-4af8-ae3e-545c692f6dac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857087, "uuid": "1c683e33-9392-4bf5-b2ed-662676331626", "value": "2022-2-3-ea91f4cd6b2d88139938e98954d17547.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "629b6176-851f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643913038, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913038, "uuid": "fdc41007-d0e3-4912-a17d-7d73ed383b1d", "comment": "Malware payload (Heodo)", "value": "fa352a2e5d80d4379ba80e0f3ae618f2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913038, "uuid": "2d167009-459f-42ee-9371-6bf346f1ca9f", "comment": "Malware payload (Heodo)", "value": "0a94bff93ed307c15e1994489914d22049fd2535850530aaba39e2fd399b2ef6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913038, "uuid": "65887f83-a946-40a7-9250-7bd15caadec5", "comment": "Malware payload (Heodo)", "value": "550e730920d39647980d4323e8c74886c7497462", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913038, "uuid": "8f5c9a9a-7c67-4a21-994c-820c4cb94632", "comment": "Malware payload (Heodo)", "value": "39007c8d4dbbaacc7d2e161c57b5f8eba6d4811089e6e824ad0efdee51727db002400b891b00cab53b95ad63a67db694", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913038, "uuid": "bf1e1d67-fe5c-4000-a36a-b39cfe419c0d", "value": "T1CEE39D26B685C95AD91407311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913038, "uuid": "bcc446fc-4bb9-4663-b9f3-aeb1c6faa685", "value": "3072:tcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lc0:tcKoSsxzNDZLDZjlbR868O8KlVH3UehA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643913038, "uuid": "7cd17698-929e-41ab-b1b5-202c42a790cb", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643913038, "uuid": "71bc54dd-9609-4b9c-808f-6f66f6416576", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913038, "uuid": "749fe85d-315c-4966-97a9-46c386961308", "value": "tmp45y1sg24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df6782bb-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856124, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856124, "uuid": "64de48f2-5c17-42d5-8049-f04446419dc8", "comment": "Malware payload (SilentBuilder)", "value": "8247fb3f0f58f2bad72b657024a70b54", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856124, "uuid": "593f1c53-047d-41bf-b9c4-cf129b2d6980", "comment": "Malware payload (SilentBuilder)", "value": "0aa4045cae54c7092ce05683bd45deb1c5192c9d757f625426427a48b62db57e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856124, "uuid": "a74e48d8-bdad-497c-b5ff-67af34d7f607", "comment": "Malware payload (SilentBuilder)", "value": "2f46d91b2428d1af49eba869010c7c81340d6def", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856124, "uuid": "bc1978f1-a1da-4ea2-b212-c4ebdd4d660d", "comment": "Malware payload (SilentBuilder)", "value": "fffbf672c1348507cf9a94247ec58b49043b04882db5f5112a46bec868dbc4fbeb379c37c305048848f29455ad3890b3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856124, "uuid": "eeabe717-81c0-47bf-9597-090905897f29", "value": "T11CA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856124, "uuid": "b13e7659-b774-47db-b1a9-bbdacf5cf5da", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4d4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856124, "uuid": "52f086ed-8d34-4179-9b83-61b9b3f44ad7", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856124, "uuid": "5e62a3f0-3e2b-4334-9452-fb730e374e8d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856124, "uuid": "0eecc8a9-ab61-4385-9f32-9f3ad25ee490", "value": "2022-02-03-8247fb3f0f58f2bad72b657024a70b54_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5349a6dd-84c6-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643874787, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874787, "uuid": "23119949-4ee0-48ec-b515-35ad46b4d763", "comment": "Malware payload (SilentBuilder)", "value": "7cca07f1cf6872186704655e7ed3805d", "object_relation": "md5", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874787, "uuid": "bb788b54-9176-414a-8751-881c694aea17", "comment": "Malware payload (SilentBuilder)", "value": "0b27af7a20fd6f69981d8c5c4ef8237577e4c39f454856d5ac44218a03ab1ddd", "object_relation": "sha256", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874787, "uuid": "579dd88c-14fe-4601-9955-ae95c46fad44", "comment": "Malware payload (SilentBuilder)", "value": "961971d99d1916fd977d39b3080b143eb88d2093", "object_relation": "sha1", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874787, "uuid": "c1400e4a-357f-47b3-a233-eac025dc2a29", "comment": "Malware payload (SilentBuilder)", "value": "3d50a97aeba70896672a9b433cd00b35fcd1236fc342e85bf0c986ac590a93252b555eaa4bc15c3e1a90b2781ad35ec3", "object_relation": "sha3-384", "Tag": [ { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874787, "uuid": "2ed2a957-5eb5-461d-8ce7-67f0cdf376cb", "value": "T135B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874787, "uuid": "9892af52-a6e1-4b7f-846a-ccfdade54352", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49s:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874787, "uuid": "f276a7e0-4cc5-40b4-b900-ae0501756f0c", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874787, "uuid": "5880ed32-cac9-417c-b976-4b2f2b73c095", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874787, "uuid": "26f22ab7-baeb-437f-b3af-d84f88ebe520", "value": "bypa.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd7e857a-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "c8632ed8-9139-4bc3-8f8e-8df768d4ef7c", "comment": "Malware payload (Heodo)", "value": "a1f1c0f041f49e2ce3acc0f153320437", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "f7d8ccf7-c11e-470a-8598-b357c6f8f7fb", "comment": "Malware payload (Heodo)", "value": "0b40eba72722ded6caf566c5462e4c31540f0382569e74e9825864c37953b734", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "dc091091-e04e-4fa8-a4aa-3347d30dac1a", "comment": "Malware payload (Heodo)", "value": "dd3f20fd37b9e9de3ad61f67cdd375af17ac6092", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "2e58692a-4aa2-420f-acf4-376e98a2357c", "comment": "Malware payload (Heodo)", "value": "bf1fdb6fbff843fa852b1e362bcc697076b7a567e9c33312f3001d471303718f400d0ea5cadc90290720888b0a63ba8a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "3957d823-e048-4e36-8849-c82208109927", "value": "T1C564E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "f1605793-5a92-43d0-9142-fbd14f6e9b6b", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "616a1fc0-f003-4641-bd95-b624cecfe4ac", "value": "6144:83DvZRFTFbksYyljaMYDMgT7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMYnLAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910292, "uuid": "ff94d03e-cce8-4703-892f-79d2d0f7a7e6", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910292, "uuid": "429551ec-0a0a-4b84-8aa3-3aecc69fbefa", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "28c3a941-f16c-453e-883e-e35e9c76fb41", "value": "emotet_exe_e5_0b40eba72722ded6caf566c5462e4c31540f0382569e74e9825864c37953b734_2022-02-03__174436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d448c233-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883594, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883594, "uuid": "8827ee9f-6be6-437e-9083-c8f5864f2fc4", "comment": "Malware payload (SilentBuilder)", "value": "81558170de004e584e0e9ef028be35a5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883594, "uuid": "40f3fa69-0ecc-4f18-83b0-d519a7cc5fa1", "comment": "Malware payload (SilentBuilder)", "value": "0b8c1d53cc707b39deebd93c2534a197cb43093772227b6eccd8bf2bdc279c97", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883594, "uuid": "d3a3a6f3-6cd9-40d0-be32-10c0bb00fd57", "comment": "Malware payload (SilentBuilder)", "value": "840cab1551ebdf40f28babd63dedfea29b0d69de", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883594, "uuid": "bf6a5bf8-18ba-491b-9a7c-6ae21b4b58bd", "comment": "Malware payload (SilentBuilder)", "value": "b7565ad21f2ac780dd84f2e6d2e987180bd69ad3aecb60c9163a1cc883e55c00cced1d97fc165a3eddfa1869d362d57a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883594, "uuid": "dcc1b882-170d-4e3e-b5a7-58bf64172ae7", "value": "T118A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883594, "uuid": "9de10842-b910-4325-91f8-a57ddef7f396", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4t4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883594, "uuid": "218a5268-1ac8-4e99-bd7c-07057ded6744", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883594, "uuid": "be2daad6-821f-4ad5-857f-4cd453435491", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883594, "uuid": "c3ef54b2-12af-4c8b-ad43-3e11c28f2244", "value": "2022-02-03-81558170de004e584e0e9ef028be35a5_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b6f312f-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883364, "uuid": "faa9abab-f8d4-4fac-896e-6cdf43873aa4", "comment": "Malware payload (SilentBuilder)", "value": "5361d5d3a449c1ac85379711c0dead5f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883364, "uuid": "2792ff20-81b9-443a-8d85-761988df77eb", "comment": "Malware payload (SilentBuilder)", "value": "0bb447388ca6f9fff725bbf1b81b2421a58dfcb0a3722e030a0772a2f81de7db", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883364, "uuid": "073d7177-94d7-4f5d-a4a9-5944ff7e0765", "comment": "Malware payload (SilentBuilder)", "value": "2a4c8df74519172220652e993ccef4a4438deeff", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883364, "uuid": "608b9d90-c945-4858-83b5-803aa100409c", "comment": "Malware payload (SilentBuilder)", "value": "0707c328130ade29d378c62e3d2034fdba1ea455f740b70a51b1e047f1eb3be9c5b4c807394a837d43c77c47af52bbb8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883364, "uuid": "d9c11518-d5e8-47be-9e9b-8195b72fbf7e", "value": "T1C8B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883364, "uuid": "633a7b5b-d8aa-42c2-97d8-502b8887a421", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49b:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883364, "uuid": "c2819b1f-1b1d-4db0-91bc-ea5f7070a843", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883364, "uuid": "7cb191a3-10ca-4cf2-a521-6d298a6d87dc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883364, "uuid": "47529e72-ce9e-4c97-943c-4b002e735477", "value": "2022-02-03-5361d5d3a449c1ac85379711c0dead5f_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "60eeea7d-850f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643906163, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906163, "uuid": "8f750a25-7c34-431c-a9c7-7d69cc759761", "comment": "Malware payload (Mirai)", "value": "2db35d329e9da709c21f9dc1e8fdd0a1", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906163, "uuid": "28e369be-7503-4642-b125-19f16aa814dd", "comment": "Malware payload (Mirai)", "value": "0bcfe56fbc7756d6045e9527294350b815a8f216befc25f2fb8117c1ff753b41", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906163, "uuid": "83098da1-23f3-4c93-92d4-ecb8f9855b73", "comment": "Malware payload (Mirai)", "value": "287c7b60cca835048a600b071ee2f94b3eac1cd4", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906163, "uuid": "2a4d757a-4683-46fe-9257-0b1992e71ad6", "comment": "Malware payload (Mirai)", "value": "c98b4f7484612a2a20e7cd083c49fb9df799e4fdb66f875ecd127c0f44e68b8834f5f349378ef401f9b2d393befa2a6c", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906163, "uuid": "41d14272-9ccd-4f75-b66b-a1f8a29326d8", "value": "T1CE63C75A6E219FFDF2AC87304BB34B21A79923D623E1D685D29CC5041F7038D585FBA8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906163, "uuid": "3599af88-2426-432c-8242-7654a803ed58", "value": "768:bBupf3Hn3pJa+3ndzHswBLg8yEtleUjINNgDbRVIXK:bkR3HLRn/JHerN+bRVh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643906163, "uuid": "a96b2ab2-e133-41f7-aaa9-4e26cf25f2ca", "value": 68372, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643906163, "uuid": "00773a0a-53b5-4b73-a6a4-8c8b2825b454", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906163, "uuid": "503eebf7-b64c-4ca7-86be-128839e45714", "value": "ahsok.mips", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d5f0595a-84de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643885314, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885314, "uuid": "e00b88dd-8068-409d-9e67-ea37b2e9f5fa", "comment": "Malware payload (Heodo)", "value": "b6521c3666077007de19f55bd2adeaf9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885314, "uuid": "e54e8ac3-5491-4e60-b6ca-1d74b3452390", "comment": "Malware payload (Heodo)", "value": "0c1faff7131453a16ba39edc178103d4fe0e263738ee46976b520f31def60f34", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885314, "uuid": "b1dc3deb-9d52-46bc-98d1-6b028a18cb44", "comment": "Malware payload (Heodo)", "value": "19dc996bdf583e888cc4d5452ded14cc5b7661cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885314, "uuid": "63d34e28-6756-41cd-b92a-ff365377087c", "comment": "Malware payload (Heodo)", "value": "6cbcf7a09a65516132050e4017fe59c1f45607d4049e8bd36fc9e6dc538ffb9de5e149bd5b89ed6d2cb309ad27fe1c65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885314, "uuid": "90e37060-4eca-4ff1-a961-8ad1e1eac8ae", "value": "T1AD25C0216D8A40E6FA47193E0069B3544FDC69050BE0E8CFEF54F9A66F12CC25B785AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885314, "uuid": "730d9855-728c-4274-a052-09478b07d48d", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885314, "uuid": "0be8e6d6-1929-4e1b-b4f6-8a320497425c", "value": "24576:vyj4pucLsugl4zCy9fG+OVE+cXcs2vUqFIIm2m0:vzfnl9fYVoDvqFIr2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885314, "uuid": "dcf54fc9-7dac-45c1-838c-bddf16a62dbe", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885314, "uuid": "aa8d5d97-ab53-4b7e-969c-04fe451ec321", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885314, "uuid": "f634ac94-64ae-4527-a9c6-3880679327d4", "value": "b6521c3666077007de19f55bd2adeaf9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64e0003d-84dc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643884266, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884266, "uuid": "f1066a97-7e75-4d89-a537-3cdd1df961c9", "comment": "Malware payload (SilentBuilder)", "value": "229e47632aaa6b1c030edc3ee70bc453", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884266, "uuid": "d064b417-648b-4252-865d-337413802757", "comment": "Malware payload (SilentBuilder)", "value": "0c22b3e207d5858af96d7335e36b578eacde7975aeea980a9ecbc5b1f95d630b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884266, "uuid": "5be0ef0c-20c9-479c-b80f-022a16f7cee8", "comment": "Malware payload (SilentBuilder)", "value": "5cef925596e1a2974874b66cd05ee18ccb38d0cb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884266, "uuid": "3ac84dfd-2d80-416e-813e-f95c9cae27f0", "comment": "Malware payload (SilentBuilder)", "value": "e8e60409d7887a02723f563e58a3cc936be67a5063bf442de2a292741bc0636571d975e263177ff10957864df02ab2e3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884266, "uuid": "fa4e2104-8d3f-4faf-a510-b1e8b17a4e7b", "value": "T178A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884266, "uuid": "80bf55da-193f-499b-915d-3e4108df7db3", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4Z4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884266, "uuid": "8e3a6b8c-3481-43e7-b733-ddae012c1fa7", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884266, "uuid": "55215e87-2f48-4a98-ba12-976c21295a97", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884266, "uuid": "50701ac1-e13e-43f6-94b3-6420d73201c9", "value": "2022-2-3-229e47632aaa6b1c030edc3ee70bc453.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76452d8a-84ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643890308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890308, "uuid": "52768b9b-7a06-465d-8aac-245f7e400d20", "comment": "Malware payload (Heodo)", "value": "5059ba317c6ef3f2e7a3992b1b4f7dd7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890308, "uuid": "9a1623c7-575c-4270-ba5f-74a27196c187", "comment": "Malware payload (Heodo)", "value": "0c38023b89a034f5bf06be92bab3904f1aaef13b6127694f4323f2aa60d893c1", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890308, "uuid": "9a83a5e4-2234-4017-8b63-950014fe8b27", "comment": "Malware payload (Heodo)", "value": "85192383c89d50192ea479e0f812698addeebbeb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890308, "uuid": "c4a128b2-017d-48b7-8c49-170cdb089977", "comment": "Malware payload (Heodo)", "value": "21593cd175ad4d91809008d54fc2686f34fd1a2a2d22482a69302ce10ba4e219e6d3f6238aba87afda71d5873559f204", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890308, "uuid": "85a35c0c-b0bf-49a4-9e70-43cc5a29765d", "value": "T11025CF516D4980A1FA0B293D107A63660FEC690117E0E9EFDF05F8E75F26CC196788AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890308, "uuid": "f35503c0-f414-47ca-aade-4f8658d8bbd4", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890308, "uuid": "701158a3-f1e7-41f5-91ad-f796daea63de", "value": "24576:O77NlW4ZujpK630cavFuwNUsjk6opl2VD+rNtl7ifTI5dTpyQFIIm2mHL:6W4Z+LEtvFuwDjVK7GTC7yQFIr2mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643890308, "uuid": "e5c39868-7e21-41f7-b3c6-acc9a94309d4", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643890308, "uuid": "b642b30b-0865-41b1-86b0-7ac3ce24d091", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890308, "uuid": "6f25aad9-4e57-4c08-bb22-f50612fa5dbf", "value": "emotet_exe_e4_0c38023b89a034f5bf06be92bab3904f1aaef13b6127694f4323f2aa60d893c1_2022-02-03__121137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b5eede4-8526-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643916006, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916006, "uuid": "82e4207b-e875-4498-83a2-0c2b40d79554", "comment": "Malware payload (Heodo)", "value": "26218969b12f8ef6c50a69b56b311183", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916006, "uuid": "e27abc92-e470-4872-b49e-77c9ecbd34fe", "comment": "Malware payload (Heodo)", "value": "0c6303172c2dce18937db039fb8bcdd2a430617e4c2cb9ae81019fc4874e455e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916006, "uuid": "f60f2fad-1ec7-4c64-bf3a-5f2daf486260", "comment": "Malware payload (Heodo)", "value": "966d8ac5448faf5b83090f3c30101d92e19d78f8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916006, "uuid": "d64085c4-da85-403c-bdc5-d60ad1159118", "comment": "Malware payload (Heodo)", "value": "78d52e439dc999ac17c3f796c5b8c266595208d9e07f4afaa3d399a9d01e41080fd4c4eb11106e5371625bfd8c8c6171", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916006, "uuid": "4b939f54-c1c8-432e-803e-81cf8aa7db03", "value": "T133D4C05472A28476E0AEA83404249B138D6E7F715FB0C4DBD7E539AE4D3D2D16A30E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916006, "uuid": "9ee36b21-313f-4672-b7b4-b2c606dd9d3f", "value": "15b471bbc15a140b9567d4daee05d632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916006, "uuid": "58110b10-391b-444c-ac1b-a0c56ef857b5", "value": "12288:8m9+I/aI+W1QbBi3IjeuXe6q7nCi/xCMqYDl2JwDKCX:8XrbB2IjevCxMqW2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643916006, "uuid": "59c9b22a-15dc-4c2b-984b-ddb845516a1c", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643916006, "uuid": "1f8000e1-c65d-4811-94b9-c9a9fe3647f4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916006, "uuid": "b34c911a-835e-4efa-919e-b28fe6b13ce2", "value": "emotet_exe_e5_0c6303172c2dce18937db039fb8bcdd2a430617e4c2cb9ae81019fc4874e455e_2022-02-03__191952.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43a25f46-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855434, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855434, "uuid": "5fcab828-4d11-4046-ab1c-a6339c67b1ff", "comment": "Malware payload (SilentBuilder)", "value": "17d7844dd660fd5be04a365c736f0502", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855434, "uuid": "6853c150-a53d-450c-b89d-88e7161b401d", "comment": "Malware payload (SilentBuilder)", "value": "0c81bacc72fca03d8c0ae4e0ff5589567241901946df3e5a4148e74efad50ad4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855434, "uuid": "f91459d8-cf82-4e4c-81dc-d20e328147f9", "comment": "Malware payload (SilentBuilder)", "value": "a29a504ffdd88fdfe99ff7f8f7d9213aff685001", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855434, "uuid": "314d4c05-15f4-46f5-b943-d3188ccfb0d9", "comment": "Malware payload (SilentBuilder)", "value": "8ecf3d697347fab36727b84aa872447740aea0e077a1e6d95321369cf7ee1aa3d315c3d53188ec592e4ae0652981b811", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855434, "uuid": "8a8ddd70-fc0f-4159-b21f-728d495cabe2", "value": "T150A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855434, "uuid": "a7496655-9380-4d1e-8103-d420f464b8e5", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4Z4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855434, "uuid": "c5c33cd5-b41d-4590-a52c-a066d2dea313", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855434, "uuid": "e1b550f5-2e34-42bc-b787-04e4fce58121", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855434, "uuid": "a86ddb53-208a-44d0-8fff-a8b9cedb9506", "value": "2022-02-03-17d7844dd660fd5be04a365c736f0502_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "db2d30d9-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643847098, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847098, "uuid": "f961b7f5-5ef6-4a9b-9b31-8c4709d481be", "comment": "Malware payload (Heodo)", "value": "e2d76d0a50ab29eb6e28cb50c911ae9a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847098, "uuid": "2acbe7b7-9c10-4bdc-8168-24be65029383", "comment": "Malware payload (Heodo)", "value": "0c85b3f8f1997c59b86fa1519d4b2e4880bc766c31111cfb50b93ae53faa22d7", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847098, "uuid": "6dbbcedd-5c0e-4560-b117-466dbc70d869", "comment": "Malware payload (Heodo)", "value": "3ac2259f4abef8c86bf46e699b5a0dc409205d1b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847098, "uuid": "e9e75eaf-a519-45e6-8a81-1fac21a084b1", "comment": "Malware payload (Heodo)", "value": "de8b57a9563c04ef3d04c87a900dff12918df2c5f6ec56e41a68cffc93f2027afee2cd5d9a97d4e2e07991099861b32e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847098, "uuid": "49f5f80c-bf6e-4aa2-8a47-3f28330d01c2", "value": "T1DAE36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847098, "uuid": "727ae138-a0a3-4f17-8223-063bfb153ab5", "value": "3072:4cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0a:4cKoSsxzNDZLDZjlbR868O8KlVH3dehc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643847098, "uuid": "d8268f6b-58b6-4989-b9ff-1beae56aeaa6", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643847098, "uuid": "a176a735-a697-425d-96c7-5873cfbd1b8a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847098, "uuid": "60ffcca5-21c3-4dd1-bb98-e48e7c1df079", "value": "2022-2-3-e2d76d0a50ab29eb6e28cb50c911ae9a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30b66634-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855831, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855831, "uuid": "8b644d4d-c523-4955-a083-a97d1d05ed80", "comment": "Malware payload (SilentBuilder)", "value": "53a7ae617b1b7bbfe9c6ae616fdf2a11", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855831, "uuid": "9e0f07ab-4bb4-4b6e-8afe-a7917f8f3d5a", "comment": "Malware payload (SilentBuilder)", "value": "0cb989b5ef736e657b1d216041816a25fdfad97489cc9948153ca08335578743", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855831, "uuid": "c18d4486-cef6-467c-ba05-f7655cdd1d1f", "comment": "Malware payload (SilentBuilder)", "value": "45b328f32be63670510ba72fb647f26053eeead5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855831, "uuid": "5dd141af-04d2-4a59-a719-0f4c9954a970", "comment": "Malware payload (SilentBuilder)", "value": "1f9bb7dc42a57aa9b49ef4047b8944d0e5452052e9e5923992ac6687c8f94e9b98d5efb4133fac6eeff5482d693db833", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855831, "uuid": "cb1fff24-e2ec-4a65-a9c2-ffa165714a93", "value": "T16EB37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855831, "uuid": "e37293e7-408c-4536-8595-10a4f890b2ab", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49L:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855831, "uuid": "25a2f2a6-26f8-4ca1-9281-797f90d95585", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855831, "uuid": "ef08a3bb-6b08-4fc1-a7a7-521a2211a20c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855831, "uuid": "e34c0142-6343-45d9-b5bc-5cc126b20f53", "value": "2022-02-03-53a7ae617b1b7bbfe9c6ae616fdf2a11_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0eb0a6b-8514-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1643908552, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908552, "uuid": "97a25b00-b1b5-43df-970b-a5d5e4f8fd7f", "comment": "Malware payload (RaccoonStealer)", "value": "7a2973571f083a8b8cdb6051de5fdd0f", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908552, "uuid": "890b2192-9b29-4d45-bd01-fd47f3ec9476", "comment": "Malware payload (RaccoonStealer)", "value": "0ce285cf68d5bf2dfef9e6e11d398b251085cbca275363691cf94e64de622212", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908552, "uuid": "4eee9841-5788-4a2b-a881-0e80de5bb9c7", "comment": "Malware payload (RaccoonStealer)", "value": "ffb6b671d29c634e837418a53cf28ee3efbcc308", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908552, "uuid": "943a26e0-e607-4fbf-83ed-a555f6cb95d5", "comment": "Malware payload (RaccoonStealer)", "value": "752224c2a8e9dd3ca573e219c46a374e7e7664e5608201ef37c3acf79f84b822c357f89186122654476544261afc14b5", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908552, "uuid": "d09fb91d-fde5-495c-b035-f6dd621cb522", "value": "T1FC648E00B790C035F1B756F8897A93A9B63E7EA15B3450CB62D52BEE5A346E0EC31317", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908552, "uuid": "6da72d1b-0068-42fe-bc68-48cb3241441e", "value": "3f0af22a03ecdedbd2c62f1da70f1873", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908552, "uuid": "bdabe56d-9a2f-42f6-a4eb-6021882a2aa3", "value": "6144:bemEaPNAZLA2/eOtBfS15qrm3EKwJCkS0ZLzXgVg36QjkZuQCIVKoH:C3gmpPGeBfS15qrD3CSwWq9UIV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643908552, "uuid": "15966d90-62a8-4c75-a8fe-5c3e97ccce31", "value": 315904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643908552, "uuid": "2ba48408-08b1-43ff-b00a-43bf1a3fe7fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908552, "uuid": "f8e5c40d-8d82-4743-9682-981ccdaef55b", "value": "7a2973571f083a8b8cdb6051de5fdd0f.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b187b0d4-84fc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643898138, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898138, "uuid": "b7bf628c-8ae6-471b-b6c0-1e0469a59813", "comment": "Malware payload", "value": "fb0d531d6ad9e1d5c2ba5c16977d3c07", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898138, "uuid": "37d1754c-2bee-4840-a394-b66a31c0facb", "comment": "Malware payload", "value": "0cee84c21be933e56c20500afb57f7cf347c41f3c7eef4bee2bc76ff9bb57a42", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898138, "uuid": "60cf7a80-4ee2-4544-a493-ac069fc5c6c6", "comment": "Malware payload", "value": "48bc9ca05f9f271a82345ceb8375b6be8216a9d2", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898138, "uuid": "92adbce6-bd3f-4477-888a-789c65c7cd3b", "comment": "Malware payload", "value": "b063d801a923dcf6aae265639cea0a4c6e32f2494294e7397279d09edd1703e85bf9110490174ac392cbd926438bee17", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898138, "uuid": "f9500788-0c4f-46f9-90ef-256a44fc321e", "value": "T1811412C4FFB1FB15F804ED792DC58BE3D35A9EE2A523A2462493350821F68525C6863F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898138, "uuid": "7da02d6c-bacc-40e2-b153-0c5cb98f083b", "value": "3072:Rf8WbZCz/B2kgK1atFasd3rI7LtTqaRV/uxlEvwXM00sJJqxj9NEUNw5eFo61NEy:5bZCz/JMtAsVI7ZRj/uxlEvwJdc9Noer", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898138, "uuid": "75ac08ef-81c8-4709-88cc-5df8a965e91e", "value": 191592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898138, "uuid": "a8844956-5f96-411f-b0a8-90f56206c651", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898138, "uuid": "1e2171e4-bf1c-469f-9915-0fb9df66f997", "value": "W6904.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45572dab-84e8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643889367, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889367, "uuid": "196f11ea-a628-40c0-a270-39ec237f933c", "comment": "Malware payload", "value": "c6b24c0f59c395898ebad9767870aad0", "object_relation": "md5", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889367, "uuid": "66566032-3672-4baf-af4e-109417f01c0b", "comment": "Malware payload", "value": "0dc4eae7f921392b38449ac228aa8f17730c87c43c31d6b2a76364d0391c5fe7", "object_relation": "sha256", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889367, "uuid": "b9960132-458c-40fb-87c7-a842abdc3a36", "comment": "Malware payload", "value": "d9fb9728a002d6a608caa1f1d3313468af52d90e", "object_relation": "sha1", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889367, "uuid": "b5cc5d59-f36e-4d8a-8d81-4ce519d37a3e", "comment": "Malware payload", "value": "2e540932c5545ffc1c49a07deb64df0e19df330ce3daf3622cb21d0f29e382ea5b5d65a536f898a75f68a5a56fae2c13", "object_relation": "sha3-384", "Tag": [ { "name": "html", "colour": "#9396B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643889367, "uuid": "b53e7a99-e881-4117-a5a2-43426b20b2a2", "value": "T11503F25681C5BE400D164D40E789FEB241A825B35C1CD1CFE8F5C9E9BEA221A2FD758D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643889367, "uuid": "66f28df2-5f88-4051-979c-aa3e8fc7b171", "value": "768:3VNW2hh/fQNq6WshJ9U/4Cbebp20lPL080gZQuiqZ+9PWM+YXmEEs4Pe:lsY/fD6prq/4CbQp2qLqUQuTZKPWsXmo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643889367, "uuid": "fb1e2a85-4f06-4567-a5f9-46c18aae5627", "value": 40233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643889367, "uuid": "0cde8fde-e0ba-457f-834e-09ea153ecd1e", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643889367, "uuid": "5d45e24a-3b02-4a75-8d52-b063d9ae7a97", "value": "RFQ NO-[3023373]-[NORBC].html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0884090-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1643856073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856073, "uuid": "34c8f864-f281-4861-a741-1b0bba5c3153", "comment": "Malware payload (RedLineStealer)", "value": "a90be429c9884c38dcdcde354f96e5eb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856073, "uuid": "1427ec30-14d7-4fcd-9c0e-1815145b2963", "comment": "Malware payload (RedLineStealer)", "value": "0e041d06cf4c8b7ed4e1fd8bd71bc4d06d575365fc261db2013ca046414827e1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856073, "uuid": "97c0b43d-fb79-4ecb-9361-5dbb04c40520", "comment": "Malware payload (RedLineStealer)", "value": "45c408a0d4dc822c6c5006476c4ce9f44fffa542", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856073, "uuid": "7893f100-2fcf-45d4-97d3-9d3d4e5e0b32", "comment": "Malware payload (RedLineStealer)", "value": "002edf146e4e6cda3423afc267e12582b5c54c600113b856142a747c68681c88fb2924ac2e743ff19cae189ea52a99b4", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856073, "uuid": "cf3c653b-19b2-4cf5-bc84-7aabc7e89be3", "value": "T1B27633D421ABA45BD5AFD978E7F1303B6EA4B50B1F12E5BDFF1A502B31B6182C10214B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856073, "uuid": "fc6e6629-85a5-4554-9a9c-be9b782a79c0", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856073, "uuid": "633af8ae-6b81-4d59-8d0a-46a3e601912a", "value": "196608:JTyiFkfRvi5BeBQDe8gtdQA4W3lGwW2K4LK6Agf7doYHS0LYG:JeDcuP3QA4W3lGwY426AgjdoG3LYG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856073, "uuid": "46fba33f-ee5e-4faa-99ac-a6e1aec4786a", "value": 7548005, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856073, "uuid": "858a3acb-f0ac-4eab-a361-ecf2b8beb98f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856073, "uuid": "c11c5ece-73f8-4a46-938f-f78c4eadda60", "value": "a90be429c9884c38dcdcde354f96e5eb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1771df07-8500-11ec-9275-42010a9c0029", "comment": "Malware payload (QuasarRAT)", "timestamp": 1643899598, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899598, "uuid": "8468ceec-6d7d-465c-a8ba-f8764e2a8b62", "comment": "Malware payload (QuasarRAT)", "value": "c41056d6cc3d8ca1ada8794ff631af13", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899598, "uuid": "042efbe4-a358-4e55-b67a-6e68060b93ca", "comment": "Malware payload (QuasarRAT)", "value": "0e05745ef53d73623346765e004779ecd46d050a7e0af7c456870c8b7e64f54a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899598, "uuid": "ea7ba6dd-3173-4f71-bbb0-9ee814a08636", "comment": "Malware payload (QuasarRAT)", "value": "b29c6c23d55143a81b2fe4a577746278258f4113", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899598, "uuid": "363816a7-93a1-4c0a-a39e-74649d136f1f", "comment": "Malware payload (QuasarRAT)", "value": "6ffb5df6ea96c4d18655cb03828f89937f0c9c43165eb6f3cfb0a0b96054b7b59bb966d4b476ce8c455ed10c264b21d7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "QuasarRAT", "colour": "#359B0D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899598, "uuid": "ca2284a8-359d-4741-9c7b-9a9e4a7e39cf", "value": "T158C317013666F066ED7276308C9787720A295DE8A9D3C70761C7776E2F7EB0043AB635", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899598, "uuid": "1b41b7c7-0975-4703-82b0-e511f88b057f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899598, "uuid": "1837b0b8-bf9e-49e1-abcd-0093c3f966d6", "value": "768:wm5U+9fboV+us4n9AylUuFqTrUT1wULPBt2Pupv2Uz:Rd9fboVRs4mylATrUZCu7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899598, "uuid": "0708e271-4b4c-4987-8864-c848b315f763", "value": 121344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899598, "uuid": "42d1978c-1637-4f98-9e46-301b375384dc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899598, "uuid": "db281946-f1ef-43fb-847b-32a0df6ab6e8", "value": "c41056d6cc3d8ca1ada8794ff631af13.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9b92ca88-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855581, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855581, "uuid": "93598f9f-ac6b-4c7f-949c-d5956e9fce20", "comment": "Malware payload (SilentBuilder)", "value": "398a937eba0303fbe062f9978345a46a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855581, "uuid": "b6356e31-05bf-48aa-8943-30bfe0cb7e58", "comment": "Malware payload (SilentBuilder)", "value": "0e0659445094adf40d6d337a5f9799e5c041556846305afd35e896c743075929", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855581, "uuid": "22c084d8-52ff-40a2-9aaa-577eb7f9768c", "comment": "Malware payload (SilentBuilder)", "value": "ffffd3cc9466a47541939a636e26b2d27f11bcb0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855581, "uuid": "dd729162-e85c-47cf-948b-e5fd7ec06de3", "comment": "Malware payload (SilentBuilder)", "value": "600a4416cc5daaf1c0ef47e1b3ac6be37da175c1eeebf6d7f6557ce7fe3269262f1836c7a87c07293e59441664332576", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855581, "uuid": "60b2f766-e014-43c9-8107-63ab4111c05f", "value": "T1D3B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855581, "uuid": "81858db0-6f88-4639-b75a-e6dc9313e627", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49/:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855581, "uuid": "d50b3d5e-7237-4de4-a2c4-e993a5ce6582", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855581, "uuid": "429af4bf-cc80-4fc2-a707-f6971bbd23c3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855581, "uuid": "dbfc2a29-52ea-40c0-8875-f2dd4f663427", "value": "2022-02-03-398a937eba0303fbe062f9978345a46a_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ac959fa-850c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904838, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904838, "uuid": "38749441-e54a-48c8-b564-a1960a4248e2", "comment": "Malware payload (Heodo)", "value": "bb701412f4174c5ab833cc6b7b281485", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904838, "uuid": "bafb6bc4-06cd-48df-9108-fd0d159b21d7", "comment": "Malware payload (Heodo)", "value": "0e529272ac0e25ff85c5452165cfc8402b9d9277e3964da72f547ddd6e01925c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904838, "uuid": "1f715c6d-92a5-4cb1-8ece-1ab7c2d3d7cf", "comment": "Malware payload (Heodo)", "value": "383e3cc9f03aa27badb4406021c61db7533ebc09", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904838, "uuid": "8c8b88ab-dd74-4e93-9c76-d815a6d34d9f", "comment": "Malware payload (Heodo)", "value": "f1b64af491952b8afa0c97a8a577689908c3da9f096876a1932581df0c5457e470f273f31672aba157caf5f974e9f237", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904838, "uuid": "2756f565-e736-4558-a0cf-e9b36d03ee77", "value": "T1EBE39C26B685C95AD91407351DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904838, "uuid": "f37322e0-bd01-4886-94fc-e1d8a2a39078", "value": "3072:ycKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcf:ycKoSsxzNDZLDZjlbR868O8KlVH3Uehb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904838, "uuid": "f011adc0-ae48-401a-8acc-9b01aebe6e9a", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904838, "uuid": "ff6eaf59-5d46-45c6-9167-accdea5ada13", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904838, "uuid": "26ff6ed7-ee08-4a70-90d9-1b7a8b4548fe", "value": "tmpdeggsiji", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0db8449b-8508-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1643903017, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903017, "uuid": "6d7667ca-75df-4f78-a034-11c9b8da9e8e", "comment": "Malware payload (Formbook)", "value": "494712fb9005602f605a433acc37d8ae", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903017, "uuid": "ff89f0d5-0721-4ed8-8c27-5d050fcfd9e8", "comment": "Malware payload (Formbook)", "value": "0e8333bd57ef2ac051d65249e88b4fbc2e648951e5e417cc807bb9e23edffab1", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903017, "uuid": "b6933d1d-200a-407c-a67c-fe9d65bbef5e", "comment": "Malware payload (Formbook)", "value": "8c5b07163aef58523563bb00e06ca1792187a271", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903017, "uuid": "7d8738c7-6374-4579-985f-01738f7d0a53", "comment": "Malware payload (Formbook)", "value": "5d35d915b842c7a586645ff533f77537938484867ff348a4b8d82ff41ca2cdbc5a7815acd9e5597511d4e48d44519d11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903017, "uuid": "03b4221a-d93e-4b14-8e41-ac0444b85cbe", "value": "T11FB4F1A1F6D75681F56B99312136BC4142773EE3AEC6CA191318F24C4BF33604E6AA4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903017, "uuid": "d7b5ef59-4edb-4704-bc4a-e9f1cfb56541", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903017, "uuid": "0f4facdb-9f9f-445c-bd40-acd6156f2759", "value": "12288:c97p3StJJ5PFGrfOZ/chy/RyUgAbeEN+gSidWCEp5J:ttJJvGrOZN/RpgRMoi8b5J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643903017, "uuid": "305d75bd-1114-462e-9193-e232fb39075a", "value": 542720, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643903017, "uuid": "37073f38-baa4-4362-b593-2fe370e75931", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903017, "uuid": "578d6039-d180-4e6f-a2d9-5874a615b56c", "value": "494712fb9005602f605a433acc37d8ae", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bcfd6570-851d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643912331, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912331, "uuid": "6a7aedc8-5679-45be-9cdb-638fd5a24a91", "comment": "Malware payload (Heodo)", "value": "8f5dfa55253bd739e42e67d6da6a3948", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912331, "uuid": "2a8264fc-96db-4367-bfbd-caa52ecd30df", "comment": "Malware payload (Heodo)", "value": "0e9076c62005c5a01c4916b45694599274c1d8841acc49e8b669c85f02a61ba1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912331, "uuid": "31cdbdba-b243-48f6-96f2-297b2bde44e1", "comment": "Malware payload (Heodo)", "value": "30859b3ac0ec647e9c234131621cd7c97ecb9d02", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912331, "uuid": "96c7908c-5542-4c5e-8633-d1a098e94168", "comment": "Malware payload (Heodo)", "value": "6f687310390daddca733305e9ab85946d95929b9de6d3b23af9cad6ef47a4429e8a37acf0d6b199e1312f01b4c6427e4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643912331, "uuid": "51ed2f1b-769e-4f68-b955-5f6007407488", "value": "T15DE39D26B685C95AD91407311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643912331, "uuid": "5cc26c48-73d9-4b2f-b1d5-0b98424d62da", "value": "3072:ScKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgi4Lcd:ScKoSsxzNDZLDZjlbR868O8KlVH3Ueh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643912331, "uuid": "59c5357d-881f-4a29-8032-64b11dd87e4d", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643912331, "uuid": "1b1b8341-d38a-4e04-b49a-706cfb837d93", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643912331, "uuid": "589d07f1-170d-40e5-98d6-91442992f0f0", "value": "tmpr1arox_d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "85dae0c6-8500-11ec-9275-42010a9c0029", "comment": "Malware payload (IcedID)", "timestamp": 1643899783, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899783, "uuid": "c632ecf5-cd1f-490d-ae63-972d11790e20", "comment": "Malware payload (IcedID)", "value": "edb73a20819bd8c4ad53377e88c5ad0e", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899783, "uuid": "b8b15f03-8ff1-4db3-8d9e-da3642756e1e", "comment": "Malware payload (IcedID)", "value": "0eb7305400b177ff6ba6925d52ec9c3d922282ef380cf876a31b973cf454f74e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899783, "uuid": "ae9bec2d-2b51-4090-9824-3c89b11181dc", "comment": "Malware payload (IcedID)", "value": "00827a2f5d8f464414ee32f692ef2e5f7d42cdc9", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899783, "uuid": "4ff5d645-73c6-4efc-add0-f6df68094fc7", "comment": "Malware payload (IcedID)", "value": "b41076c9ddbb7256ebb532f2347183f691ef3aa684ed5b4d48a173718b8be4efa0522ccf516e1e52ebc254886c66f045", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "IcedID", "colour": "#819B92", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899783, "uuid": "4364d158-873f-4466-bf10-a7eeb4fd94d6", "value": "T12A83E321FE7B8299C965FD3A0231F22FA864393ED1EC51FB8BD587157320B02572A794", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899783, "uuid": "261494c9-eb40-401a-aeed-6eef5312f97d", "value": "001ec41bdbcdc88875ccb30efbbcd29f", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899783, "uuid": "59d45404-933a-45e0-84d5-ece7dda9e02f", "value": "1536:Ceak7FyM1fSHsUL4EBJMM5fMH+noSLVGBPn85kQ:Jak854uJMEfTVGn8H", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899783, "uuid": "1971159c-d7b5-419b-8629-e261089b1cec", "value": 88229, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899783, "uuid": "31be2522-413d-4ce4-9f27-111b5578c52d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899783, "uuid": "68a3db22-620f-4232-8bdf-631420a29218", "value": "0eb7305400b177ff6ba6925d52ec9c3d922282ef380cf876a31b973cf454f74e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "108f57d2-850b-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1643904311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904311, "uuid": "e6ba28e0-8561-4a2b-bcc1-421f5e74d601", "comment": "Malware payload (RedLineStealer)", "value": "acad5e6af6cfb4fe316c104033a77949", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904311, "uuid": "1d15bc55-fc60-4485-addf-3853ba21132a", "comment": "Malware payload (RedLineStealer)", "value": "0ec522dfd9307772bf8b600a8b91fd6facd0bf4090c2b386afd20e955b25206a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904311, "uuid": "53d2c8bb-262a-467a-aca7-9ae46033e49c", "comment": "Malware payload (RedLineStealer)", "value": "45fec5886bbb883664d616af5292383f3e1b985b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904311, "uuid": "036c3101-f8d6-4b04-82b4-e93348edc531", "comment": "Malware payload (RedLineStealer)", "value": "5a0823bd800e584d1143520f3c809f3357722c96228544214dfad71cdd929587244a0d2354e079dc9d241d518503123a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904311, "uuid": "2acf88d2-8b34-4ef8-8790-7230cde5aafd", "value": "T15E66336F9408938BFD653978236CDF5C6968803B11F092BA6B43968D74376CBFF88446", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904311, "uuid": "fc36a002-570d-4f02-9ac5-1fcb4ec4abed", "value": "c05041e01f84e1ccca9c4451f3b6a383", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904311, "uuid": "8152deca-1d69-4233-9394-edc89b9a8f71", "value": "196608:J1xxHANOW7UR/VI5KtzCcoqFNVM5Ag384:J1xxjW7UR/qKtBoqKR384", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904311, "uuid": "36d1b3d1-98b6-425c-88fe-e335c0eada06", "value": 7117302, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904311, "uuid": "d1ef32c0-5f21-47a4-b73d-8052a0743370", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904311, "uuid": "caebff5b-7772-476d-a29d-1f2f4467936d", "value": "acad5e6af6cfb4fe316c104033a77949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "837797f5-84de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643885176, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885176, "uuid": "79545d59-f9bf-4858-ab8a-1c71bce6a336", "comment": "Malware payload (Heodo)", "value": "637e87f9e3336e4c42110dd709e0ea49", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885176, "uuid": "022be7f2-944e-46aa-a307-6ff7c4c3f09d", "comment": "Malware payload (Heodo)", "value": "0ecf19262ce50d36bbd6ed770ead4b5796a8d49826f60b552ebc917c59a08ad5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885176, "uuid": "3df762bc-6bd1-40fc-8b1d-d994d5d92e00", "comment": "Malware payload (Heodo)", "value": "72b91531bf9ab9dd5d016aef1ea2e53902bea015", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885176, "uuid": "5ef48bfb-066e-48cc-a39b-2941304e8fa5", "comment": "Malware payload (Heodo)", "value": "be12fb2406abf02afb2cb104de3244748a21bcb3b844d2e8faa3c90fb999a47f31bbbe5764978f2c7eaa385217078eaf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885176, "uuid": "a282904d-a6e8-4bbc-8f12-f5055e4801a8", "value": "T1B5E36B6576C5D9C6DB0822350ADACAEE3327BC479E7643C33158F30E2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885176, "uuid": "3c218868-138f-4e63-9aa0-294c1f6b0821", "value": "3072:5cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0W:5cKoSsxzNDZLDZjlbR868O8KlVH3deho", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885176, "uuid": "062cbed8-05aa-4cc9-8638-90f8433b8032", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885176, "uuid": "80fdc1df-5aa9-4005-9f48-b61afe636459", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885176, "uuid": "c56f620c-eea9-402b-ae77-840042f3a1b2", "value": "2022-2-3-637e87f9e3336e4c42110dd709e0ea49.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "488c6229-850d-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1643905263, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905263, "uuid": "ce7443cc-5463-43af-ab75-956bda43b1a0", "comment": "Malware payload (RaccoonStealer)", "value": "d233399094597e32a797781d3bacf4fb", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905263, "uuid": "e60bdabe-8d42-4c92-a1f5-3d2068d5d696", "comment": "Malware payload (RaccoonStealer)", "value": "0ed974de469222788be4db09ddf1720ea96a39e959df8eda85e6dcccb73e4a59", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905263, "uuid": "46ca667a-bf30-43ed-b29d-9ec51b6995a8", "comment": "Malware payload (RaccoonStealer)", "value": "87b1dbc01b5ae45dc4d18e4ffc432ce2911590fa", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905263, "uuid": "16ebd071-131c-40a8-96e5-04a421114ba3", "comment": "Malware payload (RaccoonStealer)", "value": "732d988553196867f2120f35144459c5b274e26080d50601c0a416b44cdc8d403414b86b8708a4a239f9383b5020ba24", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905263, "uuid": "336d6e0e-1531-41e1-a31d-6af49388beb2", "value": "T17BF4F110BA90C035F6B312F446BA9369BA3E7EF16B2454CB52D52AEE67345D0EC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905263, "uuid": "cd52ec62-2f60-4509-b72f-f59a0319441b", "value": "6f6aeb6fc382a28ed1adc7823a20786d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905263, "uuid": "c1cffacc-6a4a-4b34-abb8-90d91bbfe715", "value": "12288:d951lETQ+kdW1tvvmk8weH+e2kQhcuvgwDsJWCQJ12453Rum1JUbAOMXpo8u:cuWj2QaUkQuAhDSQbxqXB4+8u", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905263, "uuid": "51bb69e3-af95-4f48-b11f-d95278138ecd", "value": 725504, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905263, "uuid": "67eddb0b-d470-46e5-b539-30be90cb33ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905263, "uuid": "8c233b29-4fe5-4788-a099-026d69bc6d6c", "value": "d233399094597e32a797781d3bacf4fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d074f7e8-8519-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910645, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910645, "uuid": "c2817a0a-73d7-46d1-babf-78b6273b6a86", "comment": "Malware payload (Heodo)", "value": "50f07a06813542c7fce11d2e81696553", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910645, "uuid": "668b1f59-e86a-4995-bf04-7aea13440c9d", "comment": "Malware payload (Heodo)", "value": "0f049bfd4880c362e07c8a3fc68c8e4fec3db9715e062fb7a35f2b1838437243", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910645, "uuid": "e82aaa8e-e10b-4723-a1fb-99b1c94b7fc5", "comment": "Malware payload (Heodo)", "value": "3831eb2954fd86a762ea234e8c0b2c26a03c4ac6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910645, "uuid": "64bf9f16-f27d-4dd5-ae13-968c650e1b3e", "comment": "Malware payload (Heodo)", "value": "80ce41e58e6bba3ac8002a1f38b2867f9529b914af58207ae380cc034bdf4a24c43d9896dbdb6169f629144e6ca241be", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910645, "uuid": "549df1f1-a146-44dc-92c2-853ac45849e9", "value": "T1BBE39D26B685C95AD91417311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910645, "uuid": "545e61e2-9323-421a-b9aa-f3373dc777ed", "value": "3072:NcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4LcI:NcKoSsxzNDZLDZjlbR868O8KlVH3UehE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910645, "uuid": "e3e2e69f-027c-4589-b98f-2844bc2646c4", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910645, "uuid": "eec40797-b82b-4c0f-babf-346ffb8c39e8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910645, "uuid": "d17e84d8-a22f-454e-883b-4abfa74b76c8", "value": "tmpq7bz1pcd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ee1c6ef6-84ed-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643891797, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891797, "uuid": "d5b073b5-4240-4518-8ac9-365f0dbb6530", "comment": "Malware payload", "value": "05d4c1f996d8c32a08b4a00146a9aa9b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891797, "uuid": "a25940fc-e82c-47a2-a840-3973155403cc", "comment": "Malware payload", "value": "0f2819c612174a9dd1bbc4360cc664fccdddb02003fc0b7e49a159724366bb43", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891797, "uuid": "98e11523-7670-48cd-83c8-ee634f59acb8", "comment": "Malware payload", "value": "a011c6e2897a9cc8078442c4c988a87f18f54c2c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891797, "uuid": "4e809b4c-6c1f-4c10-b8e4-2de332cbae5c", "comment": "Malware payload", "value": "9a97474c3a336993c6139f7003c4568887d3ff398d6bdfb6f568e16581c0c328ae341c413662878749f6a93304285ae2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891797, "uuid": "7030b391-683d-4f98-a60d-5d212d730712", "value": "T1442132929A5700B0C95F29EFD549B3774B5DFF19A8D6D9136408C57C56B74111CA20F0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891797, "uuid": "786b8a60-248d-47f2-969e-c75d1c79eac8", "value": "24:mvVv5cpYQSHS5VLqcG11aoczvAFd+ilWwRcW0C4dgiRl9daAxRdgvOnfhPWS:mdxcpjz5hq1112zvAFdzMwRH0dgw9h3r", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643891797, "uuid": "f3705d72-d3e2-4184-a4bd-f259012ef95c", "value": 1261, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643891797, "uuid": "4e70666a-d6b5-4e47-89b2-e0402b9b69ec", "value": "text/rtf", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891797, "uuid": "358d61af-f8cf-4a3c-85a0-91c32bbe2f47", "value": "Specifications and corresponding dimensions.doc", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5023a2d6-8520-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643913437, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913437, "uuid": "f06c43d8-52f0-427c-a988-3c21e0c2723a", "comment": "Malware payload", "value": "5589b7860710a2333e8ed185c6bbede7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913437, "uuid": "cdfee52e-863f-4c67-b4a7-74ae7f04f902", "comment": "Malware payload", "value": "0f5fabf7198bb8b1f0e4de74ef2d280b33f0ee69d1b8e2b2b4751c05cdd72b84", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913437, "uuid": "b30c8b67-c853-4271-a61d-a2ac9efb6873", "comment": "Malware payload", "value": "743b122c98172242bb6e36bafd49997c0552a062", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913437, "uuid": "02905e82-a25d-442d-a6ea-311c7eb1c999", "comment": "Malware payload", "value": "0fcac94b2f29cae01e172363ea83270641317cbb11fd31170f6e94abebb997a8485fa61f44c313379b67bd0251d68350", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913437, "uuid": "932e6f75-69a8-4cf9-bd3a-91ff23935ce0", "value": "T1F99270BEF65ECD49EC09033A55A34AA7334BBD898FB203826B5DF7064FB41804617A17", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913437, "uuid": "835cfc8a-072a-444b-a7a3-b97053c56b2f", "value": "384:bwOcKoSsxz1PoQZLDZjlbR868O8KldzH3XkehvTgqAPjxYvcExyZUd+5V5xte9pV:brcKoSsxz1PDZLDZjlbR868O8KldzH3X", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643913437, "uuid": "94ff839f-8422-44bb-aa6b-1e7d5b0df582", "value": 21172, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643913437, "uuid": "f020405f-2fc5-4890-9188-364ab4f1b6a3", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913437, "uuid": "44927da0-5b4a-48e8-8f94-03cda3e8d894", "value": "tmp24ny8483", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d9c9a047-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643884032, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884032, "uuid": "f0625e26-8755-4471-b553-74866de3ddac", "comment": "Malware payload (Heodo)", "value": "ab61dd2107c2d63198ccba47c26f748f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884032, "uuid": "efa97da6-8271-43b7-bbec-6565661d62a7", "comment": "Malware payload (Heodo)", "value": "0f8e1ad7458ae1f25bc79abe44e170fd280803f3477c849223f30d1d48d81501", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884032, "uuid": "6ec9d680-bfc5-4db6-8e6c-2ff555f21489", "comment": "Malware payload (Heodo)", "value": "ca898f8484c1b8ba134537fb53215525744cf9e7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884032, "uuid": "ed1119bb-16fc-4718-a55a-8b39c3804044", "comment": "Malware payload (Heodo)", "value": "d033e5aa61aa3f74f7e6ca58d2e4e86fdf3506a9c5b4bc4bf12a6d1556d7b6fc3310c23ce3cc6c9a7f33448ec5cefe6d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884032, "uuid": "b334a520-eed5-42c8-9795-034c96542b87", "value": "T196E36B2576C5D9CADB0922350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884032, "uuid": "fc878838-7c59-4a31-9f1d-a693dfb99b91", "value": "3072:LcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0l:LcKoSsxzNDZLDZjlbR868O8KlVH3dehX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884032, "uuid": "02759199-b7e3-4f95-92a9-8543b4b07602", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884032, "uuid": "da608a59-f56c-4039-9373-b2c4505ef635", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884032, "uuid": "4ffd17fb-3479-4918-96d4-9cc3d163e733", "value": "2022-02-03-ab61dd2107c2d63198ccba47c26f748f_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3c4705da-84fa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643897082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897082, "uuid": "a13f1258-f122-49ee-92c7-a048d3d55dfe", "comment": "Malware payload", "value": "c7e45c3a783d12cf0d2759bea7d9bc3b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897082, "uuid": "8d079641-4900-4c9d-bc00-9ce83e694a1d", "comment": "Malware payload", "value": "0f9dc8883ef18f3922e4a7c1585a13db76170ae3dd81d9ca731ef2ec5506ff96", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897082, "uuid": "6dcb195d-913d-45f5-9281-25cdc3599876", "comment": "Malware payload", "value": "44ff158c5c58dd7ac65b1321c43e15e1cf47c448", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897082, "uuid": "4ad7d2f4-271c-403c-b44c-382caf161014", "comment": "Malware payload", "value": "09ec3346abf649e8fa7eda0cdcb9218321f94d2e8676ef0e0b85bcc02837cbaee37608e62fcf3d806b12ad921042b683", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897082, "uuid": "abd9b5cc-6da9-455e-9c79-4e93ef2d1ce5", "value": "T1D3057C11E6427136ECD701B382FF1AFF9D286716030C64D7E2C45DA9AB619E33B3661A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897082, "uuid": "9a8a2abf-a7ff-4f5e-aefe-386e0f1db7d0", "value": "12288:kNLuIrVpWdZnbi/62C1iDufr0b7uSr2j9jLZyQKSH988U5ZJOFp7D25+qRmZo:kLtp6U1CeUj9HZyQKSdlU5ZIn2MqEK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643897082, "uuid": "7a3e5afe-1d85-4d08-a10e-3e2cb042c860", "value": 871972, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643897082, "uuid": "329c1db1-5cea-4fa5-a75a-aac3c2438362", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897082, "uuid": "c9b5dd11-2dcb-4681-99c2-ad1757c5b226", "value": "c7e45c3a783d12cf0d2759bea7d9bc3b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "03aaca0d-84c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643874654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874654, "uuid": "99431419-74ba-476b-91d0-6b12898c3fd3", "comment": "Malware payload (Heodo)", "value": "0f44d653bb0428277dfecfa0f048d78e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874654, "uuid": "20b41cb7-af11-4f7e-95b1-8749a863659a", "comment": "Malware payload (Heodo)", "value": "0fbbb976850e7833c27220fb927b59a6c7c73f47a72c20fecb3cacd075fe179b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874654, "uuid": "d88cefd7-8047-4683-b4e0-36a20cb4bbf9", "comment": "Malware payload (Heodo)", "value": "73a07be3e3d9641579d99c8611ae3f70ec443a83", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874654, "uuid": "07a5afa5-0d8d-4175-be5c-5c50ef58d6c2", "comment": "Malware payload (Heodo)", "value": "7d1964c4d74c013b8949ed31e6adeb3bcf3f54ca0dd8c273ef8e39d4b6d9cb176607bc325b85c8504e1640cd1cd7011c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874654, "uuid": "f248ee37-0671-41c2-9d2f-f2e442413df7", "value": "T123E36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874654, "uuid": "f77f87db-6c79-4f77-bade-0db5fa5b846d", "value": "3072:PcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dg6Gx0R:PcKoSsxzNDZLDZjlbR868O8KlVH3dehM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874654, "uuid": "662913b9-5997-4037-b7b8-82ec5ee2138f", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874654, "uuid": "8eb22453-c7cd-43cd-a548-63727d0c6309", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874654, "uuid": "4b5752e1-2619-4b57-9aa3-bf0d7443589d", "value": "NG-2299 report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "10c2c3d2-84e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643886272, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886272, "uuid": "8532ca87-67d3-46fc-937d-9999fbc1579c", "comment": "Malware payload (Heodo)", "value": "f8267dd340c2abb95df48f008546043f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886272, "uuid": "be3accd6-c505-4b99-8d35-1551713670f1", "comment": "Malware payload (Heodo)", "value": "0fc99157e7fbcf9be34aeaec30c8e6bfd3b08a5f7f421216c6989a566ba8b200", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886272, "uuid": "7a4f3791-4f7b-4ed5-aed4-ade9aa6c8a12", "comment": "Malware payload (Heodo)", "value": "4b66cc4ee96a5afc4d7e4d7c0c48d4651c7df818", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886272, "uuid": "025cb41b-9e21-4c53-9e96-fcce2e546bd4", "comment": "Malware payload (Heodo)", "value": "1538aa900884d1136bb4edb1ecd54ff18d95b80d7c522b871b875b2d9119ca4779456b8cd8c761022b07b47bc0f06f5a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886272, "uuid": "f0b0d58e-0927-4476-8150-526a538b2bf9", "value": "T1A1E36B2576C5D9C6DB0822350ADACAEE3327BC479E7643C33158F31E2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886272, "uuid": "f845b8ca-96d2-47de-9cc5-85964e131f9c", "value": "3072:UcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0H:UcKoSsxzNDZLDZjlbR868O8KlVH3dehp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643886272, "uuid": "f93cb88f-1ff8-41d5-a629-5c557327a589", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643886272, "uuid": "6226f1da-5e4c-4f80-bb21-d1a15cb6bd36", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886272, "uuid": "368b461c-b684-4c0f-9975-8fc7a8ee4fdd", "value": "2022-2-3-f8267dd340c2abb95df48f008546043f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d246280-84d7-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1643882159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882159, "uuid": "c8bc0060-5be8-4454-998e-65d4e71e1865", "comment": "Malware payload (njrat)", "value": "0f8c94fa2a0b0a627a90a8a5554b73c6", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882159, "uuid": "bbf89e2a-954c-4b56-b3d9-d7de8678cfe8", "comment": "Malware payload (njrat)", "value": "0ffadff213c2d9904eff444a63de7b0988224c0aab6822ed5742d5b9effd6e49", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882159, "uuid": "6eaccd55-e77f-47f2-a02a-1e20aeb98394", "comment": "Malware payload (njrat)", "value": "3e3d3d9948f37e49d69d6417e00d204aa43fa313", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882159, "uuid": "510ed8b8-a8f7-4fe5-a4bd-df020316c93f", "comment": "Malware payload (njrat)", "value": "352aad2e5ca9c9ec51dd376ddc9e1b31692302271fb9d0cc86866c6c9053afbaadafb2d069aca4ecb083ee8fb25613a1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882159, "uuid": "3c0ba449-67ec-41d7-90e4-1e299065b771", "value": "T11755AD664FC61646C8072FF9627C5EB08627DF1EFCFF076D0AB3A810B2975817961A06", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882159, "uuid": "df033c33-f07e-49cb-914a-80adb009878b", "value": "2e5467cba76f44a088d39f78c5e807b6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882159, "uuid": "b7d8aee2-af36-4fdd-ab37-a209dc88ee9c", "value": "24576:rSaQ6r6+H1R1t/FtFPouMR6OdSl8Z8kI9wBrWFIid6MI5gEvy9Va4T:rSaXr6m1t/Ftpcol8ZQWideSEvybpT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882159, "uuid": "122083f3-69c6-4cbe-8a70-efe3a5dd66ef", "value": 1400832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882159, "uuid": "9bdff27a-2d68-4a93-840c-14860bd3781e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882159, "uuid": "3ab5bab7-f9a1-42af-9302-4c03a9200cac", "value": "0f8c94fa2a0b0a627a90a8a5554b73c6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "499ac90d-8526-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643916003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916003, "uuid": "0ff655b8-63f3-4d5e-8f62-c2a6025e1f4a", "comment": "Malware payload (Heodo)", "value": "cc713b5ef4406c729461f6516cd97dd7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916003, "uuid": "77d2aef7-afc9-4762-9d46-00cb70bee86c", "comment": "Malware payload (Heodo)", "value": "100c34ec95c4532941ad7b71a5a51d53380273549c31902cf85c2622d7cc4cb9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916003, "uuid": "25d2c171-64d9-4c84-9c6a-fcf463440df7", "comment": "Malware payload (Heodo)", "value": "79019ea5ebb2774eb62e7deb2fcdbad1e4a960ee", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916003, "uuid": "bbc0d086-8b59-4d29-b310-9e19fda31bba", "comment": "Malware payload (Heodo)", "value": "b7fdc3fe2bc00b74f14cdcb1bcc0a25141f05e18e97b75d226ec2265f579efabfc0361265724ebfe2e11a940e40dd92a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916003, "uuid": "7e31bd2e-8fb9-4880-b7e9-d587bccff29d", "value": "T1CED4C05472A28476E0AEA83404249B138D6E7F715FB0C4DBD7E539AE4D3D2D16A30E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916003, "uuid": "0c4c3f09-7a28-4c7d-9058-dec32a7fc868", "value": "15b471bbc15a140b9567d4daee05d632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916003, "uuid": "74f2c878-69c8-4d9a-b6e9-8a42ad5e534e", "value": "12288:8m9+I/aI+W1QbBi3IjeuXe6q7nCI/xCMqYDl2JwDKCX:8XrbB2IjevCHMqW2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643916003, "uuid": "14edf98b-bce7-4fa3-9749-3d4799dafeff", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643916003, "uuid": "2e40188b-7eb7-440d-a092-c3ebdca4089f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916003, "uuid": "e894795f-644d-41cc-afcc-98833fd92996", "value": "emotet_exe_e5_100c34ec95c4532941ad7b71a5a51d53380273549c31902cf85c2622d7cc4cb9_2022-02-03__191949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e464a996-84fc-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643898224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898224, "uuid": "728250bc-d198-44b9-ad2b-a525693ba3e0", "comment": "Malware payload (AgentTesla)", "value": "1092ede798349967b444153c82a2b740", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898224, "uuid": "32c042a1-cac2-41bf-bae1-bb15ae7b5ad0", "comment": "Malware payload (AgentTesla)", "value": "10e6bc57cbbc0dcac02ad5e4b2cf1de1a61bc5a366c36e90ca7f683ef0fa9eea", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898224, "uuid": "178e47bc-dd61-45bd-9697-81eee4bfa504", "comment": "Malware payload (AgentTesla)", "value": "384142f049437da901ddf4543db7814f2cdef11a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898224, "uuid": "07183a64-20af-4922-b3d0-20f7ccf430b6", "comment": "Malware payload (AgentTesla)", "value": "2b5424dbe763ba95c27291cbc810910090340657895b1dd733e3cf71aa690509ed8194cdf8c9274c598a82a0518a10a3", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898224, "uuid": "7dac3636-1fe6-40da-bd27-f1664ce0e413", "value": "T1C41412A373DA9435EEDF09F2696B2F1264F0ECD80C2176A52189B2C9DD7094F5410EFA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898224, "uuid": "3dc101cc-9ce2-44d8-a259-d63230cd1b23", "value": "3072:uuD/QIcJYO35N3+1lTUveUaKIoJ/LYFYy7CmAszmYOBPdbZAqSt4wkF9hivecSuQ:fD/LsR+11UGUaKIuDYFYypAstOlNStGD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898224, "uuid": "abd4b538-ac53-400b-bc0d-8f631c3bd95d", "value": 191928, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898224, "uuid": "3cd7e1f3-52fb-49fb-83d0-9423f9290d5e", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898224, "uuid": "4726d60f-26e5-4791-8c5a-31f4537718d2", "value": "Purchase Order-PO30222.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1461be97-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855784, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855784, "uuid": "5909ba12-af1f-4f1c-a451-1ef5a16a2099", "comment": "Malware payload (Heodo)", "value": "84efde43085595cf74ee6a4714879643", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855784, "uuid": "e9b9603e-d3d6-4cdb-b071-f496abce0ed6", "comment": "Malware payload (Heodo)", "value": "112c169880e8cf26af7ec2e3c99989c0ee56b3a81db26250f287efcf6d01d191", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855784, "uuid": "1cd9bd8a-691f-4ff5-9851-00341e1f1fc5", "comment": "Malware payload (Heodo)", "value": "6c12089b0cc985e6bee728fa0985c4020e99d194", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855784, "uuid": "f6dd25a5-67d4-4547-9465-7dc01dd09317", "comment": "Malware payload (Heodo)", "value": "be4f07291ceb35c8c0742814c2ebd6be0d4aff17d72a7427ec2b027eae9d93b4f91f9a42299780c15f6370b0949160f5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855784, "uuid": "5585569d-45a1-42a8-9f28-8b47e41650e9", "value": "T1FFE36B65B6C5D9C6DB0823350ADACAEE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855784, "uuid": "d844457c-5974-4167-bcde-e5147b20f7ea", "value": "3072:+cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0K:+cKoSsxzNDZLDZjlbR868O8KlVH3dehI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855784, "uuid": "9f41de75-b09a-4922-b89a-63a6809ddde2", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855784, "uuid": "de26e46a-e527-484e-bc9d-228a803c6678", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855784, "uuid": "d5a55f52-9e5a-408a-a249-684e524e3558", "value": "2022-02-03-84efde43085595cf74ee6a4714879643_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1aa7679-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883589, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883589, "uuid": "2743913a-4a69-4748-9751-2e8a603b472d", "comment": "Malware payload (Heodo)", "value": "633cb49152f214c8d87bbcf7b8f3c38c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883589, "uuid": "6bced1c8-fd3e-414a-8df6-9560fb79279c", "comment": "Malware payload (Heodo)", "value": "114cba070c2372a9d46006a67f2ea1cc860518e0f98fea6f63a56ff0be44a19d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883589, "uuid": "f61b3451-a016-4417-b0d3-3ab4acd10784", "comment": "Malware payload (Heodo)", "value": "8e4e06659c658576161dfe13e98bf6ab726b1698", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883589, "uuid": "c88db172-377e-4bc2-990a-d47c7e27fea7", "comment": "Malware payload (Heodo)", "value": "c142e94d5229d656ea572d0bc3378c3257bc5b4d0f665271d50d27e96e13f3b3c6c799e83622044c1378b4c6c83ee669", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883589, "uuid": "55c4ad88-fea6-4937-ab9e-10d08e5b5552", "value": "T1DAE37B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883589, "uuid": "6a7f8137-d7dd-4a6e-8abb-dffba5c0c9b4", "value": "3072:2cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0z:2cKoSsxzNDZLDZjlbR868O8KlVH3dehx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883589, "uuid": "7db42635-f23d-40fa-8c29-a80fd29aec78", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883589, "uuid": "ef03c69a-65f4-4936-9f2a-603ede72b24b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883589, "uuid": "b0bc3d57-3051-4588-934c-3d1175f3ddae", "value": "2022-02-03-633cb49152f214c8d87bbcf7b8f3c38c_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74f67cc6-84ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643890306, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890306, "uuid": "54a7d490-974c-4704-9b91-7316a96c21d4", "comment": "Malware payload (Heodo)", "value": "4147181a20b9892db2564e172f75432d", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890306, "uuid": "10c6da1b-f394-477a-ad21-38a09733cbce", "comment": "Malware payload (Heodo)", "value": "115cb77214fbeb24c2ced587ca1c9dfd2e8c1a58c8ec52d67c85720b91d3baab", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890306, "uuid": "0e3f6caa-9b45-47f6-8a4e-b8a513915577", "comment": "Malware payload (Heodo)", "value": "59cdf915b228105cdf612c7634c032df0b3479b5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890306, "uuid": "684f6d3f-c9ff-46a8-accd-e86be82ee2e0", "comment": "Malware payload (Heodo)", "value": "2f31afd729fc7d29eae0455c53077ac6d4fdad4790a943cde4bc5d30862894f09d0d6c1c67d1d04c22d03647a33e9921", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890306, "uuid": "bd8f8e74-4a97-4a7e-8741-2342a8ea617f", "value": "T1A225CF516D4980A1FA0B293D107A63660FEC690117E0E9EFDF05F8E75F26CC196788AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890306, "uuid": "08dbb99d-d99f-4673-a7d6-9fe38859f3d0", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890306, "uuid": "8af193cf-746e-48f8-bc89-8f215ea8652a", "value": "24576:O77NlW4ZujpK630cavFuwNUsjk6opl2VD+rNtl7ifTI5dTpyaFIIm2mHL:6W4Z+LEtvFuwDjVK7GTC7yaFIr2mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643890306, "uuid": "ed6f47d2-c597-40d5-8fb7-d7bb345a6635", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643890306, "uuid": "49ef2009-1612-415b-913e-d3539783b315", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890306, "uuid": "4565e7d4-70c7-42a0-90da-089b3d2e09c3", "value": "emotet_exe_e4_115cb77214fbeb24c2ced587ca1c9dfd2e8c1a58c8ec52d67c85720b91d3baab_2022-02-03__121137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76cf1a7e-849c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856808, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856808, "uuid": "ccc5e69b-c777-430b-b8f2-9ee5343b00c8", "comment": "Malware payload (Heodo)", "value": "ae3d240097990b1b75b28d1f79b8e654", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856808, "uuid": "25f6919e-71f2-4e0b-a1aa-43566484533c", "comment": "Malware payload (Heodo)", "value": "116162e63319676b746c24e958355cb27bb6195bc75290f80e8ddb7e41eec0fd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856808, "uuid": "4f400591-7d4b-42ec-8a1f-bde8fc650aff", "comment": "Malware payload (Heodo)", "value": "cb8aaeff9e95babaae230061f2cc0b21aa87c706", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856808, "uuid": "f141a830-8cfb-4eb9-a033-21c75677b2e9", "comment": "Malware payload (Heodo)", "value": "16edc975926b34ea658e8fbdca5f5539d17396fa54e6d491fa7c523a0aaefba71917b7bddd7b98b2ab62b54257716a56", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856808, "uuid": "42e0cd8f-3698-400d-b36a-b442dcb6c0d6", "value": "T162E36B25B6C5D9C6DB0923350ADACAEE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856808, "uuid": "a881b1cb-1eb2-40ff-a686-3f50cf4b67a8", "value": "3072:1cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0I:1cKoSsxzNDZLDZjlbR868O8KlVH3dehm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856808, "uuid": "8bae5b6f-fcd4-4510-9d79-28431ed6a9b1", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856808, "uuid": "3e0e9f15-6b2d-41d7-8373-e809b7acf744", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856808, "uuid": "a0cf02a5-af14-4c7c-8191-c49728edf3a9", "value": "2022-2-3-ae3d240097990b1b75b28d1f79b8e654.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2af6c797-8486-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643847232, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847232, "uuid": "cb6e1d68-d6ab-43e2-aad5-27e8bf857854", "comment": "Malware payload (Heodo)", "value": "edd74babb903892155360d29cc6354be", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847232, "uuid": "3b2fe893-a992-41fa-a3d5-63ce7b7d11f6", "comment": "Malware payload (Heodo)", "value": "116bd1c035001788bbda6f784725459a4826ed25255daccb8f1fb839c9ddfbfd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847232, "uuid": "a20fdefa-af82-46ad-bd4c-941ea48aceb0", "comment": "Malware payload (Heodo)", "value": "dd263cf022ba5e3e02d82843ac82bf2b8de356a6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847232, "uuid": "ea47d6b1-c8fd-4b7e-81bb-e5d35b846677", "comment": "Malware payload (Heodo)", "value": "3d4d6fd31e3568f968da23ad3450c29ef4680f926b921d2fa537bcf5a13a44114fab5c84a31e766dbb78cf586cf60ff6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847232, "uuid": "e168a1bd-91f2-402e-a7c3-a0e697feea02", "value": "T14FE36B2576C5D9CADB0822350ACACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847232, "uuid": "d035ddd9-8b23-4704-872b-a9daabeb34d0", "value": "3072:ScKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dg6Gx0/:ScKoSsxzNDZLDZjlbR868O8KlVH3dehi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643847232, "uuid": "31b47584-b4d8-49a8-8050-6f33abc7c15b", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643847232, "uuid": "ad4678fe-2ef2-4050-bddb-153e967a2bb9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847232, "uuid": "d0fcd8e4-1ec0-4d6d-8c15-6d71c118585f", "value": "2022-2-3-edd74babb903892155360d29cc6354be.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c4f6421-84c9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643875983, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875983, "uuid": "4fa39a39-1d70-4a0d-8a10-8a0b80d4983f", "comment": "Malware payload (AgentTesla)", "value": "1b1ac6d5ae23eb5e1249fbd10a0b186c", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875983, "uuid": "053ee4a1-9be0-4f04-89bf-d3a13e65155a", "comment": "Malware payload (AgentTesla)", "value": "1189f0394124936e4d8df6bfced810470cb4cc992bba8eb00fa2e97e1d6d2cda", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875983, "uuid": "21375bab-db98-46b8-98a1-1450329d1bae", "comment": "Malware payload (AgentTesla)", "value": "2e995890e074940349e350fa58b220173803e952", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875983, "uuid": "ad353d9f-a367-4da1-9522-3cbbada68085", "comment": "Malware payload (AgentTesla)", "value": "5099da966e06dac003f63fe566a914d46001f573fdbe73c4b1b21c0cac3cfdcd870cb05e9d9dd6487e3a894b601297fe", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875983, "uuid": "4468bfcc-843e-4789-a46c-23ca60693048", "value": "T14514127E70ACAEF0D91331B662BEA3540339ADC41C43E5A5B991718C08363F6E97E5E1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875983, "uuid": "acf43342-264c-4933-9d5b-9c330f156b63", "value": "3072:xHV+OQmtNwe/Xipcr98UWVr6aYBXbzXrpRm4JHrKlaLyu6wOsThcDaZMM:WmNDSCWVrXebpRDHrmaLiw1TdMM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875983, "uuid": "40cbcfa6-db84-41b9-808b-b2ba9376715a", "value": 191608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875983, "uuid": "e711eb8c-d36d-409a-85ee-52f4febd2177", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875983, "uuid": "352ecba9-7da8-4f09-970e-e0198e58788c", "value": "product_List.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d79afa17-8504-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643901638, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901638, "uuid": "3c972815-c885-420a-a270-10729369ebdb", "comment": "Malware payload (Heodo)", "value": "dfc8b27eba10d1d6d91f2f7ecea9c6ad", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901638, "uuid": "b86b62b8-717d-4c26-9383-1180e4cc8a5b", "comment": "Malware payload (Heodo)", "value": "1197b050b264eced164e74e303f353b389ee5ff878778bdef561b73f65d90ec7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901638, "uuid": "ae6bf262-8790-4edf-b71c-8114edfd0f03", "comment": "Malware payload (Heodo)", "value": "0af192aa2682f8066bd73c03ccc4cb64b04762a8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901638, "uuid": "d8d50a12-2a85-4b35-91d5-619512ef5287", "comment": "Malware payload (Heodo)", "value": "2bbc0be6a41d66df3e675d20db6a012a6807bc251c9a0d234de97e742a8faf6bfd264d40ae69b35efbf24dd43c309aca", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901638, "uuid": "74503800-2eab-4e94-8ea4-da5b71769306", "value": "T1E1E39D26B685C95AD91407351DD7CAF7333BBC818EB683433289F71F6D7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901638, "uuid": "27452897-1d9f-49a0-bc24-425039d35883", "value": "3072:scKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgI4LcP:scKoSsxzNDZLDZjlbR868O8KlVH3Ueh0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643901638, "uuid": "b41849e7-19ce-4762-9e0f-0c578d3bbec0", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643901638, "uuid": "6daf8e27-5df1-43c9-bb0a-71c215b6d357", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901638, "uuid": "c1e8c84a-23de-4f3c-bc60-5ada84b9b7bb", "value": "tmprrjzo0gi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e026a85-84f4-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643894508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643894508, "uuid": "53d0ecd4-62bd-4108-9eb0-70b9afd68cd3", "comment": "Malware payload (AgentTesla)", "value": "6c9e1c097bda4fb319175581c0ebff2a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643894508, "uuid": "f80f5d40-8802-4087-928f-b3fd553be74f", "comment": "Malware payload (AgentTesla)", "value": "1201988ec34394fb159dbc6643497c71a3e672c35437f632f741418c2fdb9d40", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643894508, "uuid": "fd7e2bc7-b5c0-4c72-8826-06e43b5959e2", "comment": "Malware payload (AgentTesla)", "value": "00de56e820abc60df25af33b5b093109330fe2cc", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643894508, "uuid": "ad3c11d7-4cf4-463c-935e-29ea71890b71", "comment": "Malware payload (AgentTesla)", "value": "8ca9f2202bb2f779eb222a6a28e62dc243f0505aa4379351b752c0a701447084f9a556daeacb3dbff4d92b1373b36e5d", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "INVOICE", "colour": "#75F0D5", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643894508, "uuid": "28d0ea9a-d7c3-4830-afdc-56b92275ecde", "value": "T1D0A423472CD786047BE239E0374379DC769FAAC1234811E7A72C7859A9A1A00B7B35F7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643894508, "uuid": "306b7090-a123-4ce8-bd11-70aa7131ce10", "value": "6144:khieP5O7UlPMBDbCyCu6zph6pIR7RJPpqkAJtpeqJwjzWZiCvDn6Dx5L67ZPsJaF:kFcoMlbSu6brR9qkAv9WaZvD6lZSBsg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643894508, "uuid": "74701d9f-71d6-45e5-9908-75ed7389d229", "value": 482748, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643894508, "uuid": "c8f53c2c-da34-4c83-b66e-19811c63ee59", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643894508, "uuid": "3879e654-3b91-471b-a1af-fe1760a8f333", "value": "Transfer Request Invoice Form.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "94844c14-8522-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643914410, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643914410, "uuid": "050ee820-6ba8-4685-821e-29020dd899ce", "comment": "Malware payload (Heodo)", "value": "a626586a13bb3958bd00dfcbdb4f7781", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643914410, "uuid": "c6748e11-b02e-4f92-befd-f6c8c1ee39ab", "comment": "Malware payload (Heodo)", "value": "1237baaf1ec4e18174d968e7720bfc7806257e47f491b5a76b6ff7bc1e21f83a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643914410, "uuid": "2f585a05-ffd3-4824-a494-d32d7c2ff52b", "comment": "Malware payload (Heodo)", "value": "b9003052dc1cec765aaa62733e098b9caeaa7388", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643914410, "uuid": "a9040252-a395-4192-9a38-7978b586b3b5", "comment": "Malware payload (Heodo)", "value": "ea3a42ccd3c96e47136a141b2c69be500cb167c1845988db3aff8e94ecd065f8f22fa0cb0ab5a254dd328a8c968c68fb", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643914410, "uuid": "185ab8ec-8808-4120-bd2f-1ba5045ebe0a", "value": "T137E39D26B685C95AD91407311DD7CAF7333BBC818EB687433289F71E6D7B6908A23247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643914410, "uuid": "b30b4f09-4367-49ce-9b8c-4b1044ddb56f", "value": "3072:jcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lc/:jcKoSsxzNDZLDZjlbR868O8KlVH3UehL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643914410, "uuid": "05c2f260-1f3e-4af0-a632-af546a138415", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643914410, "uuid": "4395cc94-9bbe-4b09-aeaa-e92426b96e35", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643914410, "uuid": "b279cec3-b404-47e3-8399-9aa4cd33850e", "value": "tmpzq5e57f8", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1473b208-849c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856643, "uuid": "5c16bedc-ae7c-48d5-a651-6da3fcc2ebe3", "comment": "Malware payload (SilentBuilder)", "value": "ed52af02a4d1d72d9f8a1e967f74e8cf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856643, "uuid": "6ecc8965-13e2-42fb-a20a-edc872e400cb", "comment": "Malware payload (SilentBuilder)", "value": "12418f4c2999f9b537debcdace44a5709c1802b6d367e1217725ba872b692aa2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856643, "uuid": "01dc754e-56c6-4a94-ba9f-eacd5b369485", "comment": "Malware payload (SilentBuilder)", "value": "3a1e4586cb9442b9062e66f3835ceb434b554cce", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856643, "uuid": "74a30b0a-d7f9-4079-94e8-8b5557992210", "comment": "Malware payload (SilentBuilder)", "value": "4b34546b00f0b1b98eb62e36eb86ad2f6d5b23b45bbe975e3a928fbdf5a736a2206665b630b210b6a2d8be3fd927bdda", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856643, "uuid": "0c1bac31-0d9f-46aa-b1cb-c278fca39188", "value": "T10EB37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856643, "uuid": "53a92224-885e-4ad2-a8a0-2ec1b11ba578", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49L:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgm/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856643, "uuid": "880325fd-50c6-440b-b5e2-38d588ab089f", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856643, "uuid": "428874fa-8bc3-4c80-bb27-232baeda4904", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856643, "uuid": "767a34b5-1469-451a-baef-3c32aa107cad", "value": "2022-02-03-ed52af02a4d1d72d9f8a1e967f74e8cf_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd30ab68-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "2fb7cb33-0440-4a42-a231-6845478ff3bf", "comment": "Malware payload (Heodo)", "value": "e347b003184d52d3bd683ed60258b9b9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "e99c4290-fe84-4c6a-8574-ee82afc5d34e", "comment": "Malware payload (Heodo)", "value": "12686ab121304b345fc7a57226ec2e3839da11ae584c42aae3111a0c0d905598", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "3c1b9d9a-d5d0-4c0d-b100-a6782599be67", "comment": "Malware payload (Heodo)", "value": "ddba2a9ca667f9a21e3f84effd895867a3259734", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "77e95c6e-6cca-41b0-b761-e12a62697027", "comment": "Malware payload (Heodo)", "value": "75c86e6f8ca86953cf753b69f256f83c28a38994db2539cfb9a1d3ac7f38c194a3b9bb09e26f5b2186b9962aa92cf2b7", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "73e3d964-c86d-495a-963f-f24b69ddfa83", "value": "T1B564E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "32be53ed-9f97-4e88-85be-ba9368165443", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "7c3609ed-5ef3-4ee5-b0ee-84d9399c92d6", "value": "6144:83DvZRFTFbksYyljaMYDMNT7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMYoLAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910291, "uuid": "5b290f82-fb0e-4e90-803f-3daf8c380401", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910291, "uuid": "dd9e6b22-ca63-4acc-aeb9-527689d84509", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "4cd5a5b8-2f98-45e0-8685-f5f065f34ec3", "value": "emotet_exe_e5_12686ab121304b345fc7a57226ec2e3839da11ae584c42aae3111a0c0d905598_2022-02-03__174436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0a91f76d-8504-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643901294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901294, "uuid": "108ab9b4-b720-4c1b-a9d0-c9b3064c212f", "comment": "Malware payload", "value": "fbc20e02135f90dff1f8510a636221fd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901294, "uuid": "eaee6637-a0eb-4356-b1ae-7284e38676e6", "comment": "Malware payload", "value": "12b4bf47780a44f577d491f185ecaf33e1c481d5a89178f015c31777afa24673", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901294, "uuid": "5ba03eb3-e4fd-4c4f-806c-44ae822e279d", "comment": "Malware payload", "value": "988c244c076609c0870865376f7a2eabf991672e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901294, "uuid": "85cda6e9-8bc1-4b56-a63e-47775a61ea48", "comment": "Malware payload", "value": "58d5fd239ee4e44dff3ae6fa6627799d92d325b218f83bd2300de794bfdd7fa4e92a0e80946e1166c217cf89484ad876", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901294, "uuid": "c11ea145-8386-480d-8f60-23869beef56b", "value": "T145938C8AF5470C99F9184B3984870A6833F7ADD48E1A6243B748B35A6FFC2F4915713B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901294, "uuid": "9ff4e43d-4215-4eb3-8d33-c39107ecbbad", "value": "1536:fHsKpbdrHYrMue8q7QPX+5xtekEdi8/dgbquD1VJhaVYIr/iBNk5AbViKGnTeshP:fMKpbdrHYrMue8q7QPX+5xtekEdi8/d9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643901294, "uuid": "69115b80-ae3c-4fa2-94a8-c1613587ce29", "value": 89794, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643901294, "uuid": "c0403ec9-4d2a-4bf5-9073-dada8a289c4d", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901294, "uuid": "c7a749fd-0962-4e50-a8b7-29a52eb147ae", "value": "tmp45_p4dru", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6483f116-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883836, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883836, "uuid": "95fc3048-a922-4a35-97fb-8c306634e5d3", "comment": "Malware payload (SilentBuilder)", "value": "ab4e671ba8a9d9d74a07451b6ec0e2d1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883836, "uuid": "004348bf-026e-4e9f-8809-83815fb8f224", "comment": "Malware payload (SilentBuilder)", "value": "12c0e459ad91d33d5ea6488635fee5a97d273bd871463262afbc5179d4a0353e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883836, "uuid": "83e20fca-ded2-4873-862e-35895f9d69fb", "comment": "Malware payload (SilentBuilder)", "value": "ecb96f48b0b0e88c9a67d206b191593f75300973", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883836, "uuid": "11bcfabb-672c-4562-bc3d-73e7f05d8f3e", "comment": "Malware payload (SilentBuilder)", "value": "2da75073ed395396366235c4b0e35bc1b96b216dccdb049c4f37c7971d218d37aa4ed6d504ab4cb9c4fb5cf12a05bc5b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883836, "uuid": "ee3778f8-171b-43f6-b1e0-07c61bcbcb44", "value": "T131B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883836, "uuid": "4c726c64-be93-4416-91fc-eaf23be1b16e", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49n:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883836, "uuid": "cc52553d-f52d-420f-a455-23d8bbda8f7e", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883836, "uuid": "85ae99e6-6653-497d-a064-b80874fd7ead", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883836, "uuid": "6aa984d1-eb73-4713-866a-410c04ae5a65", "value": "2022-02-03-ab4e671ba8a9d9d74a07451b6ec0e2d1_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb06de51-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856600, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856600, "uuid": "725f8e2d-0b01-414c-81ee-8a932868c7a7", "comment": "Malware payload (Heodo)", "value": "71400d83ae6545c1ec8590f224aca0e9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856600, "uuid": "7b8d25b4-7201-43f3-a265-6c2d9f0456f3", "comment": "Malware payload (Heodo)", "value": "12d3e63882efda51a4babe475b4b38803658eca7e242db412dc2760bb064cada", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856600, "uuid": "8b80ac5e-f7a8-4852-94ef-f94b73429ec2", "comment": "Malware payload (Heodo)", "value": "3ddadb53f8712e507f5a6a9a6fd41ddb62945cc1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856600, "uuid": "8ffe3f4c-0aa8-4571-8864-837ea12d8af3", "comment": "Malware payload (Heodo)", "value": "d561be19d0b5da60d5310bf3e82ee02a84e90a33ca90dd2764d83f88cee7418e79a58a8b274ebea956bb9915d38fa1c3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856600, "uuid": "38cbeb50-5fe1-4924-bbe6-00824e2f0fad", "value": "T147E36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856600, "uuid": "6faa557e-6ec3-4b59-b1d7-e1518db6777d", "value": "3072:4cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0V:4cKoSsxzNDZLDZjlbR868O8KlVH3dehv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856600, "uuid": "bafae45a-58b6-4947-8e96-ea6e6393611f", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856600, "uuid": "3f751323-66d1-45bb-8b61-b60e1424720a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856600, "uuid": "4411ed61-a9c2-4752-bc13-f34506441a09", "value": "2022-2-3-71400d83ae6545c1ec8590f224aca0e9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a6e608e7-84cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643877075, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877075, "uuid": "8c057135-04f7-4a4d-9391-080a0bd0df45", "comment": "Malware payload (Heodo)", "value": "dec9bf1eb96b031e72950715e2ec6f08", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877075, "uuid": "1986e6f8-84c5-40b1-a4d9-ec2643839ed9", "comment": "Malware payload (Heodo)", "value": "12db71f4e859625ef7d343675f8134160ada669604b8456a020145389cb805e4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877075, "uuid": "3e2584f9-c479-4df2-afbe-6120c99336e4", "comment": "Malware payload (Heodo)", "value": "60fd128a0456b439aa6398f6a175c8b0cb7484ed", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877075, "uuid": "6c4fbbf7-8c07-4895-bc65-51d520c33eeb", "comment": "Malware payload (Heodo)", "value": "0f69769901b97676e0481c3d8863516699f2d6fb6ea5598dc0bb0042dbffb437a54c88f6a78cfeb23cf41b024d091a05", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877075, "uuid": "b0a19672-fd8b-40a9-8003-82aa6bbe7c86", "value": "T132E36B65B6C5D9C6DB0822350ADACAEE3327BC479E7643C33148F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877075, "uuid": "c802a803-1705-4969-a6b4-35431c02973e", "value": "3072:BcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0H:BcKoSsxzNDZLDZjlbR868O8KlVH3dehZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643877075, "uuid": "c0788655-f30c-4e23-b50b-bc52b794a093", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643877075, "uuid": "8d4c79f7-b1e6-46d7-84b4-b7c33c01887e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877075, "uuid": "0c72819b-54ba-45b7-b5ee-8bbaca526969", "value": "GT0528144033257386578.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e0ab6b1-84e0-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643885865, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885865, "uuid": "54dfbec5-b7b0-4e62-ae47-d5212c118125", "comment": "Malware payload (AgentTesla)", "value": "891301cfc51968a1d687cbcbfbc51934", "object_relation": "md5", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885865, "uuid": "375bdb3b-59ea-48a4-b509-b0d60c3caffc", "comment": "Malware payload (AgentTesla)", "value": "12ee9b69bfd8add9a4d0114eba848c0d9d36b231130e1b7168ba594f98c82c50", "object_relation": "sha256", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885865, "uuid": "3881c364-2268-4e45-890d-32370d6ade4d", "comment": "Malware payload (AgentTesla)", "value": "b4820dd9fe2e53be2e7a76fa57ecf546b55a6537", "object_relation": "sha1", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885865, "uuid": "78093448-62e9-49e0-bad9-719b54e23fb9", "comment": "Malware payload (AgentTesla)", "value": "221cf2271b546f994c9fa6ab5c9d5caf111cb94d0b7cfcc274b00ef98218e016f35fa845b6e5a89a0e454864b8e0a041", "object_relation": "sha3-384", "Tag": [ { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885865, "uuid": "47019064-0c77-466c-a4f4-45102550b6b1", "value": "T1D7A4236D441530FEB69B6D6EAAF0EEF12AA115BDD86183F920024F29334A7017F77834", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885865, "uuid": "f2c01449-050a-47b3-ae93-3672d792586f", "value": "12288:RJzKYJnUCSyDv0bgoX1TlxbBcs9FFiapYwUNmGCu1Uu:rzFJOyDMbVdlxb3vUsYhAoau", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885865, "uuid": "56a1880b-3b76-4d8c-951f-0f8a49202241", "value": 480133, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885865, "uuid": "49f54f7a-4b39-4cae-9962-4fbbcdad296f", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885865, "uuid": "509e4ca2-eba8-4794-8d81-64fd5c023f58", "value": "EXTRACTO DE CUENTA (1).rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "66c2cd6d-84df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643885557, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885557, "uuid": "78849590-4871-42ac-96c0-a85990f101bb", "comment": "Malware payload (Heodo)", "value": "87f977591a4efa2eae17588b46507b89", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885557, "uuid": "41e2844d-fa86-420c-a7cb-8925ad3bcad2", "comment": "Malware payload (Heodo)", "value": "1354f9e04f244d6de6d71c38a9b39de2526ac8fda9d2bee34ca8255fb62af38c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885557, "uuid": "f6f801cf-1b87-41da-b07d-cd792073091e", "comment": "Malware payload (Heodo)", "value": "5aaba6ffea1908e73ef9da07c2844d8a3cd15a7e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885557, "uuid": "eb70984b-1cd9-4c03-a3bf-282146bbc8e2", "comment": "Malware payload (Heodo)", "value": "f916d08ee5fcad70250240fbc7b5a62724ee4dfe1e03553f77c27a34bf7b4c804cf9bc688409c03922b263ab19adf261", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885557, "uuid": "4838a2a8-81a7-4060-af5d-3300aceffa96", "value": "T111E36B2576C5D9CADB0822350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885557, "uuid": "9f2268a3-f857-4944-bd0a-6f01fa1a61f3", "value": "3072:6cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0R:6cKoSsxzNDZLDZjlbR868O8KlVH3dehD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885557, "uuid": "fc56aac4-ab38-46f7-afad-8bcd96651807", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885557, "uuid": "af37f913-f3b0-4c40-bac6-1feebaf2e139", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885557, "uuid": "eadbee6d-3311-4bec-9fae-f73a6937b42d", "value": "2022-2-3-87f977591a4efa2eae17588b46507b89.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "911f7e86-84c9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643876179, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876179, "uuid": "df891feb-7fd2-4eae-99d7-f7ded6ebf8a3", "comment": "Malware payload (Heodo)", "value": "98eb27f514406597d3a8fab8b1718e03", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876179, "uuid": "deab2dcd-e969-4dbd-9f72-b4d4b37c2330", "comment": "Malware payload (Heodo)", "value": "136fb7b65b70459476aa6cddb7c46f3ffbd3c3da1450128b6d7feff3c02721a7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876179, "uuid": "37029488-1f0f-4b52-9109-cf8a9cd6eaa7", "comment": "Malware payload (Heodo)", "value": "02bd4abbf08c2cccaaf3951edae3c20892ace401", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876179, "uuid": "936d20aa-8ded-43a1-bacc-15d465493a9e", "comment": "Malware payload (Heodo)", "value": "83187693a7a67efee2fa16274390794e273b888434de24330c66c92b50ca75e7233d6f3a28f070d21c42eaaf6c9066ef", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876179, "uuid": "dce1b1ce-3765-414a-b663-3ca4c44f4d5d", "value": "T17EE37B2576C5D9CADB0922350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876179, "uuid": "343639c3-aafb-4bc6-a6cf-172c5d37e402", "value": "3072:NcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0D:NcKoSsxzNDZLDZjlbR868O8KlVH3dehB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643876179, "uuid": "78ebc1fe-945f-4ecb-b026-f8e632ce3318", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643876179, "uuid": "730717a7-5488-4c6a-933e-509a4d6903cc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876179, "uuid": "305c45bf-a014-4c49-ad27-17f7a9fa4e2e", "value": "DCN145624056UV.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1ef1c7c2-8507-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643902617, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902617, "uuid": "c75da952-7723-423b-87e9-e684cf74c0d4", "comment": "Malware payload", "value": "ba52b56140ad46b208853b95e0e98c31", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902617, "uuid": "0fbcf5ad-7aa8-4683-9584-395415d99a49", "comment": "Malware payload", "value": "13f65cf873b7fae0d18354197954de11ed4a37bf8b44e7283511ee2b05c8cfcc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902617, "uuid": "e563b73d-d5c6-4b0d-93f2-4392f3bd1e3d", "comment": "Malware payload", "value": "4c97e0bd9c60a41e0fd498f3cfd3613b5bca13cb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902617, "uuid": "53717321-5159-44ac-8d1b-c3eb384ceba9", "comment": "Malware payload", "value": "9a413a95b629fa6d98f881e203f916bd94c04c4b6a0d75bcb38a1029288b69949d1af6c891f5041a68a8efe2f0deda8c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902617, "uuid": "28e0a7e0-6c86-48db-a055-17c9be85d321", "value": "T17CE39D8AF25B0D68F192CA3584DA4B1437B39CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902617, "uuid": "5bd7ef62-e35b-4788-9eee-59187475077f", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgfquZha9YILiQaVObeshRTEKwJQiQmGo:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643902617, "uuid": "0283711b-5e8a-492d-acd6-55ee9294b9d1", "value": 148456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643902617, "uuid": "5bb10856-96d0-4fb8-bb5f-a2732176187b", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902617, "uuid": "c8c44b50-a243-4c32-bfba-afadb71f6ec6", "value": "tmp7_udf2pz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d8b6542-8503-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643901111, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901111, "uuid": "66ec03b3-86f0-487b-b34d-96096bfb11e9", "comment": "Malware payload (SilentBuilder)", "value": "d6a39a8e21dd78c3594e01157e2ac3ec", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901111, "uuid": "a8f47c14-06ab-44f9-8067-398dfce0c976", "comment": "Malware payload (SilentBuilder)", "value": "140cf888031983c9a5809ec7049ae9b92966e0c88d4934473e117d60c6e5eb98", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901111, "uuid": "37b491aa-3990-46cb-8cbc-c5d680f16831", "comment": "Malware payload (SilentBuilder)", "value": "35eb3d17c38d62420f045c3f0a6daf5d21378f0f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901111, "uuid": "7491a5e1-dd11-4157-8cca-3b91356c2e2a", "comment": "Malware payload (SilentBuilder)", "value": "5a7c0673f2238c717c9f68928beb6d125b867b6e4e94367180d84bd8b38e222f95c2811237fb54f9d3d43d01b01ccdc2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901111, "uuid": "6e0cc7aa-9edf-4757-8b40-41728b8a7535", "value": "T185E38D8AF15B0D68F1A2CA3984DA4B1437B35CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901111, "uuid": "960058bc-3b5d-410b-b6a9-17db46832d42", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgbqudhaVYI7iQ6VOTeshRb0KwJQiAmGox:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643901111, "uuid": "a2b538b4-36e9-42f1-82f2-6dac709f138e", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643901111, "uuid": "bf24ca68-232d-41b6-93cc-502c20503be6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901111, "uuid": "94713738-c31e-4fdf-89d6-2a73ce49527f", "value": "tmpqic64aj0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e427ceb5-84e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643887915, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887915, "uuid": "55464f58-abbb-4080-8237-0ca23690ca64", "comment": "Malware payload (Heodo)", "value": "fdc2f74c112ab89087193988efb99d1e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887915, "uuid": "93541979-ba75-4275-9bcb-c3dcb9819079", "comment": "Malware payload (Heodo)", "value": "1412e9956da6134eb371393af6380e627b3db78e02c13ffd5097917a6452859a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887915, "uuid": "4001ca71-5e25-45bc-8202-e76998f43a50", "comment": "Malware payload (Heodo)", "value": "ecc5f7935869b748aa43681d4ad8809ba0f88244", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887915, "uuid": "83c4dc0f-1950-492b-9d61-284ea034e390", "comment": "Malware payload (Heodo)", "value": "25b1130cea5d0582214d362a36722334efd3036fbdedb1971d73728d1305b7434384aac68f4d1f15b6aafd759131621f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887915, "uuid": "381feb6b-9211-49f4-a82e-a024e8fdf3b5", "value": "T15A25BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887915, "uuid": "a44de50a-dcd9-4f34-a119-43a7ed0c4bca", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887915, "uuid": "d71ac430-bdf3-49bb-9ef5-102ada91b2eb", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gvFIIm2mlg:kBiaa4powXiolDS2gvFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643887915, "uuid": "5caca08f-4e3c-4f3d-9b93-9d7802ee1cf5", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643887915, "uuid": "da95e733-7e06-4f89-9038-959c43a8bca3", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887915, "uuid": "e47580f5-4d92-4487-8e01-1b3f67db66a5", "value": "fdc2f74c112ab89087193988efb99d1e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0e0b4cfb-84c7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643875101, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875101, "uuid": "c8022170-7de7-4788-a916-e7cbe5139d61", "comment": "Malware payload (AgentTesla)", "value": "2b64d89d5d01ad9b1eabc622c38690b1", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875101, "uuid": "5a1da2c2-6c11-4ad3-acee-c5804b8c1806", "comment": "Malware payload (AgentTesla)", "value": "1469a1d40499aa89afbd02aaf30d0801d324e6a33b42fd082ece97b3dcb4fc27", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875101, "uuid": "02362bed-a9bb-41df-8b07-0d012b1c9e44", "comment": "Malware payload (AgentTesla)", "value": "7da2c386443861e0e438798d24f9d9c827460e30", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875101, "uuid": "131c6aab-61d9-422d-bab8-8d0bc8597de8", "comment": "Malware payload (AgentTesla)", "value": "f20b0e7be351c31222f92b5c186555fe13e6156de44b939795c277dba6015ec999b01d4e7042314cbc4c7418f39bd452", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875101, "uuid": "834be851-82d9-4505-90b4-9b7e6bd73f2f", "value": "T156E4F1A1F69A9581E52B9A3122757C41023B3EE39EC5DA19332CF2480FF77504F66B4B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875101, "uuid": "48aaf589-92fd-41f5-8558-5e171ff251e9", "value": "12288:6F7p3BQJFhwBnccBMYZ/SrH+kTIfZF8T/oOQevY7QLrJ:WQJFC0YZ6D+RFxOFY76J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875101, "uuid": "50ce965c-6ba8-4e3b-9318-4421ba8f25b6", "value": 659456, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875101, "uuid": "4782e680-2a77-40f9-8717-7f6ca6908793", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875101, "uuid": "177aa065-a8cf-4464-8c83-bd13ae267c8c", "value": "SHIPPING_DOCX_BL-018907-PDF.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dda9ba10-84e6-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1643888763, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643888763, "uuid": "1ea6c401-bae9-4801-bc56-47754b28d21a", "comment": "Malware payload (Formbook)", "value": "4fab5a453770723bfefdd8f2ed4fec51", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643888763, "uuid": "8b66f919-39b7-4c44-8b3b-94bdab30eeb3", "comment": "Malware payload (Formbook)", "value": "146e0b58c5b745d2c5cd9ec902b54738057bde024aabf56475aef11e5a8fe07e", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643888763, "uuid": "da905fb8-cff1-4dc8-b474-015b4fa050a7", "comment": "Malware payload (Formbook)", "value": "70ce24b229d5644f9c13f0f12ec797f8cbacc973", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643888763, "uuid": "0ae956bb-b858-4631-953b-3fe57b8447ad", "comment": "Malware payload (Formbook)", "value": "0aae598e41c9ed4708665a0bc62a5c0540e823935cba1574c69280465d97408deef4be77167295ccc70de57f0f66a157", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643888763, "uuid": "1b8ef2d0-752e-4fae-ad91-c15bb970e7a2", "value": "T154842300D20B98F7B13E22A9DCBF86BDD91157D71F22B9C3487932419B5A4D62FE489C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643888763, "uuid": "edf1dd83-c6c0-4b25-b8a8-a481f344c99e", "value": "6144:kstdK7YaFLOC+Tc1P0lgktSyQ9KXm2zMqT1/+1Yr0CneT56bcS3OzkirL4Qs+8cf:kOOYaFLO/A1egk7UcgqB/+1rCe01YFrj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643888763, "uuid": "669b7be9-405d-404f-b7dd-2849150024c7", "value": 389623, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643888763, "uuid": "4c176c12-f57a-41ff-85be-8c99d23dd4af", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643888763, "uuid": "0aef17d3-d67f-40f0-b362-42bc266afc58", "value": "1643856836.Vfc11Iba64a2M764860.dynamene_Pending Invoices.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eba53c8c-84ff-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643899524, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899524, "uuid": "21a5c46f-a161-4626-b4a6-a5d38589d4d9", "comment": "Malware payload (SilentBuilder)", "value": "95d094f7ec70b07f610e23592f58dfca", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899524, "uuid": "2696156c-9940-4a93-bf26-90c4ed8400b1", "comment": "Malware payload (SilentBuilder)", "value": "1480e6274ac1f5cd501a956a7b29888e39ad0d81323796c1eb9abd8757735f83", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899524, "uuid": "5178db0f-8cfc-4076-a284-a33674e6cf9b", "comment": "Malware payload (SilentBuilder)", "value": "2f99c9c42b3c2b04648f949118de447088ecfc24", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899524, "uuid": "8dfb622a-1fe4-4d38-8383-bd89c51f9016", "comment": "Malware payload (SilentBuilder)", "value": "da06615e5ada697c6e2579ba9af7991e095ddb13de8f6a41cf52df44c8187b69c00b639c3856daddc762de6fb05d3b7c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899524, "uuid": "d915e671-af96-4ce5-b90e-df27878f156b", "value": "T1F2E39D8AF25B0D68F192CA3584DA4B1437B39CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899524, "uuid": "fcd0cf81-1d49-4c9f-8991-177899e10e56", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgfquZha9YILiQaVObeshRTEKwJQiQmGo:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899524, "uuid": "992acd76-851a-4340-999e-e3017229f62f", "value": 148484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899524, "uuid": "a0a4f5a3-25e4-4b6d-b7e4-cab2aa2f32af", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899524, "uuid": "76f60ce7-12cd-46e2-88b9-944edf68a01b", "value": "tmpz2dkiksi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "994ce0cd-850c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904969, "uuid": "ad2b0cf3-d9ae-498c-b799-f75da6e5b66c", "comment": "Malware payload (Heodo)", "value": "6663be5ac762834e4e394f27049b6173", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904969, "uuid": "34125ac5-da5c-4d08-8e20-4aadfc0ee821", "comment": "Malware payload (Heodo)", "value": "148727a181fba51bb9e490c1326cb7861aae99c35c60827a24390e3bcc713822", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904969, "uuid": "418271dd-d6fb-4729-be81-55d2bd14db23", "comment": "Malware payload (Heodo)", "value": "7465c3b455fe15af97540b9c3f1e3e28d499e2b6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904969, "uuid": "0e80f8cf-4894-4c87-aacb-f05c114d2374", "comment": "Malware payload (Heodo)", "value": "dc4cefd6bd2567943be5aadb653c5b02229b49f09b0882716835aade71f06853606400cc7eaacc9a82bf8bd92757badc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904969, "uuid": "61f977a9-2391-415f-b5a5-03805e4ad75a", "value": "T16AD4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904969, "uuid": "089d3268-9593-44f8-a226-ba115c40682f", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904969, "uuid": "21032a73-296e-4db1-956c-35e26eb599e2", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBPX7+7/Q0xIop1KpR:JynoxcCOllFxBPS7LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904969, "uuid": "f9e4a936-156a-43c2-9f79-ba1bfb976c28", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904969, "uuid": "72903819-599e-4920-a6c8-503432bfdecd", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904969, "uuid": "1b32a61d-f131-4c26-ae27-7497747d094d", "value": "emotet_exe_e4_148727a181fba51bb9e490c1326cb7861aae99c35c60827a24390e3bcc713822_2022-02-03__161558.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd442ec6-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "7d41cbfc-76a6-4ca6-97f5-2523ff8cfc05", "comment": "Malware payload (Heodo)", "value": "9bf902ce91d7f9ae4104e853ecd644cb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "81752660-b3bb-4b53-83f2-21da96c71221", "comment": "Malware payload (Heodo)", "value": "14fffb43f031eb32b6c81eb3f728531b3d62885c29fc5096cd2ba8460bae0bf9", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "251772e2-a45a-4988-be7c-2dea808925a6", "comment": "Malware payload (Heodo)", "value": "69096f525db52aca0579942b82258a5503476e9e", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "c33e3732-a849-41de-90ad-5c090886f5db", "comment": "Malware payload (Heodo)", "value": "37f2492854ca9dee6d21268a312c40d207cdff1afda4aae7614d69b5b14b6660b0191d8b006b3f441888aefac9b27bcd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "b605001c-f8f5-4cbc-8ea4-adba31cadf0d", "value": "T16464E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "db892633-abc2-482d-977a-952c70b52066", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "3f6adce3-989d-4baa-af36-0e9eab5a10e0", "value": "6144:83DvZRFTFbksYyljaMYDMjT7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMYqLAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910291, "uuid": "c21289ee-6c51-4c9a-a371-c916c29adfb4", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910291, "uuid": "818df355-29ad-4151-bfe7-740a79f96243", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "5fb89eee-89b9-4b71-ba8a-42945263b82a", "value": "emotet_exe_e5_14fffb43f031eb32b6c81eb3f728531b3d62885c29fc5096cd2ba8460bae0bf9_2022-02-03__174437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d882f47-849c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856658, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856658, "uuid": "b86e43f9-0ee6-45e1-9eee-f0b6ac54feba", "comment": "Malware payload (Heodo)", "value": "7f05e2b1a4dc81b2fd47b32f5b406a9a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856658, "uuid": "7db36555-4bb4-41e1-975c-014a49ad0760", "comment": "Malware payload (Heodo)", "value": "1536a82959d183ad73e02648e6c759cee73b800674c71c385480793a8f08138e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856658, "uuid": "fc10831f-cce1-4bcb-9781-b4595c2f7cbd", "comment": "Malware payload (Heodo)", "value": "2c93812fee95fbad157d38922bb36b5a2cb93f2f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856658, "uuid": "3a955615-e273-4fbd-ba9d-85794e7ae471", "comment": "Malware payload (Heodo)", "value": "2f5bcfe85c2b52d18e9d0daf91ca60c4f52f4c6875f07572232759bdfc25e7c1adbde224a774e369922adadc33c0b5cc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856658, "uuid": "1c10a0f4-5511-4c84-a4a2-f65141e44941", "value": "T133E36B2576C5D9CADB0822350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856658, "uuid": "d1319b0c-7613-451c-ab30-7d8cde83a404", "value": "3072:mcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0Z:mcKoSsxzNDZLDZjlbR868O8KlVH3dehz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856658, "uuid": "91968e56-af11-4225-ae02-e6a094234863", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856658, "uuid": "a9e862bc-1c43-4e00-ac84-17d02eeb1a6c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856658, "uuid": "a89f40e1-9633-45cc-91e2-8df93c3bd518", "value": "2022-2-3-7f05e2b1a4dc81b2fd47b32f5b406a9a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "95c5813b-84fc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643898092, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898092, "uuid": "c85fef9b-f864-49a3-aac5-939c4c3896b8", "comment": "Malware payload", "value": "5fb5d3304b9c39c07fc7ce47e3bcd67e", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898092, "uuid": "7df89718-60a7-4280-8007-ca26a32f9f82", "comment": "Malware payload", "value": "15772ea060d2a9a148685235c542281716bd1cb35928df330acd5a46e8b92646", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898092, "uuid": "3043169e-8598-4025-b4c1-dde71b5e7e10", "comment": "Malware payload", "value": "4513588e9a7bc8ae828ea780901794fd89b9f56d", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898092, "uuid": "b2fbf28a-66bc-4b47-895d-29c76d1c50c6", "comment": "Malware payload", "value": "a95645d09fc3712e124cd47d25e7af934c68bb8d5117e91f43a85dadc7276d36406a266a6fa09aa22d4a823e72e56299", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898092, "uuid": "9d587d9a-be93-4f7e-be37-9531401c6284", "value": "T1C81412E16EA09991C2831FFC1F35C6571E66DD3BFC056D8935803E0959F2FA89C80275", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898092, "uuid": "ac9fb8e0-bc7e-403b-8ed2-08de7580cf98", "value": "3072:COzMTpp52uEYz4i3TEmsAVon5hiHKqh7rx7nSswjISljXUalcXkGoimg3vgjsXt3:ZzG5z4iQms15sKwBOJlXCbXoCaA5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898092, "uuid": "67cb3975-6876-4d1b-9175-584d65c7668d", "value": 192136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898092, "uuid": "bd343cc2-6736-49f0-af23-bbb55cc7fad1", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898092, "uuid": "10009856-4342-467e-9008-f310b4dde3a7", "value": "ORDER PACKAGE - BALTIC GRIFFIN POLAND.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "067d4286-8525-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643915461, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915461, "uuid": "a43df933-ab9c-477f-8abf-6ff2623de642", "comment": "Malware payload (Heodo)", "value": "42b1fbeff523effc14c2e5d3aa495742", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915461, "uuid": "9bcf8ebe-cc55-4be1-894c-e67d67b081b7", "comment": "Malware payload (Heodo)", "value": "15ec3c0088cf672f54e122516d40a04dff7fa87fbf6edd1e00a512cd4d896f1f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915461, "uuid": "6d3ecc7f-30eb-422c-ad85-fa6f56383dc8", "comment": "Malware payload (Heodo)", "value": "59f01501aed3971ffc1d30b9ef7ec93456c631de", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915461, "uuid": "f573f276-92e1-42ca-a353-7306d36707b4", "comment": "Malware payload (Heodo)", "value": "28aba066f151805bf7205c32993091e089fd93002c1a68fb7ae2367969b26b0ad82ba091e4a53194d515a25e0976d70b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915461, "uuid": "6c683611-7583-47dd-87e8-411f40362e66", "value": "T11B25CF11AE4980A1F50B293D1469A7A60FDCAD021BD0ECDFDF44F9A36F12CD3957886B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915461, "uuid": "86813072-26ab-4ae1-a050-b8fbe12341a2", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915461, "uuid": "fc5bf11f-7b37-4b07-859b-d3326b99d573", "value": "24576:SCiv47/YUr3bti5wcjbnZeZfxan8hX1HlyOwLVttCAUXGEFIIm2mB:SCjYwLtMvgZfxailVFIr2mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643915461, "uuid": "61c909b3-ac54-43c1-85f6-bd512761edbd", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643915461, "uuid": "85a6ebd4-04e9-4532-b7ed-f828872a6129", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915461, "uuid": "2133e0d4-8765-4f69-8783-15c3bc513940", "value": "emotet_exe_e4_15ec3c0088cf672f54e122516d40a04dff7fa87fbf6edd1e00a512cd4d896f1f_2022-02-03__191051.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6b47136-8520-11ec-9275-42010a9c0029", "comment": "Malware payload (XpertRAT)", "timestamp": 1643913689, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913689, "uuid": "e98967ca-b8ec-4d28-9209-0103c4b1a941", "comment": "Malware payload (XpertRAT)", "value": "bad6fbfb1cf5875499b388ca6a2e50a5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913689, "uuid": "09f2b545-1a62-4dcc-ad53-42cb7b05c51d", "comment": "Malware payload (XpertRAT)", "value": "16078aa819c76562e37c5af8c88dcb31a39aa433ffcbe53b41dacc0aba8ee3ed", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913689, "uuid": "9cf82aa7-5767-40bc-9e27-4f1fe7a415ba", "comment": "Malware payload (XpertRAT)", "value": "f7a6fe1e5efeffa3bed7ba1b0c95a3c23cf3813d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913689, "uuid": "8eead2cf-c598-4294-9cc1-4eb46a7a5f82", "comment": "Malware payload (XpertRAT)", "value": "35b2d18dbb2f3d80dc812756a4c9984a07325ff303c098556616ee90dfea8c879f9c7902c21b5ea026e53ab9e055eb6e", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "XpertRAT", "colour": "#0B8513", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913689, "uuid": "f2241c7a-defb-497e-88a7-b39072fb32b9", "value": "T174341259A4D189F7EA3B4B722F79C31FE7B9E7055B6141079B24CFA66C202C0A94B390", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913689, "uuid": "2afad382-3183-472d-b265-e0e808be1a9e", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913689, "uuid": "92bb6af8-a542-4e83-b34b-792f08598bf3", "value": "6144:owZK9jAg420MZW6T3YBBOGEnLcOXgqkfNkSEupgEFPFc8tI:lKZAVyTEO3nQWkf67PEF9I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643913689, "uuid": "4dd7c649-3171-4750-b565-ee7127c5aade", "value": 252010, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643913689, "uuid": "c0d34d13-f33e-4254-99b0-f6f92ca9193e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913689, "uuid": "50a752d3-db96-4a5c-aa8f-b76d3668d415", "value": "SOLICITAR OFERTA 090034.xlxs 247KB.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0d0393c2-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855342, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855342, "uuid": "873262b8-9d93-4acb-9006-60346fcb1f4f", "comment": "Malware payload (SilentBuilder)", "value": "04778caa083a29eeea3f8a16770c9db5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855342, "uuid": "fae84a0c-ef13-42a3-bb34-107e936c63fe", "comment": "Malware payload (SilentBuilder)", "value": "16c0fda444a9e4aef98157b931d1700d4b2f36fa12aeddbb1faf69372e2e670c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855342, "uuid": "c8e03f4d-d114-45ed-aaa9-fcf1ea926a9b", "comment": "Malware payload (SilentBuilder)", "value": "d2e86f8c0fb33670df665b5bfff453615c57a10d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855342, "uuid": "99d59d34-23b8-44d1-9c8c-0e6b30877af9", "comment": "Malware payload (SilentBuilder)", "value": "b006489cc1da9aaef1d596eafe35d5a77055e0f2cf676a91628f397bd0faee7fcac99cebc302dea1e2c98de72c3e6d1e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855342, "uuid": "6b6f0b77-ac0f-4bab-bfcb-8e9e035a95ee", "value": "T1D7B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855342, "uuid": "8406099f-eae3-46f7-b511-b9924169c94d", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49r:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855342, "uuid": "20c999ac-1942-427d-8459-6e13e5768161", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855342, "uuid": "a8d945e1-a142-4493-b713-802cb6c2d7e1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855342, "uuid": "205adc01-d58f-411c-8a2d-7b82d11b1b1d", "value": "2022-02-03-04778caa083a29eeea3f8a16770c9db5_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "86c4a918-849c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856835, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856835, "uuid": "773803ab-c681-41de-b1f0-7c6ab564fe28", "comment": "Malware payload (Heodo)", "value": "b178e0216eacce87d0b275de5511ac86", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856835, "uuid": "174fc57e-6f57-4749-89ab-a1a5e442a28a", "comment": "Malware payload (Heodo)", "value": "174a233ae11a209c8e6a9c000ff8f15fabc1bc2a2722aebe3d7aeb7bdb49d859", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856835, "uuid": "741ded2d-7a03-42f9-862f-224eb2599cea", "comment": "Malware payload (Heodo)", "value": "51f024d48b78086211d3fef6c088334f3da223d9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856835, "uuid": "177a478d-c3cf-415e-b25c-3828df02c869", "comment": "Malware payload (Heodo)", "value": "a90a97b33c9771208be6e24db14105cebc567bc8df81ce47b6f49b6326724911166506e1c8b773a3b599ab28d2d942ad", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856835, "uuid": "ffb566d3-24fc-4d3a-b77a-d961ce637248", "value": "T14CE37B2576C5D9C6DB0822351ACACAFE2327BC479E7643C33158F31E2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856835, "uuid": "42a1e995-5594-49be-b875-efc600902ebb", "value": "3072:OcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0x:OcKoSsxzNDZLDZjlbR868O8KlVH3dehL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856835, "uuid": "2b4dd1cc-62c4-466f-b8f1-c1406d0f48f5", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856835, "uuid": "914c7592-7e76-4546-b82f-756178c9d1e2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856835, "uuid": "8b576399-287d-4960-836d-ec79766c46c3", "value": "2022-2-3-b178e0216eacce87d0b275de5511ac86.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1e59d44-852d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643919292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919292, "uuid": "518e7994-0864-4717-8d68-19932eb8598c", "comment": "Malware payload (Heodo)", "value": "973f54b0f85878151dc562ad6f9a8ded", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919292, "uuid": "34ae3e60-e2cd-405d-800b-5aaf34bfb0af", "comment": "Malware payload (Heodo)", "value": "1786192abd14fa97cde93aab5d40615133b4d7922c9e77ed062726b84bdefec6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919292, "uuid": "7d8d9860-8c95-4eab-8352-c3e755850c98", "comment": "Malware payload (Heodo)", "value": "ce326cc845c3eb3a95992acf2ed2d11739cdae52", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919292, "uuid": "514e6a36-1eed-4ea5-aa3e-3a035159d013", "comment": "Malware payload (Heodo)", "value": "96bfe71af5218039c6b215d952a06da0a66fae11341e3bc3144b4b3f0b4eb469c31bcea7ce63a062e7a130a1b5612fba", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919292, "uuid": "e598ac14-bf40-4ac1-99b5-b0c8d93f7e19", "value": "T17F25CF103ECA40A1F64B153E006A73584FDD6A1507E1EADFDF44F8A7AB15CC2AA3946F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919292, "uuid": "eda2d698-7685-4017-989d-a379f562a9ed", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919292, "uuid": "99e9a9ac-b74d-4a89-81cb-269acbd63b57", "value": "24576:aKzjU3EJ7mCRpnAOxxmd3uIqUUvoq116OzvMyvbFIIm2m+l7:al3g74mm9uIqUUn1xTbFIr2mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643919292, "uuid": "f208e724-b98a-462d-a778-d6462097abba", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643919292, "uuid": "a23ddffb-fe60-422f-a532-31873dd10a7a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919292, "uuid": "9cf97658-a523-4ab5-adbc-a09d634bb146", "value": "emotet_exe_e5_1786192abd14fa97cde93aab5d40615133b4d7922c9e77ed062726b84bdefec6_2022-02-03__201440.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1d4a4c0e-850f-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643906050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906050, "uuid": "689aecee-00f4-408d-a440-68ffd14ec0f0", "comment": "Malware payload", "value": "2aa128a1ea675cc2a9c9fc04ee952546", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906050, "uuid": "0b4f144a-90b7-42c2-b24a-e20c2f1761e7", "comment": "Malware payload", "value": "179859ab41c030d7c6cadb1ffdb8354accf409c94c3367a6d0a6ff6e28ed5a67", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906050, "uuid": "50d79e79-d4c6-478e-8ac2-5d69460d5ed0", "comment": "Malware payload", "value": "3b659ee84c60fb610d916fe2d1a3c3e65243a67a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906050, "uuid": "b8467b50-64dc-48f3-8fd4-bfc286fa8208", "comment": "Malware payload", "value": "c31c193e35ff9b178f960f626b0ec7f31cb10eded55d9db317853e1f0dd5b7aa8d037aeb682f5c17c151d736dd6f4872", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906050, "uuid": "98550569-afa0-45c6-b5f3-e9bb793fe5fe", "value": "T1E8F63331339AC33BDA5E0630646E925F5674BEA3473280D7A3997D3E8CF50C06B79A91", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906050, "uuid": "010aa0d9-0473-4e59-a69b-41df59c0db8c", "value": "393216:tH0693Zr3fpDQdWGYbzcBODuej62IfTmpmsOMx6sWmgA:BrRvpDQwlrJo2mjm+/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643906050, "uuid": "61f3eae5-3162-465b-9070-6aefb4904b36", "value": 15661568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643906050, "uuid": "d00c6456-48cf-4669-b511-6da4136b9d11", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906050, "uuid": "d07e8829-f21d-44ec-aad2-b01fabb51ab2", "value": "MERC_PG_MDLS.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8c745d97-84cc-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1643877460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877460, "uuid": "e513bd57-0c72-44dd-bae5-d61a55c384d8", "comment": "Malware payload (Formbook)", "value": "e871d5d07364a929ba833087560ed693", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877460, "uuid": "381294f2-467d-4c6d-b55f-25cbfef78205", "comment": "Malware payload (Formbook)", "value": "17a015fc34d0e243070f80340d1692b5a52d7806328c587d8fcb153c209ad545", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877460, "uuid": "b80cd1f3-c8ed-4736-ba30-f856998c9a7a", "comment": "Malware payload (Formbook)", "value": "c67b7cd2b85b55e4329009d272c4e12d2b9f455e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877460, "uuid": "b321e543-5e4d-4c79-9d71-87e05c432e01", "comment": "Malware payload (Formbook)", "value": "d25dedfcbc1d33396fd81884ec2507f9b1d4376903e715df3754a842de4f5232429fd97565c0e578a936210f690ad21f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877460, "uuid": "79f76515-f41c-400e-a1ce-96ec093d81da", "value": "T13E3512C2F6C5E5A5C81B0AFAE83ADD621727BE6AD424811F3449761B6CF33431863D1B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877460, "uuid": "936ffc47-4937-4c03-97ad-c2892974afd7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877460, "uuid": "c6e5c50b-d432-457d-8349-fb5b58c9424c", "value": "24576:wDI6HI5lWE7jsh7+bXZ9vtkTOlUtNyfrGaREYx8tmP:wDI6HI7nCqiKKefrGaTx0m", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643877460, "uuid": "fbd770d6-cb72-4340-b317-80a2b3177c6d", "value": 1082880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643877460, "uuid": "8c58231a-5909-4cd5-8eee-2ee75bba3139", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877460, "uuid": "2bf21cee-7cf8-4696-8d6a-e3962b6f3335", "value": "neuer Katalog2022.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca839c28-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856519, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856519, "uuid": "a4193b99-fbdc-4673-88f9-b3758d06068f", "comment": "Malware payload (SilentBuilder)", "value": "d22f3943278d6b0ae53c230781897dee", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856519, "uuid": "eeafc978-a59e-4ef7-8605-efc3c8d9f508", "comment": "Malware payload (SilentBuilder)", "value": "17af408bdd62e540e6797639e1d71716bf0642341297b5338fa9193d762fa844", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856519, "uuid": "d239f71f-5917-4845-b793-b2826912deb6", "comment": "Malware payload (SilentBuilder)", "value": "9d2e9e0caf93ba211b16749cc9535a86134ab85f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856519, "uuid": "63436197-c3e5-4d6b-848d-acef714ac84d", "comment": "Malware payload (SilentBuilder)", "value": "3caac707511ba742e9f8af70280cc4d1b1097b8e71227cb3bdd8a3b7fc830bfdbdd18d695f35bf0e40c91d04fd8c3f9e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856519, "uuid": "feb9ab46-bf00-42fd-b67f-94cd56ce17b9", "value": "T16AB37C5A7365884EE55A8B3488F707962333ED208B5F06477115F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856519, "uuid": "4fd0a55f-8c47-4645-b46b-29a77d4f42d9", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49/:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856519, "uuid": "2851755e-cb81-4354-8a13-689ae5f9ca8e", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856519, "uuid": "57d749ff-3afa-474f-af5f-2973c519596a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856519, "uuid": "0fa3b671-b58d-4149-a1a9-a982ea0b1ed5", "value": "2022-02-03-d22f3943278d6b0ae53c230781897dee_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7459085e-8484-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846496, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846496, "uuid": "d6c1883c-96a9-4167-a93e-fb675a15de0a", "comment": "Malware payload (Heodo)", "value": "aaa1f25efa159ed572cc29aacd32c829", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846496, "uuid": "addefbd9-0fd3-42ff-86d6-7afa3b615994", "comment": "Malware payload (Heodo)", "value": "17f0e06b32270571947895e6a5fc40d6d505a0e133898d4c0eea23e66d1830ad", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846496, "uuid": "596f7b40-9fc8-42a7-b1e7-4ce6de75c70b", "comment": "Malware payload (Heodo)", "value": "8fa2fdded0da443bd9be1f88ec50be2bc8e020cf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846496, "uuid": "065eb7fe-2fb3-466b-9a5f-1a9a41e5fc26", "comment": "Malware payload (Heodo)", "value": "e888b08c259b9183e670dccd29f7c7cdf0b8ba096dd96f4a20b453caa471037b8430618e2c7431e90ee5ade69f7faa40", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846496, "uuid": "dd463747-cd7b-46f9-9b8c-12233e188a3b", "value": "T187E37B6576C5D9CADB0822350ACACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846496, "uuid": "c7899cbc-6ecc-4e95-8dfd-815de021a43b", "value": "3072:mcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0X:mcKoSsxzNDZLDZjlbR868O8KlVH3dehR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846496, "uuid": "f841f8eb-d9e1-4d5a-b7cc-83c225359beb", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846496, "uuid": "3c605acf-b6d2-45d2-8296-64a9fcf4d3e5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846496, "uuid": "ad69f33e-15b5-4ee9-97d5-705f55af9ba9", "value": "2022-2-3-aaa1f25efa159ed572cc29aacd32c829.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcd57955-84ff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643899553, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899553, "uuid": "61caeb8c-5d2e-4be9-a135-c0df290d8a27", "comment": "Malware payload", "value": "49437f2daf89875e546aaa1ea043a598", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899553, "uuid": "23a5f279-befe-40bc-857b-8d87341a1937", "comment": "Malware payload", "value": "17f1be1cbc4031d8a1d3f1fa661304f9b680e9da76f5c8ae6ef4f768e3c7bbd4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899553, "uuid": "d8fb6108-7b36-4a28-aa67-7b221c895a96", "comment": "Malware payload", "value": "9c4915d9829bf01de7c0a3a11ca9f849af3c649b", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899553, "uuid": "233acfe7-ee39-4a0f-9450-5f705c0ef293", "comment": "Malware payload", "value": "eab6ffcc810e6de681aeef4fac16bb928de6df89cf9fdd5c4716f08f20ee8be365b89432a40d75053067d9296ad826be", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899553, "uuid": "313bfbab-2262-4445-9cd6-5b2d34716bcd", "value": "T1CCE5235128DBDD31CB7A24FE053B6A20E6D13D93C475932B3BA20E652A496B0CF4E4F5", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899553, "uuid": "d63a3427-e8c0-4372-8dbd-65e37b5ec9a1", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899553, "uuid": "44ee5a82-b1d6-4e7e-9e9e-f531165a3a41", "value": "49152:KsmhnqAs9pJc0dnKh+Q0N1rs+vIUSg+6+8ohnRh1Na1OKM6nYAKhFQpSH3Oh5gxJ:IqXpy05Q0N1rsYSZ6BoXh1kkypSH3OhI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899553, "uuid": "2ae1e2f3-03a6-461a-8918-51440d0c2097", "value": 3096064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899553, "uuid": "6dd42e16-3193-4237-b1fa-17594ec9a341", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899553, "uuid": "07d5e38b-6259-4e4a-a87c-17c300c014a5", "value": "49437f2daf89875e546aaa1ea043a598.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6f917af3-8484-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846488, "uuid": "420b9326-6b34-4a3a-b4a6-f2734a87097b", "comment": "Malware payload (Heodo)", "value": "10ad4999d1c893a6e91a3f4602215acc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846488, "uuid": "9d0ab3a9-6ecc-4fbf-82f2-55cb66cf3a17", "comment": "Malware payload (Heodo)", "value": "1816e73719af29d25dadc017d28282961516efc86aa3f75244e8a809bb8d693a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846488, "uuid": "94aa3167-fc3a-49b8-a8cf-4396970a117c", "comment": "Malware payload (Heodo)", "value": "7bd61467694b95490cad061d2ebca58e36ae6112", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846488, "uuid": "05e30b25-29b1-4c53-8682-360885745007", "comment": "Malware payload (Heodo)", "value": "b823c4fb8827783ff4f5b35915acf65b40bf65b90ed2b9854fd7224d22d584bdc9919a2419529f39455c6081e14b0927", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846488, "uuid": "141b6bb9-60b6-413d-9a18-bf457f796a35", "value": "T13A25C0216D8A40E6FA47193E0069B3544FDC69050BE0E8CFEF54F9A66F12CC25B785AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846488, "uuid": "048fc875-547b-44ce-a789-f7fc468c6e4f", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846488, "uuid": "fca515c7-79fd-4d72-8bb5-3e08b65de92e", "value": "24576:vyj4pucLsugl4zCy9fG+OVE+cXcs2vUCFIIm2m0:vzfnl9fYVoDvCFIr2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846488, "uuid": "e4dc5830-cac0-43ca-9cf7-359058d63ce4", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846488, "uuid": "640ba37f-40a7-43d1-95c6-d50a12e67b35", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846488, "uuid": "36930d99-881d-4eb4-a6f7-163ddb2f343e", "value": "emotet_exe_e4_1816e73719af29d25dadc017d28282961516efc86aa3f75244e8a809bb8d693a_2022-02-03__000121.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cf39394f-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856097, "uuid": "d2c0b0a7-837b-4fde-9b68-8fbadf6a4ffd", "comment": "Malware payload (SilentBuilder)", "value": "81834785b9a9a092e3e97f47a4049938", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856097, "uuid": "b8016dba-2cf4-4895-a441-1cafde6b7af7", "comment": "Malware payload (SilentBuilder)", "value": "182490784411fe3d1bfd92ce5cb043cfdf2fce10a37c8f38297ed734fb5c102d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856097, "uuid": "1a48aded-7a7d-4481-bdd5-9c0f10a26289", "comment": "Malware payload (SilentBuilder)", "value": "a5d1515e81124058e8447a9afbee05523e1140ae", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856097, "uuid": "ad75c317-2973-4d66-b51c-bc01b9e58b08", "comment": "Malware payload (SilentBuilder)", "value": "133567d93799efa2b980e965ed2c8ef96c4c7df59e3b0060e49f4d4438481fdf23e82ba7cea86f475a3e694ed37c6fa4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856097, "uuid": "c4510d71-2374-481e-9cb7-fa19676177b8", "value": "T1E2A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856097, "uuid": "acc4668d-0d46-4bf8-a7a3-256768b169ce", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4N4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856097, "uuid": "a0e78e57-6acf-4f7c-8ce8-8c15fe3f9b39", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856097, "uuid": "af67126f-d918-46c5-86c8-33026fb5ccf7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856097, "uuid": "871cb675-44d5-442a-91b2-81b84051e6fe", "value": "2022-02-03-81834785b9a9a092e3e97f47a4049938_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd126516-84fc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643898265, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898265, "uuid": "0ca772a0-0ff8-4d0a-af90-ac86e66eb5c7", "comment": "Malware payload", "value": "08950fe1c94fa9f579b31eb4c2d62072", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898265, "uuid": "a0b2637a-80ed-4901-87c4-adf9780d59a1", "comment": "Malware payload", "value": "189cf0194814b0e659bf21849c5276e0d39e70176ceb0bf163639c80822d0177", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898265, "uuid": "a24bf6e4-ef71-4fd9-bd53-c33ee2e579f3", "comment": "Malware payload", "value": "8457463b99e1122243941888a4d354adec8fca2a", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898265, "uuid": "49271a87-930f-4604-a426-bb42c2a1625e", "comment": "Malware payload", "value": "c0c6f7e57e529c4abd406fa33b6272a07d4d4c16efb814d774b01f23cf8bf152aaf418c56ddda8f4a149178b23c3343e", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898265, "uuid": "78e21c1f-8e9c-45e5-88bd-4fb6f48f74d1", "value": "T10114121FF690471EEA93257BFEA08A40E1127DD46E26C359E4D3721E297C80B8F65933", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898265, "uuid": "dd6b3608-2f7c-45f3-9760-f1121fd5c659", "value": "3072:FYo+/MUIoAZ2xgqslhaxKdwZOupvX0jbu6dFjZP2CfZqKDsVyr4WQ9DH:2F0qslhpwZOD+qjUCfZCyr4hH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898265, "uuid": "cafab4ca-8e39-4cee-8913-31ad87bbfac5", "value": 191304, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898265, "uuid": "8f3b2b45-6833-49de-bc22-1ba898c2ea6b", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898265, "uuid": "0fdc5d25-3c2e-49fc-923a-a0c69b8274c6", "value": "QUOTE--67489.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72d856f2-850b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904475, "uuid": "861a875d-dc00-49ab-bebe-583150914ba7", "comment": "Malware payload (Heodo)", "value": "4814bb5d0c1b605cb7c666b99dba4ea4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904475, "uuid": "e48b7c2b-ce75-4fb0-91bb-5cc32a9327ff", "comment": "Malware payload (Heodo)", "value": "18d86eb4ad2d7dc1bad8b07352511bb5d5252dc23665ae3e24a01756781291d5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904475, "uuid": "9fb6ef8c-92ac-44b3-a8e6-e91225be9532", "comment": "Malware payload (Heodo)", "value": "c25a91a5979c1207b88d4017208c765374d835c0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904475, "uuid": "95c86f09-e202-4a4e-bcf8-17e5498b9e60", "comment": "Malware payload (Heodo)", "value": "da93099f05b2f21e46347fd7925bfce263d64c55ae1106afd66550c8255de26d004ee7f53a18809f4b335cf66e90b964", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904475, "uuid": "607849eb-87e9-43eb-87f6-69f170eb30a4", "value": "T12EE39D26B685C95AD91407351DD7CBF7333BBC818E7683433289F71E6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904475, "uuid": "74118919-5605-48d3-8c32-3a9f792846bb", "value": "3072:tcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcz:tcKoSsxzNDZLDZjlbR868O8KlVH3Uehf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904475, "uuid": "d87792d1-e487-4df2-ae02-a5a66f9bacd7", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904475, "uuid": "9ecccc3d-9ef0-4a33-87b4-e7a984a85037", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904475, "uuid": "c58cf6e3-1683-43e9-a698-38877329de65", "value": "tmp4klnt4h0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ebd4f60-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643883933, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883933, "uuid": "b5813cfd-2ce2-4193-9f80-5b53079d6ba5", "comment": "Malware payload (AgentTesla)", "value": "81a2cd1d1e952ff25641e66bf0add333", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883933, "uuid": "a4736171-4c05-4d83-a3da-8b33d6ecf29c", "comment": "Malware payload (AgentTesla)", "value": "18f486ed2b23b9da306edd0ad4cfa46f2e2dbcb7807ee252fa0aba1b8df8d3e0", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883933, "uuid": "640b5303-1ece-46a7-9286-cd0320a5de69", "comment": "Malware payload (AgentTesla)", "value": "6bcbb1852e1d68bc04f4abfda742c5d26cd4d29b", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883933, "uuid": "056f1baa-1ef0-48e1-a192-bd27bef89048", "comment": "Malware payload (AgentTesla)", "value": "0de655c43a54ffcc7c4d42a294ae8367668e3ac6d5b2a59c7a7cf8853af6a6ecfe65b7295a22b6b416e428acd9109bd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883933, "uuid": "cd582c26-8da8-44e4-8bac-d00f23b12302", "value": "T1C8D4D17ABA4BCE90D016253211BFB41107B23ECB9AE3D6063F5CB3480B726554FA665F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883933, "uuid": "35bd91ef-88e1-4907-bc61-962fb7e9b451", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883933, "uuid": "8b2f91ab-c8c9-4ce6-8eea-5c01afa645ef", "value": "12288:SmX+cJTVHkPRnjlR3NEcJ5ieHFOZetUEqJJ:ccJTYRnRRdEcJ5ieHFOwtUzJJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883933, "uuid": "301502a6-ad8e-481a-aa19-01de44380075", "value": 644608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883933, "uuid": "dc3ac96a-ba12-49ee-8c1b-577bc9a38711", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883933, "uuid": "5176aefb-66eb-4a18-854b-8f87472d4d23", "value": "ORDER PO.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28ff270f-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883736, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883736, "uuid": "d32e815b-09d9-47ed-a91b-9f3321ca2d70", "comment": "Malware payload (Heodo)", "value": "79b8f1929e19d6d752576cc0e43b0516", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883736, "uuid": "ff0f6378-469a-4825-a162-245b99d5a0bc", "comment": "Malware payload (Heodo)", "value": "19177f863d51995771ff56ca945e396d6766e44fb75ec4e9873b9ae7e85eaaf3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883736, "uuid": "f44ab77d-8739-4978-9818-6a8073644c32", "comment": "Malware payload (Heodo)", "value": "0a48efe1184849289edae3a571117a10cb7abcec", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883736, "uuid": "891dc283-d437-489b-9706-610224fc382d", "comment": "Malware payload (Heodo)", "value": "9f464658516e9a8cb006c37af8910a64635f8972d2972cedfc386dce738c0504ef989061ff019b5705ce7b72a92f2d32", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883736, "uuid": "dda7174a-c3f5-4061-b969-42bc7f556ad9", "value": "T1D1E36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883736, "uuid": "e37929ec-efd9-40c0-99c7-2048e6da642d", "value": "3072:DcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0W:DcKoSsxzNDZLDZjlbR868O8KlVH3dehM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883736, "uuid": "889b2f2c-300d-4e77-be60-75eacb8a9618", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883736, "uuid": "bcb868da-7420-4a71-b9f3-d53ff6c60a30", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883736, "uuid": "6793a2ec-dfbd-449c-9f5a-8e6ca4d39390", "value": "2022-02-03-79b8f1929e19d6d752576cc0e43b0516_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c6b91136-8514-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643908482, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908482, "uuid": "b92ec4fb-0ed9-4bd0-9e35-47adc08f0408", "comment": "Malware payload (Heodo)", "value": "98debcfc5ad46568362b2cb5af5d03bf", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908482, "uuid": "4d05a68b-19a3-489f-a8b2-de043f037682", "comment": "Malware payload (Heodo)", "value": "192ff16e0813712cc86f0b56cbd225e9894031297d81306189fa13e2b9ac9fa9", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908482, "uuid": "f4cf116f-dd01-4925-855f-70aede980c7a", "comment": "Malware payload (Heodo)", "value": "02939e828d009378a55eac9cdcb33d71dff2eabf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908482, "uuid": "d949c5b1-8dc1-4067-8e86-ad342dee72c1", "comment": "Malware payload (Heodo)", "value": "d0a996005de4ebe56aed6d250cb73b4e922281d12ff0a514c2a5acc7b9ef97af93581ce2e9299def31af8a29ab942c40", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908482, "uuid": "d4c334e1-56aa-4583-92bc-924302668620", "value": "T13E25BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908482, "uuid": "c6d0834f-afc3-49c8-93ef-f86d33b0f3ba", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908482, "uuid": "e8b05bd4-6fcd-48af-9b85-110c19c8f27b", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gZFIIm2mlg:kBiaa4powXiolDS2gZFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643908482, "uuid": "c6853e67-2dbd-4206-9f16-df483bb6e5d7", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643908482, "uuid": "82224d0d-7ccf-46e4-bf8b-43da9c4a5dc2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908482, "uuid": "625084bb-e6a3-40a2-950a-e932fb97743e", "value": "98debcfc5ad46568362b2cb5af5d03bf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43260356-84fa-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643897094, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897094, "uuid": "380c5878-226b-481d-9a06-bf74d874655e", "comment": "Malware payload (AgentTesla)", "value": "ec1288d4dc2c0d418d2deb5e5b509ff3", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897094, "uuid": "d5e4db35-f6a5-4d82-8eb8-3ff9727c7929", "comment": "Malware payload (AgentTesla)", "value": "193aab662f6d35d2722fd836cd52c11c1c0ed5628189ac2533d53e899091ae74", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897094, "uuid": "e67539c2-2876-4aff-a83a-1f3ef049a21c", "comment": "Malware payload (AgentTesla)", "value": "1000a4606d57fbec1945b0ede405db128774d439", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897094, "uuid": "37445972-1a4d-4708-8247-57c1a15f89c9", "comment": "Malware payload (AgentTesla)", "value": "e5c3132ca5c80c6a7fcfa1f7b43099d64982fdc50b1f0155dccffd4cb01203029bba2dc2f267224ddd7384f40c288ea8", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897094, "uuid": "375fdb57-3b84-4ba1-88e4-90586962ff6c", "value": "T162D4D07AFB4BC991D056153211FFB81103B23EDB9DD3D6063B58B3084FB26564E8A64B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897094, "uuid": "6739d2d0-ef94-4b57-ba64-6e0fc904093d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897094, "uuid": "90274b17-0144-4bd9-b3af-38c485cde2ca", "value": "12288:UpZJNbZuYxZloOmm7RzcPvKiDcJA4vuAp7D8A+LC4ePJ:aZJNbO2RCSOcJPpn/J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643897094, "uuid": "46f23359-36de-45d8-86af-93526b494520", "value": 634880, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643897094, "uuid": "e921540b-20cf-498e-8137-e16fb9b5aa3f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897094, "uuid": "66b78b74-4fc3-4605-83fc-63dcbb289a21", "value": "EXTRACTO DE CUENTA.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "410d1ad4-8517-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643909546, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909546, "uuid": "e4e4efcc-cc9e-49e3-b5a7-efaa2f8b29a3", "comment": "Malware payload", "value": "1c07732f23403ec89f868220840dc8d7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909546, "uuid": "b87c0529-4b5a-4c88-8d9f-89bf7efc54ed", "comment": "Malware payload", "value": "197bfdde30ea374ec69928861553cb13d7aaaecc0fc3c62528afba6afb125d38", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909546, "uuid": "9d01712c-fd7a-44f2-a989-110032550f46", "comment": "Malware payload", "value": "ddb883508532c12f3e6b9fac3669975758be8318", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909546, "uuid": "35338cb6-8a12-4b0c-b8f6-f86c024d833b", "comment": "Malware payload", "value": "b0ada8acfe0106af67b9d44bdee0ceae3c2886e32be4153b5e682d3c187978fb6ceda1f2ae6e10492fafeb9ea5ecc728", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909546, "uuid": "247e89e6-bd94-4142-a8db-a10384cb07eb", "value": "T133E36B25B2C5F996D71436311FDEC6EE3227BC838E7543833249F71E6D7A6908A62306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909546, "uuid": "7c108612-6210-4fea-a34b-36342eed069a", "value": "3072:qcKoSsxzNDZLDZjlbR868O8KlVH3jehvMqAPjxO5xyZUE5V5xtezEVg8/dgL4LcO:qcKoSsxzNDZLDZjlbR868O8KlVH3jehM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643909546, "uuid": "57993809-9789-4513-bbbb-a42e365b2c38", "value": 148444, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643909546, "uuid": "b5ea410f-18b4-4bdf-9b77-24a3573e886e", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909546, "uuid": "33153dba-5613-429d-9772-fea7c3c4871e", "value": "tmp6j86p6b3", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e172000-8486-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643847291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847291, "uuid": "9901135f-2545-45fe-bc8b-eced9b40e2a8", "comment": "Malware payload (Heodo)", "value": "f6ed90a1f56b346916faeaaff04594d4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847291, "uuid": "2fc16dc1-1929-4b7c-9446-fb882811084d", "comment": "Malware payload (Heodo)", "value": "19a6daa42b60af6e6d96c557ea31f54f6026b24d8869d198ad289d33c363d81a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847291, "uuid": "789fe14e-61be-4a94-ad45-9c136f44d782", "comment": "Malware payload (Heodo)", "value": "a6dd0eb58e79b69f9f84c704fc2b59b73dc3a672", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847291, "uuid": "66faf0e3-49ad-4518-ae0c-ec48f9f732ed", "comment": "Malware payload (Heodo)", "value": "cb8989f16b34e84204dad3869d0560954b372438c44e5ab2eed8ca12d9967fa2c7e4dbe4c63af96636cff3481df71a3f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847291, "uuid": "f7f9ed87-552f-4060-9af3-5116013d3e66", "value": "T1C9E37B2576C5D9CADB0822350ACACAEE3327BC479E7643C37158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847291, "uuid": "1d8b001e-3c53-47be-af3c-174e5abddd1d", "value": "3072:BcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0L:BcKoSsxzNDZLDZjlbR868O8KlVH3dehx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643847291, "uuid": "da325a71-84cb-49f7-ae0e-871f6da2cbeb", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643847291, "uuid": "85aaa6f8-2f9b-4978-b81e-ab588c3f6c28", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847291, "uuid": "e76160ea-aad8-45c2-befd-02b4c71d61be", "value": "2022-2-3-f6ed90a1f56b346916faeaaff04594d4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0ee33ad-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855671, "uuid": "d6577a44-d69a-49d3-b8b3-ecf0dad9426c", "comment": "Malware payload (SilentBuilder)", "value": "3d7f113edb1a138839dd9faf9f882919", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855671, "uuid": "6d434a39-bdc4-4f12-9587-52c7ebd3ce2f", "comment": "Malware payload (SilentBuilder)", "value": "19e00f7e7a24d52c2870260575a5df9a6e23f0c2813b12c6e91c6abdfcbcb283", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855671, "uuid": "9793436b-2c7d-4895-9406-2dc5160a9582", "comment": "Malware payload (SilentBuilder)", "value": "580211eef88f37996bbd84e996a18109e67fc8c2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855671, "uuid": "314e8002-62a9-40ba-bb2f-9fdb390ebd6f", "comment": "Malware payload (SilentBuilder)", "value": "440ea42e7df942fda025589ee152666639d23a8333eae8fb0ad5cc06008f495c2f6082d851e61758b5715214ba509ee1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855671, "uuid": "61bd6e59-b4f2-4996-aaa1-acb0b4794794", "value": "T1EFA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855671, "uuid": "f61297b8-708c-4ac4-8c0a-0a4a52e7a188", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4Z4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855671, "uuid": "5b4fd6f6-a846-4798-994a-7bc0105a05cb", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855671, "uuid": "793d8eb4-433a-42b3-a746-83d661398be0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855671, "uuid": "351e97cb-8c23-4895-80c6-305bcd515912", "value": "2022-02-03-3d7f113edb1a138839dd9faf9f882919_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13642765-84c7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643875110, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875110, "uuid": "8e84aee8-5a4f-4680-b929-9af633bf552e", "comment": "Malware payload (AgentTesla)", "value": "0745767293956ba51033b66ef17416c7", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875110, "uuid": "a15b9610-af6f-4ddf-b3fa-43f8cd1703c5", "comment": "Malware payload (AgentTesla)", "value": "19ea70b85d1e0c5c9c9ebb1f2412ee14b363da45f5ba68f7f8ea217fe6dcb975", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875110, "uuid": "36fc0c7b-f4e2-41e3-b0b2-826d0bbd090d", "comment": "Malware payload (AgentTesla)", "value": "94047f5eceea355cde7b817881fad487c68a62f8", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875110, "uuid": "7f3bf507-7fa7-40ec-8319-3a31cb343c8f", "comment": "Malware payload (AgentTesla)", "value": "67e28c09166f55d66e0ac2848cdd673d3500b637ab064facec06abf59d183a250803ff2cf8c2dd1cccacd955c2939d58", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875110, "uuid": "5714f533-39bc-420c-a75d-812b98b32c45", "value": "T1B6C4F1B1F69A9581E52B9A3222757C41023A3EE39EC5DB191328F2480FF77504F66B4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875110, "uuid": "4b48347e-55a1-43d9-acd2-ac182755904d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875110, "uuid": "06b7218f-53d3-4491-8d51-a016e46d25d1", "value": "12288:iF7p3BQJFhwBnccBMYZ/SrH+kTIfZF8T/oOQevY7QLrJ:uQJFC0YZ6D+RFxOFY76J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875110, "uuid": "0221a03f-e096-4079-ac02-f5e623f60572", "value": 596480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875110, "uuid": "82cb840e-5cb6-4107-93b8-289a69dc5a1a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875110, "uuid": "cafa4efc-e288-4d1c-84ca-e99838d71c42", "value": "BL-018907-DKAEQU7EMEZSG1O-0972-PDF.EXE", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38ba793-84d6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643881794, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643881794, "uuid": "f8dda8a0-dc74-4b6b-8cca-a8b9bb1b8faa", "comment": "Malware payload (AgentTesla)", "value": "84584cb8b2e46a0de11d4a084d68e910", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643881794, "uuid": "444b6e46-007d-4161-b00a-2c3384c7f75c", "comment": "Malware payload (AgentTesla)", "value": "19f3591a7e0a37694777c6e3a6a2d48b71c409c223d2168fcf7cddb6b77a8b49", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643881794, "uuid": "7aa889ef-7a66-4242-94eb-1b9d9d58513d", "comment": "Malware payload (AgentTesla)", "value": "f78dba48c61f15486998b76841751b0d7d464c64", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643881794, "uuid": "aba8d69b-1265-4e48-9a93-2be0ae181be8", "comment": "Malware payload (AgentTesla)", "value": "918e03cbe4462f4d13cc439bed82d6368264fbf2b1dc4eadeec20dba7aca20b5c640576fc15cf89f064745f0dfb5eef7", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643881794, "uuid": "749885f5-e23a-4862-a5fd-bf6c478c97d6", "value": "T127F47A39F78ACD48C43686F601BAF7500F617D9E59D29ACD2BC973C80A72ED61A4C41B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643881794, "uuid": "cd5347ee-d6f3-4fdf-9036-620bf3174533", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643881794, "uuid": "165e20aa-38c8-47ad-8e23-ffa9c35e6d47", "value": "12288:Nl+m2uJrf2SzBOLTh8DMMnGO8WfJmSRZtRCO5UF6XqAWKEj:L+LuJrusYaDMIZVrhRC/F66AWKE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643881794, "uuid": "690acbf9-b657-4a1f-8f7e-b9404520ed28", "value": 764416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643881794, "uuid": "14b41c16-8aa2-4354-aae3-0ab42cbecfdb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643881794, "uuid": "d5d69fb3-bef1-4c5b-8a4a-69ef57178576", "value": "original shipping documents.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "83ee2030-84d1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643879593, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879593, "uuid": "967ad464-c46b-4046-8757-bd78fefd6d38", "comment": "Malware payload (Heodo)", "value": "212bd53aea04e02c1f81c0741a044aa3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879593, "uuid": "d21ff83a-0575-4f95-b09f-1d34e19626e2", "comment": "Malware payload (Heodo)", "value": "19fd6a6548f827f1c68bf66b11e2a2ccea01b7689cad63e5ab98412e5b1e7330", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879593, "uuid": "b3e77bdd-7a6d-4cd8-9751-e2b9fc0e475b", "comment": "Malware payload (Heodo)", "value": "164c8883aa06106022db57446371278e2163b73a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879593, "uuid": "d9005cbd-29e7-42d2-9b05-fa288380614a", "comment": "Malware payload (Heodo)", "value": "e0ac4d58f27bf46c0c81109495cf0d463866f677bd0a6dc8d63537cb6ecd0659ce68eeee8c8690a5da9cb87d312b625b", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879593, "uuid": "b30e19e7-4f35-4474-9e7d-cb4a4031bd77", "value": "T126B49D902E4A41E9FA03396A017651938FDCAD051BE0EDCFCF49F9135F26DC1A6398AD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879593, "uuid": "908cf034-e972-4123-8dce-40a8f3a30b03", "value": "12288:ktXWAhkIVeXZPyWk44/dL8idTExIO8/powdAtCiU6+jgQFlb:ktXfiIeQV8iFExIB/powWtCi3+0alb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643879593, "uuid": "0ecd1735-f9df-4ed3-886a-557c746f282e", "value": 508045, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643879593, "uuid": "7db6ea5b-d1ce-47c5-ab1d-b67b9156edf8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879593, "uuid": "bc269d5f-1c64-4cfa-a917-561bb2ab32e1", "value": "emotet_exe_e5_19fd6a6548f827f1c68bf66b11e2a2ccea01b7689cad63e5ab98412e5b1e7330_2022-02-03__091307.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d194438-8510-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643906560, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906560, "uuid": "372102af-b54c-4a8c-957a-a9580d77a6d2", "comment": "Malware payload", "value": "97591eb301f8419c63dc44c77349174a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906560, "uuid": "8e287659-9918-44c0-9ad5-b5ca726af2dd", "comment": "Malware payload", "value": "1a1b7f1832dfd1cc5fecac973821b4b179bb426b5d21c47343d516f0e4600165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906560, "uuid": "89fbbe7c-6056-4ee8-aac2-c96f1d8e7f65", "comment": "Malware payload", "value": "18dfece438df8f91eaf968a13c7161e0fae2df57", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906560, "uuid": "0f35dccd-f4f3-40fe-9f98-e1e92d3bf623", "comment": "Malware payload", "value": "37694afa316062c3593e5a7b632b1d019172cc010792e27bada38a258f02e57c1a7fc5a269bbb85b5e3cd6e992e281f7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906560, "uuid": "32de2b2d-1cc1-4e24-8b5c-8e9148da8196", "value": "T16035AE17B35841B8D5ABE1B8C6874A06EAB178065331AB8F17E4977A2F277705B3F310", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906560, "uuid": "ce57c88f-7b86-46e1-97c0-d3d17446d081", "value": "5ecf0afdd053c0a1fd0eeefb706867db", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906560, "uuid": "beff89ed-e6e9-49c4-807b-f023d99b6e33", "value": "24576:uSC7R+tv2+9A2EeRF7PtdlufjLgQExynTmwXK9YWC:j08xTHI9nTC9C", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643906560, "uuid": "7e3d9ca3-77b6-40bb-8c1f-143eea452c50", "value": 1061376, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643906560, "uuid": "00437161-6393-45d2-b6eb-65e7abf3c44f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906560, "uuid": "aad52aab-32c1-4baf-903f-8fff708cb1ae", "value": "1a1b7f1832dfd1cc5fecac973821b4b179bb426b5d21c47343d516f0e4600165", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90711541-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855992, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855992, "uuid": "bb943de8-f35a-4aef-bc79-98dc8d771cff", "comment": "Malware payload (Heodo)", "value": "c24bc961b89a66ff58ef39d356f4830d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855992, "uuid": "bcb34a80-1a80-4bab-8fb2-08da1239dd4f", "comment": "Malware payload (Heodo)", "value": "1a6048bfbec37a92bd3605a5ff16f17924177abbc629bdc9499be3a46cf3d7c1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855992, "uuid": "341ef0c4-f85d-4032-964c-99e5bc437246", "comment": "Malware payload (Heodo)", "value": "fef3328f5c8427310312ab2f92aa11348e1192c0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855992, "uuid": "e9352758-89f0-49bb-bac2-c497f11e36fe", "comment": "Malware payload (Heodo)", "value": "ee108f3cd947e4a0fe06566e75c972c61962a85b0808f69be690595f927b809d03ab25f0217cc9d166cf5b24286e435b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855992, "uuid": "921884f3-353d-4529-8277-07a9e4a4be23", "value": "T152E36B2576C5D9CADB0822350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855992, "uuid": "0c6e1df3-eaa5-42ae-b627-dccebd57bf6e", "value": "3072:fcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0N:fcKoSsxzNDZLDZjlbR868O8KlVH3dehP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855992, "uuid": "58892c16-3daa-4182-b732-3bccc4734c98", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855992, "uuid": "2ad09451-7771-4faf-a6ed-4c75cf8eeb8d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855992, "uuid": "91d7dcc3-2e9b-4529-9dff-297c73e86b52", "value": "2022-02-03-c24bc961b89a66ff58ef39d356f4830d_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b04a3a55-84fe-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1643898995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898995, "uuid": "5e5346a6-4f96-4489-b793-ca70cf61a749", "comment": "Malware payload (AveMariaRAT)", "value": "c5386da1d112dff14be7ad616d2afc5f", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898995, "uuid": "2f9a2924-68bb-4320-b668-b3f9bf07f26f", "comment": "Malware payload (AveMariaRAT)", "value": "1a8433f8cbe705c0e316283170eab4a770a099ba74119bb6377bc47bfcc0a57b", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898995, "uuid": "2b7da20b-1678-43c4-91fc-647f79d14dd6", "comment": "Malware payload (AveMariaRAT)", "value": "f08ac9c5b41690e9cd90d3609b69fe1c94183da6", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898995, "uuid": "3eb86c31-cf5b-4617-961b-489c5552b387", "comment": "Malware payload (AveMariaRAT)", "value": "c77529de691233c36761c6f5968e3a38026679296fe561c4896149a9ea40070e0a49a76df287fcbe1a60fd03d9a90af0", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898995, "uuid": "354c7613-c57c-41fb-93f3-556f56b48964", "value": "T153B4BF7AB68BCE91D015503221FFB45103B23EDB5AD3D6062B58B3480FB36664F9A58F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898995, "uuid": "c7aad73c-9a0c-4a97-a292-a4a1d741b69a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898995, "uuid": "d582b5ec-6039-455a-a727-6727045eac06", "value": "12288:r1oOdyGJ7/JNqX2f4whYbo29jBYyT9yp+EJ:3gGJ7/7qGf4iao2lBNhyUEJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898995, "uuid": "ee021121-05a7-47d8-ab20-b289bafed5e5", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898995, "uuid": "e344787b-4bbc-492c-9e03-74444b3ff4ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898995, "uuid": "3f276d2a-6490-433e-bbd0-3e5bf65a6ee8", "value": "Yeni sipari\u015f _WJO-010222. pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c0f9cf8-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883499, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883499, "uuid": "d5beea22-abcf-4e27-be12-365a5174cb0f", "comment": "Malware payload (Heodo)", "value": "4b1428691c659dc068f52c7af63a3c41", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883499, "uuid": "8986ad1f-18b3-494d-89d7-16ab72315b88", "comment": "Malware payload (Heodo)", "value": "1ac1e9854e09e88d940c2904b8980aa895d03001cfbe64ebc82abd7e2aaf914d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883499, "uuid": "950165f3-3c98-4980-b6c5-1ed8f85bd5e7", "comment": "Malware payload (Heodo)", "value": "1eb2fc0df021c8caa29cb563088264dee1c8c6db", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883499, "uuid": "e21d5aa2-39a5-4fb7-ab4e-5e373c5231c9", "comment": "Malware payload (Heodo)", "value": "56d21830c732d44babdb45681a776dfdbc136aa79f3f804337176298b56ad2cbf4a4b716fdbe75c5e7460c557149e6f6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883499, "uuid": "210e8506-5a13-4c55-80e3-680513ac9589", "value": "T1E5E36B2576C5D9C6DB0922350ADACAEE3327BC479E7643C33158F30E2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883499, "uuid": "4e40c8de-698c-4386-9f2f-77b6ff8cb43d", "value": "3072:QcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0Z:QcKoSsxzNDZLDZjlbR868O8KlVH3dehn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883499, "uuid": "4faf3dbc-2633-4b02-96ea-2b51765848fd", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883499, "uuid": "67200b8e-edac-4a66-bc7a-ad5f48acb51b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883499, "uuid": "116c28b9-96ae-4bfc-ab89-0eb2c56595de", "value": "2022-02-03-4b1428691c659dc068f52c7af63a3c41_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087c3c16-8525-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643915464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915464, "uuid": "6db94b72-1302-4bd2-a733-7f5831cbc460", "comment": "Malware payload (Heodo)", "value": "9715e85a5d4cdd573afd735beb0ffebf", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915464, "uuid": "ebd23e48-8cb8-4cb0-94e8-2863e5f5cda6", "comment": "Malware payload (Heodo)", "value": "1b14125087843db374622a2a5884c5c38b8e422113862559c3783090f8183ee2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915464, "uuid": "7f654d54-4a37-406b-860e-ef29bb050f87", "comment": "Malware payload (Heodo)", "value": "499692fa16c8de090fc667c9409bb9487f46098c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915464, "uuid": "39f8f1d0-b815-4c10-97f6-61fad6c3e5fd", "comment": "Malware payload (Heodo)", "value": "26a8d4d967dde10dcf5aed6da4537b776ad4dd3c4ca516581440e0ddba37f065ef247ba0f37bf17e84d997c60e209ab0", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915464, "uuid": "61656f5c-8250-4d12-9599-ab1aa87ee88e", "value": "T1EA25CF11AE4980A1F50B293D1469A7A60FDCAD021BD0ECDFDF44F9A36F12CD3957886B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915464, "uuid": "f1a3f4b1-6846-4cde-abd9-7dca91776b54", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915464, "uuid": "02310897-d7cd-4bd3-85fe-6364a557ef6c", "value": "24576:SCiv47/YUr3bti5wcjbnZeZfxan8hX1HlyOwLVttCAUXiEFIIm2mB:SCjYwLtMvgZfxailRFIr2mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643915464, "uuid": "3c553588-c2b3-4a45-8204-c6daa4dde41a", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643915464, "uuid": "47e37491-eebc-4200-880c-5533feab31f7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915464, "uuid": "704c843a-e074-47c5-8287-691a2eae5243", "value": "emotet_exe_e4_1b14125087843db374622a2a5884c5c38b8e422113862559c3783090f8183ee2_2022-02-03__191058.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c9470139-84fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643898608, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898608, "uuid": "d233084c-16ac-4f92-921a-34580ffa0307", "comment": "Malware payload", "value": "acaf8014dacc2e49d5180b1574dba7af", "object_relation": "md5", "Tag": [ { "name": "colibri", "colour": "#15DE12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898608, "uuid": "dd68c5e1-9ade-4a7a-b2aa-320661667290", "comment": "Malware payload", "value": "1b2eaff481b083525a42635e86bbeb6ca0e7c1c9c3d880ba29754b9a2277b962", "object_relation": "sha256", "Tag": [ { "name": "colibri", "colour": "#15DE12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898608, "uuid": "73271e19-c6e0-49b2-b834-1d766927fcf9", "comment": "Malware payload", "value": "be6ca826d012944c664918e8981c063f5a1c968a", "object_relation": "sha1", "Tag": [ { "name": "colibri", "colour": "#15DE12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898608, "uuid": "d9278548-3845-44c8-9152-9961502fada4", "comment": "Malware payload", "value": "c4eddde4752a83c7fc6ea2495b96acd6e01d657cd3db00a6aad53133ad86ce5b7638e1bf05d72f8ebee5e0c9612c4258", "object_relation": "sha3-384", "Tag": [ { "name": "colibri", "colour": "#15DE12", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loader", "colour": "#BFC5AA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898608, "uuid": "d989f117-166b-45e1-af05-380dab58ef30", "value": "T178B20913BAC4517AD16102744F9B5BA7B03BAF2303776C5AE3C36B9358137866E3A48D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898608, "uuid": "3b6a7035-edb2-4afa-9f54-4b986b9d90cd", "value": "384:UdZpkkgd1qAA6jdo6om4Te1RDZPrSTqJ5CEYcsaR8/2q8ask:cZOkaIAA6BaBTy/jnLZY3aOkq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898608, "uuid": "1bf94e43-cec6-41d0-8842-d7744537c2c1", "value": 24576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898608, "uuid": "e3981bf9-d92a-44ce-b1ea-f77bd622f7f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898608, "uuid": "c5564867-0540-419c-a761-ca9c110d3f99", "value": "cunp.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcaf6647-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910290, "uuid": "5cf290f2-99fb-4ce9-93f3-87aff60e0d36", "comment": "Malware payload (Heodo)", "value": "1962b083aa1b932a5d1ad3580fa1a95e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910290, "uuid": "130e3438-0b77-46f3-a73f-731d2207100c", "comment": "Malware payload (Heodo)", "value": "1b34273b7ab1846f63c0dd4f96c9260f84febd454b18b01671bc027abcdd181b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910290, "uuid": "8e0cc7ed-b87a-430f-96a2-9db750b7c019", "comment": "Malware payload (Heodo)", "value": "f4cb35423721e8a46e8e0ce334e93d45615a6915", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910290, "uuid": "222711ab-4cbf-4802-9ec1-ca25e3a010cd", "comment": "Malware payload (Heodo)", "value": "83751276effac0cb7f1464fcb6ade331227fe864896a7e005532eba946300872824b4eb2e7e3c01784a238c27df22dd6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910290, "uuid": "033d0ad7-c19f-4fee-b7ab-e8d8556d46e1", "value": "T14E64E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910290, "uuid": "0a299371-497a-4f16-a8bd-5785c0657c0b", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910290, "uuid": "583761f9-5be5-4b7d-bea9-6e734e32daec", "value": "6144:83DvZRFTFbksYyljaMYDM5T7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMYYLAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910290, "uuid": "0468cf36-c516-4417-a44a-faf8f736b756", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910290, "uuid": "b7f8c8d7-c4dd-49ef-b23a-1ff5225a1dc5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910290, "uuid": "32047310-1805-4683-994f-4c961bbbac45", "value": "emotet_exe_e5_1b34273b7ab1846f63c0dd4f96c9260f84febd454b18b01671bc027abcdd181b_2022-02-03__174435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cfe3ae13-84e5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643888311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643888311, "uuid": "7ad5f976-5d2c-40be-8f94-bb8ad47be2af", "comment": "Malware payload (Heodo)", "value": "d4bc3501af03c0dd9db455190dbf1f77", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643888311, "uuid": "9c100bc2-385c-4323-81b9-a2136542c2d4", "comment": "Malware payload (Heodo)", "value": "1b41d0f51761ed9194d29e28a2c45c064f0ab491a4f7006c17cc8e203b9b1fd5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643888311, "uuid": "39c15c80-5d42-4ac8-a134-c8cd20a1733d", "comment": "Malware payload (Heodo)", "value": "56de18961d5e39c6ab51d025542c02113f45bb0e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643888311, "uuid": "249f2524-fbe4-4e12-93a0-478e6b6d27c1", "comment": "Malware payload (Heodo)", "value": "2b8047fe50a076da06063a23b4d8a26b4977aaddb3aa0e90ec70541380518d25b80b323dbc96d976e57b1ddc81150f6c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643888311, "uuid": "0c1f1785-0c1e-4c27-bff5-0716b38ef909", "value": "T19B25BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643888311, "uuid": "e919d6cb-8594-4e7c-9841-eeefd6f48841", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643888311, "uuid": "f2d4cff6-d929-40bd-b0b0-4bd55aeda6b6", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2ghFIIm2mlg:kBiaa4powXiolDS2ghFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643888311, "uuid": "e0448a46-1319-475c-8a0e-4e4c7519e160", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643888311, "uuid": "8a313efd-742f-4b96-9d62-7c741af5f541", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643888311, "uuid": "3db6261a-6a88-42d2-aeb2-ad219d63ccd8", "value": "d4bc3501af03c0dd9db455190dbf1f77", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00fe6927-84fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643898271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898271, "uuid": "12bb0a39-e937-4e46-8b9c-118c295c972f", "comment": "Malware payload", "value": "48c4b96260921a851ced7fa952ce331c", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898271, "uuid": "9a9cce71-21e8-4ca9-bd28-a6a214acba53", "comment": "Malware payload", "value": "1b511bc8b03e058cdb7b487abb22c09daf2f2ad75f80c87ac7819d520207eef9", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898271, "uuid": "58d5092a-bb99-4f0f-84eb-ecaacf157c37", "comment": "Malware payload", "value": "268d31dd2b1c0b8b9a35a650642ca7185ffcc2c3", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898271, "uuid": "2c87bc29-43a4-49e8-b687-6b4e7c26809e", "comment": "Malware payload", "value": "e3cf8f2ff8b6f3b058feb477aa8d48ff0cd32ea0dd7b4dc68192f1ecfb3a84f3aef949bef35574214f36b002d982282f", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898271, "uuid": "b9286018-fd55-4c88-89a3-0d809d6cd402", "value": "T1DA1412ACB3A92708FEE837BED234BA1F0019DD85667C515E713936849B713C148EE136", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898271, "uuid": "a0bd6d2a-0825-4d7b-ac51-5fec678ba47f", "value": "3072:K2rLgIMGYkhUAMKwed8KKPp5r/Sw3MluLWgM6LyPZ/+KeKb4uosx4DwwN:Xr8IMbtAplApB7cQTDK0KUsajN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898271, "uuid": "b7b280eb-f2a2-44a9-862a-0397b6da27c2", "value": 191800, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898271, "uuid": "4563eccf-b08e-4f8e-abb1-4dcc1852dd03", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898271, "uuid": "ad00ffae-c8da-4837-9b85-52594b5dc1b3", "value": "PO_20220203_Thailand.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2b4c1f9f-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855822, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855822, "uuid": "9004ff67-5e99-4fed-822c-3c8e1f7e23f6", "comment": "Malware payload (Heodo)", "value": "955637535e7788a168b879e8b84e1acc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855822, "uuid": "58546f52-210f-4488-8ff9-f66ee879d7e8", "comment": "Malware payload (Heodo)", "value": "1b720f153a94f92d33f3d0558f9430f2be306e6feee23cf35897940a09e1e6f2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855822, "uuid": "10905b5f-5f97-42ef-a116-0eaeaea1bf74", "comment": "Malware payload (Heodo)", "value": "40867d0b293f6a31e085614da805324b671da30a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855822, "uuid": "60b125ab-c71d-4eb5-a2d5-14344d9a67ab", "comment": "Malware payload (Heodo)", "value": "4ae369e08599d19e15195294e2276312fb856448cd8dff60e18674c003d41c852e8fe78f599670742a5f2a2204891b89", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855822, "uuid": "dbd81760-ab82-4390-96a2-b67d02724e8e", "value": "T12CE36B2576C5D9CADB0822350ADACAEE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855822, "uuid": "f717e692-6938-4e49-8f53-08558f1059bd", "value": "3072:4cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0h:4cKoSsxzNDZLDZjlbR868O8KlVH3deh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855822, "uuid": "8521f60f-a6b8-4728-bdf9-2e9678422668", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855822, "uuid": "1fd3b6c7-7607-44c1-8cee-a5cdffa3c954", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855822, "uuid": "9093a1be-e06e-4f11-a870-7f18b461d78d", "value": "2022-02-03-955637535e7788a168b879e8b84e1acc_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "776485cd-8536-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643922951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922951, "uuid": "fd0286c7-2285-4aa7-b01b-372d3579d73b", "comment": "Malware payload (Heodo)", "value": "eb105ed0ec344bb0c1e52ae56ae2f035", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922951, "uuid": "79f14b15-04ed-4aaa-8704-3d5c04739137", "comment": "Malware payload (Heodo)", "value": "1b8426e13f029a31b9a5ee00bf0af7e5df05153741a2e52b7119d7081bdfbd8d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922951, "uuid": "590fa860-3b29-42ff-8f16-e0720e566e5a", "comment": "Malware payload (Heodo)", "value": "76cdd84f2da1024e2d3a7c7112e99817b5d957cf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922951, "uuid": "dbc23346-2593-45cc-8a98-548070a42634", "comment": "Malware payload (Heodo)", "value": "7817d9f17fe5abae3ddab5a8972e013805fae1834da3cd8bbcd5c1900c8b140354f673173a2feed7499b033d2566eefb", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922951, "uuid": "2787a01e-9a35-4074-959a-5b8da023fbe1", "value": "T18325CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922951, "uuid": "3b5946d2-5bd5-425e-adea-5efd1782d35b", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922951, "uuid": "8114124a-abc4-4a52-8bb7-39643151a6f8", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyP+FIIm2mHv:exyq2kpWGWRCLWeNWO1tyGFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643922951, "uuid": "f38b23d7-ec39-44ff-9bc5-7a131c62d04b", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643922951, "uuid": "e936c439-8d85-4a55-bd11-30ce71c405c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922951, "uuid": "2dcd770a-2913-4c65-ab04-597981b80e55", "value": "emotet_exe_e5_1b8426e13f029a31b9a5ee00bf0af7e5df05153741a2e52b7119d7081bdfbd8d_2022-02-03__211536.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fe2a812-850b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904551, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904551, "uuid": "84b13f54-25c0-4a3b-b581-f44d207b194f", "comment": "Malware payload (Heodo)", "value": "8a6c6cd52ec2b60f9fd4a0e6b3127619", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904551, "uuid": "94b3cd34-4992-4e2a-a438-d104fa685824", "comment": "Malware payload (Heodo)", "value": "1b93c4506fed1435f553d18ac96b9440103442e87b963ed78a1ee34aea9d669c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904551, "uuid": "28fdd410-e935-4734-86d2-868c7ab263fc", "comment": "Malware payload (Heodo)", "value": "a7ce1bb1292609537a693b286d7b2b5a70a18edb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904551, "uuid": "c1454564-5fbd-47bb-9ec4-97636bc16ccc", "comment": "Malware payload (Heodo)", "value": "53085eb92581be39832a7a7400b01c0f496e8e8311a325114a40f851b1b5e071b6d11c8c030a04072c3a2326c0890a2d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904551, "uuid": "4bf9ae8f-fe19-4857-ae98-1f88680e663a", "value": "T1D1E39D26B685C95AD91407351DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904551, "uuid": "56c300b8-e2b5-44e2-84f3-7bba65724606", "value": "3072:jicKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lz:jicKoSsxzNDZLDZjlbR868O8KlVH3Uey", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904551, "uuid": "6790b438-3f66-41ae-978f-dca985f20b2b", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904551, "uuid": "721a34cb-08a2-414b-a9be-2de15e54086b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904551, "uuid": "21ef65fb-39e8-4730-a092-9d2da9d86b94", "value": "tmpt5665f7z", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "746e7f0e-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856374, "uuid": "25c62d42-092d-4c17-871c-54dbe4e678d7", "comment": "Malware payload (SilentBuilder)", "value": "aed5ec17a46c8b991b14f9edc7290158", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856374, "uuid": "e32427b4-255a-4bf7-b48f-bc40d69a9156", "comment": "Malware payload (SilentBuilder)", "value": "1bb4e713ebb4d4f9b96e272458c6c3f0c5824f352764718358b9325827c3993f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856374, "uuid": "72ceb20b-46f5-4010-a4d1-3fc5246e077c", "comment": "Malware payload (SilentBuilder)", "value": "d1c676a467285b11a6c3a81b1ca8a3fa37ba48fa", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856374, "uuid": "b52ae5c5-5035-4271-b8e6-e6f79438bdb5", "comment": "Malware payload (SilentBuilder)", "value": "8607fc2a55fb473d67e86063eae27f126c7a9281a672ea70d902c2889b0c17bf654a84b6d75d3cf3b4e8701300caa449", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856374, "uuid": "1fb66e35-b149-48a4-a31c-6b67f786dd7d", "value": "T12AA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856374, "uuid": "e1264266-24eb-4532-b5ce-e3fb85b6babd", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4t4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856374, "uuid": "3c6819c9-b378-4e6b-9bc5-6908fd3994c9", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856374, "uuid": "4c29430c-679a-42ac-a84a-b24aed7b397a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856374, "uuid": "8c4671d8-1f6a-4023-b28f-d20c8fae0eed", "value": "2022-02-03-aed5ec17a46c8b991b14f9edc7290158_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb0be4ef-8530-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643920488, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643920488, "uuid": "c85b0145-24b2-480b-ba31-f28a1a557dd9", "comment": "Malware payload (Mirai)", "value": "3e91fcac1fdf716522a7166e6768c020", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643920488, "uuid": "8e7d4f33-2f1e-42e7-a4a7-dc889a604e89", "comment": "Malware payload (Mirai)", "value": "1bc2b8f5054ba1aed8a39a81042f820a79b8de7d17b294010a761bb23482b4c4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643920488, "uuid": "9f12df68-669e-4566-a9f5-9eebc6491334", "comment": "Malware payload (Mirai)", "value": "c8f06ca62f956c381a150254f343e4d89b06c406", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643920488, "uuid": "243f240e-a53e-4507-baf9-42395d7468c9", "comment": "Malware payload (Mirai)", "value": "e9ca1d00c598cd53bf71b2768445a2e86b6f221028c31ad0979ae157d0a3f91648c0813f89e7ce828f857633b4507aa7", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "renesas", "colour": "#A6898B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643920488, "uuid": "a72bde5f-b10f-4316-bdc4-c9fb24d3ade1", "value": "T18F83AFB3C4A42DE0C1684138AAE58D391B13F10692276EF95959C7AE6407EFCF14E3F6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643920488, "uuid": "04abedfa-62a7-4e12-a46c-289b40cab480", "value": "1536:Zah/1YHzZLRwtK09pQ5YiMjzu74m9HvYDOK3oFWZCVpCVd9qYO:Z49YTRRZsO2i+KhvYDh3fCVp0K", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643920488, "uuid": "dd63a1f5-84e2-430b-aa16-3ad103871eaf", "value": 88644, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643920488, "uuid": "4d2e2534-5874-45e3-8b44-c42fe69de328", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643920488, "uuid": "9f4a7d04-bc06-4106-979f-08f54e9339e8", "value": "3e91fcac1fdf716522a7166e6768c020", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0ae0bc70-8529-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643917186, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643917186, "uuid": "1c78fc79-042e-4793-9d21-d8d64697634d", "comment": "Malware payload", "value": "59f479ba471d04a60f77b437f4db42bd", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643917186, "uuid": "05be07b6-341c-4a34-a3f0-e080e7f22272", "comment": "Malware payload", "value": "1be5b2ed3677b0b09106d0e346a9748159171322b935b5c57c6afbcac2295b7c", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643917186, "uuid": "5aec1810-5301-453b-8c86-abc4ca89cb9b", "comment": "Malware payload", "value": "50d4d0e861d83fba851d170d3a0861363f24ef49", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643917186, "uuid": "5372eabe-ad6e-4e25-a304-88b7454231a3", "comment": "Malware payload", "value": "a43b53b4b7d24b41917f3de9e8a299a41c03f876bbca1759e519432282192c679ff1f3d4728c123cbdd893676a90f1b7", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643917186, "uuid": "be98a425-5868-439b-bda9-34ae4656571d", "value": "T1CF41CB129E404792438B9F93162A2095F0CFCCD9B0D0A88FDA0CF9C26D523619BAAF31", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643917186, "uuid": "c8d067ff-5d9e-4199-a8c8-2e71ca3f58bb", "value": "48:a2c83/+txGHgTEGGNnYys8NmV5R53+V8F0sMcwx2AFEmxNcx4:ae3/+tAATGNnYd8NK+iFocy2nmxNcx4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643917186, "uuid": "3b2fa5f1-6c79-4232-87c7-46fcfd482beb", "value": 1974, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643917186, "uuid": "569af359-c847-4131-8fe4-e391758ca452", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643917186, "uuid": "1ffb3d50-28d0-41b4-add0-527c4b1b6dac", "value": "Electronic_payment_#152537368.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4614d839-84a6-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643861021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643861021, "uuid": "f5e6c784-fcdd-4346-943c-9493f0756386", "comment": "Malware payload", "value": "7704feb5a916e55b03880170aa8c1d24", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643861021, "uuid": "80bf4413-a810-4393-8fc3-f476a838439e", "comment": "Malware payload", "value": "1bff923f6c9ab4f663a07d8fdae3533fa8e9d5d9d5c0992a4948f105cae45e42", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643861021, "uuid": "8a3522b8-9abb-4ca7-9cd7-bfb027266082", "comment": "Malware payload", "value": "609cc353973d23e39fd7d9534dce5a3261fa3a42", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643861021, "uuid": "cd6182d4-5b1a-4257-a914-1f42e5966e60", "comment": "Malware payload", "value": "ed7c9696742dbfdd89303ad2930ce6a697c41328e74323e93ebe7ad957244fb144520aeabf0adafcd38de0e2a9d5d7b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643861021, "uuid": "ff7d9f2a-fc69-444d-a14c-a0a00e6deab1", "value": "T160749E622E0650DAB6432A2F055A90054FCCAA590BF9ECCFCF8AE6434F52CC957794FD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643861021, "uuid": "b8d1696e-ef96-4933-ac99-cf6716deeb88", "value": "6144:vyjLlGP8DxYryxDb08c/bvTkDzBO6B4C7CwFrfY4ucciBwgomwm+zCk6Jm:vyjUPuoylbMD7kfw27FFLRuglomwnzWs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643861021, "uuid": "11adae48-da22-4229-8d30-3006b8d7e779", "value": 360448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643861021, "uuid": "c29b3154-a550-4170-9cae-04d05cf4dd9f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643861021, "uuid": "b2f16d4b-dd4c-4206-b006-d503f3df9496", "value": "emotet_exe_e4_1bff923f6c9ab4f663a07d8fdae3533fa8e9d5d9d5c0992a4948f105cae45e42_2022-02-03__040337.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2bab7ae1-84c9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643876009, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876009, "uuid": "8e9cb59e-a636-4c67-bb6e-0b3f6d5e1b0e", "comment": "Malware payload", "value": "f1e087898d1367c6b9d92eb65af3b099", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876009, "uuid": "9fdf5c78-649b-4086-ac09-0034de743ec1", "comment": "Malware payload", "value": "1c08e2dc78dff63552391e74bfdde2816b7b5f80ee4f5d2e3bf85be7b3035d55", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876009, "uuid": "d3edffd4-ff8d-4d88-972d-6e257cfdd842", "comment": "Malware payload", "value": "2b3564fe9ae044a6a14ba8cad693651ea9681e52", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876009, "uuid": "1e288cb9-9306-41f8-b420-e0c36f8b0274", "comment": "Malware payload", "value": "79423050d708faa7674b2f8063a74a2505b0ce3a81cc8969c92fe76693d96155632d7f0655f805a25786dc5e49e35416", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876009, "uuid": "4f812fa9-9068-4a99-9d52-62f325dc90a5", "value": "T1A3F4232365DBC94EDDEF993776F1A12E402DAC39571BEC03E248B2234ABB7315127582", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876009, "uuid": "ebc21c44-7da7-4ae6-b00e-d41f5c1837d1", "value": "12288:v8gHH0Cv4pMFE0lyMHzvuK+rpQMKTD9c3GN/85mvZxnAZdfH8EUq:v8ID46FLMMHKKaBKv9Kw6dfl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643876009, "uuid": "a4650818-ad33-47cb-aad5-5c74f063ed18", "value": 724808, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643876009, "uuid": "1e0255f5-7155-41c1-9ff0-6ebb7bfcd8ec", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876009, "uuid": "2cbe098c-bf8b-48b6-b4e6-3664835f5880", "value": "220202_Rieter_Order_Intake_FY_2021.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b3045fc0-84fb-11ec-9275-42010a9c0029", "comment": "Malware payload (Lucifer)", "timestamp": 1643897711, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897711, "uuid": "6bed0261-eace-4ad3-b1c4-0830daae3f9a", "comment": "Malware payload (Lucifer)", "value": "824eda4348858071ffd12a133ddb4824", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897711, "uuid": "9cb60f5b-41ae-48ed-97b8-8cc49707679d", "comment": "Malware payload (Lucifer)", "value": "1c63d83084d84d9269e3ce164c2f28438eadf723d46372064fe509fb08f94c3c", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897711, "uuid": "21e7c10c-ce65-40d5-aa6e-33ee0bb5cbe4", "comment": "Malware payload (Lucifer)", "value": "985aba48c08d1fa1d65cf77db7ab608887fd11ab", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897711, "uuid": "b60cdf89-64c9-4707-9574-7c5123c1d7de", "comment": "Malware payload (Lucifer)", "value": "9a9743350146676ba879a309b43212eb7d55e98800e36f70d06aaac461e5f332c98b5fb6cc8828b8584cf355d5339307", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Lucifer", "colour": "#CD012E", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897711, "uuid": "b45a79b9-8946-4823-9587-62f3227f286e", "value": "T157252349D7EFA726C6BF87366966885013397E3D9F23CA0F058C5291106375C83E2E6B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897711, "uuid": "9c71ad22-38fe-4af1-bb53-4210a6229edb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897711, "uuid": "c80188d0-0060-4a83-a189-b4fa61f60e7d", "value": "24576:7prgdmnHNJUhOC6ujRnmWbYe9C4KSZbvZYx:9rRnTC6c8eOSZLWx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643897711, "uuid": "baeb36d6-2c4a-40a7-a1e5-07e493f0afd0", "value": 1034240, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643897711, "uuid": "a3700c47-e2d5-4436-8f81-5f9a089aaa60", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897711, "uuid": "9568c1fa-3bca-4344-976d-4d04f5fc9f74", "value": "hesaphareketi-01.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9d0b2cd3-84d1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643879635, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879635, "uuid": "58baecc9-06cd-4a3f-9fd6-8f54c91ff048", "comment": "Malware payload (Heodo)", "value": "13ce8f10c1d4031c4578dd4cdf878e32", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879635, "uuid": "e9e868d4-62df-4fc2-9fda-4f83061c0c41", "comment": "Malware payload (Heodo)", "value": "1c71dfb3b1149c5d829ed082098c92964eb928881cb5a459f4fee203340a6f68", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879635, "uuid": "90516951-a2da-4984-a16a-e3c70203513e", "comment": "Malware payload (Heodo)", "value": "97720451b640a7ef95e234f3fcde63b1737b9888", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879635, "uuid": "cb17fc13-f207-4ba5-9224-d23b854f82c1", "comment": "Malware payload (Heodo)", "value": "dc15e45d3e93ac6af1be0f4f639baf63192d628b66c58ec2578d3a545f656538075b204c56b64a276d9bd364ee06db68", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879635, "uuid": "e79ff0c9-4f93-458c-8d86-f37131bd8319", "value": "T1C825BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879635, "uuid": "a9c57cb4-1062-43de-a3a5-6f8bc92ee861", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879635, "uuid": "ab536743-10b0-47af-8324-ce7de6360193", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gTFIIm2mlg:kBiaa4powXiolDS2gTFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643879635, "uuid": "8c3d43d4-f300-4ff0-ac20-3325aeeab9a3", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643879635, "uuid": "d74a9983-2e09-4419-846a-90b9bc844dd4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879635, "uuid": "5e581491-7975-4e49-89c4-2d5fa5dc383a", "value": "13ce8f10c1d4031c4578dd4cdf878e32", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ffa870c-84c7-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643875184, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875184, "uuid": "d82470f7-ebc4-4b5e-a20e-42d265347827", "comment": "Malware payload (AgentTesla)", "value": "eb6a172979202b7f53d315e625d8113e", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875184, "uuid": "d8e8e091-5265-4ea5-90fb-afe22be9d6a4", "comment": "Malware payload (AgentTesla)", "value": "1c88e64fa65839e26939ab7701755252b7f24b8e65164dd88acae735c30e4fc4", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875184, "uuid": "9f2ca3e5-66e8-452d-91a5-7caa9040daed", "comment": "Malware payload (AgentTesla)", "value": "8a9079d9ad2d9d0826b2c5361ccdc0688af55067", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875184, "uuid": "0b2ce73f-1024-46a4-96d0-2089a280ac93", "comment": "Malware payload (AgentTesla)", "value": "78648b7ff10b1a4be8b3f4a2822202f2f962f6c3a23adfff9de0059c586f897e0b6c447c6c612d4de7363c1f5451d43a", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875184, "uuid": "6e1ef0b9-ef59-4d8a-b90a-7a0017d231ed", "value": "T1BEF46BBC312075EFC9ABC431DB681DA8EE506C7B930B5667901771AD996CA87CF201B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875184, "uuid": "ddd229be-5a9f-4658-883b-1235c96287b4", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875184, "uuid": "4e4f7fd9-457e-4cca-83f6-382776811812", "value": "12288:d+lfTQoOyocDQkjdh0BaTyG+fx3cKWb8jX0HBuTdwqWqd2TEn+FQ6mLvehxjVP0N:d2r8bSQGgAQxKb8jX0HaeqWTE+FPmLe4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875184, "uuid": "d8a10ef9-853a-48d8-ba53-f00ffae4d58d", "value": 784896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875184, "uuid": "09251110-0cae-4417-9370-ae366d11ff2a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875184, "uuid": "f0baeccc-d6cb-4136-ba23-ac1bf254a65c", "value": "payment advice.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b15a2e71-84d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882676, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882676, "uuid": "21a94da1-e286-427f-b943-76067c1dc7d1", "comment": "Malware payload (Heodo)", "value": "5b6502ccab878895b2b841068aa42fbb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882676, "uuid": "b847974e-5313-4e07-9bc8-a3af16d60e4f", "comment": "Malware payload (Heodo)", "value": "1c9a455f4dab179f5cfec961fde577b37108211a64415730753bf2fd11a1c9fe", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882676, "uuid": "43d9c0cf-56e2-4323-a508-eb85fec6aea6", "comment": "Malware payload (Heodo)", "value": "044d1dd80bd739a1ed1b1a72a0eef9292c5a60bc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882676, "uuid": "f926d929-f3a7-4dcb-9d30-f182ad592252", "comment": "Malware payload (Heodo)", "value": "7e7b0b87fa7710ecdf3b73c3c9d87683ce321436f553f3559c31eb3fb770e43e3a90bfdfa138960cae55c1b06dbe7003", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882676, "uuid": "2533a331-c718-43c9-bc37-1bc216e1fa6c", "value": "T121E36B65B6C5D9C6DB0822350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882676, "uuid": "6fd372be-bd44-4491-b2c9-bdd6a3594edc", "value": "3072:+cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0d:+cKoSsxzNDZLDZjlbR868O8KlVH3dehr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882676, "uuid": "752f0fa1-0191-42de-aff5-04bb7783c797", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882676, "uuid": "e3749f25-8bcc-4e3b-9fb9-381c4f2e5b1c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882676, "uuid": "7d87786a-f7c8-44d8-a7dd-6e00272a7634", "value": "2022-03-020932.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7383d6a9-84fd-11ec-9275-42010a9c0029", "comment": "Malware payload (STRRAT)", "timestamp": 1643898464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898464, "uuid": "ad083ffd-37da-4dfc-bd20-71414c738ee3", "comment": "Malware payload (STRRAT)", "value": "3d4ab933250ad59e4985ce38205d7d13", "object_relation": "md5", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898464, "uuid": "0bb905b8-194e-4b37-b893-08ff20a3b3ed", "comment": "Malware payload (STRRAT)", "value": "1ca90605b8cd8b9a919aefd274dbb31086632c6006cbb7a219d5b8a3e8aa7c38", "object_relation": "sha256", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898464, "uuid": "fb3215d9-451a-4551-9206-0ca670defa0a", "comment": "Malware payload (STRRAT)", "value": "fb52a5d609172ad9f8bcdbd6ff37f032fd5467f3", "object_relation": "sha1", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898464, "uuid": "3d1841c7-5f84-4140-a8c2-ba92e6579b6d", "comment": "Malware payload (STRRAT)", "value": "1a712ff5d7edd55c7dc891956884dc5037bd0f2ff5c225140d789814c0f41a9e7db4758949a7d9041a12bb2c38f724b8", "object_relation": "sha3-384", "Tag": [ { "name": "js", "colour": "#F7D241", "exportable": true, "hide_tag": false }, { "name": "STRRAT", "colour": "#DA76AC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898464, "uuid": "b319da30-ed97-41e6-a908-15f79e499786", "value": "T17A04D1624AD0670B85FC441CEC64E686F670DC8F500923E1BBAFEE7145B6C7489ED8DA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898464, "uuid": "f83b13c9-ab28-43ea-9198-d07a96afcf4e", "value": "3072:xEFAvqYqP841CrfYUnXPaFlVUj+lSvxAukJNIQxFvd:xMdUEmfYUXPaF7U6lNboMFvd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898464, "uuid": "cb126015-3c8c-4da7-b9ab-14baac4bb141", "value": 187847, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898464, "uuid": "053fb671-e4e7-4030-bc5f-01b0e5bd3ca5", "value": "text/plain", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898464, "uuid": "4506de6c-615c-408f-9f68-60360a6f5925", "value": "Quotation Request.js", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d557dcf4-8528-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1643917096, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643917096, "uuid": "65531e63-eaad-4fdf-8cbd-935fd4473439", "comment": "Malware payload (AveMariaRAT)", "value": "9730928c4fb387ff72c166ab30dbb9a9", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643917096, "uuid": "6d816b87-42a8-4255-95ed-9b39f7932d94", "comment": "Malware payload (AveMariaRAT)", "value": "1cb83e04d8cda4b5b659aea696035621402664a873409d0928365380f5558bf2", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643917096, "uuid": "af983603-d0d7-40fb-b6b5-c3b16fb97f41", "comment": "Malware payload (AveMariaRAT)", "value": "c5f1f740bb683246d9dc97c915ee3125491dbc7b", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643917096, "uuid": "d845b417-bb56-49e2-bc0d-2b657efcee5c", "comment": "Malware payload (AveMariaRAT)", "value": "1d8987a37abc9c7a1d2c1b214410d95b1ce7b5ca5a857eede7920a5167103d28f70e0c70b375bc5590969f09d8b5b88b", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643917096, "uuid": "a812238f-f82e-4177-9cef-dd58dd6a89ea", "value": "T1E954026130D7805FF59680FB03638AAAE6F3DA143173257757662B2FEA095C1DAC036B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643917096, "uuid": "125c55b9-c139-4e0d-8a33-c9ab0e9b8d42", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643917096, "uuid": "4261ed30-e91b-4c3f-8a1f-f84992ce7ee3", "value": "6144:RwqJ+0GfXhzqwgirW2Dz19w3y/cLfQRL4JnPfe+IvoRh:50P1iirW2D/mycLoR+n3bIQRh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643917096, "uuid": "fa856299-aa93-4870-984e-f65dc1d19894", "value": 279411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643917096, "uuid": "ad45ac84-51e3-483e-a6e3-97870a5c62e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643917096, "uuid": "3b6a993d-f9ce-439f-b549-989915b32a83", "value": "DHL_eReceipt.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e7c20b-84ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643890309, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890309, "uuid": "34c9b890-dab4-4597-a6f2-93b2fc7d8335", "comment": "Malware payload (Heodo)", "value": "e0a7bf28b4de2d58deb02186f99efc02", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890309, "uuid": "f9bc5e34-e5a2-4f56-8725-00ccdeec2716", "comment": "Malware payload (Heodo)", "value": "1ce9fcc2324664863c9049ccfa3cb009c40961c8a870a14c41cfe55d7f940e02", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890309, "uuid": "e1809e98-de2a-49b4-bb83-d83877f4127f", "comment": "Malware payload (Heodo)", "value": "a11487254b66ef442b1691445c5bb35f705c56f1", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890309, "uuid": "ad4166f6-6aed-442d-9215-4366f375393a", "comment": "Malware payload (Heodo)", "value": "091603a660c794484710c7daabbafafb65b99a9cd8cf61a199bc82aa359298c05d635305187429ae03a03eeb3956ad05", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890309, "uuid": "2b15a143-788b-4070-913a-811f89ef05d0", "value": "T16A25CF516D4980A1FA0B293D107A63660FEC690117E0E9EFDF05F8E75F26CC196788AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890309, "uuid": "031b5536-329c-4df6-b0b1-e2277d3c0afe", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890309, "uuid": "f402ffe3-330a-4be3-a689-8ea1ed172c09", "value": "24576:O77NlW4ZujpK630cavFuwNUsjk6opl2VD+rNtl7ifTI5dTpyRFIIm2mHL:6W4Z+LEtvFuwDjVK7GTC7yRFIr2mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643890309, "uuid": "600ad405-653d-4ea3-a9e3-6d84892dcde5", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643890309, "uuid": "13a26280-b563-4470-a923-3e1067a8d44e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890309, "uuid": "fcecafd0-ac9f-4b8d-909d-218bbd84c555", "value": "emotet_exe_e4_1ce9fcc2324664863c9049ccfa3cb009c40961c8a870a14c41cfe55d7f940e02_2022-02-03__121137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1a266591-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855364, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855364, "uuid": "193e15d2-9478-4abc-b4a8-14abb4f01188", "comment": "Malware payload (Heodo)", "value": "11c8541f3c29f3b9bfc7619e2e49d74a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855364, "uuid": "cc45ddd8-83f9-4f83-8d94-07407e6f4c99", "comment": "Malware payload (Heodo)", "value": "1ced1e5fdd624e3b390da317048468ce92b7fad023d613ccae41b9d34ad42e99", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855364, "uuid": "23e7672f-a4f1-476a-a151-6cc0f9a458e7", "comment": "Malware payload (Heodo)", "value": "10161fc3f6b08dfac1a30de874cf6693bb56557c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855364, "uuid": "e241ce06-66c2-4627-9550-62676a673806", "comment": "Malware payload (Heodo)", "value": "b9fbe21c74ab3f4d119a0be5bf8222a82a157d359650f8e182afd0eede210e5f2661cd16567295eb7dfb0de22fd5a309", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855364, "uuid": "88e29a96-4914-4ec0-963b-cb87589b0a83", "value": "T131E36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855364, "uuid": "8f50741d-0539-45c9-a471-42f89e5f098c", "value": "3072:bcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0x:bcKoSsxzNDZLDZjlbR868O8KlVH3dehv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855364, "uuid": "a7289865-d374-46ad-9f24-8e6a791c2407", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855364, "uuid": "6ce5c9f9-1753-4fd3-bf40-e2539ce1e405", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855364, "uuid": "58561c45-b0d6-4f1d-90eb-b5d8a60235c8", "value": "2022-02-03-11c8541f3c29f3b9bfc7619e2e49d74a_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d4e21a26-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643883165, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883165, "uuid": "ec92401c-c267-4fe2-b937-db3ebf1ec72e", "comment": "Malware payload (AgentTesla)", "value": "a719dc1683241420973e52eacf0a4deb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883165, "uuid": "d5f5b97f-a77f-4398-a342-53f5073a79ac", "comment": "Malware payload (AgentTesla)", "value": "1d1dc3b6be4b95982557b055f8e0f44c094c6376b19dd0d88866ceb95d6caca9", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883165, "uuid": "8c1f396a-8a7d-464f-a35f-137e8b4339e3", "comment": "Malware payload (AgentTesla)", "value": "a035f689a8100a5ea9eda76be3cb6efae39a7c06", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883165, "uuid": "ebb7e1db-7e7b-4e59-80be-f72146ef4b84", "comment": "Malware payload (AgentTesla)", "value": "50c959df7abffccd13a3fe0d8436bd786b7c82b793d6e014a1dd3581a6606930ee5971b381aaefec1d86a349ff817066", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883165, "uuid": "362e936d-320b-45b2-b246-35e5739c4682", "value": "T1EF450211ABBEEF35CD76063FD55071645F3EAE4490A2FB2D7648B9A82C73B009D80267", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883165, "uuid": "8d1de255-fadf-4d47-8940-b457faeb339c", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883165, "uuid": "2b1255da-0c38-4de2-92b2-090c08568341", "value": "24576:pUZfvWxcxJgM/Al5MnlvKRiJRz28W8ZVYxN:6fvG2CQA7MnlYK5SxN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883165, "uuid": "a2e51ba1-725a-4fd1-a31e-21013fc0db4c", "value": 1168896, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883165, "uuid": "06a0804b-a87b-4671-b64e-7bd785870ddf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883165, "uuid": "b4321662-6c5c-4cd7-9a32-239e615779b8", "value": "RFQ #037022-SCIENTIFIC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "544c008d-850e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905713, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905713, "uuid": "dcb207d6-e77c-4580-b5db-668ffe47da6f", "comment": "Malware payload (Heodo)", "value": "c3a0c3b43c4954fd5eb2e9d8165b187f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905713, "uuid": "bcbee16f-72cc-4b9c-8226-4efaad8e1d67", "comment": "Malware payload (Heodo)", "value": "1d26b07cd910e20d7d56f59a9677b000ce8f8a9911e032e7dc6709991d8e7b99", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905713, "uuid": "982a1c34-c86e-4a66-bb2c-9616c529188c", "comment": "Malware payload (Heodo)", "value": "6f090cecdbce53c5384ae8df3b0757771e7c9c4c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905713, "uuid": "d63d3d91-8937-4435-a314-dd02591d14dd", "comment": "Malware payload (Heodo)", "value": "8d95b7a409a66cd0598a17c8cc86aaffd20add04095c3fdc147c8411cec13db777987aacc23e56a7a496375a6d10a79b", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905713, "uuid": "f2604731-7bbc-4401-a9fc-0edae82aadda", "value": "T1ECD4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905713, "uuid": "9376b7df-8ed9-4c8a-b1f3-663330e89112", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905713, "uuid": "cc64bc8a-10ec-4384-a5fa-54dc1a926d23", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBPp7+7/Q0xIop1KpR:JynoxcCOllFxBP87LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905713, "uuid": "6e4fb1d7-326b-454c-a8fc-b552264d66d0", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905713, "uuid": "5eaa5cfb-b731-46ba-8c27-7f1872c2930f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905713, "uuid": "64fe5159-6223-405d-910e-9bc4cc14f2b8", "value": "c3a0c3b43c4954fd5eb2e9d8165b187f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "351e89e0-84ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643899218, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899218, "uuid": "3fdb35df-4243-4708-a52d-0439ac1ef537", "comment": "Malware payload (Heodo)", "value": "cab9cef6e76c7fb7019b647c9c8978a5", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899218, "uuid": "ce897d1a-38fd-4f7a-944f-86d3c36741a5", "comment": "Malware payload (Heodo)", "value": "1d302a5cf9fce48cf0bf1e63bf13add2cea47893d9aa217a2ced1b377f084350", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899218, "uuid": "cdd2c2a8-a7b4-4ce2-8d3a-0a30e7c2b0c8", "comment": "Malware payload (Heodo)", "value": "27fef1df5786d87cdfd7c1e957c016296c1496ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899218, "uuid": "9610c816-85af-441f-8f3e-9d28558469ab", "comment": "Malware payload (Heodo)", "value": "8357b10fee34988aeb6fa14d94844cc0b16fa5265051b071e7d758a2003403fa6e55727507900e9cf7753f7ee203044c", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899218, "uuid": "0217b663-2690-4333-b36b-85543571d8b0", "value": "T14925BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899218, "uuid": "faf5dc6f-6441-4cbc-9b47-a45edcda6bdb", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899218, "uuid": "86e2b6fa-fce7-40bd-9071-22d37681cd80", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2g1FIIm2mlg:kBiaa4powXiolDS2g1FIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899218, "uuid": "e3c6488c-e4a3-444f-818c-3f7412b3162e", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899218, "uuid": "052fcaf1-9a47-406d-84a7-2ba70333c4a8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899218, "uuid": "28267e9f-9835-4890-a069-48c12ea17424", "value": "cab9cef6e76c7fb7019b647c9c8978a5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "751c09b9-84ff-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643899325, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899325, "uuid": "e8867f79-a193-4069-9bc7-7b0261bbc679", "comment": "Malware payload (SilentBuilder)", "value": "911d419b318b24ba8f87162a32f6c61d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899325, "uuid": "5dd134bb-adfc-4c52-86bc-b452a363ea8e", "comment": "Malware payload (SilentBuilder)", "value": "1d42edc3b1081c79d29f76a46dffd0f7581f36c6ca57a41f6ef986a3874344e9", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899325, "uuid": "7e2d9e81-354c-4679-bab4-6faa6df4a4d8", "comment": "Malware payload (SilentBuilder)", "value": "6ea6c2461a72f6e2c5645062282448d9b0906816", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899325, "uuid": "cf5616a0-0823-4acb-b827-d48a61e1f063", "comment": "Malware payload (SilentBuilder)", "value": "dbaba28b3820170ebcfbaae0f2409cefb24584c4bf3be84a1248f18b5102c9d56a6b734d7f9db4dc0ef18f6da6f53fbd", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899325, "uuid": "21f11dc8-65b4-47a5-83e1-e9372040c227", "value": "T165E38D8AF15B0D68F1A2CA3984DA4B1437B35CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899325, "uuid": "571ec3b3-d358-4569-86f7-5f12c29aee94", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgbqudhaVYI7iQ6VOTeshRb0KwJQiAmGoR:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgbh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899325, "uuid": "9eb5d9bd-6988-499b-9567-ad35e07355b4", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899325, "uuid": "f8fe65b9-bb2c-4f6a-836e-6c803b2b7242", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899325, "uuid": "a75357df-f0c8-48d6-b22f-e62bec630d70", "value": "tmpnqvw2stx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47bd1cd8-84dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643884217, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884217, "uuid": "a49fd7e9-cd9e-4299-9cc5-f0caf9511fba", "comment": "Malware payload (Heodo)", "value": "d33b055c2e741e6cce6f5bc4cd6112ae", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884217, "uuid": "6c749620-7c63-410b-9ec5-d96c8d493988", "comment": "Malware payload (Heodo)", "value": "1d4a73eb79e45e4380aa5edb4fdf45efdbbc24de9628d08df19aa9b53f77e29f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884217, "uuid": "b0b15595-5d36-4aef-a926-09962a9c3c7e", "comment": "Malware payload (Heodo)", "value": "323c094eb251c362b0f4bc68658cd12dbfa98a26", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884217, "uuid": "95d86c99-2baf-4e7f-a9e3-42aa39dff336", "comment": "Malware payload (Heodo)", "value": "6f8a1e3fcd5e71e61a3daa886e9a4301cdeaf12e0f624b9985ffe55957d578f32b68bb41cf70c5c61b8d0237d37b2aa2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884217, "uuid": "5ba1a10f-5eb8-4e9a-8e67-75c823d7c4f1", "value": "T166E36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884217, "uuid": "64fe06d4-07aa-415a-963d-504ad4577dab", "value": "3072:YcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0i:YcKoSsxzNDZLDZjlbR868O8KlVH3deh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884217, "uuid": "68ce6844-1073-403c-ba8e-fb1eb1b52d82", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884217, "uuid": "b85abb0b-53f4-4eaf-be72-ee64993c3274", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884217, "uuid": "d8bc9335-03cf-40e3-bca6-c86a117c42a6", "value": "2022-02-03-d33b055c2e741e6cce6f5bc4cd6112ae_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24d23349-848e-11ec-9275-42010a9c0029", "comment": "Malware payload (Sugar)", "timestamp": 1643850657, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850657, "uuid": "9ec05b66-98f6-41cf-a48e-0ef7ba94130e", "comment": "Malware payload (Sugar)", "value": "ec3e1d0401d2fd7e6f7051f657ca0ba2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850657, "uuid": "eaf0639b-f600-4367-b6b8-07d5dd2b86eb", "comment": "Malware payload (Sugar)", "value": "1d4f0f02e613ccbbc47e32967371aa00f8d3dfcf388c39f0c55a911b8256f654", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850657, "uuid": "af674c39-c434-431b-92a0-ca2b7ca6902e", "comment": "Malware payload (Sugar)", "value": "2f8c666b1ad2a1fb7eb976d7d069375071de35ad", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850657, "uuid": "e7b7b040-cc91-48dc-a967-4f6b875086c3", "comment": "Malware payload (Sugar)", "value": "cde01d6d76140b38608ffa062b6b970c603a43bab335101fe82d9058604dfa0a4ba4104500e9cf0c1f465bef4cf186fe", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850657, "uuid": "1cb75777-a35c-4be8-a932-d3d69c5d02f7", "value": "T1F643F162AEB16777E9C915BD4D8BAC0C80792A6203B0B4A18C6C7DCF77D41C8A37C653", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850657, "uuid": "65e03a04-56f4-45a3-9dd9-ff330430bcf2", "value": "29dc79e4c9ab8bfa299719f434758791", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850657, "uuid": "d071529a-05be-4a68-8c73-5c895c4f0786", "value": "1536:fPOL2Dvwqzm7b8vFfkWtZ+VOrfCjOu9i/0so7fFD:HOCDNS7QvHZ+VOujXSpmfF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643850657, "uuid": "1bda5107-6124-48c6-9ef1-40fb783f2223", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643850657, "uuid": "3cd21ed4-75bc-4bc5-aabe-db42b15aecb8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850657, "uuid": "ddc17b57-e0f9-4a69-b7a7-bab94e8aa7bb", "value": "1d4f0f02e613ccbbc47e32967371aa00f8d3dfcf388c39f0c55a911b8256f654.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb1dedfb-851b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643911469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911469, "uuid": "b54ed5b1-4545-4781-b883-117f16e2aef3", "comment": "Malware payload (Heodo)", "value": "9f9d268535e8c86be0bcc6b4c96d5683", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911469, "uuid": "907d34f7-961d-4284-9b34-3a0280677915", "comment": "Malware payload (Heodo)", "value": "1d54ddd841edd9030c4686f5c6a9209ecab046483a9f3de2240ee099a1f45352", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911469, "uuid": "a7bfc6f7-a383-484b-92dc-30d7d69c3ce9", "comment": "Malware payload (Heodo)", "value": "45873acc35fb083683f23758d38745a7955b0a92", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911469, "uuid": "56249e4e-413f-4356-9505-6783b2f603e4", "comment": "Malware payload (Heodo)", "value": "b6ae115e9b08504d3c0ebe58c8ef9075e0df8740298a7ce655369db47eb43024627833f6f80db089d3229bd79f22be35", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911469, "uuid": "d0473484-023c-4bf8-8375-4afcb6592b17", "value": "T120D4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911469, "uuid": "2e8d47bd-24bd-43b8-99c0-ceef94734138", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911469, "uuid": "ef009cbf-ab16-43fd-a7ed-cb9002b3a717", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBP97+7/Q0xIop1KpR:JynoxcCOllFxBPQ7LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643911469, "uuid": "e5b64c3b-96f0-4507-9d84-44932a062e02", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643911469, "uuid": "3700b1d3-c522-4df3-83c8-b744720798a6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911469, "uuid": "b816b23c-251e-4e35-8cf4-aa7773bdb4f1", "value": "9f9d268535e8c86be0bcc6b4c96d5683", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e6f238ec-851f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643913260, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913260, "uuid": "54d98af2-fccc-4dd4-8c70-29c5bc50758d", "comment": "Malware payload (Heodo)", "value": "2c334a403d6abc5602f44c5aa249cac9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913260, "uuid": "0d28c281-e3ec-4f15-87b0-eba100455e84", "comment": "Malware payload (Heodo)", "value": "1d7e07d0a65ed5ebe547d50a66dfa1b7c3cb58174168dda497d0e3e080cc64b5", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913260, "uuid": "a6d78f31-1c28-4c3e-bece-6fe190dbd93f", "comment": "Malware payload (Heodo)", "value": "4b227657f353cd265cffbd5c2cc6916c180dd537", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913260, "uuid": "e57c5013-00f8-44cd-a14d-be4baa2609f0", "comment": "Malware payload (Heodo)", "value": "e68c9d65636dec1e54bc142170d15692c5c2167d558529ef44d9edddb0fe4ffb29f0b56e4c889abbda44638a38e82595", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913260, "uuid": "4634c39e-cadb-4ec6-b4d6-10386590ba77", "value": "T104E39D26B685C95AD91407311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913260, "uuid": "3128f655-d208-404c-a261-bf97120f457e", "value": "3072:lcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcm:lcKoSsxzNDZLDZjlbR868O8KlVH3Ueh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643913260, "uuid": "4c5b3335-18ea-4fd0-8334-dcda44f2d8b1", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643913260, "uuid": "36c67a60-5d7a-4b16-841a-c2a0a33c21a9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913260, "uuid": "6abd4104-082b-42e2-90d6-b2057fe8b4fe", "value": "tmpq189nj_0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dac5d96d-84c8-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1643875874, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875874, "uuid": "fd588e31-8b25-4bf2-bd67-ffbfd39c183e", "comment": "Malware payload (Formbook)", "value": "fd909db104f4ae9ede6c1c320cdf69c7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875874, "uuid": "26f6da8b-6e70-42f5-bd2e-2f5039249818", "comment": "Malware payload (Formbook)", "value": "1d98137d7e001a745ad15fb444b3f798d9d5c4b1a6a027ce61c283c7aa26a5af", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875874, "uuid": "bfbf27d9-21b5-45d9-a7ea-320cad227d3a", "comment": "Malware payload (Formbook)", "value": "20266a474de807b7bdf76323fce5d2c0055f160a", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875874, "uuid": "2ec43474-53b3-42f5-a336-d1e21fef8ba1", "comment": "Malware payload (Formbook)", "value": "d081fdd9e983adf2684540d07fc62e44c8077d2b1218dd5a950cb29c8b2f9ca112f448c5dfc8536d7bf9a1e71b5c0186", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "iso", "colour": "#ED4E86", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875874, "uuid": "95ad9183-3342-4a50-a7b8-6715ca4fcb83", "value": "T189C4E0A1F6965591F52A96316136BC5106773EE3AEC2DA18332CF24C0BF32904E76B4F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875874, "uuid": "86beecc4-4ff2-4c8a-953b-113c34ec4e1b", "value": "12288:CV7p3jchxySDy8Wuj+xFA+UfBQgJxOz8qbBQE2JBlG8d1k8YwS5gJ:IchxySDy8Wuj+xFA+Uf2gJxOrbBQdJGW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875874, "uuid": "9a1f1b75-3407-42c7-b554-22d3f0594694", "value": 589824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875874, "uuid": "b4f16b29-5cdc-4dec-96e0-f575abefc695", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875874, "uuid": "d0d324ed-0396-4cfd-a0f7-7398f1922a1c", "value": "QUOTE REQUES__pdf_________________________________.iso", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cefd949f-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856097, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856097, "uuid": "a655a0f8-ea27-404b-8f7d-d358188665e2", "comment": "Malware payload (Heodo)", "value": "f13002d9ebece54bcb5dc5f1f170f6a3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856097, "uuid": "87afb6f0-8b71-453e-8805-aa2b870e4115", "comment": "Malware payload (Heodo)", "value": "1dad14df32ad50c01feb4dd9ffee82d252c767f091226792320ce886ad381f14", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856097, "uuid": "ee6d2395-462c-4ba2-9032-0320b328981f", "comment": "Malware payload (Heodo)", "value": "f4c23b3a5662023f15655576b4e673ad06660bb7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856097, "uuid": "db84b63a-fae2-45c4-b8b2-c5aee9789956", "comment": "Malware payload (Heodo)", "value": "71edeed16c786f34cb994c70e5cd651420f0693cf4bfaed86edced9c3f6e2f3f0383b0911bfb5b81deb32ab189fb1f21", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856097, "uuid": "47002821-ef4e-41a0-865b-8ae40ee9218e", "value": "T16AE36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856097, "uuid": "27e84e1e-1572-4cf7-8a91-f6cd59858b91", "value": "3072:UcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0q:UcKoSsxzNDZLDZjlbR868O8KlVH3dehE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856097, "uuid": "b0bc13ff-a9e1-4653-85b8-afe2e0f65f55", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856097, "uuid": "32b91153-88bc-4706-8263-ce7a6dce6e56", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856097, "uuid": "ee8ef1f4-6ef2-4540-8e66-5eba4ce762cf", "value": "2022-02-03-f13002d9ebece54bcb5dc5f1f170f6a3_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8bccfe63-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855555, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855555, "uuid": "f70a4ef7-af8a-4d12-bb68-eef2179b4418", "comment": "Malware payload (SilentBuilder)", "value": "355ed1a8766bd2572430dfa122114a29", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855555, "uuid": "7f8281bf-b816-423e-8bcb-6e67b7ed6d0e", "comment": "Malware payload (SilentBuilder)", "value": "1dca24f4be85a31b80959eaeacca7cfe27f252a66a775c434cad468a5220b1e9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855555, "uuid": "3a27c333-7dd1-4067-8add-b76373b74bf6", "comment": "Malware payload (SilentBuilder)", "value": "bd2e6f4606b5f41df0cc570ce797c8532907ddc1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855555, "uuid": "e4676a7e-c6f8-4928-8d3f-0c7de620c886", "comment": "Malware payload (SilentBuilder)", "value": "f15d6f428fbe415f4780004217d8099c9769c1d44b10a4dcfac12b830e812589d3483f2f35bd9ead04d656815da18385", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855555, "uuid": "05521e55-31e4-42d5-8380-6f7d20e07672", "value": "T141B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855555, "uuid": "9a9a1010-d14c-4748-b50a-3055eb80f6cd", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd497:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855555, "uuid": "daadf30f-3c2e-40fb-b4fb-bb7eddee4bd2", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855555, "uuid": "2bb1c264-640f-4d34-84f8-caa2c93b8381", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855555, "uuid": "5a810866-9440-426b-8447-886c8e7b47ef", "value": "2022-02-03-355ed1a8766bd2572430dfa122114a29_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ca994474-84fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643898610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898610, "uuid": "26d6e1e2-e087-4372-b469-580827064117", "comment": "Malware payload", "value": "015102c1414b470e82a46bafd741c4d6", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898610, "uuid": "e897eb0e-76f7-4259-8587-925136f948ef", "comment": "Malware payload", "value": "1deb9a03042f384e5cdb3fba50f7f03747714e6a19e5eddc427f7accb5f7e0aa", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898610, "uuid": "0837182a-569c-4ea8-aa09-cbb181c04406", "comment": "Malware payload", "value": "46689dc57b1b48e5a6d7b2e718a11a434ecd0e9d", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898610, "uuid": "224bde12-2c85-4125-8fae-2a51907c4dbc", "comment": "Malware payload", "value": "c9a0288a71558984ab020578da4ce39bcdb2d73e79407ad8d90e6b4e2daecdc96f82fe6aad2047ae41f8d731a19250e6", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898610, "uuid": "95fb45c8-6b30-41f0-bdcd-22c48b1f656a", "value": "T177B3015885E14757C2238439DC7CC8F6854A4D43A5246E0FF8E1BA875BBDBE9272E3C8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898610, "uuid": "4226fa7e-2e6a-49fa-bb0c-e6199aaf0475", "value": "3072:pGMm7AbHQgusBxXspFM6CHvTnD4brjUG1za:RXlusBcy6CHvTUq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898610, "uuid": "c01ad481-eeb1-4e3d-bdff-817d1da6809d", "value": 114582, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898610, "uuid": "317ca24d-6515-4cae-b301-41c83f11b482", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898610, "uuid": "eb2a458e-6edc-4e56-8e8e-f4635dd7b892", "value": "11.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75b15e4f-84c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643875274, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875274, "uuid": "a103ef40-4916-44cb-ba88-76708dcf25f6", "comment": "Malware payload (Heodo)", "value": "9b08d2e348fb68a31149e18f189c18a7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875274, "uuid": "29f166c3-d21d-4cfa-87c4-286324d86b27", "comment": "Malware payload (Heodo)", "value": "1e33c4d4ffb80b0d6f6feac92e3a45dba02dd285bdc52281338b4197992a4bdd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875274, "uuid": "5eb06595-b8f9-4d81-a8d7-49ea84e9899f", "comment": "Malware payload (Heodo)", "value": "c406cfe8c552378d8b4f2f68ba35b24b41db2de8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875274, "uuid": "2aa31178-d174-430b-b54e-6c7ac7fea8b5", "comment": "Malware payload (Heodo)", "value": "9b9fcd6a26526e98c448a30719390c14e69f0646e490a2de258aba3f5ffbf1ee63d3faff4f104a71c24b4c6d5bbe34fa", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875274, "uuid": "dc44d184-4a8a-4776-b415-caa445eff838", "value": "T1E4E37B2576C5D9CADB0822351ADACAFE2327BC479E7643C33148F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875274, "uuid": "c83c2544-fda2-4625-abaa-10e0b9f8ee66", "value": "3072:zcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx09:zcKoSsxzNDZLDZjlbR868O8KlVH3dehf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875274, "uuid": "7161f471-e1a8-43c4-a446-5f8695a429b2", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875274, "uuid": "34b11705-2ffc-4d49-ac19-d5f5216df5ab", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875274, "uuid": "c5e10ffc-287d-4645-b19d-044d304fbe4f", "value": "KH-2395 report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "96ec409e-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855573, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855573, "uuid": "b92b79ac-b603-44e2-8140-46792e760df6", "comment": "Malware payload (SilentBuilder)", "value": "38c9f766dbc6689c7edfadac2b038119", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855573, "uuid": "597bca26-ff5f-42da-9a37-e4fb4d8eb675", "comment": "Malware payload (SilentBuilder)", "value": "1e64b8297a042c98da59fe99edbe572b92232219feaccd9c4adbc5e138b4755d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855573, "uuid": "693f2f8d-8ce1-4805-a88f-258969fbca62", "comment": "Malware payload (SilentBuilder)", "value": "ca1967476063c2c3d51dbd291388401fc9f79923", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855573, "uuid": "1a13f9b5-40f2-4b00-9887-a83b78301e8b", "comment": "Malware payload (SilentBuilder)", "value": "bf136462a4c07bf7506a570ffa780fe7f34122c813689e0e5eeace6d1783fa8d17b6b0e490b3296e849e2488a9a743a5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855573, "uuid": "f68eb87d-cb53-4858-9788-2815af1a7dae", "value": "T181B37C5A7365884EE55A8B3488F707962333ED208B5F06477115F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855573, "uuid": "71585a8f-db68-42f3-b7f5-0995ea1bd7cc", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49r:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855573, "uuid": "efdb9820-68b4-47a1-9196-284b822c0257", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855573, "uuid": "f96fdfa8-b3a8-4a47-88a7-6ae210b31a23", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855573, "uuid": "5937d802-6b97-4991-b950-e0f4cd92a315", "value": "2022-02-03-38c9f766dbc6689c7edfadac2b038119_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a354f577-84d1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643879646, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879646, "uuid": "33eaaf3a-5022-4eca-9f81-461b6f2c0e41", "comment": "Malware payload (Heodo)", "value": "38b0fa39ccf927cb11b48ece3fc97e44", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879646, "uuid": "6c788bec-7a7e-4126-a95a-2f18f972823d", "comment": "Malware payload (Heodo)", "value": "1ee0fb0cd778bb9ad1da137250189444a96b2a903ac2fb14b5067e38b54b2044", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879646, "uuid": "48923517-1c69-4576-a31a-ff5978d72a68", "comment": "Malware payload (Heodo)", "value": "5ac1752ed81d3034c77b679b228f0d30f3baab73", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879646, "uuid": "0ef42a5e-0c2c-4492-a011-61f797fe97cc", "comment": "Malware payload (Heodo)", "value": "d9568059b986bc40ce4fa3b9eb4d630c05b2dc08f90c0895c0f733c15a5122d7dd9e9e6a09c18d492f19dd88f6a1f9cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879646, "uuid": "5a0f76bd-453a-44c2-9196-903c5c428967", "value": "T15E25BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879646, "uuid": "6f796815-0802-4e6c-87df-ab342e605791", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879646, "uuid": "74dc68a3-17dc-4fea-b2b8-4425f44205c2", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gcFIIm2mlg:kBiaa4powXiolDS2gcFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643879646, "uuid": "281af1ca-3738-4b5d-b935-900e9535b168", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643879646, "uuid": "66bc5ccd-0fcd-4f63-b1be-dae38b5a8742", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879646, "uuid": "0153539c-ab7a-4261-84a0-65c5bffeba7b", "value": "38b0fa39ccf927cb11b48ece3fc97e44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "17deaa95-852f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643919785, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919785, "uuid": "84af9bfd-affc-46bf-b611-52a00eb8943f", "comment": "Malware payload (Heodo)", "value": "bb391cea581c8b4e01cf78fd74a73190", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919785, "uuid": "28b7ef9e-37a2-46c1-8774-5d7485aae4c2", "comment": "Malware payload (Heodo)", "value": "1ef1ec2ef3aeecc63ddb74ebd44782ab5c382a26dba0e3c34eaad20575d91199", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919785, "uuid": "8a70b0b3-401e-4bfb-a9f8-997810c76b02", "comment": "Malware payload (Heodo)", "value": "7338db422b51e3036f0a694d931ad04f69a4634b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919785, "uuid": "4d2f0f53-6158-4194-b11f-6e23d82405c8", "comment": "Malware payload (Heodo)", "value": "4fff16bae686ac66ec0ab1e3fcc8d19799f38aaf95343a9cc41ed898a69de0119036d092e3ab217ef8ad1299f690a667", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919785, "uuid": "dcaa396d-f641-4d10-b6b0-9115c90858fe", "value": "T11E25CF11AE4980A1F50B293D1469A7A60FDCAD021BD0ECDFDF44F9A36F12CD3957886B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919785, "uuid": "3454cd5c-d792-48a7-af1a-46601e69b4c2", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919785, "uuid": "02200bff-1b14-4684-9dbd-fddbe7e75eab", "value": "24576:SCiv47/YUr3bti5wcjbnZeZfxan8hX1HlyOwLVttCAUXfEFIIm2mB:SCjYwLtMvgZfxail0FIr2mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643919785, "uuid": "aea2a76d-dd86-4921-a0a5-4a8ed080c1df", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643919785, "uuid": "1ff1d989-ea63-4424-9fa9-2ac2151f1f99", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919785, "uuid": "029b4409-230e-43d9-b495-147800ac706f", "value": "bb391cea581c8b4e01cf78fd74a73190", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b1a8e65-8500-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643899765, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899765, "uuid": "798a4094-3b90-4235-9385-f42dc3e00595", "comment": "Malware payload (Heodo)", "value": "e0ecb1529e3184d0543175b3ec0bb6ab", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899765, "uuid": "49c1fe4e-901c-4375-8891-2d8917733c0b", "comment": "Malware payload (Heodo)", "value": "1ef1f70306eb92f98fec80ab4961cdd5ebb07af7f7505f70d8eac1635493a5fb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899765, "uuid": "2fa8de12-2350-4be6-a077-a85401e42d24", "comment": "Malware payload (Heodo)", "value": "18ad22ad6f57f79d380481351fa3f515e6095da5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899765, "uuid": "17bdd798-3bc7-40af-9d61-9b316f7e6729", "comment": "Malware payload (Heodo)", "value": "9dbabd3eb8b5909e8cd35b6938dbe9a37949285925e34f6a3f16303a7f597511e98897bbe21c62abad19484511922869", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899765, "uuid": "474ead7f-7926-4648-a608-ccc74f296df2", "value": "T1DC25BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899765, "uuid": "2ca82688-4df7-46fd-88c3-2db59b0242f3", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899765, "uuid": "36b0368d-bba0-4781-a175-ddf9ca74d1d8", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2grFIIm2mlg:kBiaa4powXiolDS2grFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899765, "uuid": "a91c2c42-11c9-4d09-9051-907d2fbc0924", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899765, "uuid": "4e6b6279-efa4-45f2-857c-b426844694e8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899765, "uuid": "8c6fd968-6886-4669-b8ef-0b8329d8e00c", "value": "e0ecb1529e3184d0543175b3ec0bb6ab", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6a2eb6a-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643884081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884081, "uuid": "817416dd-4afd-4ec3-ac84-208e59977943", "comment": "Malware payload (Heodo)", "value": "e2c8c5ed8c9784c94eda97cccc94c850", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884081, "uuid": "f734a1ba-1927-4487-a647-e3e621782796", "comment": "Malware payload (Heodo)", "value": "1f0d5773cc3aa9ebc3c7fa0dde8de762ee3037e4d4e59bb35b36b08ba56d9367", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884081, "uuid": "194624b9-91e4-48df-aa00-f609755edab8", "comment": "Malware payload (Heodo)", "value": "8ce96a258924ab94b9b424dc67ed6487466b59a0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884081, "uuid": "05eb6b27-c584-4757-8d54-bfd932fd1355", "comment": "Malware payload (Heodo)", "value": "7d74eafdc9bb362503755c32c9e4b74200e578abdf421250eb85d0414557e8212b0639ca95d2acf7fec6e4dbccd2c0d3", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884081, "uuid": "68bc34f8-a627-4274-b0dd-71788ebb7c26", "value": "T161E36B6576C5D9CADB0822350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884081, "uuid": "747d7ede-ca4e-4d78-9a1e-0f5ca451525d", "value": "3072:acKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0h:acKoSsxzNDZLDZjlbR868O8KlVH3deh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884081, "uuid": "8be2a3f3-2531-4e2c-a4bd-7c314144afad", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884081, "uuid": "41e6a67a-7b2b-41bb-bede-441e9a468282", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884081, "uuid": "45672843-fa43-40ff-8323-ae5b22bc4163", "value": "2022-02-030942.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5822d525-8500-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643899706, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899706, "uuid": "03e6b0a2-5731-4fa1-9c98-75eccb589009", "comment": "Malware payload (SilentBuilder)", "value": "3926c968c5e3d365c0959d1f1ff9bc7d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899706, "uuid": "f58eb4c0-d70e-45e6-bb11-cf8ab8da15b6", "comment": "Malware payload (SilentBuilder)", "value": "1f14f879820fc467a7b9b6e852751ff8dd5a52d565037e28c30b79290b59b52e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899706, "uuid": "191cb7fa-8d33-4d73-ac4b-e0605efb5969", "comment": "Malware payload (SilentBuilder)", "value": "470eeb072f83285c381abf064f7e6e3a20953e6f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899706, "uuid": "08e4cc93-ea68-45d0-98de-fe3831062186", "comment": "Malware payload (SilentBuilder)", "value": "3b17e181331fb26f4bbdedddddbc2617bebe4bd78597bcf4e8156bbb4dc031e9b57345056503e2aa6fab15b4fd57bd4d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899706, "uuid": "b30296f9-ea28-4b12-9d03-e4637f92062f", "value": "T181E39D8AF25B0D68F192CA3584DA4B1437B39CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899706, "uuid": "cf728902-0c10-4611-a934-4d8d3552d0d9", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgfquZha9YILiQaVObeshRTEKwJQiQmGoI:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgfM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899706, "uuid": "d105d9c4-9acb-4215-816c-d62f19973c6d", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899706, "uuid": "29f2db1d-ef5d-4054-9f5c-058a0d652be1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899706, "uuid": "93e23135-fcc4-4cfe-bfa5-7a254c12719c", "value": "tmpecdb0jc0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "07a7007e-8517-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643909450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909450, "uuid": "ec12fb07-ee18-4e31-bed8-10291877aeec", "comment": "Malware payload (Heodo)", "value": "5b8ee895d0d6aac587c836329b83e1d4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909450, "uuid": "aaa7ef71-9842-4fec-9227-08c3ec79ad91", "comment": "Malware payload (Heodo)", "value": "1f35dc31eedbfa725bcc2ccf981e9551d305b41cb5aa345ae7ca7142b8c6721e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909450, "uuid": "6e2b7542-94f5-49d4-b7e6-e9d921ec520c", "comment": "Malware payload (Heodo)", "value": "dc512ae27d27fc88a704b617049330935caed7ef", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909450, "uuid": "7bd97b0f-b2ff-4cc2-9429-28e91d30cdc1", "comment": "Malware payload (Heodo)", "value": "7848743890729e2742e4a0d08a931c9be7645469e9e827361696fc2ae6b73eff0a349250a37cae1dcee0f6e42abab846", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909450, "uuid": "624fc9d1-b21b-4cb8-91b2-27a634f5c1c6", "value": "T161E39D26B685C95AE91407311DD7CAF7333BBC818E7683473249F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909450, "uuid": "6b1fa04e-519c-4dc6-bd12-c3e45005923d", "value": "3072:wcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lci:wcKoSsxzNDZLDZjlbR868O8KlVH3UehW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643909450, "uuid": "3033dffd-0ac8-471b-b7f1-6ad2c904ef07", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643909450, "uuid": "6498fe82-9f12-4ebf-a214-9b1d0c0979d9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909450, "uuid": "5f67cee8-3d56-449a-be5d-0e5d4e215ac1", "value": "tmpeamwww_d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ae457844-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856472, "uuid": "f7ae714f-8e1b-4a36-b434-706e733cb84b", "comment": "Malware payload (Heodo)", "value": "555664235ca17e31277188f2f2c550de", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856472, "uuid": "4dbe4ed4-bb05-4193-8143-6909d121c611", "comment": "Malware payload (Heodo)", "value": "1fc5fe4b0b4ceb38171938036cce6eb196ca09f9b6bec50efbdbd717ec23705d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856472, "uuid": "b5a6e0b5-60da-4afc-aa77-30de53784a69", "comment": "Malware payload (Heodo)", "value": "30f1cfafc5fe88a58b25cc5338fd75b504ff3119", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856472, "uuid": "4d917f1c-baae-406f-bea8-9c25efaad199", "comment": "Malware payload (Heodo)", "value": "0d9ab55089bfff85bf0f11301a0e05a7b4d85ad7215cadd9d87f3d2334648f31d07c4a550a27bead8ba4806dfe9844d6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856472, "uuid": "e28c1002-83b0-4679-ba3b-6eb79a35e0ab", "value": "T155E37B2576C5D9CADB0822350ACACAEE2327BC479E7643C37148F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856472, "uuid": "03ba490c-0341-4a14-a291-51c90fa8f4fe", "value": "3072:fcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx00:fcKoSsxzNDZLDZjlbR868O8KlVH3deh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856472, "uuid": "25d711d2-ab85-44c4-b390-be1a21e68d97", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856472, "uuid": "fddeb7f9-3896-45fd-8202-d9b8bd9b0d81", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856472, "uuid": "84e53d85-89b6-4648-9ac4-43454caadd0c", "value": "2022-2-3-555664235ca17e31277188f2f2c550de.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "831835bd-84fc-11ec-9275-42010a9c0029", "comment": "Malware payload (PurpleFox)", "timestamp": 1643898060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898060, "uuid": "538f5ed1-d95b-4497-9cce-fd6c43655508", "comment": "Malware payload (PurpleFox)", "value": "e92193b8b6278f3588a71f0c5b49f9f0", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898060, "uuid": "6572c1af-7b14-47ba-a09d-3b66503c5cf1", "comment": "Malware payload (PurpleFox)", "value": "200b9a0b6261bf4b7950bdd5479abf05953f369a7796f06078ec07ea8275b519", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898060, "uuid": "26bd7c4b-dc95-4c9a-b648-86445c44695e", "comment": "Malware payload (PurpleFox)", "value": "8f00d4564c885672441f4df12bd581128027204a", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898060, "uuid": "ca2fd044-1dec-4631-b8bf-d4facd2e0c20", "comment": "Malware payload (PurpleFox)", "value": "feecaa968377e26d96a87d734436d378ad2f820b72605f9a770f00c2b81b8eff97b55fbd6e15ceb31a26fcf50c63c7f8", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false }, { "name": "PurpleFox", "colour": "#FDE7BD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898060, "uuid": "07689010-3548-41cb-b7b9-8c52ef4a0111", "value": "T17A258D2076DAC536E57E05B02A2CD75E406D7EB00BB998EB63C85E6F09F09C24635F27", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898060, "uuid": "31f65f4a-4e2f-4ea3-bf17-aa63905d4419", "value": "24576:ZxaBqnGIQ5M6DLrVVdWG859GCHrSoUzLyaVtFUl:Zx8lrXVVdWX59GUrSLzeaVtFU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898060, "uuid": "3e5448f5-16fc-4376-bc56-f4ba37125bb8", "value": 1019904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898060, "uuid": "d1dc55e9-c966-447d-9dfd-5e06d58f371a", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898060, "uuid": "b7369326-48f7-410c-b1a9-9e39d0c18423", "value": "e92193b8b6278f3588a71f0c5b49f9f0.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b25bd27-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883390, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883390, "uuid": "2c51c1f0-e621-4eb2-bd38-e1a67d40abee", "comment": "Malware payload (Heodo)", "value": "36ab53cc134b3915e630a3291631c34f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883390, "uuid": "a670a759-ea64-495a-a919-5390979b4d6f", "comment": "Malware payload (Heodo)", "value": "201561f2eb4f96fc36edab097709066e32f003396b6ce2b459aa0b41982b6756", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883390, "uuid": "b18608ef-4be2-4756-b0f0-36426d41a7c3", "comment": "Malware payload (Heodo)", "value": "008a5cfd8ce42dc85afd197e4447fa853799cf0e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883390, "uuid": "6e1ced88-49f4-43d0-b7ad-6a261d1309bb", "comment": "Malware payload (Heodo)", "value": "060516a2d2a4b1aa90f56bc4a42892af2bcc1e4a359d981650c8d59fc853c2e012d8eb9f95ccbb776e904aa63e55d188", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883390, "uuid": "846b91d1-63cb-4114-810e-94dc6ed22960", "value": "T151E36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883390, "uuid": "ff474478-805d-4395-8068-59ca640f6122", "value": "3072:1cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0y:1cKoSsxzNDZLDZjlbR868O8KlVH3dehs", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883390, "uuid": "e22484fa-f993-4a8d-819e-d49b5118f829", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883390, "uuid": "77a51932-d807-4aa3-b039-d3f104652fd0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883390, "uuid": "057db4c6-c322-45cf-a03b-d0a06755d4f1", "value": "2022-02-03-36ab53cc134b3915e630a3291631c34f_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5aad514c-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855472, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855472, "uuid": "c917875c-b446-4d02-84fa-34874b1c51c9", "comment": "Malware payload (SilentBuilder)", "value": "2327497bd1a0b773d4d0544e05ad6e4f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855472, "uuid": "a725049b-c92f-41ba-922a-71144dff6b7a", "comment": "Malware payload (SilentBuilder)", "value": "203d5eb8959a11f088ea201e07239c0ac891527522d04d65f312ad087ac16985", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855472, "uuid": "9d514953-7596-4eb1-8218-66eb7f43b55e", "comment": "Malware payload (SilentBuilder)", "value": "2f15fef4ec23fd0e19b9b3a39286f00cc9f1fa87", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855472, "uuid": "794b44e3-0f69-49bc-bb81-c5813eee740e", "comment": "Malware payload (SilentBuilder)", "value": "3158df0ac24ca30e13688be4dfd473dd2c327fab277834686d29569e4e613ac40da21040ec002b9086e1382b4095ccd0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855472, "uuid": "90f74233-e7d0-470d-b10d-f26e5a4e6350", "value": "T142A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855472, "uuid": "837c4077-c64a-4067-8785-1c10c703a9e0", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4J4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855472, "uuid": "355fdcd2-9c33-43c3-bc71-b6f3ba0a27b9", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855472, "uuid": "626c5682-f76c-4be7-a60d-1a0776e44283", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855472, "uuid": "c608738d-b081-4710-b493-9aeb76093bf7", "value": "2022-02-03-2327497bd1a0b773d4d0544e05ad6e4f_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2e6123bf-8517-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643909515, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909515, "uuid": "321ee435-2807-45e4-b75d-e43bfddb4b76", "comment": "Malware payload (Heodo)", "value": "31ed713c42c50c90527427dc09495f05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909515, "uuid": "f493470e-7825-4a72-b320-d76f2181bd7f", "comment": "Malware payload (Heodo)", "value": "204f06a88b6fdd8affb41efb96d07e765f33d29839a66aec215fb714c4d82839", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909515, "uuid": "e6a8925d-e90c-4ad3-ab38-a5e0fca61030", "comment": "Malware payload (Heodo)", "value": "01438665fde8854fcf26bb4c2a8a03b2c0735b65", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909515, "uuid": "48644e1e-04c6-4557-8839-faf1a7255435", "comment": "Malware payload (Heodo)", "value": "b801fd905c7960bf4e15c840db502e11503b4f737933a078f48d11ce24cb6af15fcd6d8f3f7a80caa7d79fd8db294c11", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909515, "uuid": "78a3dc28-feee-4720-b8a4-9739c58a76ee", "value": "T15325BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909515, "uuid": "cd18427e-6db3-42b7-89da-0cf215892e4d", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909515, "uuid": "d34c962f-abea-4bca-a347-cdae38d2439a", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gYFIIm2mlg:kBiaa4powXiolDS2gYFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643909515, "uuid": "30515565-d9df-4b75-8cf0-95865394d48c", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643909515, "uuid": "9712ab85-4496-4226-a16e-dc04e35683fb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909515, "uuid": "3da598dd-1f0b-43f2-b260-e79f529eaffb", "value": "31ed713c42c50c90527427dc09495f05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "758f9c72-8536-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643922948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922948, "uuid": "3da75e9d-6142-4f37-8b2a-6e11378189a9", "comment": "Malware payload (Heodo)", "value": "718d6bfcab8c4adba416f27f5158050c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922948, "uuid": "6edd91b4-8481-4125-8ca6-13da02326b12", "comment": "Malware payload (Heodo)", "value": "205e39498736ce824950cd49af2198387b02e6598c2eeb3f2d71e430871dfbce", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922948, "uuid": "d1b33499-33ba-493d-9627-c1d5498d25a5", "comment": "Malware payload (Heodo)", "value": "c044f527847c701ae45b83b98dbf32bed6b69647", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922948, "uuid": "bb4ccb3a-7f47-4669-9a34-49ee22dba03e", "comment": "Malware payload (Heodo)", "value": "9e7a3dd96272b2fa4a88d67fd0dda21411a42e50393e81888222cb11fe80b205b24742f655dd6be644a44459e0aa6c50", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922948, "uuid": "b39f99ef-cee7-4cff-8439-4001dadb35ff", "value": "T12625CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922948, "uuid": "1ea285e2-0ed3-4fd5-a34b-f1fa8765b2f5", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922948, "uuid": "acce1374-0f06-4c46-9b3e-885c7a551f7e", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyPPFIIm2mHv:exyq2kpWGWRCLWeNWO1tyHFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643922948, "uuid": "0caea9b7-b1af-4b58-a463-ffedda341a44", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643922948, "uuid": "a25539cd-9b69-47ec-9f1e-ee59436bd5b9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922948, "uuid": "a346bcf1-a5b0-423f-af95-7a9f080bbc0f", "value": "emotet_exe_e5_205e39498736ce824950cd49af2198387b02e6598c2eeb3f2d71e430871dfbce_2022-02-03__211532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e478a9eb-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643847114, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847114, "uuid": "2d5ced9e-5f1d-492f-a975-c12da3d047f3", "comment": "Malware payload (Heodo)", "value": "e3f06962260635752f3dba38fd356372", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847114, "uuid": "b9130eee-673c-4ba0-a65e-fb854f026400", "comment": "Malware payload (Heodo)", "value": "20a54925e7caf9775897f68ef2d99bdd9b69bac2d82442916c3aea2ded8eebd5", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847114, "uuid": "c0475744-94e2-45f6-bd99-b5169bba4b46", "comment": "Malware payload (Heodo)", "value": "e59ff99fdacdfa9711fbcdc5396ac325ac19444d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847114, "uuid": "da45c543-c628-4bd1-84ad-8e10990e0ee8", "comment": "Malware payload (Heodo)", "value": "17a125315a5f4b8d0b778f2a3ab2075d570942b9a93121bed57b6bdef5875f2f211ddff1f0c5937115a6d881b6582bda", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847114, "uuid": "88b0727f-44c2-4b01-aff6-983ba516863c", "value": "T14FE36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847114, "uuid": "4d1a53e5-c81a-457f-9485-edc4ea3b67e6", "value": "3072:ocKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0H:ocKoSsxzNDZLDZjlbR868O8KlVH3deht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643847114, "uuid": "d844ee64-d71c-47e1-9e92-c90ba005e33e", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643847114, "uuid": "bf80190c-3df9-4dd1-b54d-de49e96cade9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847114, "uuid": "75625d90-4fca-4e3a-b313-b5cd9260dfc1", "value": "2022-2-3-e3f06962260635752f3dba38fd356372.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a819e1b0-8520-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643913584, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913584, "uuid": "aad0e54c-42b8-42cd-bad8-b748f695382d", "comment": "Malware payload (Heodo)", "value": "aec314d45ff38329f467a477e2855388", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913584, "uuid": "82877383-d1fe-4fc8-a654-a91ba903384f", "comment": "Malware payload (Heodo)", "value": "20c7cf7f68b8dc0aee13c72fee952805c74b4176151cc7491f6e234c036382bc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913584, "uuid": "de0640b0-21b7-4c86-9cad-5a59a223a81f", "comment": "Malware payload (Heodo)", "value": "ecc7841d62f13ba73607e2371804ba4fb3bc8f4d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913584, "uuid": "ee423a77-0c32-4f4e-a290-17c0c3b5aadc", "comment": "Malware payload (Heodo)", "value": "4546a9b0aabe8e94c07c03e7794e858020e4dfc1f661f8ad4355422524ddb44ff9978caf567ae33ea2c7b5b22199c645", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913584, "uuid": "37b0d7bb-6235-4e9e-80a3-018ace331f74", "value": "T10EE39C26B685C95AD91407351DD7CBF7333BBC818E7683433289F71E6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913584, "uuid": "b444f65b-4e8b-49be-a037-aee92cdc917b", "value": "3072:4cKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dg94Lcw:4cKoSsxzNDZLDZjlbR868O8KlVH3Ueh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643913584, "uuid": "b2a51afd-a519-4623-a221-b8e58dbdaef7", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643913584, "uuid": "52f3983d-ad23-464d-a5da-9a13bf38a0fd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913584, "uuid": "c5dc5437-8a10-49f9-8ceb-27cc81ac499f", "value": "tmppavd3h_j", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7f9529a0-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855534, "uuid": "80bdff2c-d643-452f-bddd-7aab117eebc2", "comment": "Malware payload (SilentBuilder)", "value": "2f73e1f21ab482acfeca0eecd8b16ebf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855534, "uuid": "311d41c9-839b-4f6e-bd2f-71f5021e4aea", "comment": "Malware payload (SilentBuilder)", "value": "20f63971cfd6df3a376fab0ddd43e53812dd2d41cb286417a4f79598ff5fefb6", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855534, "uuid": "929a0f42-56a5-4519-87c5-4da6cce262bf", "comment": "Malware payload (SilentBuilder)", "value": "107e3f5be20e4621585e43eb93d89bde7064af12", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855534, "uuid": "8cb41979-84e8-400b-b427-d49eab02c77c", "comment": "Malware payload (SilentBuilder)", "value": "9d4ee928f9bfdec61b798868b3130fc9891d373aed73ea7cd1bf51c822e291b001e54ada6bc45c625b66343767d3a901", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855534, "uuid": "b1ff2c6d-b4a1-4e5f-9779-11568187559f", "value": "T1B3A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855534, "uuid": "a1560349-0deb-49d9-92cc-0be1ff8d1821", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd494:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855534, "uuid": "7311586d-d1b7-47eb-a8ab-abb0016c5356", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855534, "uuid": "4fa94d4b-f4ba-4015-88cf-28d89bf5a4e0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855534, "uuid": "e7c48463-53e2-41f4-9bd9-7a2f1196ceba", "value": "2022-02-03-2f73e1f21ab482acfeca0eecd8b16ebf_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51685eba-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883374, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883374, "uuid": "f25600dd-fd3f-40d8-9943-75a19d0af6b2", "comment": "Malware payload (SilentBuilder)", "value": "5580744b34a28381ce093d316f63cc55", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883374, "uuid": "abc68038-a718-4050-bdb7-853ce5b8d532", "comment": "Malware payload (SilentBuilder)", "value": "21174c46cc45c9a0a9c692b09bde56515c44f86a91b11fbbe5a50a1010f75d00", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883374, "uuid": "81fd5cc3-2a40-4510-98a2-e12b3d64bd7f", "comment": "Malware payload (SilentBuilder)", "value": "279a02884eae208e095bd83d617faaf825e5fab4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883374, "uuid": "3f2d9de1-8a53-43a6-8144-cbf5b292794e", "comment": "Malware payload (SilentBuilder)", "value": "1a1387fdda96f3cdca90bc947469ccd4283feefc14279ad5e032b63e3a79ba2a09e9a8aee8b264c199a703acc3794df7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883374, "uuid": "8bfb8715-df02-4640-b491-5d76621469e9", "value": "T1C1A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883374, "uuid": "9b4054ec-bbf1-44bd-b58a-af62150c39c3", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4J4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883374, "uuid": "83f0142f-7aac-4d46-832b-fb423922212c", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883374, "uuid": "35a30acd-ae75-4ef0-b3ea-d19f5a80b453", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883374, "uuid": "c4fad1c6-7a3c-4522-b631-c2635dcbe265", "value": "2022-02-03-5580744b34a28381ce093d316f63cc55_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b55d1215-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856054, "uuid": "b946a9b5-c24b-4bb4-a473-4d2dae46d661", "comment": "Malware payload (SilentBuilder)", "value": "777d9bce51d86858ca6431a68df640e7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856054, "uuid": "00037acf-8f06-4abe-bbd6-adc5a81bb71d", "comment": "Malware payload (SilentBuilder)", "value": "2157db2cf383d9186fd1c8b142f4a3102da6a00900f210a33085ce56fc510852", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856054, "uuid": "50a31e79-0473-49c2-8b87-df0916a5f866", "comment": "Malware payload (SilentBuilder)", "value": "a835db78c847b667df246fc40f827efff8b16ca0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856054, "uuid": "23f559ad-de16-4c84-bcca-521cd8074a5b", "comment": "Malware payload (SilentBuilder)", "value": "227eac9185a89c9d92ad8aaba491c17ff8c0b9db48c0d1181dcd3eafe96276bc23a3188f4b61f3fbe1b092fc816bb36f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856054, "uuid": "bca33946-91f3-48c0-a07f-50b4c48d9046", "value": "T142A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856054, "uuid": "21bd94a4-1ff0-4dcc-9e7f-9c991ef65165", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd494:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856054, "uuid": "7e2b7bde-fe2d-4b02-83ce-26ecc699621c", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856054, "uuid": "72a2ab16-6a15-45e0-b321-57fb1410799c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856054, "uuid": "a01efe4e-928f-4d41-ae7e-777dc4968a30", "value": "2022-02-03-777d9bce51d86858ca6431a68df640e7_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de72a205-8521-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643914105, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643914105, "uuid": "56921069-7bf5-4470-97d0-7e756c1b256e", "comment": "Malware payload (Heodo)", "value": "19a9bab0b7479fd2524af80c8a4566d4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643914105, "uuid": "f29c5eb2-0475-4d6c-8c52-a108d451ab8a", "comment": "Malware payload (Heodo)", "value": "21586aedea9577b543957c424b0d376cfcd132af442ea5ee93113744a123c952", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643914105, "uuid": "ea594419-fa39-4e13-b68e-ef005d618f1d", "comment": "Malware payload (Heodo)", "value": "83923ea1a0596e9e864dc2ae9431acd7e1117544", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643914105, "uuid": "6c8a620a-6800-4403-b6b2-4b04db1eb848", "comment": "Malware payload (Heodo)", "value": "0cf41092305a74d27ca42ba1b3fa77b85ff31dca4530fc10d96a95c3d1feea66e9a6ee04d064f412356dffc629d8f847", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643914105, "uuid": "47761445-79f0-4618-8568-807d8b9a7a8b", "value": "T11BE39D26B695C95AD91407311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643914105, "uuid": "f2650232-4914-4533-8b8a-63c720d6d429", "value": "3072:pcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4LcT:pcKoSsxzNDZLDZjlbR868O8KlVH3Uehf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643914105, "uuid": "b8424b99-0ea8-4ee1-afb4-9980365e6c72", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643914105, "uuid": "1c490ded-9465-4ea2-869c-c519041bcdb1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643914105, "uuid": "2709386d-4d40-4f29-859d-23928cf64885", "value": "tmpxoy77t_f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7ba1204c-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883445, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883445, "uuid": "397b508b-71ef-4a44-93c9-b1a4c18c31b9", "comment": "Malware payload (Heodo)", "value": "47ccd5de6157eabf9a64a9710fd4cb34", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883445, "uuid": "0b0368dd-fc80-43f3-b4ca-3119a519266e", "comment": "Malware payload (Heodo)", "value": "215a675c929963b8f2672f24546c5f9b3b1a5f2ceaf145bbf53ca4c599eae283", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883445, "uuid": "c8dc085b-1422-45e3-95c6-e08e45fdcb03", "comment": "Malware payload (Heodo)", "value": "18dc44c7f3f55b16c1589580536c6ae4e895be32", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883445, "uuid": "f08bbb03-94d4-485d-837d-848827ee3f8d", "comment": "Malware payload (Heodo)", "value": "2eeb45730bf3ef9c7a9b2609ef75aabf580a1933ab8ef0139e966c452d6bdc0fd29550ade410b416591ca0eaf200ae60", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883445, "uuid": "59a18021-a633-49f1-a982-3eb73b4c9641", "value": "T17AE36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883445, "uuid": "5d2d65d8-80c1-4e9c-a3db-9cc4c33c61c6", "value": "3072:ncKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0I:ncKoSsxzNDZLDZjlbR868O8KlVH3deh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883445, "uuid": "a5252d72-55d5-4e31-9247-36ff550c2237", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883445, "uuid": "9e71b333-39ae-4d47-a7bc-78daa5ceb628", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883445, "uuid": "d31d8912-e646-4020-846e-003965a85c27", "value": "2022-02-03-47ccd5de6157eabf9a64a9710fd4cb34_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fe06c568-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "f55b0194-356a-41ef-aac6-5d163c43ed7f", "comment": "Malware payload (Heodo)", "value": "32324a5235b32ef7e43a4b025b8ebcbc", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "460dc647-aa3a-46f6-af87-d3fbed0cc763", "comment": "Malware payload (Heodo)", "value": "2162b75e9e411cc34722f0c79c36b7ee914eb5bfcc492d2ea595b9044f9b6379", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "9c929d95-5150-497e-b7ad-49535526d8d2", "comment": "Malware payload (Heodo)", "value": "850e70cafaf76b9d7a39bb00f4fe01bd4ed5f10f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "5e901d92-3405-4722-b87c-6a0b4020efe5", "comment": "Malware payload (Heodo)", "value": "1c607b2a171f89ba7e6e3561d8868ff45370bd72d69423265696898f9a0d51fd1097401e9711a86fa2909863110d0bed", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "4937f6e9-22e7-4e4f-93b2-74e896feffcb", "value": "T12564E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "75ea1e3d-c53c-45d0-8310-a5d3235fc69a", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "40f423b5-e6c6-4f00-8050-8d51183c83bb", "value": "6144:83DvZRFTFbksYyljaMYDMRT7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMYoLAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910292, "uuid": "18263666-5100-4231-9aca-638e7649804d", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910292, "uuid": "ade8c644-9cc7-4195-af3e-704a920aae84", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "99f268c4-5640-4d8b-88e5-fe979ccad91e", "value": "emotet_exe_e5_2162b75e9e411cc34722f0c79c36b7ee914eb5bfcc492d2ea595b9044f9b6379_2022-02-03__174436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6dc85281-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883851, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883851, "uuid": "0f9d4082-f0f7-43e2-8e70-1846f6abdd5f", "comment": "Malware payload (SilentBuilder)", "value": "b2a5a6f51399fcfd2521d00ee720f5a7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883851, "uuid": "3e13c9c0-3539-462a-9afd-54e49121efd9", "comment": "Malware payload (SilentBuilder)", "value": "218853dc30cfb5f7eec31f9f278862b56980f854fa8d4c93275856e427c16086", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883851, "uuid": "067fcb88-1bb6-4113-8640-1dba72f43688", "comment": "Malware payload (SilentBuilder)", "value": "1d0cf2bfbd7e9b6b83bbc5a78c39f1a255d38641", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883851, "uuid": "226e53e2-28b1-4afc-b1b7-d84413f6b2c5", "comment": "Malware payload (SilentBuilder)", "value": "2c4e420a4d10c341a8f9b8258201bc00d2fee0f1bdf351804c687a0f7bd685fa347823695a3687e5d2df28e76d11d179", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883851, "uuid": "398a37a0-be71-4b94-9c6c-7ccbb9817ec6", "value": "T18CA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883851, "uuid": "3ee7bedd-33ce-4afe-9590-dda3921fafb8", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4N4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883851, "uuid": "8edb2826-942f-446e-9d2a-3552d0ca6ba4", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883851, "uuid": "8bda8696-422b-46a6-a170-4361fc0ae16c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883851, "uuid": "ef757945-282d-40cc-91ae-f32438182403", "value": "2022-02-03-b2a5a6f51399fcfd2521d00ee720f5a7_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ba7eb0d3-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883121, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883121, "uuid": "7ab593c9-c958-4e0f-8066-55cba9b2a1ba", "comment": "Malware payload (Heodo)", "value": "07588de0f96f91c64469e0af2e18c764", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883121, "uuid": "7be512c5-8d0c-4309-9bed-ffe19fc770f6", "comment": "Malware payload (Heodo)", "value": "21e73106cbf2cbad5143c1470017f0f40fd14b009f5c52330337cfd36d623db0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883121, "uuid": "70312c10-7d65-4a4a-9e7d-ce7722038949", "comment": "Malware payload (Heodo)", "value": "ee4336bc9929e8b759414fe5ed1f8ef79e47f32b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883121, "uuid": "8e400e4b-07b2-4cff-b3a0-250aa0d35864", "comment": "Malware payload (Heodo)", "value": "df190bba2f0c1378f2d858feaf6eaf45069298b0f84d893dad02ce5dd2131b2ab7763a6d2c47dc97bf03de611321d5c0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883121, "uuid": "dd0a1db3-52ea-4015-bf49-24183f912d6b", "value": "T1C4E36B25B6C5D9C6DB0923350ADACAEE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883121, "uuid": "cedad802-1225-4de0-ab74-18ab5103ac8b", "value": "3072:dcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0x:dcKoSsxzNDZLDZjlbR868O8KlVH3deh3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883121, "uuid": "4d06f133-71f9-40df-80b9-096c48f0554f", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883121, "uuid": "8e37b67b-fa3a-4b43-9fcf-0a80fbc13f65", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883121, "uuid": "3d9eaacd-8d91-4f76-bb06-83fe49d94b54", "value": "2022-02-03-07588de0f96f91c64469e0af2e18c764_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "55c0c99e-851e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643912587, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912587, "uuid": "5c0255c0-e671-477d-b516-8dfc73d2fb81", "comment": "Malware payload (Heodo)", "value": "f95bb4b2e81c21adbd44533ac3268614", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912587, "uuid": "4d614149-af80-4af4-b3b9-63431f7c6b0d", "comment": "Malware payload (Heodo)", "value": "2205d047597af9644e100c1ce70f46c3e439e0dae6324ce097be91d115cd3227", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912587, "uuid": "7dcb1556-24d1-44b8-8ba9-c53899666206", "comment": "Malware payload (Heodo)", "value": "c98989222ec34aae08cfacfd38d41c3e6de967f3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912587, "uuid": "2f017076-137a-48b3-aa97-40025cf68a37", "comment": "Malware payload (Heodo)", "value": "861936550b93661de899b75be8e0ba2cd11a2c8d05d59bdd505461ba46abb67470678459be20540286517243d4ab5817", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643912587, "uuid": "c4ed7132-982b-4f09-995c-033297d066b7", "value": "T15EE39D26B695C95AD91407311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643912587, "uuid": "2b383d0c-7d11-4039-94fe-a5b2f6157150", "value": "3072:ncKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4LcT:ncKoSsxzNDZLDZjlbR868O8KlVH3Ueh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643912587, "uuid": "4101e467-bf74-4a89-9a0f-2c5f7c17fd53", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643912587, "uuid": "dfd09b76-1b40-4dfd-8a08-1b31a6c355f5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643912587, "uuid": "7462f353-0830-40ed-bb02-d69ce13d56e1", "value": "tmp96kgr875", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9b70f90-8501-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643900273, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900273, "uuid": "b1d01e73-8d9e-45db-a36f-ca675471dab1", "comment": "Malware payload (SilentBuilder)", "value": "c5962c6fef1a4c1c8db4b59c840cba3f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900273, "uuid": "125a2e63-ac45-4bc1-8241-fa4c533b18bd", "comment": "Malware payload (SilentBuilder)", "value": "220d8e32da2d31d3fa6022f1bd540ba8a504e80379ac8a3a230ef6563ea115cb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900273, "uuid": "d2b1b5d1-18a1-402f-895e-75a40740b3f7", "comment": "Malware payload (SilentBuilder)", "value": "b70cf9543259723054c05a0c54dcbb6f8da268a5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900273, "uuid": "c7bc44ff-2d23-4052-adb2-010f3ddbb325", "comment": "Malware payload (SilentBuilder)", "value": "6c1f74b24d88d6b4ed9da18ecb99e724da934e66fb042f35208e7d385a2aea94c5671e3168a66cbbf1d7d87bf551970c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643900273, "uuid": "66d0b92f-0b54-4786-8bf4-aa7dedd60ce0", "value": "T140E38D8AF15B0D68F1A2CA3984DA4B1437B35CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643900273, "uuid": "d8d575f4-a800-4e16-a173-4a76a7ac4581", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgbqudhaVYI7iQ6VOTeshRb0KwJQiAmGo9:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgbN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643900273, "uuid": "cdc1503c-b8df-437e-8cf9-99e7ee331123", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643900273, "uuid": "faaaa233-e749-49d2-a336-f04c094b69c5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643900273, "uuid": "36a54c24-ad31-4b3b-b896-dbb0d331c946", "value": "tmppl7rgiaz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd1805fd-84c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643874643, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874643, "uuid": "a5d0c261-da70-40cc-a65c-870956bcab4d", "comment": "Malware payload (Heodo)", "value": "7b7863f2360f58649bc748c87fb12ffd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874643, "uuid": "d7ec3d56-4226-4f1f-9c80-885986a2d0e9", "comment": "Malware payload (Heodo)", "value": "22283238e273fffd1515ba97d55300667914305af30b902d92bfdf70a4378235", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874643, "uuid": "29f2112a-7751-49ac-bbad-71a98b38d9c3", "comment": "Malware payload (Heodo)", "value": "7546c61bf661e3069994e444eb938034d4a36509", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874643, "uuid": "48813dcc-4507-4093-8e65-6810da2ec2e6", "comment": "Malware payload (Heodo)", "value": "8bf3b20dd0234713a5be77ca79b698f51db1195e9720c4cb4e2a0985c45d984b668a54443929428f87601db1a27f4f75", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874643, "uuid": "4380f5a5-048e-4398-b8ca-cdfd7e05f101", "value": "T14CE37B2576C5D9CADB0822351ACACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874643, "uuid": "53598302-2238-4bc1-8171-2ccf23222b42", "value": "3072:PcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0w:PcKoSsxzNDZLDZjlbR868O8KlVH3dehe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874643, "uuid": "6b15afcd-bab5-4750-8006-df7c27e353e0", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874643, "uuid": "364043e4-64c2-4b95-9e60-be37b502a8b0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874643, "uuid": "75d5039e-407a-41ed-8557-57f27bde83fe", "value": "ZVV662516905CS.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "627dfb47-84e8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643889416, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889416, "uuid": "90ab806f-69ea-4ae2-9059-a604726feb19", "comment": "Malware payload", "value": "59f637eba063a85d3440459e94a01a1d", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889416, "uuid": "551e8d41-5285-467b-9daa-da2acb57483b", "comment": "Malware payload", "value": "2287f2f198cdcb6bfc2538b7afec3eab393689c2ea42491a0f2b6af21af0a600", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889416, "uuid": "3853cfaa-b260-47a5-8e7b-41345279232a", "comment": "Malware payload", "value": "e6fedb6d12ee72c29d6b7641f66531bc97851071", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889416, "uuid": "2c78fbd3-2898-4cd5-b56d-fa94e1551e17", "comment": "Malware payload", "value": "5f68e2ae9fb07b58b1af4a218e377bd5162fecb26cc7ef9369ea7844102275bcae9482c7943d1146e4543b88aec6167b", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643889416, "uuid": "fe0cb1f9-8a67-4c8d-a2cc-9430dabee2ef", "value": "T1BE03F25681C57E400D164D40E789FDB241A825B35C1CD1CFE8F5C9E5BDA221A1FD758D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643889416, "uuid": "c36a4aa4-52b2-4410-b285-a780f55ec38f", "value": "768:3VNW2hh/fQNq6WshJ9U/4Cbebp20lPL080gZQuiqZ+9PWM+YXmEEs4P8:lsY/fD6prq/4CbQp2qLqUQuTZKPWsXm+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643889416, "uuid": "c94c1a02-0d1c-45e1-b1c3-c4462377ff58", "value": 40233, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643889416, "uuid": "0133050f-b470-47de-86fc-150d87a42dec", "value": "application/octet-stream", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643889416, "uuid": "19fb5f91-e13b-4dc2-b883-26b38acbaa50", "value": "GWY-V2-21030.html", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5e9b4299-850d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905300, "uuid": "24bb4fec-47d0-42cf-a12c-034d9619ad08", "comment": "Malware payload (Heodo)", "value": "3812ef5d3b15adf23b6af443ac4e3181", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905300, "uuid": "f3d467d6-c32a-4fdd-a387-18900e75f29a", "comment": "Malware payload (Heodo)", "value": "22c66294df2b66ff09b6e7c1e876d3f19ad53aaab1c9c629fa8e98575720e50b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905300, "uuid": "bdf10f2a-0bd2-4db9-8bd3-af42926485ff", "comment": "Malware payload (Heodo)", "value": "f57dc2d6323c3a00c91b83b1b11fd6c92da0f930", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905300, "uuid": "7017862d-c691-4791-9008-828bc0594869", "comment": "Malware payload (Heodo)", "value": "141a36d9afb39b26913d3c8087207ba1663e0560b449f1653498aa79a2ef75f1b1b4c395261da2ef0915fc5b9302a74a", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905300, "uuid": "83990507-343b-467a-bada-07829bb4a2e5", "value": "T14CE39D26B685C95AD91407311DD7CBF7333BBC818E7683433289F71E6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905300, "uuid": "fe2e7036-5eb4-4264-97c2-2428dc35c054", "value": "3072:TcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcg:TcKoSsxzNDZLDZjlbR868O8KlVH3Ueh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905300, "uuid": "59332fd1-464e-4319-88a6-28b47ea2ab9d", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905300, "uuid": "44d410d0-bc87-4130-9bb4-8507210fb91a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905300, "uuid": "428276ed-604a-4e80-92b2-7f622c035e0b", "value": "tmp6j8go14i", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "805b1778-8500-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643899774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899774, "uuid": "9c45e1d2-fc87-4d62-9c94-87f273b0adce", "comment": "Malware payload (Heodo)", "value": "a5a99486e2d705b5d4a92032b6633c38", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899774, "uuid": "a135161b-fe42-4400-9275-79c10a13b62d", "comment": "Malware payload (Heodo)", "value": "22d1fc27f8daa9729c1928cd7e451ca53e92c06d7c357e90d27d9e6e8b8f8300", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899774, "uuid": "a5c3fbd4-2e0c-4a4f-aaa2-49df91966959", "comment": "Malware payload (Heodo)", "value": "efd3dd1a82195033816ffc2284bd441969f8e3c7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899774, "uuid": "ee65dde8-5301-4cd7-8967-9bcc48bb4132", "comment": "Malware payload (Heodo)", "value": "b9beec9fa75481021e2f9a9410b4ffd44dd5fa5f8d2248ca56f9e67c54c30960506468033ddf21800631f60b810c95a9", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899774, "uuid": "c0f913fa-732f-486e-9ff9-b850f27544f6", "value": "T1B525BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899774, "uuid": "ef931625-8551-4de1-af2e-371581fd0ce7", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899774, "uuid": "89fa52a2-d767-4ad4-8da9-7a6f7ebb26af", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gpFIIm2mlg:kBiaa4powXiolDS2gpFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899774, "uuid": "3fc494f5-cb84-4a99-a2b7-891264a31e9e", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899774, "uuid": "8fc7b4d3-c5b0-40e9-b931-32918e9b148c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899774, "uuid": "f7e38579-4434-413b-a33c-af04a87d30df", "value": "a5a99486e2d705b5d4a92032b6633c38", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b1ba6ff-849d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643857057, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857057, "uuid": "a4230288-7e84-4d8c-8a3e-dfb7c6247c14", "comment": "Malware payload (Heodo)", "value": "e67ac2a9439e4ec8fc6ea95fb5380f64", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857057, "uuid": "c66cc827-3f29-4487-b773-da84440d494b", "comment": "Malware payload (Heodo)", "value": "22d3f70ad2a296ec12602579b3820e951d0adb728bfd9dc97ac278a10dcb9dc8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857057, "uuid": "c837cc29-55a8-4385-a8fc-81987280d74d", "comment": "Malware payload (Heodo)", "value": "30efc04409b70e069b5acbdad28489ee5baea0a2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857057, "uuid": "7ca77169-4dab-4035-b667-fbb234fbdd3c", "comment": "Malware payload (Heodo)", "value": "0e473eb5a3b38bbc3eb5102c31f46e28f98f474890356814d2d877764b927316c19eac530a05ebc4270b09d2f6f0d125", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857057, "uuid": "13b5b099-3439-4730-9bc0-2311ede37a0f", "value": "T178E37B2576C5D9CADB0822351ACACAFE2327BC479E7643C33148F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857057, "uuid": "dc943d29-062a-480e-a17f-538636bed7b0", "value": "3072:OcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0f:OcKoSsxzNDZLDZjlbR868O8KlVH3deh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643857057, "uuid": "465a354f-9979-4835-abe3-fbeed4f2bcfc", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643857057, "uuid": "2ac22632-be01-42e0-b8f5-4e89f705ceef", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857057, "uuid": "2174966d-cf61-4589-ae2e-d24020ec21fa", "value": "2022-2-3-e67ac2a9439e4ec8fc6ea95fb5380f64.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ecc0510b-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856147, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856147, "uuid": "c104b6c8-a8af-45f8-be06-0eaa7a916879", "comment": "Malware payload (Heodo)", "value": "03cf9071ebca9857fb101ca95bacf973", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856147, "uuid": "c43836d3-c8ac-4587-8d42-fc4c1b34b29e", "comment": "Malware payload (Heodo)", "value": "22d891f875e21c9e4aaca3da5102b1c1b1d87671c5ce5461c41a51eba4c2cebe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856147, "uuid": "b42fcaf7-4286-40d9-bd69-333dc8aca85d", "comment": "Malware payload (Heodo)", "value": "cd765ec09dfec71aa50f99383b42b36485276bd5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856147, "uuid": "a03d62ef-5eb2-401f-a192-463d412be688", "comment": "Malware payload (Heodo)", "value": "f679168cbc0968887c995b7ec7b6f0bca57ed961ef6f8051ef6de94693fc6426c7b3452d172bb25008d4d6fd30c75945", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856147, "uuid": "fdfcdddb-a0dc-4469-8e7c-ad0caa530b24", "value": "T1FFE36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856147, "uuid": "3f2fa0c4-b618-43d5-abf3-c02dfcaae114", "value": "3072:OcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0P:OcKoSsxzNDZLDZjlbR868O8KlVH3dehx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856147, "uuid": "b7690fa0-9a23-47e8-b7d0-b06c8b4d10d8", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856147, "uuid": "08e81b34-1f8b-441d-a003-19f16df4ceb1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856147, "uuid": "dec53ae8-8192-4fb5-8607-7e2c27a85f3d", "value": "2022-2-3-03cf9071ebca9857fb101ca95bacf973.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f342b29d-84ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643876774, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876774, "uuid": "dc2cf695-2c01-42ee-9991-1cac9f46f511", "comment": "Malware payload (Heodo)", "value": "d2db39828efe4ad23b39952bec8b62c9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876774, "uuid": "a481e29e-8523-4039-8f53-ac524827b213", "comment": "Malware payload (Heodo)", "value": "22d961593880fd2c8639482fe089eec53625eafe416771197b69ba10721b5575", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876774, "uuid": "aa6e8a21-de96-4565-82b5-16747c5ea265", "comment": "Malware payload (Heodo)", "value": "c3bca09d88b0df8514437e8fcc6b508805f1e73b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876774, "uuid": "990a4b0a-94d1-4ae3-9867-760d86fc34f7", "comment": "Malware payload (Heodo)", "value": "5dee897af1d6e61883fd4141ba4f9bd9256cead712acd80806e095e6a0c4c57df2b2d74312cf9420206acaab88186e5f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876774, "uuid": "c17691f5-b93d-463c-8a10-578f0301561c", "value": "T12FE36B25B6C5D9C6DB0823350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876774, "uuid": "308be3d5-5663-4c97-b468-3aea93f6ebaf", "value": "3072:VcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0J:VcKoSsxzNDZLDZjlbR868O8KlVH3dehj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643876774, "uuid": "2bccdf29-785e-4f42-bc30-31b333769c66", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643876774, "uuid": "c1fdd473-aaf5-4a00-9e06-e1854d358550", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876774, "uuid": "013c4310-3afb-415e-86cf-a606c1bffd77", "value": "Electronic form.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "38ec121c-84ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643899224, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899224, "uuid": "2e07f0a1-058a-4fdd-91ae-f35261510351", "comment": "Malware payload (Heodo)", "value": "91baceac925da8096214d2adae66d2cb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899224, "uuid": "8f7b4b3f-8483-404d-8dc2-8e7b8079cfb1", "comment": "Malware payload (Heodo)", "value": "22e7195325e88a25280812782ead87ab406c0a3fc082492750e036be11000ba3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899224, "uuid": "5bdd8faf-c9ed-4293-864f-937a46771776", "comment": "Malware payload (Heodo)", "value": "c1c56d52217e85212fe16d57d9f59ec31c6fde56", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899224, "uuid": "fa0972d2-003d-4914-929c-5bf2f65169ed", "comment": "Malware payload (Heodo)", "value": "70d0dd595ea16c2cb1a7a30d6ad641139407de490b5ac41eddd157a02ff8027407593969401d9288c0bb246cbee171c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899224, "uuid": "aa876bb2-6d29-4858-bcac-05303c12a2b3", "value": "T10125BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899224, "uuid": "53b19885-b857-4cc5-a8de-e801df30091d", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899224, "uuid": "3ade6c7b-2668-4494-a1e6-453cc59d9a81", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gtFIIm2mlg:kBiaa4powXiolDS2gtFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899224, "uuid": "10afd495-2bfe-4c61-b14f-dfe1226137ff", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899224, "uuid": "0c20d85c-d2e3-4017-a2f5-203aca66be03", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899224, "uuid": "4f368255-28c1-4d64-a42d-5d7ce4dbb260", "value": "91baceac925da8096214d2adae66d2cb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7464b7a5-8536-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643922946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922946, "uuid": "b676485a-3d10-4f1b-95c0-46ba2978bdb6", "comment": "Malware payload (Heodo)", "value": "e1aeeb453100ec02409ee3d535d6f3e1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922946, "uuid": "f61d77bb-ffe4-41cf-93ac-da9fb6c58735", "comment": "Malware payload (Heodo)", "value": "22e897096e89a28b6d7bd730efefe80142d20259b6a915126cc19ace9619b86e", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922946, "uuid": "b1b7d033-2f76-4747-bfd6-cc70ccee3988", "comment": "Malware payload (Heodo)", "value": "79382722aa2b86619385860b268583256d79d86c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922946, "uuid": "7a58286e-fb7b-4389-96ff-30054ff8cbdf", "comment": "Malware payload (Heodo)", "value": "30f554b4175670dee8b87b2f1a0e6e62cc601a32e7b00a58011f3d4d4d5233900331d084fbd866fe5e8eab5497c1439c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922946, "uuid": "2fad4ae0-13d5-45ed-a488-126ccecb06c0", "value": "T1BB25CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922946, "uuid": "c20712a4-8da4-4b5a-a179-56c609011841", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922946, "uuid": "128086f0-4122-4e4e-a8dc-065370cad507", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyPWFIIm2mHv:exyq2kpWGWRCLWeNWO1ty+FIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643922946, "uuid": "f3f8dbe5-4c83-4e9b-b7ae-8f3165b1c503", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643922946, "uuid": "4ffbfcda-8867-48bd-b961-dfb0fb533a67", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922946, "uuid": "90f914d1-8e3c-4801-81da-d850214c77d5", "value": "emotet_exe_e5_22e897096e89a28b6d7bd730efefe80142d20259b6a915126cc19ace9619b86e_2022-02-03__211532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1246334d-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883268, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883268, "uuid": "3a238a0e-9f69-4770-8c2f-65470461edfd", "comment": "Malware payload (SilentBuilder)", "value": "332d35d9224ffbd173e0778f9053aa5f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883268, "uuid": "82f6f886-ade2-43cd-8629-f9073667be71", "comment": "Malware payload (SilentBuilder)", "value": "22f6e00b3480f0f28d089454fe6fe1b0f9eb0b28528382347379f32129e87083", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883268, "uuid": "ad0ddfd2-e088-4cda-b9f5-35d662e54cd9", "comment": "Malware payload (SilentBuilder)", "value": "de77d9d1e5fed471b80496910f48fe77573ee96c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883268, "uuid": "c82b8b94-8bd6-4ec8-9e20-db9740cbf441", "comment": "Malware payload (SilentBuilder)", "value": "5c08ac3ca64879295f2e834a45446f7d6f855aa3d9dd7db77c8fb7289bc10662d85a3f91300700704880ecaadd99efd7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883268, "uuid": "929b1774-1532-477b-91a7-9ed4a3d67b10", "value": "T105B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883268, "uuid": "d8eb1a38-d1b2-4e65-b43d-7c8a9aead868", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49X:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883268, "uuid": "ecc295c4-0e15-4908-855b-29c25bb5700f", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883268, "uuid": "50946941-0fd4-451e-9666-5c3a609017fc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883268, "uuid": "5de14b2c-4090-4914-b493-4a0fab6e3018", "value": "2022-02-03-332d35d9224ffbd173e0778f9053aa5f_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8d75f903-84de-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643885193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885193, "uuid": "4f6f9af7-b50f-4782-ae59-35132bb34cb9", "comment": "Malware payload", "value": "66e7fcbd0edce1ae623e5a6c191da473", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885193, "uuid": "242e2196-4f1f-42d3-a6ee-885ce612f7d9", "comment": "Malware payload", "value": "22fd5ea41d188019f475e05897b9d48dd5d139aa9ed565c3200a2e9feea0f996", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885193, "uuid": "0fb89251-d507-431c-83a7-edbc8822c801", "comment": "Malware payload", "value": "a6fdab8435a467934ea27c0e0b1a84882512741a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885193, "uuid": "4a0aad16-1905-4c73-8da6-9ea26edfd24b", "comment": "Malware payload", "value": "7b0ee0e0d426275dc0882f3eb1a4e3a24367bbf43c1619ab3f5abad3be5cbf8f993335c64731d1c0a54baf11ca37fca6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885193, "uuid": "b6fbd702-26ef-44b5-86cd-904c521490cd", "value": "T19EE37B2576C5D9CADB0922350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885193, "uuid": "36fe02f6-31b7-45ac-ad16-cf777d9dbe0e", "value": "3072:RcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0o:RcKoSsxzNDZLDZjlbR868O8KlVH3dehq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885193, "uuid": "43a16d24-a6ef-48fa-96b3-ffcb992909e3", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885193, "uuid": "e9cc6fb5-ca1f-40c3-984c-2ff7c66ea376", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885193, "uuid": "34692ab9-d135-4e44-8cd8-f2555fc665b6", "value": "2022-2-3-66e7fcbd0edce1ae623e5a6c191da473.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16c8ff72-8500-11ec-9275-42010a9c0029", "comment": "Malware payload (RevengeRAT)", "timestamp": 1643899597, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899597, "uuid": "31927149-1021-4012-8c06-dcf852f3df60", "comment": "Malware payload (RevengeRAT)", "value": "8e2c2ac7fbda44d67e6f75adfb0195c3", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899597, "uuid": "adbb2e82-09f5-4e44-b9db-8f41ac059bf9", "comment": "Malware payload (RevengeRAT)", "value": "230afb5144866520a2f26c52c986d5652f36a4237fef75de56225017917414d4", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899597, "uuid": "bc439d07-3708-401a-9110-7278abe95253", "comment": "Malware payload (RevengeRAT)", "value": "5666951946ea4e050cfdf7abf51ea1be403e76bf", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899597, "uuid": "7aa4bf5c-e123-4ca2-a95a-c76222889894", "comment": "Malware payload (RevengeRAT)", "value": "92cf7ca92024504dce709a645f216213b78cfc0039a472a8a2d6f0be4d7da5044fdded1fd62243300eae074984b8b6ce", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RevengeRAT", "colour": "#2A8CF7", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899597, "uuid": "bb303ea7-8023-4597-8801-368a1d8c9c52", "value": "T13F5421E267166876C962537C4271C67A923B3E983763D34B61E5FC673F331C21CA6882", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899597, "uuid": "a8cf9187-40a9-4c5b-a01f-d10690e9c47a", "value": "ba701d625d9fe4b055c54b1b9449630d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899597, "uuid": "8325d2bc-2c07-4b2a-9be9-43d52c1c2e83", "value": "3072:xfAV35gByp6aJXAAum5xX0K8WtvMfADT:1g3WBy6WtvMo", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899597, "uuid": "f0f36364-00f6-4ec7-8a7e-20307a15e989", "value": 304640, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899597, "uuid": "6eeaf267-b797-4fd3-876d-61b5706896e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899597, "uuid": "79bdf818-a674-46a2-b984-83a42378de5d", "value": "8e2c2ac7fbda44d67e6f75adfb0195c3.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c60202f9-8500-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643899891, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899891, "uuid": "1f878196-869c-44c7-a88c-4422c7446b77", "comment": "Malware payload (SilentBuilder)", "value": "25247a6f988e8daebd3bfd92e217b0c5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899891, "uuid": "3fd61415-80ae-45a1-936b-af453adf6bb7", "comment": "Malware payload (SilentBuilder)", "value": "230b35dbef4c103dedcf51b62508362707205d1d5fce654c4391abe73c06cf52", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899891, "uuid": "a0d91c52-0d33-438c-927c-78c8903d5a4d", "comment": "Malware payload (SilentBuilder)", "value": "5cf5afbcf741eb9f692d8e84a7c6c62475a5985d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899891, "uuid": "8ef1e5f9-4b69-4ad8-802d-1ba38715114d", "comment": "Malware payload (SilentBuilder)", "value": "12a020b9b323146b0276f9a944ec7bc17784983b1d990a9198253d33bb949e424b0fc038df828ac34e3341879ebc050c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899891, "uuid": "2d934e9a-3b71-4b41-a03a-b8456c18cf6b", "value": "T1F1E38D8AF15B0D68F1A2CA3984DA4B1437B35CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899891, "uuid": "d4d02ef4-aa99-4778-b1f7-778c7c7a1881", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgbqudhaVYI7iQ6VOTeshRb0KwJQiAmGod:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgbt", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899891, "uuid": "bc230a89-158f-4dc2-aafe-7f11c3dfa0e6", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899891, "uuid": "989db211-b3fa-4a62-bda6-1d184a63617a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899891, "uuid": "63b02999-e7b6-4685-8f3e-5878b8056932", "value": "tmpe156pgyt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87297d78-8504-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643901503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901503, "uuid": "37327b62-fbb2-4061-a285-2ff8725a8ceb", "comment": "Malware payload (Heodo)", "value": "11b6bb7252530256c195f335925d61c6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901503, "uuid": "6fb1e161-4f21-4c6d-aea0-9d7779807ca3", "comment": "Malware payload (Heodo)", "value": "231d510b7f8fbf73a3d41972070017c41986dc498dd0d070b9a0196289f7d0fc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901503, "uuid": "dcc76631-6035-41ae-badd-66578ee68a2d", "comment": "Malware payload (Heodo)", "value": "19f64e7a8aa3e97aaeaeaea0959c07b2f65d9ef1", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901503, "uuid": "5ec1a732-ce10-4fd3-a6ee-0cd12bb5ba24", "comment": "Malware payload (Heodo)", "value": "2d513ca85f0599834f2b9abd0ec46e477191eb08cde47a92ba20f5131dc99fe687f19db7ba011433be9c783567fbe238", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901503, "uuid": "3e2f5c92-7a19-4a7c-8c2d-c8e2fddf3af3", "value": "T1AAE39C26B685C95AE91407351DD7CAF7333BBC818EB683433249F71F6D7B6908A22246", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901503, "uuid": "2e490866-f43b-480c-946e-68372340cf25", "value": "3072:gcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgI4Lcs:gcKoSsxzNDZLDZjlbR868O8KlVH3Uehf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643901503, "uuid": "c306b834-32e4-4030-969a-15c65428ec9e", "value": 145411, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643901503, "uuid": "f0d4b0a6-460c-447d-964f-edb4d85cfcac", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901503, "uuid": "bf7aa1ad-af2a-4d9c-9d51-56c9f8061aa2", "value": "tmp64sed2xx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "933a7599-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846977, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846977, "uuid": "34a21f0e-07a2-4472-9c25-2e97d0159ffb", "comment": "Malware payload (Heodo)", "value": "d8e684b5ba1e50317950602ad8bbbc7b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846977, "uuid": "052aaebd-0d4b-450b-a5cb-7d8edeec534e", "comment": "Malware payload (Heodo)", "value": "2394d3e787ce2d59b776c6956e67ef23b2984d6bb8e8b657fedc4c0eafcfaccc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846977, "uuid": "a3bd2e7a-a15f-4e13-a74c-7b35212047dc", "comment": "Malware payload (Heodo)", "value": "91f81d63d9051459ac7ab67dbd2e5771946589e9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846977, "uuid": "c191a3ad-7455-4a23-a516-e17a7eef67d7", "comment": "Malware payload (Heodo)", "value": "90583abe076d5386766f12b3f13a0a32163e0257ba0328342051dc3bce34f98b51fb1de977a999139b44840ba1354f9e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846977, "uuid": "ff4868da-4350-4e8e-b5a2-c32c942632ea", "value": "T14FE36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846977, "uuid": "87f7a746-b370-42a3-a82f-6278da609e20", "value": "3072:gcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0p:gcKoSsxzNDZLDZjlbR868O8KlVH3dehD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846977, "uuid": "0448198f-38af-499c-b3e0-b3b542e1e42a", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846977, "uuid": "ca977b56-ae95-47f3-9187-871cc9b814a5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846977, "uuid": "703caaa6-b74a-4ced-a427-3c12cc940451", "value": "2022-2-3-d8e684b5ba1e50317950602ad8bbbc7b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "37a9a8a8-84cc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643877318, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877318, "uuid": "1c2d4883-8cd5-4f77-afaf-bf4df7b54216", "comment": "Malware payload (Heodo)", "value": "f657272179bde1a9e1479fd6f5105f3f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877318, "uuid": "7414f9cc-9310-4e6a-bf03-e108d8c1cd17", "comment": "Malware payload (Heodo)", "value": "241ec474d0191443299204265c502cdb5c860bae3510260c4bdceb19a2d832ef", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877318, "uuid": "bf26fd38-e4da-4f06-8151-21d291662339", "comment": "Malware payload (Heodo)", "value": "f7b6e55b772e78a5dbf959f2f0a35683129cc605", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877318, "uuid": "1dd227f1-986b-47be-996a-d936935f6edb", "comment": "Malware payload (Heodo)", "value": "1be991f081b20532c6818761a693e234e55e8f67b54ecfaf2313b3b44a456a30d16d68745b6aa48760e7fcae8b30ba9e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877318, "uuid": "ce2e030d-9a4d-4b27-9142-7b16f496b039", "value": "T12AE36B25B6C5D9C6DB0823350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877318, "uuid": "c819e14e-8946-4e3e-82d6-44827901dcbc", "value": "3072:UcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0W:UcKoSsxzNDZLDZjlbR868O8KlVH3dehU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643877318, "uuid": "692f3631-a867-4f1d-89db-9f54c8d87bc5", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643877318, "uuid": "cda1083f-0a2b-4a49-9677-ac3af55c9829", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877318, "uuid": "85952507-030a-49bf-87aa-62a2fcb8c0d0", "value": "DLK284408386XJ.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f6cf1a98-8506-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1643902549, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902549, "uuid": "b07c7027-e39f-45b8-871e-8ce626e5de8d", "comment": "Malware payload (njrat)", "value": "a35f80ad73bb1986481466e7d83397d2", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902549, "uuid": "4488c91d-6868-4471-ab92-204088843b71", "comment": "Malware payload (njrat)", "value": "242090d60cc0b725f61b1e7286ca2b1cb161e48cfd8a1b3f96e8f04a7c2effc6", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902549, "uuid": "6367bd9f-9b22-4409-ac23-7c88764e7480", "comment": "Malware payload (njrat)", "value": "143f2dc890fc38170ed31a2251b2f688b2dd3f90", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902549, "uuid": "e40e77c4-94f7-4fa7-87f6-120f0419d8d3", "comment": "Malware payload (njrat)", "value": "b6a9f93ee3439b69b676afd297523eb12dfa15539daeb3ec6c3e4e611dfd96fec15456423bd7890c05c489d6d4fedce1", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902549, "uuid": "6183b396-05b5-4241-b962-cc940e68f5f3", "value": "T1D384014C1494685DF2EA82B234471EAAD71C0714DFAE39E38F7E7487254F60D17362EA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902549, "uuid": "b80c7a1f-c4d6-4c1d-85a4-d36b83bbe9e6", "value": "1536:dMAJ0Cr7cOHTgkPRe7wI1fhYtsRvuxUSOZja2Cc7dI:i+BoOzZPuwkWZSaLaI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643902549, "uuid": "3ca6bec1-b639-4318-8369-9dc46942a8cd", "value": 373599, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643902549, "uuid": "71e34c89-50fb-4ddf-83a6-e763dae0b492", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902549, "uuid": "f0fa8be5-a142-4011-b1d9-9cea66a6e89a", "value": "jfdusdb_Receipt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "87b1c8f4-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883465, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883465, "uuid": "732cd80e-7918-4396-b236-438e24455c4d", "comment": "Malware payload (SilentBuilder)", "value": "6a1c0aa0016a27760182a50077399989", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883465, "uuid": "5d283082-309e-47e7-b757-746904e4c3b6", "comment": "Malware payload (SilentBuilder)", "value": "249318e01d7f96eb447bb39a3d978403b77eba7975edcb1d0c3eab1491440b3b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883465, "uuid": "6220290c-fce4-4344-bf23-a590d7277960", "comment": "Malware payload (SilentBuilder)", "value": "3a6cd3a65ae4dda2d373ca2de044af9cc310601a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883465, "uuid": "eea590c1-a6d9-4e28-acb2-0f6fb2b35027", "comment": "Malware payload (SilentBuilder)", "value": "7e223315d2eb09cd52fcc95ee0adda41158bc913b344d8bbfa6fcf32f7906e9f6e18f8a1ab3b512c397439212a886613", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883465, "uuid": "beb349f1-3614-4325-a7b5-7b9056c4d41e", "value": "T120A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883465, "uuid": "9550cc1e-63a1-4cf7-a36a-bfad7c280841", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd454:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883465, "uuid": "5bb36260-b48c-4b49-8499-3eb5e4a7f0ef", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883465, "uuid": "da0068b0-892a-4528-b003-ed542883f83b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883465, "uuid": "1b644a46-59b9-43f3-9d8a-a0378ddeca00", "value": "2022-02-03-6a1c0aa0016a27760182a50077399989_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d64458e4-84d1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643879731, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879731, "uuid": "362366f4-0972-4f03-8830-9ab314f83ea6", "comment": "Malware payload (Heodo)", "value": "644fa8bcbdaa7a7ce18739d200bb15ae", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879731, "uuid": "ed75eeb9-18b9-48d4-90ef-7a959854f36c", "comment": "Malware payload (Heodo)", "value": "24c5989e3be22ede316cb4b12fdc3afdf1d5c9ed64819dba4aac317836455285", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879731, "uuid": "369da53e-ec05-451f-ac9f-37f1db8c91a0", "comment": "Malware payload (Heodo)", "value": "8dc2428ec61aec79cee5e15c399a6001f37be61f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643879731, "uuid": "4b3d0a81-2fcd-440a-81eb-72632b8dba3d", "comment": "Malware payload (Heodo)", "value": "4eb5a6690c00cec2b8099be8d24e1ed349b39eff36f8e03365ab46e8b5872a419a73ebdaf585af031d80ae5a6729c10f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879731, "uuid": "aff4fae1-0a7f-49a6-9f92-db1fed9fff64", "value": "T194B49F3C72A0A435C27B34F574F992B745AFBC524B29469BE7FC212B1E3D5814A3460B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879731, "uuid": "3e71a4f9-c2e8-416a-8119-8968f25e747b", "value": "7247c2c21974aac9c8163fb2b0a2c7b2", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879731, "uuid": "9b2f939e-6032-479f-9939-734011d0fdfd", "value": "12288:G5Yfb6SGkFIPbKq1r26JQ6DraMA0ZaC87j:GK21kFIPT26ZD2MDW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643879731, "uuid": "6187bccb-07b7-4938-9b2f-1345f99cd91d", "value": 530881, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643879731, "uuid": "24a1d73a-5320-48d1-9296-aa43a1015d58", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643879731, "uuid": "1cc2f18a-b264-4e9d-8136-590ec143e01f", "value": "emotet_exe_e5_24c5989e3be22ede316cb4b12fdc3afdf1d5c9ed64819dba4aac317836455285_2022-02-03__091527.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11250a1e-849d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643857067, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857067, "uuid": "5df0cbdc-23af-4293-96d3-5a9a9b2e1cf8", "comment": "Malware payload (Heodo)", "value": "e6e6b46d3e7750210039fee0cb21dd90", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857067, "uuid": "43445a71-4bb7-4c17-a77e-96d23682b3cb", "comment": "Malware payload (Heodo)", "value": "24ddafbc8a5d92f2ffb9c48e58ad25a720fbae9a5978ae170210fefce5e9c315", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857067, "uuid": "61ca7f7a-72cd-4964-a3b9-e87f6693d53e", "comment": "Malware payload (Heodo)", "value": "95aab71c1ac4b27b1c77994191232a3cbd178064", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857067, "uuid": "664ac949-0f22-497c-af2a-63814b9f2eed", "comment": "Malware payload (Heodo)", "value": "f07d33efeae1cdf1ef23fb30f1e2f9a4f12077ed1c56658b89b26595f2b50f700a74b1e00501dda45a785c784dbc5c03", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857067, "uuid": "b7c84bcf-165b-4140-a802-679c561764cc", "value": "T137E36B6576C5D9CADB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857067, "uuid": "c6eff497-e1cd-49a8-8acc-f5c6b7045148", "value": "3072:ZcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0P:ZcKoSsxzNDZLDZjlbR868O8KlVH3deh9", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643857067, "uuid": "7385e20e-1883-45b3-b566-5a912060cf58", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643857067, "uuid": "ec782a86-c866-4020-bf78-ddcc566273ad", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857067, "uuid": "fb02790f-d81b-4bed-a6f5-3f0cb5dcb4db", "value": "2022-2-3-e6e6b46d3e7750210039fee0cb21dd90.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "253740e8-84dc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643884159, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884159, "uuid": "9edf4be1-8b15-40c7-a147-e6cc3e12edf2", "comment": "Malware payload (SilentBuilder)", "value": "ef9ffdaa18fe83103305387b7866f09d", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884159, "uuid": "f529d59d-fc5a-4392-98f4-c5d25e5e94b7", "comment": "Malware payload (SilentBuilder)", "value": "24f5dbabd3500373cd5465c7a73cd704b420887a6f8eb9bddcf3d3abb29dc607", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884159, "uuid": "c8fdaa6b-d053-40bd-adfc-9e755daf872d", "comment": "Malware payload (SilentBuilder)", "value": "18abf925cc0721cf17b50fdf23b6f18fe28d0489", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884159, "uuid": "dd528b36-6720-4fbf-b9b2-981466f7b2dc", "comment": "Malware payload (SilentBuilder)", "value": "81ef5e9b341a7ca3aa185b4d93b6dbb831666223efd0d8968739aca0161929b7861c16a1dcbdd411a47bb5c0e4e4d054", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884159, "uuid": "5866f3ea-8c5e-45ba-8bc9-735c2e241401", "value": "T1D8A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884159, "uuid": "33217b25-1dbd-4ac6-b80b-e14686799532", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4Z4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884159, "uuid": "88f32e5d-6a57-4aa5-b01d-aab5d1c184d7", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884159, "uuid": "e4880303-34e5-4d9b-b00c-7e25d903ba92", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884159, "uuid": "2c54f90e-04a6-47ba-b9ba-1dd667d4b73a", "value": "2022-02-03-ef9ffdaa18fe83103305387b7866f09d_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b12de75d-8505-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643902003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902003, "uuid": "06fe5edd-df9f-460c-9565-ac335856c994", "comment": "Malware payload (Heodo)", "value": "706779177bf906fadb6900bd4b3c352d", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902003, "uuid": "efab6c54-12b0-42ab-85d2-d1b466e2244a", "comment": "Malware payload (Heodo)", "value": "24fb043cadc8dcb06b385109023aa15d57660347958b029e9503a1a3c73b46dc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902003, "uuid": "9f6366e8-fadf-4ae9-90a9-b49265a108a6", "comment": "Malware payload (Heodo)", "value": "ea318fd26b2c6a56bc1507fdf486afe1d10451ad", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902003, "uuid": "1a309e75-d689-408d-8ced-fa411dc3b6a1", "comment": "Malware payload (Heodo)", "value": "19feed68c4af67cc6e3954aa6fc2b4f19e2d1b6435ad7ccb34da3ba63db15f923f1f3217190911d83bb590c62e579d44", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902003, "uuid": "74d8fd52-a8fa-473a-ad16-e0facd6b1596", "value": "T1C225BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902003, "uuid": "de44ddda-82b1-4be9-aa60-0194fb294f7d", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902003, "uuid": "1ffd1baa-0afd-4897-af98-f21bd1c83d00", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gwFIIm2mlg:kBiaa4powXiolDS2gwFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643902003, "uuid": "aee1d8b0-648e-4e30-b421-68811ee34842", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643902003, "uuid": "ba09887b-9457-40c3-9394-a9eeeea4a766", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902003, "uuid": "7a63c29d-be22-4401-aabe-699820c02fe9", "value": "706779177bf906fadb6900bd4b3c352d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cea602f0-8503-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643901194, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901194, "uuid": "c4425cb9-1cf5-4ec0-9751-f16c18023c82", "comment": "Malware payload (SilentBuilder)", "value": "712c6eb5b4f68ecc1bda3b6dbd9ef6fe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901194, "uuid": "48160ae5-5583-4458-afd2-21f28b58c492", "comment": "Malware payload (SilentBuilder)", "value": "250c357d36cc837f194fdbcef9df7b96de186927675aa653842de773ee0a133b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901194, "uuid": "a71f1884-149a-4f68-88fc-56bfe8f991da", "comment": "Malware payload (SilentBuilder)", "value": "3c78748cffa9a9771df2920ad514427cc22f89f7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901194, "uuid": "b2ca91ac-bc87-4dcd-9d64-34f3428bb010", "comment": "Malware payload (SilentBuilder)", "value": "f8d5f69b7797073a8398d651d4dc152a0431b2b45281d9c813d7101db85c9a9d382c1dfbeec1593e4cb4d778cb75e4b6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901194, "uuid": "5b000f93-4e82-4f19-9654-9a46f8e351e5", "value": "T1DEE38D8AF15B0D68F1A2CA3984DA4B1437B35CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901194, "uuid": "c6c174a1-6b61-444a-b6d9-172053e432fd", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgbqudhaVYI7iQ6VOTeshRb0KwJQiAmGoP:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643901194, "uuid": "1104c776-85e8-4f01-85ed-2cbfb28a8cb4", "value": 148484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643901194, "uuid": "c30b4507-2d3c-4c60-810e-d74e665e3ccf", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901194, "uuid": "7b1e088e-b942-47c2-bf31-835ce72d4f4a", "value": "tmprzt2j_ds", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "823faed9-84ce-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643878302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878302, "uuid": "6f93e9c3-e4c8-476f-b72f-62d287d38735", "comment": "Malware payload", "value": "48b3c6131ee0b766b622e27e8afb08f2", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878302, "uuid": "d124a0a4-4ce2-4c9a-b331-3b9b2d988d10", "comment": "Malware payload", "value": "25219b1ac36f8c55f49ab61747eae5328105e44df3dcd2db1d21ad801b0784a1", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878302, "uuid": "13802384-cbba-4b0f-a78b-16c36c365ac4", "comment": "Malware payload", "value": "41012445cb54802138c4d08632e011794767aee2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878302, "uuid": "cb1fb5d0-e8d5-4146-a82a-00e1e0b38ec5", "comment": "Malware payload", "value": "ba463745af6d1a3da11dd2a85a28d32462f98b7ba12f8d4672405e9e7748d458df3419e3d5233d8b4da1e289d19698cf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878302, "uuid": "e0eb30cf-b3f0-458f-a811-e00c96dd2c60", "value": "T1D4536C2153B8CB17D6BE1F79B47DC0610672B28A7062EB6E2D88F4DD2D53B01472277A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878302, "uuid": "9a298ca5-5b78-45f8-ab5a-b5bd3e5d6951", "value": "1536:Hnit6rBfl/sqV+R/QvynjzsYpNa+8FmyXuM/xi:Hit8xj+R/EyjRBcmyQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643878302, "uuid": "5c934bab-01c7-4c10-9027-ed5a6292bc09", "value": 64392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643878302, "uuid": "f8460f26-cf43-4022-963b-4dd81fb31cbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878302, "uuid": "27baa2bc-ad48-4f6b-9c47-300057a36f2e", "value": "Wox.Infrastructure.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d153bc80-84a9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643862543, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643862543, "uuid": "b7ee2ca8-065e-440f-93f1-c6b2e53dd351", "comment": "Malware payload (Heodo)", "value": "fc24305b7f01e0f4156910a412c393eb", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643862543, "uuid": "fd7f920c-d4cb-4aa5-b1e0-0eab36879f0e", "comment": "Malware payload (Heodo)", "value": "25470b543ec9d13eb1101539229cfb82cf2c5d182b22ece5b73c4ee9929e0d38", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643862543, "uuid": "9d239ee6-8f7f-48ab-8cff-cc01cd5b5016", "comment": "Malware payload (Heodo)", "value": "6be1e8a04485fa3ec5a19409a1aea488b462afa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643862543, "uuid": "0c6f95a4-fd7d-482b-b94b-17b92a858b78", "comment": "Malware payload (Heodo)", "value": "3c6f55b588fb7f7bcb4d0236725bdadc52bffd35a50e4070c5a0110089633d80caa4067b5cbd4d5d170ac0a76ea79b9e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643862543, "uuid": "0e6934f2-9c13-4cbb-9c79-ce0b7d7a96c9", "value": "T11525BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643862543, "uuid": "ab7cf34d-4e9a-4397-87e9-b3c8a054c965", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643862543, "uuid": "57793e8c-e47d-44ab-a487-cf7df07fc5f7", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gyFIIm2mlg:kBiaa4powXiolDS2gyFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643862543, "uuid": "cd3532ef-a241-41ae-a307-8c16b8322db9", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643862543, "uuid": "0c3f9243-707f-4177-93c7-30f9a8d8d760", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643862543, "uuid": "3e3141f8-437b-4c02-91b5-95dd8cc52567", "value": "fc24305b7f01e0f4156910a412c393eb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7438f05e-84ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643890304, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890304, "uuid": "d45e7c57-3e2f-41ba-862c-6f64626a1fff", "comment": "Malware payload (Heodo)", "value": "ddade3a6842db9cf243148aa26b45e1a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890304, "uuid": "d0ba0e90-d35c-4c71-8011-805e4d2275f5", "comment": "Malware payload (Heodo)", "value": "2550a4831cec3c7388ef96d92c5385aef30d0929b887a1e6d691fc4477e6be3c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890304, "uuid": "af684861-fc9b-427e-854d-1cccaeb04d5f", "comment": "Malware payload (Heodo)", "value": "aad9b3d09c2786c3f3ca7307e51625915f18841f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890304, "uuid": "5d626874-edae-4d8c-aac8-7743818acff6", "comment": "Malware payload (Heodo)", "value": "b91423db8f9703c3f06cfd18e30023b4cfeea0418ff4614ca806dee5cc46abb5a7175ad7a747f585621c1b4d2fcf9f3e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890304, "uuid": "56c1ff7f-f4a3-4173-91db-0ac5672ccef4", "value": "T15C25CF516D4980A1FA0B293D107A63660FEC690117E0E9EFDF05F8E75F26CC196788AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890304, "uuid": "43b2e593-2d17-4585-9eb4-ea1ea6a8ebdd", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890304, "uuid": "3e24ee65-9a10-43a6-9a9e-6e28fdaeb802", "value": "24576:O77NlW4ZujpK630cavFuwNUsjk6opl2VD+rNtl7ifTI5dTpycFIIm2mHL:6W4Z+LEtvFuwDjVK7GTC7ycFIr2mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643890304, "uuid": "410aca93-cdf1-4b6a-b11f-8dcca18d7ff2", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643890304, "uuid": "a2de749c-f0a9-4520-8d00-706aa8b0eb26", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890304, "uuid": "555cd7d5-e3c2-4b9f-bcd8-5b1274c5bc22", "value": "emotet_exe_e4_2550a4831cec3c7388ef96d92c5385aef30d0929b887a1e6d691fc4477e6be3c_2022-02-03__121137.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d46eec23-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856106, "uuid": "7074f77e-8a5c-4359-a994-7b72f085123b", "comment": "Malware payload (SilentBuilder)", "value": "81fea659dcb3a19c4f504e3a90b61af1", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856106, "uuid": "544f0fdc-c2cc-461d-a9b3-d6b7d112acc0", "comment": "Malware payload (SilentBuilder)", "value": "2579303efe67f88ddd48daa1e6c2515f0305360946d7e8de2defc4b4e2e28556", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856106, "uuid": "6b7da364-3ee0-4b3c-9bd3-fe8c88a4ae71", "comment": "Malware payload (SilentBuilder)", "value": "1a9cc72f523bb009108360ac461e427cf3f91d0e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856106, "uuid": "4ceaee09-1f23-404b-9061-27caa0fc7451", "comment": "Malware payload (SilentBuilder)", "value": "5d1b08bbe00044c17a9d5601315ceacb198aec7e7bce6c484444b6554b25105a0994f1f475f8d8a035243a64acb9ead2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856106, "uuid": "b9f3115d-68f2-474e-8e0f-d0e137e54951", "value": "T1C4B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856106, "uuid": "0f0fe316-94eb-45a6-930e-fefc7c9454eb", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49b:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856106, "uuid": "dcada2f7-de09-4c0b-b19c-e934e953f09f", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856106, "uuid": "08d13be7-f5bb-46d4-ac49-5c815ecee58f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856106, "uuid": "ece46221-e666-4e10-a2dc-1bd27d26bf00", "value": "2022-02-03-81fea659dcb3a19c4f504e3a90b61af1_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2ba35f6-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883215, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883215, "uuid": "0a23c29a-d7db-4187-99e6-5dacd6c4d61f", "comment": "Malware payload (SilentBuilder)", "value": "1f4e21690f058bea320f2c7f656c7bd7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883215, "uuid": "1f955819-e7af-47f0-ae36-06d96b33e652", "comment": "Malware payload (SilentBuilder)", "value": "257d467c9e052cec72b31f57147e1b250942c5bb022b0bc23b4c91e7ac9d8f1b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883215, "uuid": "230af215-4c63-48e4-ab69-b968fbe855b4", "comment": "Malware payload (SilentBuilder)", "value": "cb5342507172c4a120c3cb25b2df9d3acc0e67a8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883215, "uuid": "94c1d1b5-c843-4f08-a312-0bdd87936985", "comment": "Malware payload (SilentBuilder)", "value": "c5ebba9fe299685307985275ba53c4f653c1f9f8044e750e9b87c3f8466daebe9e1892ca28edf8cb99e8508a4da80d04", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883215, "uuid": "3f2bca87-a262-494c-a06a-2dbd7d82f0ea", "value": "T1FDA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883215, "uuid": "95998492-7347-4e7b-a3e4-cf38bb848ef5", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4t4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883215, "uuid": "0fe02523-19be-44ff-aaa8-fd3f6bb6cf72", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883215, "uuid": "8ea03196-bbbb-42af-90b6-2510306e3345", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883215, "uuid": "a59c7fb1-e381-4437-a48d-ec1fe7fbfb84", "value": "2022-02-03-1f4e21690f058bea320f2c7f656c7bd7_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0134d4f0-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855752, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855752, "uuid": "e91e1dd1-37a3-4f4a-a0ca-dc62fb0ff1e0", "comment": "Malware payload (Heodo)", "value": "7dfb159fb49505f7cd43b1f09bc68716", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855752, "uuid": "90f3b569-ae71-4644-90b0-eae765d5244f", "comment": "Malware payload (Heodo)", "value": "25bfcda38f5af6b7df84531d4b33cddf2f7ec42423150b4b6e4b1800ebe82e9c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855752, "uuid": "9c1b121a-7312-4ec6-a7ee-092275b0ff2a", "comment": "Malware payload (Heodo)", "value": "1dc499bbe36aa23917f779d39071cee3a59cbf28", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855752, "uuid": "5f70206e-b988-4a64-8306-04695871a07b", "comment": "Malware payload (Heodo)", "value": "13a33fc50edba8722d21e70a204788a3ed542004019c436e8116ed26bd55b9b4da6f89e7a678730c17283db141abc7bf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855752, "uuid": "c31f8471-136a-45a6-a375-3474c2917db2", "value": "T132E37B65B6C5D9C6DB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855752, "uuid": "4bdd64cd-54bd-47c0-b85f-17ae511875b8", "value": "3072:jcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgzGx0J:jcKoSsxzNDZLDZjlbR868O8KlVH3dehr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855752, "uuid": "6bb353ca-1fed-44e3-896f-46ae4870fd83", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855752, "uuid": "7954f3ac-9f09-4003-b4b2-b9cbfa5ce91c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855752, "uuid": "6daf2852-2396-45d4-879d-7dbb0497eb41", "value": "2022-02-03-7dfb159fb49505f7cd43b1f09bc68716_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "081c2f93-8525-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643915463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915463, "uuid": "1fed82ff-2c2b-4f40-ae56-4240c2ad76ec", "comment": "Malware payload (Heodo)", "value": "5c720415acb27a5e24d4e99237d561cb", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915463, "uuid": "6d419709-8ee8-4c04-ab35-b7b1fec41efd", "comment": "Malware payload (Heodo)", "value": "262a106f1b8cad166d2db82199e26177ccdf39810197db4be9fa6044b400d0ac", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915463, "uuid": "8c91296e-e100-438a-b32b-29b0316dfb7c", "comment": "Malware payload (Heodo)", "value": "6f5edb159a36b33c5c9dc04e8a7fb841be5e270b", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915463, "uuid": "d99d8038-bfc7-4b74-8ced-be4bb20d5989", "comment": "Malware payload (Heodo)", "value": "2648dfb7cea574b5dd1c44d531222996c9d315ce7a506a24cedbd5678dc9a96c556a3539196657041d732a119c90159f", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915463, "uuid": "c0cd3986-764f-42d1-b579-9d85d95950cc", "value": "T10325CF11AE4980A1F50B293D1469A7A60FDCAD021BD0ECDFDF44F9A36F12CD3957886B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915463, "uuid": "b7044076-d91c-4353-96e9-222fc6d3f38f", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915463, "uuid": "9ef15ef0-3eda-4c68-a612-c16cebcc02fd", "value": "24576:SCiv47/YUr3bti5wcjbnZeZfxan8hX1HlyOwLVttCAUXQEFIIm2mB:SCjYwLtMvgZfxailnFIr2mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643915463, "uuid": "b83a086e-9d38-46c2-be4e-abf8c9366ea8", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643915463, "uuid": "145300be-7289-4d73-8da1-dafef6846e33", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915463, "uuid": "991caf4c-dad9-4776-a2e4-aece03cc63ce", "value": "emotet_exe_e4_262a106f1b8cad166d2db82199e26177ccdf39810197db4be9fa6044b400d0ac_2022-02-03__191055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5039abf4-8519-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910430, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910430, "uuid": "3f763603-219c-4135-899e-e7a866369ebc", "comment": "Malware payload (Heodo)", "value": "39509289d74b1d89535bc234b3e3affc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910430, "uuid": "e293bc1f-04b7-42b7-a818-159ac6f2704f", "comment": "Malware payload (Heodo)", "value": "263419f9c1a0170fc93da91ac53a0653cec08ea9dcc64b739c05ebb529758b18", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910430, "uuid": "f3a966a5-593f-4f7e-8f4d-fce159a30cfb", "comment": "Malware payload (Heodo)", "value": "d226fee4d2f60f8bb9308ddaa73c10f3574a2df9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910430, "uuid": "6fe099d4-fd3b-40f7-b6e2-70876e2b5dbb", "comment": "Malware payload (Heodo)", "value": "f2bfcda35af947465c9e65d22d5539b933975d7686355f744eb7f296482bcd7582a3cb77dc235659a0606a3d4daa98f7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910430, "uuid": "e7ff1463-1f1a-4698-adf1-757bd0106cb2", "value": "T141E39D26B685C95AE91407311DD7CAF7333BBC818E7683473249F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910430, "uuid": "3de3af7c-6d9b-4206-9507-af6404de1d10", "value": "3072:fcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lc0:fcKoSsxzNDZLDZjlbR868O8KlVH3UehY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910430, "uuid": "e21be558-8421-4a49-9a71-ef8758a603b5", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910430, "uuid": "2d5c3c5c-b827-44df-a507-6470158ac97e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910430, "uuid": "1b71c9e5-5537-4bca-93b6-621e100d1521", "value": "tmpv595zdli", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd30906e-8502-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1643900762, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900762, "uuid": "5b1fe64c-da81-406d-9b59-8a8728d05c22", "comment": "Malware payload (njrat)", "value": "2325fcbf09d1dc499fe2282a3d6c4379", "object_relation": "md5", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900762, "uuid": "bf5c1c39-32d3-497e-b4be-0ac319211f67", "comment": "Malware payload (njrat)", "value": "263d2b7c09dbf2a03dcc6f171f397ab728fbf7b7a8fa0e25bd9c7b5bccce6a17", "object_relation": "sha256", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900762, "uuid": "66e04583-30ba-4a11-bc4c-9eddf863e318", "comment": "Malware payload (njrat)", "value": "ccb596ce375a335c30cbbfa12f92127309031213", "object_relation": "sha1", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900762, "uuid": "54570f77-4e3a-455e-bfd5-a906c7df7d8b", "comment": "Malware payload (njrat)", "value": "794aff30a711c7a41f946e8ddcf82d7137b6add3aefaddde49734b9aa5ab725f721ab93606ce9b28540f49d9d971d653", "object_relation": "sha3-384", "Tag": [ { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643900762, "uuid": "db675c5b-a8e3-43bc-886b-fc532dbc9be3", "value": "T1A384F1A0BD54293BF4E00E3E9901AD30F75CB934DC697FAB8EA496568DC324F0359693", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643900762, "uuid": "482156ed-a342-4f0e-b83c-b225818798bc", "value": "1536:DPKaw03IwLHpO1V1QJx7mda1EAB/n1lFx6r44V5NddTKoS+Dj:7K+IEAQ/P1PB/HFx442zTKaDj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643900762, "uuid": "d41fef4d-94e1-4a28-ac82-53d596623dc9", "value": 373597, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643900762, "uuid": "b4078368-1931-42b0-885f-79741b747497", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643900762, "uuid": "8fb5a7df-4aba-4546-8576-db18d8ead1f8", "value": "ozicnksh_Receipt.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e18817a0-8528-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643917117, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643917117, "uuid": "215b1acf-8af2-41c3-9d8e-6c826d084bd6", "comment": "Malware payload", "value": "14c1ddba36598b914d14ef03357a812d", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643917117, "uuid": "9d5704e3-d034-4067-9505-3d96f98b5aa0", "comment": "Malware payload", "value": "263d964e1b6c25b1aa55d15832d35c019a7251219ace4a4eb5a6caf2dc137e81", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643917117, "uuid": "25d4718a-3e42-4c45-a25e-71bde09143a5", "comment": "Malware payload", "value": "fa03f1e90a47f6bf04d5941e9e0b50dd44620166", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643917117, "uuid": "13e0c325-84f3-4045-8dbd-01ef9e889f1c", "comment": "Malware payload", "value": "724f7796f5b2b68111710570bd5d838e2f38469bf08fe2138fbce82d21a20ecf254a467398fd096ba90afeb3bf071f49", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643917117, "uuid": "019b4159-76f0-40c4-a47d-7493d6ca1a05", "value": "T18A74D07072EB8A94F56F8BF16539F8A1027232E395C6CA1C0B6C52880FF5F456E54A1F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643917117, "uuid": "93f6f8d1-a195-4ae4-909d-ce67b8173dce", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643917117, "uuid": "9d473be5-d1a7-4594-af87-48f3ee54868f", "value": "6144:/vtll37yTao2gysZTtgrJhXyr9lQ5AA2ALhQXADgFZIQ3UADaCUn3:/FGxZF9S5AAjOZ3ko363", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643917117, "uuid": "741e9999-adae-44cd-94a7-2aecb5c7dd15", "value": 366592, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643917117, "uuid": "5d9e55a5-e604-4982-8fc9-2b6738514dee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643917117, "uuid": "2e72054d-2e1b-4e2a-a522-c3ffe70ffc85", "value": "DHL CUSTOM INVOICE SHIPMENT WAYBILL DOC.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e15d99fa-84ce-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643878462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878462, "uuid": "0af3b627-8b98-4944-bade-eee0c320b34e", "comment": "Malware payload (AgentTesla)", "value": "6f8a982cda50c4c9db8183c953571eec", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878462, "uuid": "91a04a1a-f587-467e-826f-6e84aa2ffcaf", "comment": "Malware payload (AgentTesla)", "value": "2675fbd790bbedd9766ed354eb482cb4febd9de848e230e1f72aba283548af0f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878462, "uuid": "751d13a9-ed1f-4b51-9b0a-760532cfa53a", "comment": "Malware payload (AgentTesla)", "value": "de5f557dd600682d99783b95dda2b6b6f564387d", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878462, "uuid": "2f391fe0-e02f-4928-8e55-b400dfdfe465", "comment": "Malware payload (AgentTesla)", "value": "ff13540aef4d1d180c7e941710e6726c84d4fe462aebbcd74585c3db753602df3d3ae7711420f1a4e1ca2d1a517dfc8b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878462, "uuid": "ee4053b2-ab9f-4bb8-8867-45785f3ae889", "value": "T133F46BBC313075EEC9ABC431DB682D68EE506C77931B5667902731AD996CA87CF201B3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878462, "uuid": "bd506f61-7f3b-4953-9c28-d18539da2191", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878462, "uuid": "7c452953-d05b-4791-ba0b-8a25a148762f", "value": "12288:F+lfTQoOyocDQkjdh0BObwDPYr8bIwgKDwI+0QCi8397Qnb1wNMk6kUiUuqeQt+Q:F2r8bSQGglDPYr85w/CjoyjAUc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643878462, "uuid": "b0142490-2c99-4ff9-9903-df5017a93a4e", "value": 782848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643878462, "uuid": "c532e05d-0d2c-4055-8237-a0050e42d4c6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878462, "uuid": "86623f27-7e02-4dfa-a650-100b8904f2f7", "value": "gd6MCNSF9kwgvS6.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2779cd1-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856156, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856156, "uuid": "a285e1dc-4e15-4f7a-b55d-cdb4e50498db", "comment": "Malware payload (Heodo)", "value": "04df5a7804fe0d379b04e911f7c1697f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856156, "uuid": "1f351c10-7602-43c1-9a8d-e3fada343941", "comment": "Malware payload (Heodo)", "value": "267e0524c2a56675664efea936a0ca7678128eab5fba97b78778c35c1b3fdc6e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856156, "uuid": "e1bc171b-f81c-42d9-ad6e-102597f874e2", "comment": "Malware payload (Heodo)", "value": "17afe04798da888f9b0269726898e953b3e176f1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856156, "uuid": "f76baac1-80ca-4418-826c-f362cd1e639f", "comment": "Malware payload (Heodo)", "value": "0e07a62cb40edafce8724cd7c551fda9f9e3196507c00cf8b7229d176b16fb74d2ec77ecc851d63154ccbb03bc91f6c5", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856156, "uuid": "9374c416-e66a-47e7-9391-23cc8df79034", "value": "T11DE36B25B6C5D9C6DB0823350ACACAEE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856156, "uuid": "a7108945-adc4-4e7c-a70f-88a597f0ddf7", "value": "3072:EcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx04:EcKoSsxzNDZLDZjlbR868O8KlVH3deh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856156, "uuid": "5b319cb7-93cd-4760-9482-800a0f36d70e", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856156, "uuid": "bbdaf411-5215-492b-94a8-8b6d31aa2ce6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856156, "uuid": "55e2c710-0e45-4ad8-8bab-4aef579a2056", "value": "2022-2-3-04df5a7804fe0d379b04e911f7c1697f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2802d6a5-84c4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643873856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643873856, "uuid": "ed55d157-bb49-478f-a591-277b98abecf2", "comment": "Malware payload (Heodo)", "value": "4a34d6aeadf9d396b992230a1a73d3d8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643873856, "uuid": "07e8671e-2175-4c9f-addc-58611d7aa6d7", "comment": "Malware payload (Heodo)", "value": "269d1ac4e33c35df549152c671c7bc8b6fa6aeccc339687a4fedaffa8c2bd57d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643873856, "uuid": "4856ce72-3f38-4841-aeff-d8db1b086d35", "comment": "Malware payload (Heodo)", "value": "fa509f1e9fe5a2f28f3fa87721ba53d7c58823ec", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643873856, "uuid": "0a651eff-8d90-436b-87f6-d2cb04f2cc81", "comment": "Malware payload (Heodo)", "value": "c11801f69e14fd8059c2d553c66663ae1c46031675c54fcb0db1888206ec7815c792e1324738f5dfa9296705ff0e021c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643873856, "uuid": "1e13baed-9ad1-468e-a7c3-010485aef62f", "value": "T1C3E37B65B6C5D9C6DB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643873856, "uuid": "e2615c41-da34-4c13-ab74-35ca859b56b3", "value": "3072:McKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0W:McKoSsxzNDZLDZjlbR868O8KlVH3deh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643873856, "uuid": "47114d47-1183-4c4f-8864-807dfed18ac8", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643873856, "uuid": "56595002-a5f5-452f-89f6-1ce4758d894b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643873856, "uuid": "4b44c4d4-41f8-4b5a-b91a-1ab24c7ea647", "value": "VFO-010222 ZJGD-030222.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "45a88b4a-8509-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643903541, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903541, "uuid": "b36a0604-aa8f-47b7-9a02-67c6bf4f37a6", "comment": "Malware payload (Heodo)", "value": "755fdf0506de13c33b00cb4372c3b37d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903541, "uuid": "90d0742a-ccdb-4fce-bf7e-664bc72f0f9a", "comment": "Malware payload (Heodo)", "value": "269fdcfc5b962b835afc2100aa46649f0c6434745dc87760bf4f94f942f84264", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903541, "uuid": "4f9f67c6-4503-4c30-b150-6f7c0334d294", "comment": "Malware payload (Heodo)", "value": "424f79741540dff2fa2e8aa24884fa061807d164", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903541, "uuid": "f49e9655-5d81-4c6b-8d80-19651bf330e6", "comment": "Malware payload (Heodo)", "value": "a5a2b8ace78f47d170ffe5ccc6fda00113ac601bb34376a60b18cae1374072a048378e59804a687d6dadd2e63de43a62", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903541, "uuid": "dbde96fa-a196-49d2-9389-106da9997a1b", "value": "T1CDA3BF4DE1130DB8F2E5D43AC1485E107BB702DC88827B1BB684896DBF9C2F9565F27A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903541, "uuid": "a2383683-e06a-4418-9bd0-97e384f48afa", "value": "3072:p7vjgqu8hahYIfiQOVOveshVf4KwJQikmGo2:p7vjgrbtO8eOaDPk1o2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643903541, "uuid": "048e4cab-e0c1-4c94-9810-74850838e215", "value": 105976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643903541, "uuid": "91eba9c4-5eb0-4d7c-bbdd-43975cdce3ee", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903541, "uuid": "da8d06a4-d22c-4fb2-bf17-5a65285019f8", "value": "tmpfmrrsygz", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fb0548eb-850c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905133, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905133, "uuid": "e60ab093-f326-4216-8b8f-5b60deb2a77d", "comment": "Malware payload (Heodo)", "value": "b8453cba0cb846ee827970d5e0e2a983", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905133, "uuid": "a668c767-a018-49a8-b596-6fd93e1f2fba", "comment": "Malware payload (Heodo)", "value": "26b4cd2b6a0242a4532d9db711e7a5b620a0f5eafd6d4a797a0713a1e5e4ed7f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905133, "uuid": "2452d43e-2408-4ce6-abc0-26556ff61d9e", "comment": "Malware payload (Heodo)", "value": "81aa48ba575dfb95e7e0195805d715e4817fc63a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905133, "uuid": "ed0f19da-062f-41c1-94a3-4158103dbe81", "comment": "Malware payload (Heodo)", "value": "01f0645795577064da769284427ba0401382af9ee9b96d88f16feb3ee3f24304c927300f78b9d2c83a418c65f8689d01", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905133, "uuid": "65c8b9dc-cf22-49cc-ac7b-0f623f9805d6", "value": "T18CE39D26B685C95AD91417351DD7CAF7333BBC818E7683433289F71F6E7B6908A22207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905133, "uuid": "0cc633f9-9278-49fb-a95e-e1b255897564", "value": "3072:bcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lci:bcKoSsxzNDZLDZjlbR868O8KlVH3UehG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905133, "uuid": "622f95f8-472b-4406-8761-7aa85a69cbfb", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905133, "uuid": "d535a20d-41e5-49e8-8c2a-50ab9e87914b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905133, "uuid": "573fff6c-54e1-4cdc-99bb-bbc16ca0bcde", "value": "tmpdchvrks0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "efb3aab4-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643847132, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847132, "uuid": "840c96b4-fdac-46a4-bbed-91cfd665e69b", "comment": "Malware payload (Heodo)", "value": "e57149716094b8742f042365fe9c8bd8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847132, "uuid": "f4ea1b07-0abe-4ebd-951b-1962be005f6a", "comment": "Malware payload (Heodo)", "value": "26bad66172a89affdcfd3cbf5c6e0a2df538dc9783f3715e69e4011e6755ecc0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847132, "uuid": "01ad374e-bbf7-4e2c-8ed4-039f9a96e203", "comment": "Malware payload (Heodo)", "value": "be656973d5bcce727c5ad46ddb0a71cf158cef2b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847132, "uuid": "60822a03-db40-4284-b5e8-20d5bb6e54a9", "comment": "Malware payload (Heodo)", "value": "ee1a1e6b53bcf59fcebc91c537977b8252c5b44088596fa461b68a2bf49e8bdda85c318ce728d403f2eb84bda30b7407", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847132, "uuid": "387b72d6-f335-4064-9f08-378e63807d60", "value": "T1AFE36B25B6C5D9C6DB0823350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847132, "uuid": "b07f191b-6e42-47cf-afa4-0713245f539c", "value": "3072:fcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0j:fcKoSsxzNDZLDZjlbR868O8KlVH3dehN", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643847132, "uuid": "8ce6d64d-39d0-45a6-9996-cc5eb1adfde5", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643847132, "uuid": "489fa106-bc08-46c7-a13f-5453e773d97b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847132, "uuid": "56dfcd83-295c-49b1-a576-f11baf47ca51", "value": "2022-2-3-e57149716094b8742f042365fe9c8bd8.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "340f9da4-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855407, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855407, "uuid": "f8d134f9-4d0d-4af0-9784-a8a422b39d1d", "comment": "Malware payload (SilentBuilder)", "value": "150b8b16579d581df8661f4f91b762e4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855407, "uuid": "92cec3a5-22e9-482e-a9c7-57e608f8d65c", "comment": "Malware payload (SilentBuilder)", "value": "26cb689e607a40338d63dc13dca360c522a60140bfd1100c46c1207de0de5419", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855407, "uuid": "0765a795-73ac-4635-afff-990a437e2463", "comment": "Malware payload (SilentBuilder)", "value": "ea8e74891994d0fd74dcce281bbfae1064d1f5a4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855407, "uuid": "e4edcfc2-8840-42e6-9eea-701686a8f600", "comment": "Malware payload (SilentBuilder)", "value": "c3b6d0a4add238c65498dcde7fcb73de9485b62b6f4f5460e4b103fe45da5f268f287b55b7eda672c1c81b988172522b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855407, "uuid": "9d3a2715-b5bd-46e1-870c-35fc9194b2d2", "value": "T1CEB37C5A7365884EE55A8B3488F707962333ED208B5F06477115F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855407, "uuid": "e8d02709-0d83-4a31-ba93-1c1f9f37ab13", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49W:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855407, "uuid": "1a0f3605-92f9-4360-9389-a0758ea803b9", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855407, "uuid": "6779d617-1547-442b-82cb-d06905954010", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855407, "uuid": "1acae9cb-68cf-4555-876e-a3db77b3c001", "value": "2022-02-03-150b8b16579d581df8661f4f91b762e4_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed7a055-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855721, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855721, "uuid": "d5d9a590-b202-4fb2-97b8-b4fc01854e7b", "comment": "Malware payload (SilentBuilder)", "value": "4059845ad1c03c2034c20c1da89b4d88", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855721, "uuid": "616b7bcc-ae8d-4297-a58d-556be26b11f0", "comment": "Malware payload (SilentBuilder)", "value": "26f88d9563e1ec22ec719d983fddc7c21fecd9ee1cd60422e397df5a1c380b9f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855721, "uuid": "c2b7fa53-145b-48b4-acac-dd2dd5b5b904", "comment": "Malware payload (SilentBuilder)", "value": "1fdace318b82c40d331e07bbeb2a8868ab9d25d6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855721, "uuid": "02881922-6e94-4bc4-a87b-13f9b9d2d0a6", "comment": "Malware payload (SilentBuilder)", "value": "4b7ef896303124740258a197b6e42c60907146d4b224f5425eb28fe071a9a374167626b676f4b8fb7baebe5c141a536f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855721, "uuid": "2de53503-7946-4750-bbb2-8a7a5e60b681", "value": "T11BA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855721, "uuid": "dfb41fb4-4d08-4a27-b00a-72097e08a311", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4Z4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855721, "uuid": "6a0c65cd-d97b-4c62-b105-2d9d9b89c6a9", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855721, "uuid": "3b3f1816-956f-4754-9d11-84dfb08cac7d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855721, "uuid": "3fee152f-c403-498e-904e-6b4e443ff61e", "value": "2022-02-03-4059845ad1c03c2034c20c1da89b4d88_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "508bafc4-84c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643874353, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874353, "uuid": "c5cd1f79-e833-4f1b-939c-15f62085318d", "comment": "Malware payload (Heodo)", "value": "28cb2944b03c445e198a5e2fa2230503", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874353, "uuid": "39250d1c-10f6-4100-8624-135e6287fbed", "comment": "Malware payload (Heodo)", "value": "274cf35829d9276d12d33ca8f07eb74f80c3ea255dee2990399c85ba3d66c6f7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874353, "uuid": "c3807934-11b1-4846-b3b8-d4a28cb15ddd", "comment": "Malware payload (Heodo)", "value": "2314c5e6761ad2c81ed25aa620e129c562843192", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874353, "uuid": "cd07e2ec-9e8c-4659-bc2f-d2a57e771a2d", "comment": "Malware payload (Heodo)", "value": "0e561de19d95486fbd95f193978f9f55e56f0c990f11ec5830c2712eaa1cd34e3716ca218e877245375433d83e7b5e37", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874353, "uuid": "3e92936c-5797-4577-a747-91c5e3230b3c", "value": "T11BE36B2576C5D9CADB0922350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874353, "uuid": "9af2c017-16d6-4fde-beec-84f5b80a78cd", "value": "3072:ZcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx01:ZcKoSsxzNDZLDZjlbR868O8KlVH3dehb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874353, "uuid": "90c40cb9-23ee-42d8-b31b-cddc97f0fccf", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874353, "uuid": "a4cb2b39-6699-4807-9bfe-b5fe4b2abf4b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874353, "uuid": "9c1ed138-062d-40b1-95be-0fa7882dab88", "value": "Inv SS-7433.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fcf8d8-850f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643906197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906197, "uuid": "8f8a5339-40b5-4bdc-9aa3-6829cd507ecf", "comment": "Malware payload (Heodo)", "value": "a3514b1b03ff9a31d6a0a74632bdbb6f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906197, "uuid": "c13612f4-1e2e-455b-b71a-a4db29a5a574", "comment": "Malware payload (Heodo)", "value": "279bec9f22d9bbfe1d16d96e306adc6aa94b57fa24a65badcf7ccfca65a25dc1", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906197, "uuid": "c78ecb38-1204-429d-95be-886aa080e1a8", "comment": "Malware payload (Heodo)", "value": "e4b0736237e406f65a5756ea0acd013c2b8fde32", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906197, "uuid": "b3c61b1d-4014-4728-9e1c-b88ea9e9ae71", "comment": "Malware payload (Heodo)", "value": "1f86e89efb8790cf8a65aa7306ec5948153a84fed00152804baa8278c1d388eae7783d438605ab4fbd31ad9c08b9734f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906197, "uuid": "ff2f6891-689d-4650-ade9-ed54fa91723f", "value": "T12DE39D26B695C95AD91407311DD7CBF7333BBC818E7683433289F71E6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906197, "uuid": "0f2451f1-833f-40dd-bcfc-e997f23c8ee0", "value": "3072:JcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dg94LcX:JcKoSsxzNDZLDZjlbR868O8KlVH3Ueh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643906197, "uuid": "2d642654-7b22-497b-b142-11581517f03f", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643906197, "uuid": "3b853613-5b59-4580-a9e6-08516169afde", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906197, "uuid": "80fe0060-4639-4375-a880-46d499e10ae8", "value": "tmpyq22cuds", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c007a080-84c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643874540, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874540, "uuid": "9684fb27-2bca-40d6-931a-8ac478597fa7", "comment": "Malware payload (Heodo)", "value": "020bfdc68ae4113b3f37ba19f5ab0449", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874540, "uuid": "89dbfe88-4af0-4bdd-bf2b-3142edd0d685", "comment": "Malware payload (Heodo)", "value": "28049e5ee103ba901e8868d555f31329d545fcb14eced1b44b1df0d596fe06e3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874540, "uuid": "cfdbd3bd-e1a9-431d-b03a-efaeb69bc13b", "comment": "Malware payload (Heodo)", "value": "8ce61cce0125b0d12473218868c03994130b03d0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874540, "uuid": "62295bcf-6727-4143-b26e-5f3f8df20986", "comment": "Malware payload (Heodo)", "value": "9cff01b6236305ed9f27c42588871240b143edb70bd1598f2bdf880064064a4da694e918e9e90f072babc582076e80e2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874540, "uuid": "51de9b13-e0ce-4192-991f-cc65322c90f4", "value": "T127E36B65B6C5D9C6DB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874540, "uuid": "15e1f817-305f-47d6-9670-167514a85adb", "value": "3072:OcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0a:OcKoSsxzNDZLDZjlbR868O8KlVH3dehc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874540, "uuid": "a949ec1f-bc59-4830-ba34-17f3cbdd5bbb", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874540, "uuid": "dfe96a24-1183-4159-8d28-dee07c92c7ec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874540, "uuid": "8e340a07-d415-42eb-a3fe-97e1656c4c86", "value": "NI-4191 report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d495b201-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856106, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856106, "uuid": "265c02a3-a6fb-4fd8-b893-7ea60322b967", "comment": "Malware payload (Heodo)", "value": "f8b46bb4dabcc14c27682e50e57b9049", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856106, "uuid": "e6bbc546-43da-48cb-83b3-d6a1170e82e5", "comment": "Malware payload (Heodo)", "value": "282e10d8fd314a69a5dda3392b584db5909be59ff0355f6e9e4a562b0a09d6b2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856106, "uuid": "b8856943-6dfd-4928-9103-b43e4b4a7573", "comment": "Malware payload (Heodo)", "value": "c713d92eaf67af69bfd03b756d29c34d51856a53", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856106, "uuid": "e7751e13-ad55-4ea7-a633-85567fe973db", "comment": "Malware payload (Heodo)", "value": "ad913088f740b96bec63855afad1b4d75fd114cb72198f363e13133362a0487984a854175e7914aefcdf404809809bec", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856106, "uuid": "4baa14a5-e915-4ecc-b6e1-3f341277b800", "value": "T11EE36B2576C5D9CADB0822350ACACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856106, "uuid": "60aad971-da4b-40c5-8b3c-849d45def643", "value": "3072:ncKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0q:ncKoSsxzNDZLDZjlbR868O8KlVH3dehk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856106, "uuid": "1b9d597d-c1d5-4b98-bf6f-bccc209d3361", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856106, "uuid": "83a34036-f181-44c8-936d-41f43d2167c4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856106, "uuid": "3717cb3c-1c40-4dc6-ad3f-51285e261428", "value": "2022-02-03-f8b46bb4dabcc14c27682e50e57b9049_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a5130e8f-8508-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643903271, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903271, "uuid": "b6046f6d-c726-4d20-b353-da0d675e4d51", "comment": "Malware payload (Heodo)", "value": "02d9b2e1b863742ab1e6c9996e690773", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903271, "uuid": "26979a62-a1e9-42b4-a07f-baba8ff2c2db", "comment": "Malware payload (Heodo)", "value": "2839245b8fa204bcb04d1fef5bba9d843819d85b96a743525681521a354be409", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903271, "uuid": "ca1c7df8-eb8f-4551-9069-fc328996edb7", "comment": "Malware payload (Heodo)", "value": "86b2673dc516ae8fc8a66e4416192dd3953d8a2a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903271, "uuid": "d46f776b-b6ad-4c13-9aeb-4f299d5c35c8", "comment": "Malware payload (Heodo)", "value": "ad59551eed750330cd0f4bd9add60ed48a49bbde2e2229ad70b0108452d060f7758611a44592a224fc4f86f19e04ccc1", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903271, "uuid": "964036b1-08f2-44a4-befe-84a549f9c0d0", "value": "T170E39D26B685C95AD91407351DD7CAF7333BBC818E7683433289F71F6E7B6909A22207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903271, "uuid": "0a683d10-d636-49aa-9237-1a32a75b2d6a", "value": "3072:7cKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4LcO:7cKoSsxzNDZLDZjlbR868O8KlVH3UehS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643903271, "uuid": "2f8d30cb-05e7-4a85-a5ed-d6c0225c308e", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643903271, "uuid": "f7f8a6ba-9310-4c39-b0a5-64ac40dc0f5a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903271, "uuid": "400fc924-9849-41f2-a8c5-cf88e94f7985", "value": "tmpqdpl3x44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c00a2a3b-84ff-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643899451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899451, "uuid": "4450847d-6058-42f3-afc3-d2e90409be37", "comment": "Malware payload", "value": "aaea38b3bec07368a819a1e9b933cf9a", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899451, "uuid": "bc44aae7-68f2-4f3d-8918-c922d0e2fed8", "comment": "Malware payload", "value": "288d01de928a87d82d375bda4399423c1a214e10eebe6432d5c4eba8389c7d8e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899451, "uuid": "d02ee0be-53e7-4f8f-b900-65f045b379be", "comment": "Malware payload", "value": "42cc5a9335c13134f6cb61bd1fc3fa393ce2aac5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899451, "uuid": "67a14fc3-989f-4f6f-9dcb-f10dad40ca3d", "comment": "Malware payload", "value": "2d859e50b1c86a8f4975b1badc152a1e414e2111b802829296124217f33bc8cb4c274576022fd87aff8d002e7f7ec210", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899451, "uuid": "3508f2c5-af84-491e-93b9-25272d7bad6d", "value": "T1C194E1B076EB45A4F56B8BB52639BCA0037132F359C5C72C076862880FF2F55AE44A4F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899451, "uuid": "dc3d2f6c-e83c-4f15-807d-bc73b3dcc177", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899451, "uuid": "1f122c19-f27e-485a-8b60-21bebbbb1785", "value": "6144:HOZBl37yTaEaMduZKG8MfFRG/q2tucOuMJr+ElmR1tK+M4V9kZuaOiox2shp/21:4I3nBMfYhODrwRa+M4V6Yiefg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899451, "uuid": "70f29567-5744-4e77-be58-3baeff71fd75", "value": 408576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899451, "uuid": "8c22650e-68d9-4bb1-9d5f-83708f8ee69e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899451, "uuid": "da24dfb6-1a4f-4e19-b931-bb12cd4772df", "value": "Invoice document.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a58369e-84ff-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1643899388, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899388, "uuid": "25e5ff9b-df0d-4584-becb-28e3caf8b386", "comment": "Malware payload (Formbook)", "value": "cb0778d7fa870530f7ef8f3b3c4d23ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899388, "uuid": "450de705-f4d2-4967-92c6-df74bf9f3960", "comment": "Malware payload (Formbook)", "value": "28c337c65bf47de6ddca1d5e975f8dc8dfb86d3f1b9e14f7f2db464a089f6c06", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899388, "uuid": "4894b577-b8b2-4433-b475-d1b2ff34c74b", "comment": "Malware payload (Formbook)", "value": "64a22d8dc7dab49bc591cb6f1de2dff2be5e2af7", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899388, "uuid": "a8fff2dc-1d51-4a54-8550-44106e807706", "comment": "Malware payload (Formbook)", "value": "7e8e0e9a6629f6b9f12c19e9aa6147c4852cc78b38317f9918f02833957fd0af7cab2a5adf2257591cd60340e1cbe1f1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899388, "uuid": "cf8b0d73-e8b1-4acc-b5ea-3ddd97dc3a5b", "value": "T1EFD4D07BFE8BCA91D415293210BEB40507B23FDBA9D3C6063B58B3190F722654F9958B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899388, "uuid": "6f7258d8-b0e3-41cb-b2d7-6f86ee737672", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899388, "uuid": "281680e5-eb70-49a4-8973-69486e59bf00", "value": "12288:cptcEJL5dlVs0uk0vYv8LCXD3S0IRaF5vvJSFP5J:cIEJL40VvD2I5pSjJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899388, "uuid": "10fa1d06-dd34-4652-9303-ecaee38d7ca2", "value": 602624, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899388, "uuid": "a4fbfd87-5ef9-4d13-8a4a-520b80c6a643", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899388, "uuid": "29a60668-981d-4f21-8767-c378716f99e1", "value": "Orden de Compra 2022.Pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f4f9c54-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856420, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856420, "uuid": "7fc1ac7f-8780-43ff-9f1d-87bfe9854a5e", "comment": "Malware payload (SilentBuilder)", "value": "b5fcc056a364ad5f7eb7bcde210a34d3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856420, "uuid": "5d991fea-158b-45d6-8141-8fec59272a0e", "comment": "Malware payload (SilentBuilder)", "value": "28f64165c788e8b8d798b7f5923f932cb591eff85738f8206a9f2a5025df1283", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856420, "uuid": "7ccd71fc-d861-4603-90e6-63c76d4db5e6", "comment": "Malware payload (SilentBuilder)", "value": "756cbe05684d722fd2db3b54b22d5a2a9b2ab19a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856420, "uuid": "3e76b8e5-83d4-4666-ab06-9bf012e6e518", "comment": "Malware payload (SilentBuilder)", "value": "6300484133a4d05b7273b970c168712036183bc3f0f6213a4cb0c8c57c15f54d9608644c80c63f7fbc35f487aacc2e0f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856420, "uuid": "e20a5944-ce65-40a6-b4c4-436f25ec467a", "value": "T1F1B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856420, "uuid": "491701e0-1013-4381-95db-00c4748ab5c0", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49b:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856420, "uuid": "b0038de0-4376-44e0-a49e-ef70498973c5", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856420, "uuid": "b3a7beca-3bee-4680-a848-10d004736666", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856420, "uuid": "b944984e-9f69-4f2e-9327-3c2e1929b0c4", "value": "2022-02-03-b5fcc056a364ad5f7eb7bcde210a34d3_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8531087d-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855973, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855973, "uuid": "95027524-4e45-4f9b-9ec0-7e0d595ff213", "comment": "Malware payload (Heodo)", "value": "bafcf26c7590899f736b771c9581e5b7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855973, "uuid": "7d0f116c-773e-47e4-827f-4b029e476911", "comment": "Malware payload (Heodo)", "value": "2926362260fc071d32d63c2b98a2d38c0ea26a59a08b5a0e50febe298b8e0d76", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855973, "uuid": "7b50ea61-7881-40b0-a5cf-f56b61e018df", "comment": "Malware payload (Heodo)", "value": "41f41c39e6e4823cbefa17e614d09e36a3c9906c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855973, "uuid": "1d808ddb-b290-4811-9536-a33ee285c9ef", "comment": "Malware payload (Heodo)", "value": "6402a773df791f10b3093557f594fff0f5b07d561d2de6f6d3ab01aff9b4f9677bec065a602f698024ceae08afca343f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855973, "uuid": "cd92a349-98f8-4e74-a180-6d9ea406c1d2", "value": "T1B9E36B2576C5D9CADB0823350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855973, "uuid": "46c2d228-04f4-4395-a10c-5452d2a57e4f", "value": "3072:lcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0T:lcKoSsxzNDZLDZjlbR868O8KlVH3dehB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855973, "uuid": "e8258a09-ed20-4254-b663-50b21468aaa6", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855973, "uuid": "5b6b84ef-3a1f-417f-a546-9f8d4d57dfd8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855973, "uuid": "e6001e0a-ef68-4225-9c28-3c48f9f00b6f", "value": "2022-02-03-bafcf26c7590899f736b771c9581e5b7_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93fc3b8f-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856427, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856427, "uuid": "5847bcfa-e859-4367-b6af-989de55ee2f7", "comment": "Malware payload (Heodo)", "value": "4fd71b6addeaa60397ad2b161fbf509c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856427, "uuid": "ca7060d7-5160-471c-8faa-d41a652ed606", "comment": "Malware payload (Heodo)", "value": "2939592684c0143049b0c716cf91da84e06343071113a51163b24dbdba1f9593", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856427, "uuid": "17db1203-2e9e-485c-bcb8-3d2a0f4b32dd", "comment": "Malware payload (Heodo)", "value": "8ce4e7d6f0831ee7bbf4632e23b96df8357d0fb7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856427, "uuid": "78e49e94-a95b-4ec9-8958-6bab2378aaf6", "comment": "Malware payload (Heodo)", "value": "905d61b5a1617e273a322fd82aa6dd3a290650f5157a2d3fbb865d9560ecb29654e417630c4a7956fed690e11d5da3db", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856427, "uuid": "8758f1bd-74f8-4a64-8424-71b786c8d3ef", "value": "T112E36B2576C5D9CADB0922350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856427, "uuid": "d328fe77-db92-47c9-ab8d-23e6d59a4d6c", "value": "3072:zcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0Z:zcKoSsxzNDZLDZjlbR868O8KlVH3dehH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856427, "uuid": "fdcb5482-ab1b-4c9e-8280-7c70913bf78b", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856427, "uuid": "1c49ca80-544c-4334-98b9-c450dacd64ed", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856427, "uuid": "97112fa1-2b2f-41bc-b75d-03ad72c48587", "value": "2022-2-3-4fd71b6addeaa60397ad2b161fbf509c.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4c334a2-84c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643875380, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875380, "uuid": "d7e37496-fda1-4762-b54d-5c601e4ca483", "comment": "Malware payload (Heodo)", "value": "a99eb9a5a6419b27ee05e5be68f64d66", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875380, "uuid": "52006313-2e6c-4cd1-8902-78a2fb2b95fe", "comment": "Malware payload (Heodo)", "value": "2953e0f92c83a76e7d70759f7aa39178be0f9e75acccdd2cbf36029d8c41d8c0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875380, "uuid": "3e0ec1cf-66a7-4334-9008-547b8e107a4c", "comment": "Malware payload (Heodo)", "value": "ecc8717ddb8924d3e88f96965751dfdc97662ee3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875380, "uuid": "a649ecb3-aa16-4d04-a600-48cd2abae804", "comment": "Malware payload (Heodo)", "value": "3ded525fc9195028cfc0841023dc626ce3048cc49a779c667eacc2a4bd4471dbafd5bef9796e4c586523000dc4591558", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875380, "uuid": "485429f8-8d93-4ccf-92cc-ebc7d7a39359", "value": "T130E36B2576C5D9CADB0822350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875380, "uuid": "44e818bd-3f69-454a-bb4b-a0c17cb0599d", "value": "3072:VcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx03:VcKoSsxzNDZLDZjlbR868O8KlVH3dehZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875380, "uuid": "8cf3c3a6-6c9d-4364-9c6d-c7535654d039", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875380, "uuid": "cf445910-74b3-41ec-968e-d0c34a7de7a4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875380, "uuid": "f5084a8e-9c5d-4127-9e4b-b4b008dd0af3", "value": "GE-4174 report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "08745923-8525-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643915464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915464, "uuid": "08e7de34-c982-496f-b6cd-9a99527d6f31", "comment": "Malware payload (Heodo)", "value": "6448764c4573b9e8c20a0edb1bf86b7c", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915464, "uuid": "e2f11885-f6e1-42fb-9085-307d3b4c6d43", "comment": "Malware payload (Heodo)", "value": "2975e1685e47dfa1b45057080d847217906b3c85c7326fb9b87cbd21bc5ac278", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915464, "uuid": "a9b03e41-2b79-4bb4-9a40-8f47902d4fcc", "comment": "Malware payload (Heodo)", "value": "493d9e21d912fc15c2190601b2a61b6e9c877f45", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915464, "uuid": "d61d0ec3-17c8-44f2-ad20-4ccc931da56a", "comment": "Malware payload (Heodo)", "value": "ea8c90c5c5f9c5268446634369a84cfa2a82a8de65609d707d13b8e19c0edbbfb010cb0d010ba53db059589183fb34ec", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915464, "uuid": "bd28a3f2-6e2a-447f-9cd4-0fa2e956a78a", "value": "T18525CF11AE4980A1F50B293D1469A7A60FDCAD021BD0ECDFDF44F9A36F12CD3957886B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915464, "uuid": "473ed483-8437-41de-a020-fa8a1c96c02b", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915464, "uuid": "72f772b9-91fc-4426-9f37-f173bc3a8067", "value": "24576:SCiv47/YUr3bti5wcjbnZeZfxan8hX1HlyOwLVttCAUXWEFIIm2mB:SCjYwLtMvgZfxailFFIr2mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643915464, "uuid": "bfd5dc99-273c-431f-ad56-9bc261295f15", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643915464, "uuid": "99db9257-af60-4e1b-96be-45dbca4872b5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915464, "uuid": "390e87d5-7197-4efb-b67c-98aecdc700d7", "value": "emotet_exe_e4_2975e1685e47dfa1b45057080d847217906b3c85c7326fb9b87cbd21bc5ac278_2022-02-03__191055.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d5cfb4d-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846806, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846806, "uuid": "90ef9dfc-ab81-47ab-a9b1-1c83fd76492f", "comment": "Malware payload (Heodo)", "value": "cb1a420dd73c8590a64a024f9ba6ffe4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846806, "uuid": "f5e655e9-8add-4d1c-ae50-16cad76f348a", "comment": "Malware payload (Heodo)", "value": "2985e1a164c368d959154571065a11d70acf5fb74a16d2f8bd020af60b054c9f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846806, "uuid": "efe0d575-0139-45ae-88f4-597fe412b64d", "comment": "Malware payload (Heodo)", "value": "cfdc0ab397a15027d4bae7192cddf14e75594ad7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846806, "uuid": "17020b5b-be60-4ae5-a812-0e42c31dfb7d", "comment": "Malware payload (Heodo)", "value": "58a98c693c49937ad88a41cd47d1749a78343c3a701faf35362d31ba548f5451ea483d7443160cd658242808da44253f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846806, "uuid": "294d0550-29cd-4b8d-af7a-1998e4701a27", "value": "T112E37C2576C5D9C6DB0922350ACACAFE2327BC479E7643C33158F31E2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846806, "uuid": "1f8068c1-4988-40b7-a24d-fb73f5cbadd0", "value": "3072:ycKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0y:ycKoSsxzNDZLDZjlbR868O8KlVH3dehQ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846806, "uuid": "8089eabe-a78b-4316-9d6d-cbc68dae38ca", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846806, "uuid": "aa401505-4382-4c50-8710-0fa8f69966ec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846806, "uuid": "b8f1546c-198a-43af-90e1-7c8f11515cf9", "value": "2022-2-3-cb1a420dd73c8590a64a024f9ba6ffe4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da0e3d83-84d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882315, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882315, "uuid": "ac7100eb-5f63-425b-ad2a-b4bb9802da0e", "comment": "Malware payload (Heodo)", "value": "55ec415c3917b71291089d383797884a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882315, "uuid": "2d741013-4d7b-46fe-b78a-ed231c161bdc", "comment": "Malware payload (Heodo)", "value": "29b0dd7022304226140bec2184384ac9181546c1052b42627e220eefd3e7e3dd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882315, "uuid": "168c812b-e74f-42b2-90e3-fd231085fd5a", "comment": "Malware payload (Heodo)", "value": "1bb9509e6d07b76df56eba4d2615832c9a6718a1", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882315, "uuid": "7edf6158-f2a7-477e-8b35-20a2aa02af47", "comment": "Malware payload (Heodo)", "value": "a8cbce3e73c7880264a0c034dd53d0764bb9e5372a210354a69dd4021cef94d9a6b06432bc0107d75c0c2a2d47c043e3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882315, "uuid": "8da01f83-9419-4539-934e-83c061dd5388", "value": "T14425C0216D8A40E6FA47193E0069B3544FDC69050BE0E8CFEF54F9A66F12CC25B785AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882315, "uuid": "8a4380d6-9d50-4e27-ab7b-ca1be71fff4a", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882315, "uuid": "8fb991ce-c961-4f6f-82e3-bee577777080", "value": "24576:vyj4pucLsugl4zCy9fG+OVE+cXcs2vU2FIIm2m0:vzfnl9fYVoDv2FIr2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882315, "uuid": "975754bd-4769-4f5b-ab1b-2a08436a7424", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882315, "uuid": "873b89cd-ff5f-4b6b-9223-08d655e6e200", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882315, "uuid": "42801eea-05b9-4023-bca0-52da3d41f5d5", "value": "55ec415c3917b71291089d383797884a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af6305d9-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883961, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883961, "uuid": "e3df2586-4d27-40c1-86ba-106dde027478", "comment": "Malware payload (Heodo)", "value": "c3a5421513df1dad536b319e4eeb1cd9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883961, "uuid": "0ad7f8a7-15bd-4564-b3ed-0d4e9adb868b", "comment": "Malware payload (Heodo)", "value": "2a12970a58b9fa71c40724651e8a4b9d6ad333f51054d609dcbca14802648803", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883961, "uuid": "c70e8138-579c-46e4-a434-3b9130e7b3b1", "comment": "Malware payload (Heodo)", "value": "b50ca19fc48f0cf8be554468c971384f19ff6b39", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883961, "uuid": "81a09571-3f93-479e-b24a-61ceea52f376", "comment": "Malware payload (Heodo)", "value": "dda53ad8fb866bf82f6249f283e0251bd0857bd29aca12769c83de7cab7304eaf41e24b5df05d9a4a64a1dc910fe9f6b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883961, "uuid": "819119a7-a06c-4af2-a428-4e934048d1e1", "value": "T110E36B6576C5D9CADB0822350ACACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883961, "uuid": "137ae659-a987-4866-b6e7-4187a8d3f704", "value": "3072:9cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0K:9cKoSsxzNDZLDZjlbR868O8KlVH3deh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883961, "uuid": "4358e226-1c27-4dc4-bd1b-4aa7ebd8799f", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883961, "uuid": "862c2528-0e76-43db-8de6-3f613cb85412", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883961, "uuid": "33ebfc72-91c8-4741-b99b-a1be2303538c", "value": "2022-02-030922.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "70e8af49-84e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643886004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886004, "uuid": "5e71faea-1814-43a4-820e-70ce7a4d8336", "comment": "Malware payload (Heodo)", "value": "cf17ff34829f05865c1f65d585cb55c4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886004, "uuid": "f58f05ca-7f8a-4342-aeb0-656a0f089ef4", "comment": "Malware payload (Heodo)", "value": "2a2e399aff54ae6f55edab9a11d357ab18ee8a31c04cf02007446d850948f324", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886004, "uuid": "cb2d5557-ed1f-4bb0-8d10-6a462242f121", "comment": "Malware payload (Heodo)", "value": "c0d9ce3af6a9008fb57889cd6890e6c461556eda", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886004, "uuid": "087bb69f-803a-463a-9376-44c9ccb0c909", "comment": "Malware payload (Heodo)", "value": "8978480b2da3268f9e0127159b89cc6acd396d0850bdab63a89c25c5a9e9ecddbe082156932cc9660c943b93aed48fe8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886004, "uuid": "434fe7ba-248c-4b6a-b619-47e115eb1138", "value": "T17AE37B2576C5D9CADB0822351ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886004, "uuid": "385680bf-9f8c-4583-b927-c2de4d968052", "value": "3072:bcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0+:bcKoSsxzNDZLDZjlbR868O8KlVH3dehw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643886004, "uuid": "7123964c-f689-43c0-b9cb-3511eee4e7af", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643886004, "uuid": "5c441f94-8a4c-4614-862d-35ba460dc517", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886004, "uuid": "efe4ee83-ffeb-493d-9816-5bd56648bb20", "value": "2022-2-3-cf17ff34829f05865c1f65d585cb55c4.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cebe523e-84de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643885302, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885302, "uuid": "4e61c680-11ab-4e7b-8aa8-517c51f5eca1", "comment": "Malware payload (Heodo)", "value": "9ac609e7d38cb953fe33d77eb01ce6c2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885302, "uuid": "ba85c59f-9ee2-49f8-986e-6b604229db80", "comment": "Malware payload (Heodo)", "value": "2a41a62c230c037037d905807a9b32f6b260ea6fd3efe74e29c985199a395e7a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885302, "uuid": "b88c1bd2-fdfb-4a36-a5ed-bd4e1456a6a7", "comment": "Malware payload (Heodo)", "value": "b8f9c9368daedd3c516e85f36047222c14908e52", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885302, "uuid": "d258794e-4390-4b55-a9e1-9d4007f81612", "comment": "Malware payload (Heodo)", "value": "cc6306a8637bb0b29efd23300ce324aae309a9de3d42d05fb1829b03061e4409c65a2a70e540171b2c6a61def5ca314f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885302, "uuid": "39bebb3f-a73f-42b0-8ed2-5277296cf103", "value": "T14A25BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885302, "uuid": "578b4f3b-5ea5-4ed6-8d33-2f969cfde656", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885302, "uuid": "ce01a507-28b2-44eb-8f3a-f4604fcc2676", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gEFIIm2mlg:kBiaa4powXiolDS2gEFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885302, "uuid": "74f5396e-63da-43f5-b1e7-a1db8b8303b2", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885302, "uuid": "05d9791f-86fe-4199-ae0b-09d1ac909fe1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885302, "uuid": "f327188d-eb23-48f6-a7c8-837a3037510d", "value": "9ac609e7d38cb953fe33d77eb01ce6c2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e7c57faa-8508-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643903383, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903383, "uuid": "46efdd73-18da-4599-a23a-e35e535ccc53", "comment": "Malware payload (Heodo)", "value": "8093a654a6046f5d3722f0ab853f0bdd", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903383, "uuid": "985d4966-84f8-4c41-a6c2-6a8fd9887290", "comment": "Malware payload (Heodo)", "value": "2a6a0f550d085758b1bf56bf5eb76674f32eac6039d7a504d0362e1db97afb26", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903383, "uuid": "788740c5-0acb-4970-a2c5-50b1b5f3ec2f", "comment": "Malware payload (Heodo)", "value": "666ee7979e370b561bb71ab098145703c68e3743", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903383, "uuid": "e63c6aac-5f29-4f2a-8c3f-afcf170c9d0b", "comment": "Malware payload (Heodo)", "value": "9c2730f6e878ac4ed5f42f819bc5aa37ab3119614154abef424733b334534ad4d88c2b0dbe4211add071df237042bd29", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903383, "uuid": "1c44c38a-2c97-4286-9524-6870a648ae95", "value": "T1FBA3BE4DE1130DB8F2D6D43AC1485E107BB702CC88827B57B684896DBF9C2F9569F17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903383, "uuid": "c747c505-f8a5-4f72-a1c8-4ec03af09806", "value": "3072:t7vj5qu8hahYIfiQOVOveshVf4KwJQikmGoL:t7vj5rbtO8eOaDPk1oL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643903383, "uuid": "26edc844-75c2-4289-84bf-8c8aa8e10015", "value": 105965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643903383, "uuid": "9a414602-0b0b-4862-a270-10c940cee298", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903383, "uuid": "3f2312d0-ffa2-4299-a149-ea040c921236", "value": "tmp18lirbh4", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2b29374-84c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643874947, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874947, "uuid": "6f8ff8f2-0d2d-4459-8137-6d7fc51fa4ad", "comment": "Malware payload (Heodo)", "value": "78d6fca6ded1300f91715d4bcbd6ac61", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874947, "uuid": "ede6a9c5-c785-4427-9c95-982a0581a012", "comment": "Malware payload (Heodo)", "value": "2aadf4a53cf41c772e740237d946383c9145a1faf71130bd39b6f354eef48534", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874947, "uuid": "51fa75c7-6ed1-44f6-9dbc-27c92d989a28", "comment": "Malware payload (Heodo)", "value": "26b274e592b00dffc31f9e4912ed76d5fe4c1f9d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874947, "uuid": "be12a344-7aec-4bab-89db-7760e9671d74", "comment": "Malware payload (Heodo)", "value": "29283cbfc2dc6dd8bccd8c97a6a7135b841418d5ca35774be735b72134ea8b55134ee689cdbc076bb1d89b95a7b52668", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874947, "uuid": "f0a1afe7-2102-41dd-b34a-1646dfbcc28e", "value": "T1CBE36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874947, "uuid": "2125acfc-9ae7-49aa-8379-653dd3a44b95", "value": "3072:VcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0f:VcKoSsxzNDZLDZjlbR868O8KlVH3deh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874947, "uuid": "471120f1-f01b-41cd-9947-2d9ead0e3044", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874947, "uuid": "02cf0c1b-45e5-4c8b-814b-1ac3572c0478", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874947, "uuid": "ca47e82e-0eaa-40fb-90af-b3fbdddd770a", "value": "WDB-010222 JZSF-030222.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "536a19aa-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882948, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882948, "uuid": "ced01e47-d1ef-4635-875e-63eaf9ef78d8", "comment": "Malware payload (Heodo)", "value": "6a4481297c315ba61c33ea06043417ea", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882948, "uuid": "eac6c937-8d94-4a88-9dca-d4c0a350331a", "comment": "Malware payload (Heodo)", "value": "2b3774099f0d10a7be013aa90cecf3422b57d2828949295eec5fd67eb0bc72b7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882948, "uuid": "3ae0db3f-d27a-4b05-a8b4-d3e5bcb66493", "comment": "Malware payload (Heodo)", "value": "a594841a6dbe57c099843ed63e25a119b55845ee", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882948, "uuid": "5cab518e-4f2b-489e-9ff7-26863ec76932", "comment": "Malware payload (Heodo)", "value": "2d771244410ba1e7f0eac47fa9a9f981d739b1b0d4541e0bc3a0d94f99669bb2efe585d7ee188f6fbf06feb5261035b8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882948, "uuid": "276e4aa5-089f-42f6-85f0-94f061090181", "value": "T1EEE36B6576C5D9CADB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882948, "uuid": "fe0e02fd-e19c-4b9c-a6d0-d93d756fa003", "value": "3072:zcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0D:zcKoSsxzNDZLDZjlbR868O8KlVH3deht", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882948, "uuid": "4e7f2045-1419-426f-ab5b-5a11dec844eb", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882948, "uuid": "95bd3e9a-fd3b-4920-817c-6b8ba6c5778b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882948, "uuid": "4b7a93cd-d178-4ece-9c86-01afd63f42eb", "value": "2022-02-030936.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f0a03c31-84f1-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643893520, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643893520, "uuid": "80f34983-3c99-49f5-8969-80538b601e6e", "comment": "Malware payload", "value": "19682a751e311f203c1ca7edde2ff24e", "object_relation": "md5", "Tag": [ { "name": "pw 164", "colour": "#8D90FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643893520, "uuid": "7cc03a74-d92d-4eb8-9295-9b9386462bc2", "comment": "Malware payload", "value": "2b433bb2fc9058a2f99b5e32ce534b9cc51eef310ca5583c4b540da469df2cc9", "object_relation": "sha256", "Tag": [ { "name": "pw 164", "colour": "#8D90FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643893520, "uuid": "f5d8eefb-f0bf-4b53-8e65-1aa467d8eb46", "comment": "Malware payload", "value": "0d976716228f28efa12ca031c6bd52a303078d8e", "object_relation": "sha1", "Tag": [ { "name": "pw 164", "colour": "#8D90FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643893520, "uuid": "59055932-4a25-4cba-9010-fc571053ff72", "comment": "Malware payload", "value": "939ec4a7365d1eeccac2b98c654c70f036ed27cc006d88190e99292407a4bc36dd80e2c226163c0d6257a9dbfc7082e4", "object_relation": "sha3-384", "Tag": [ { "name": "pw 164", "colour": "#8D90FC", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643893520, "uuid": "d2c9e826-40e9-467c-bcc0-9e5ae1156ca2", "value": "T14B831298244F8DF6FDEF4850275DCA8188636CDBE3EB4E1884802850D9E15D8AB16E87", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643893520, "uuid": "51d31584-5225-4eb6-86ea-e206c68b1da9", "value": "1536:SElyeX6iso91vY83H5TDUjv0W/yTr7DYwir4f+IJIEjsD1c9AL6:SEYiso7vz3hDcsW/SDFUk7J/Am", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643893520, "uuid": "d7a47e8c-5d6f-4e40-bafd-ffddbf1e20b2", "value": 86576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643893520, "uuid": "f1f7af79-4735-4455-a70b-afb920bf3b3e", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643893520, "uuid": "92752a1b-c0ec-4d03-a1a6-2adcc65641f9", "value": "IZJ-03022022.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1bb74759-84cf-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643878559, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878559, "uuid": "321896ae-1b29-4ec6-9f50-7d3b81d3b5cf", "comment": "Malware payload (AgentTesla)", "value": "611e2838acaba7b86ed0f40c3d0c81fb", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878559, "uuid": "67136fd4-57b5-4a37-b6ed-d5e9a521cf4d", "comment": "Malware payload (AgentTesla)", "value": "2b4fa26a5a067ef50884beeca0a77f96f233b4539ec7d31242e9cc15c7aaadcb", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878559, "uuid": "82d6cdeb-b52a-447c-8cd6-3e6b867b9574", "comment": "Malware payload (AgentTesla)", "value": "096ef826290ed3317e6fd988bd619450e10dcd93", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878559, "uuid": "59d695e2-1e3c-4432-9982-0fe54cbf592a", "comment": "Malware payload (AgentTesla)", "value": "1e36d6f110d231a3ed5830242a6934e7bdb236c2954d93b8d5de0bbdd8ebf8d1ca2cdbd795af593c454529709bea7ea5", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878559, "uuid": "32166217-93cb-41c4-8e6f-1c248181f658", "value": "T171B4AE70A1AB8555F00B8970257CFA6102B23DE3A9C60D3917693E47FBBDF883E4564E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878559, "uuid": "fe8734cb-82bd-425c-8de1-bc286fe69dc5", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878559, "uuid": "4b83fe81-53e8-47c1-b286-ee6b01b86bc2", "value": "12288:MQVO7JV329vN6qCTVi9zkwgPmGywL2uegnv:xVOVV329EPxiewg6dgn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643878559, "uuid": "954c7a89-02b9-44a8-bf9d-6e557bd283b7", "value": 526336, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643878559, "uuid": "a700f772-35ee-4443-9983-223a6182a182", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878559, "uuid": "1e17d5ea-c12a-429d-b71d-54befbdce710", "value": "611e2838acaba7b86ed0f40c3d0c81fb.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc118819-850d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905457, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905457, "uuid": "65cedec7-1888-4996-babb-073d7013c10f", "comment": "Malware payload (Heodo)", "value": "c9b9ab6aa930b7a5fc80479bc33eb8c5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905457, "uuid": "82626960-3dc5-4253-bd5b-c31c05e1d30e", "comment": "Malware payload (Heodo)", "value": "2bb9656459ae7286961c2481c11fe9cd802e6b2a681a4be8b1136317a1c59064", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905457, "uuid": "10e3af5a-e0e7-4bb7-af5f-7004f2f31bbd", "comment": "Malware payload (Heodo)", "value": "1a4c29eec3d016fbc4434a0c2a5acdc3ecd38332", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905457, "uuid": "76222028-4b02-476a-bfdc-be2d03bc0a27", "comment": "Malware payload (Heodo)", "value": "bcf55a6ef2d58c326723a1773b4e27287318e2306ba783c275cdffffe4f7c87c70d699802f38ae512730cdb50533a72e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905457, "uuid": "a8efbd01-d58f-412b-a7fc-8626139f0d14", "value": "T1F8E39D26B685C95AD91407351DD7CAF7333BBC818E7683433289F71F6E7B6909A22207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905457, "uuid": "4b863110-e324-4e1c-a45e-7beb9548042b", "value": "3072:McKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dg94Lcd:McKoSsxzNDZLDZjlbR868O8KlVH3Ueh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905457, "uuid": "1a93904b-154f-4989-aa92-2f4a77890eac", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905457, "uuid": "f362e09f-06b7-4a53-a1e6-4511b260c941", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905457, "uuid": "76595117-5e8b-4fc0-9c21-7544f2d33eef", "value": "tmpyvs33a5c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f81dfaf5-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883654, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883654, "uuid": "20a2dcc8-e021-4610-8fdb-438dc6131119", "comment": "Malware payload (SilentBuilder)", "value": "950406441eee28ee3cff015f2e3b8c9f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883654, "uuid": "daae98cf-4b49-4d8d-ade4-8185b57c25de", "comment": "Malware payload (SilentBuilder)", "value": "2bf48c20b48e4ca007993f9dd3cd141883f8b52252be3dd9e2d3a2531dd504a1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883654, "uuid": "996476cf-b563-4ed0-b5c1-147fa943f83f", "comment": "Malware payload (SilentBuilder)", "value": "ef3fc327e4b3cc51894f0050a1de95710f5a572f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883654, "uuid": "4fcaf96e-d5c6-43a6-be93-374759947d2b", "comment": "Malware payload (SilentBuilder)", "value": "d5e43428b70cda7deda78b241e99376be6703a2a0d0e536481c1265953ff225c28d31739c1dbea6f5800a9aec66ddc28", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883654, "uuid": "93da2af8-b221-4350-8eeb-9b901ffa841e", "value": "T15EA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883654, "uuid": "5c0fe01a-4db0-4f70-b81b-f11c1975a8d1", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4d4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883654, "uuid": "0555d79c-3d92-47ca-b3be-f285c427262f", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883654, "uuid": "3d2bcc65-2792-438e-91fd-14ce0d2fba04", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883654, "uuid": "3b0a828f-beb3-4971-ab48-2af31f97cfa2", "value": "2022-02-03-950406441eee28ee3cff015f2e3b8c9f_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3163afce-850b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643904366, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904366, "uuid": "48ca6a4c-df30-400e-ab1e-5edbc5e22f2f", "comment": "Malware payload (SilentBuilder)", "value": "0df46d70b95d13224ee8551684513d31", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904366, "uuid": "9b116f78-5bbd-44ef-bea3-e33039e687ae", "comment": "Malware payload (SilentBuilder)", "value": "2bf60893f54cd2d62f735cc92857cea5df11ed3d2757a96c4321787fd4172f09", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904366, "uuid": "f2730762-fa3a-46c9-9407-c975aca9f4ff", "comment": "Malware payload (SilentBuilder)", "value": "65a27e4cc94813ea4a006780dfde4641d1026f99", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904366, "uuid": "75ecff52-6aed-4c9e-8748-2d39ff227e05", "comment": "Malware payload (SilentBuilder)", "value": "3b0273d64dc27c2ba5dd4cd2cb41794bbfe28acfce22b537a9ca4ca5ba6630267c6453a0315981257cbabe6b3a47a477", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904366, "uuid": "ca43bc73-1085-41d6-9d43-96f38ce1bdc2", "value": "T18DE39D8AF25B0D68F192CA3584DA4B1437B39CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904366, "uuid": "0375b9ee-7e0d-470c-be64-1775cd305135", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgfquZha9YILiQaVObeshRTEKwJQiQmGo:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904366, "uuid": "fab74f6c-4652-467f-80fe-7792ce71c656", "value": 148484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904366, "uuid": "8cd4b536-e774-408a-a9f9-127fbd277412", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904366, "uuid": "3eb78a32-90f9-4089-9e9f-3bc533414986", "value": "tmpoe3qvxbs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6fda97cc-8506-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643902323, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902323, "uuid": "5f5b9efd-f0bf-48e6-8d00-d78b35c9da91", "comment": "Malware payload", "value": "702a849966c67ea1df9d8e6be7ede02a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902323, "uuid": "5c5ccc54-cd64-4cd9-a83e-7e0b58acc92e", "comment": "Malware payload", "value": "2bf6399ed310e8735f371d3cba94690b4f1e80297c5ff6c79e53a492b64a2f7a", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902323, "uuid": "db7a784a-2af5-41df-88cf-fc28770e38a2", "comment": "Malware payload", "value": "3889012728ba3fc5f5e1401aa63f733b66f2886f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902323, "uuid": "04f51a80-91e1-4d53-b9e2-ecbff969cfa5", "comment": "Malware payload", "value": "9f19e77f9fa34bf411529411e7db7f0bdf3e2e490521f5610e94ae7d3e01adc263c58ed6bcd21e9ee20e4aea8b53f433", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902323, "uuid": "fb63be8f-7574-4bdb-8e37-150c10c33da1", "value": "T1C9B3CF69B759DC85E804133618D78EA73717BD814F720783765EF70AAF7B6904A2320B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902323, "uuid": "3d19125f-c609-4d1b-8a18-e71b01115eab", "value": "3072:lcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lce:lcKoSsxzNDZLDZjlbR868O8KlVH3Uehz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643902323, "uuid": "f8a163c8-62bb-4b7b-bc15-081457fcf387", "value": 114286, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643902323, "uuid": "1efc8951-18e9-4630-9833-3c7206854d12", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902323, "uuid": "77931eba-2a03-47b3-82ef-763fad894007", "value": "tmp_gmg52q5", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00e02b21-849c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856610, "uuid": "31bdd66e-8931-4379-873f-f4bee4784248", "comment": "Malware payload (Heodo)", "value": "7ac72e5214d1bb39c0334ebc93ab56db", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856610, "uuid": "6cdcff92-4ebe-4bd5-9f78-906b4c344240", "comment": "Malware payload (Heodo)", "value": "2c90bc1e80f13da59a5d2498c08fa3363cd45919a5a34799891fab59594f8e5c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856610, "uuid": "d4eb6eae-ccd1-4d94-bc56-d2ccbb441387", "comment": "Malware payload (Heodo)", "value": "4a99d40eb7f9d9fef9dacbede97a9cfb1768653d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856610, "uuid": "bc09d358-8cdf-4a12-89d6-6c4cd50823f6", "comment": "Malware payload (Heodo)", "value": "a720bb409f6d5e52bd043d01850a363364e82aa9c0672facd53231542f07ba82b6a563e13d3da8a1fc59575353bbaaa8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856610, "uuid": "4871859e-22ab-482a-b5d0-cbe38cb165c5", "value": "T1B5E36B6576C5D9CADB0822350ACACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856610, "uuid": "ddfc44c1-7537-4ce6-bd38-8f3767c7605c", "value": "3072:RcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0M:RcKoSsxzNDZLDZjlbR868O8KlVH3dehy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856610, "uuid": "19af5a9c-e9ac-4494-aa43-91655660f035", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856610, "uuid": "5b6209f7-be02-43c8-81ad-8a8caef72484", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856610, "uuid": "2f9a4aed-b69c-4635-82a2-4239fc9b6c84", "value": "2022-2-3-7ac72e5214d1bb39c0334ebc93ab56db.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7a6684f6-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855526, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855526, "uuid": "6a246b56-eb92-4e51-b502-ec66c0c9d12b", "comment": "Malware payload (SilentBuilder)", "value": "2e5fe3ceeaf6be4fda00215c91795534", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855526, "uuid": "f41dc5fb-3b0e-4101-86bb-da8d29718f81", "comment": "Malware payload (SilentBuilder)", "value": "2cd0ca797e0c09de1e47a6acd0f44bab672f8bba7d890e148742d40847a5d83e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855526, "uuid": "9d9b8acf-922b-4a53-ade9-65626554b072", "comment": "Malware payload (SilentBuilder)", "value": "4c1b44e556b8ad7a6b79d7b4d6afd7e4d6ced538", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855526, "uuid": "5fe087b9-3198-406c-9303-e57d8391efd6", "comment": "Malware payload (SilentBuilder)", "value": "28fa9df2aa005f8ac42bc6bb0500fc4aba8a019b91112be842b258013943830fc6d74490df323b6580c7d726f387cdcc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855526, "uuid": "108e461c-a13c-4d7a-a3f8-2de33ee150e6", "value": "T1F4B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855526, "uuid": "ee82f704-a888-41ee-ba28-0f0f68e0652d", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49H:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855526, "uuid": "6ff2d073-7411-493d-8ff9-eb6e4a72d7d2", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855526, "uuid": "d576866c-c046-43f1-ac6f-ab72489ad532", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855526, "uuid": "fda15614-5675-46e1-b67c-4b5673365d8c", "value": "2022-02-03-2e5fe3ceeaf6be4fda00215c91795534_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1de4619-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883160, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883160, "uuid": "cddcd98c-b95f-43a1-ba19-6f0889b8375b", "comment": "Malware payload (SilentBuilder)", "value": "14cc59f71626825d470007fe8dfcc73f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883160, "uuid": "f727db58-2a49-42fd-97d7-641f896a0fe3", "comment": "Malware payload (SilentBuilder)", "value": "2ceb53f8488cb02cc54112733b18f12804f6cb1285f2a3611629301a3eb5238e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883160, "uuid": "0ab8224e-276a-4b1a-8a83-882d1259e010", "comment": "Malware payload (SilentBuilder)", "value": "d3ebfa5d7dfc4a67290b63d748522a5c525595be", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883160, "uuid": "6c1a7066-8faa-46b8-aa7c-e040fb292df4", "comment": "Malware payload (SilentBuilder)", "value": "8efa22ffda5bd1b52c6e8cbf05eff1a279adf8520af24dcfbd6a336b0d9e4dccb9d619ea1660622d9c5a835798f0b4da", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883160, "uuid": "e983bf01-34f3-4fd8-b3bf-b7f4e558fc8b", "value": "T1DEA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883160, "uuid": "ceb5e82c-bb13-4cd9-8bda-334693bb220e", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd454:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883160, "uuid": "6ec05cb5-4c68-44a3-bd7c-dee391e1ea9f", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883160, "uuid": "8ec03d89-8b34-4b03-83bf-59fbe62f5ad7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883160, "uuid": "a888e34b-4e4e-4e0b-ad4e-c1ffeb69985f", "value": "2022-02-03-14cc59f71626825d470007fe8dfcc73f_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "28e0b859-84c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643874716, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874716, "uuid": "1efffeae-eb86-4802-802a-017552c42229", "comment": "Malware payload (Heodo)", "value": "3a85b7c0a78e4c6634cb5e45e6c68d5a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874716, "uuid": "0cb9a5d3-4b8d-4083-9faf-57640c409a0a", "comment": "Malware payload (Heodo)", "value": "2d2f0674510a6cecda206f277c02864256d76d439305fae87a322db264df30fd", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874716, "uuid": "c6b864d5-0053-4392-afc4-797d685bf8e7", "comment": "Malware payload (Heodo)", "value": "f2de30715554ba783cede9116abe7950d80e717a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874716, "uuid": "f4248872-c8b6-4f2c-8875-c2f63e0048b4", "comment": "Malware payload (Heodo)", "value": "eac47885ea1e9441fea3b4262bc7d7e991de746d1daf929bcc7dc3509d416417d3ee882a74076a61f70b2c2460c0f75b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874716, "uuid": "a73869d8-580e-4b67-9adc-a7f0337f2626", "value": "T1C9E36B25B6C5D9C6DB0823350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874716, "uuid": "73317cf2-63c8-480f-8bb9-f69849940630", "value": "3072:CcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0g:CcKoSsxzNDZLDZjlbR868O8KlVH3deha", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874716, "uuid": "4229b1d2-c59d-4f5a-aa2b-518512200559", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874716, "uuid": "93afb982-b9b9-4927-a38d-42810d6c8b66", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874716, "uuid": "04f1cac6-437e-4cc7-932d-198c5641ee06", "value": "MO-6424 report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49d5fbad-84c9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643876060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876060, "uuid": "8524f753-574b-4bfc-a27a-ac01d30e3647", "comment": "Malware payload (Heodo)", "value": "45797fba1063fef855b713099c3e9f1e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876060, "uuid": "791c80a3-4b90-4976-8d27-6dabaec039f4", "comment": "Malware payload (Heodo)", "value": "2d6bdacaaaf65af35dd2adcd7ef25e15b36c4bd3fac262a50488afccdaf8879f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876060, "uuid": "bafae2a1-bf9f-4a48-87cb-33daf5d35a01", "comment": "Malware payload (Heodo)", "value": "8b00ced77325e85e70d35044e6c1b8e3381d5d85", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876060, "uuid": "f9c04f82-7190-409c-a8d4-3442523aa0f1", "comment": "Malware payload (Heodo)", "value": "9d507a780098d1999076021624bcbd582d8b11b387e231e43518ebe05e2d9e42117619977652b60f8fdaeec9ea5d7292", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876060, "uuid": "cdd6cf6f-7213-4a4a-9483-b9e93894d3ba", "value": "T110E36B6576C5D9CADB0822350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876060, "uuid": "7895b96a-0d7b-4309-8535-d100a8024b19", "value": "3072:lcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0k:lcKoSsxzNDZLDZjlbR868O8KlVH3dehe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643876060, "uuid": "49635906-931a-42b1-83ac-a943c61a9356", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643876060, "uuid": "2646b9fc-45d4-4867-88ba-005e05922940", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876060, "uuid": "b9710f33-0d59-4839-8588-eaec2e92ebeb", "value": "ODS-010222 VEVZ-030222.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785828b1-8507-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643902767, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902767, "uuid": "134fac7a-5a3b-406a-ad89-ed18fc3fd4ce", "comment": "Malware payload (Heodo)", "value": "3eb08d60670893aeab44a6ab05bb541e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902767, "uuid": "b34f551f-bb9d-48e5-9084-0079bdd3fa6e", "comment": "Malware payload (Heodo)", "value": "2db8ad767efd03224f321bbe9ec90aeb47668450aea30fe125b5aac7a00a2cea", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902767, "uuid": "568e8abf-3fa9-4366-a337-bfef820f2f80", "comment": "Malware payload (Heodo)", "value": "a30f9137fbf4ec6c4e9b6ed3c1f9686f35c61b7c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902767, "uuid": "c3ae789d-04a2-4bde-bae1-d5ef5d7b9d96", "comment": "Malware payload (Heodo)", "value": "ae2889a09451c78102ac83fbb6a4e9e968e6099fcdc11c20b6e28debf7968681a2fb07a58d19ca95cff7b10e40584874", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902767, "uuid": "d7cc2f52-54fb-4607-afda-dcf12a9dde01", "value": "T1ACA3BE4DE1130DB8F2D6D43AC1485E107BB702CC88827B57B684896DBF9C2F9569F17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902767, "uuid": "1d044048-5b68-42de-bedc-ec930782c079", "value": "3072:t7vj5qu8hahYIfiQOVOveshVf4KwJQikmGoL:t7vj5rbtO8eOaDPk1oL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643902767, "uuid": "61ed3f20-d4af-4fc9-be72-5980a36e9a8e", "value": 105965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643902767, "uuid": "8fe00146-efca-4354-a3dd-906e82cecb39", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902767, "uuid": "381e4699-55dc-4d2e-a826-4dfc27231ffa", "value": "tmpxuz5c_ll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8440f69e-84c6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1643874869, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874869, "uuid": "5e3bf7e5-e66e-4efd-a924-b39f93f21e7b", "comment": "Malware payload (SnakeKeylogger)", "value": "f3d62c258179076c1385815f98fb050d", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874869, "uuid": "6a0734b0-03dc-4d70-b4f4-57818d299f14", "comment": "Malware payload (SnakeKeylogger)", "value": "2dfa81ba2cf18424f9f735b5b7986a1c92457aecfa55169812e25c11360c3c1f", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874869, "uuid": "004aaee8-06f6-41d6-af60-606e8ddb8bb8", "comment": "Malware payload (SnakeKeylogger)", "value": "c573665b744913d4bd86e3b5c4cfcde9c505f9de", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874869, "uuid": "9b2aeb6d-deb8-4b35-bc3f-e7e0400a32af", "comment": "Malware payload (SnakeKeylogger)", "value": "b1830ac506e9e1112c653781cad7455ba3c457ba760f8dba68578e9c45470dc66c82dc0fb3d3119c621bd8ee34b9c34c", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874869, "uuid": "0d94844b-84ff-452b-9488-c39f728db97d", "value": "T109B49D3125BB5B25E93FD7381321C2381FE6AF16D313F5A87CD86C8B7196A450A36A13", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874869, "uuid": "b29baf59-ed33-4500-9f3a-cdc97a97936a", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874869, "uuid": "08de09bd-331a-4ce2-8f7b-137edba5f055", "value": "12288:LiEjKjApJ+t4IGNh94g4EnY/pdTL6EouYDDhofKuisnel:W8KjAP+t4IdXEnYnLbGDDWKuH4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874869, "uuid": "dde2eb7e-2ae2-4e83-a57d-38c31b8b71b4", "value": 508416, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874869, "uuid": "cf6a2b69-05ac-4730-81a3-542191d5a261", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874869, "uuid": "f67f0563-4a64-415a-ab7d-4f1517d53cda", "value": "RjjRSUL80vUPRY0.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7d9edf89-84dc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643884307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884307, "uuid": "c61b8611-4f83-4b9e-9333-283884f3b5e2", "comment": "Malware payload (SilentBuilder)", "value": "7123466000812b20f400d7697511bd79", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884307, "uuid": "0456ca83-e346-4452-9b2d-b7a58badfdba", "comment": "Malware payload (SilentBuilder)", "value": "2e245dd1e8bce7c6070f3be52d399da5bd120c41b922c867939318407004f98c", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884307, "uuid": "82a590dd-d0fa-4228-881e-d5fc6e3be014", "comment": "Malware payload (SilentBuilder)", "value": "9237ac7f9205da285a8b00fe0206b9c5c4425e29", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884307, "uuid": "fba03784-0f5c-47b2-83ad-b951fe6b0981", "comment": "Malware payload (SilentBuilder)", "value": "7fc1eb135ca4cc8fee87976e477de77e356a36018f0947b216d712104e79758a5c720544f967efb652f9352981429863", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884307, "uuid": "122396d1-5f5d-45c7-b326-2e699b9ad081", "value": "T176B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884307, "uuid": "1391ba8c-d5bd-44fb-b72d-e7090ce150cb", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd497:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884307, "uuid": "50de4b68-da5f-4007-9ba0-8eed5b9fc291", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884307, "uuid": "5fd6887a-e89e-438f-9d63-01faf2e2f73f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884307, "uuid": "38b8ee7e-87cf-4caf-ae0a-d68b91de06df", "value": "2022-2-3-7123466000812b20f400d7697511bd79.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2301442e-84cf-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1643878572, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878572, "uuid": "c75a5c81-cbfa-4d24-b9aa-b6f7b1a626c5", "comment": "Malware payload (ArkeiStealer)", "value": "561d55e430e7fb7d2089f61d781dd395", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878572, "uuid": "78f51875-95b2-44da-81cb-ff09edfab8d7", "comment": "Malware payload (ArkeiStealer)", "value": "2e5e3591dfd701f78ff7a8e3773a0bfb23c7d291875276c7497579fef08f872e", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878572, "uuid": "29668b64-943f-4fe4-9782-dda4c4a2c2c5", "comment": "Malware payload (ArkeiStealer)", "value": "2ef0df0dbc2ba729cb82476167a4bb8a86c4c350", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878572, "uuid": "6905503c-a2ed-4993-a5c6-e28e2ff987ab", "comment": "Malware payload (ArkeiStealer)", "value": "9d3f07f2111094f1e6a136cb3a13bf8baf30acae899ad88c53a0d1fa844838146d6b71285471a7d8a689da183060e7da", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878572, "uuid": "402f886b-89bb-4691-ba7e-5b83c41292ac", "value": "T14E34D010FEB1C472C44B95311929C6A2AF7FBC3259B5C042BB5A277F4EB03D1962A736", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878572, "uuid": "e7d323aa-2d02-4340-9609-a4fd535ff4ca", "value": "ec9e7a13a3ae99d72c69258e6951d2e0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878572, "uuid": "85b709fc-1948-487a-9b5c-7d8d73e5b691", "value": "3072:gVEqYnfZrLwGF2xoQ9i5ESC1YJGmFnIZTyyTFRVZ:6EXfBLZ2x0C1YGmFIQyBRVZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643878572, "uuid": "834c49b5-68dd-4879-a9d0-fb9262929c6b", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643878572, "uuid": "98239aa4-8ef6-48e9-90a9-127752714810", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878572, "uuid": "9906af1e-8e59-4395-a8e0-ad9446d91bb1", "value": "561d55e430e7fb7d2089f61d781dd395.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4844ee1b-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856300, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856300, "uuid": "0753eff4-2517-4ac4-ae9e-35cfc971aa1a", "comment": "Malware payload (Heodo)", "value": "219875b76b9d0ee8a0d09e69c1763231", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856300, "uuid": "c93eefbc-f010-4021-a3e0-f8f6913bf98c", "comment": "Malware payload (Heodo)", "value": "2edcdebe272aae712cc2a69305b643be8edace416f88c6f5ce9d18eda75129c1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856300, "uuid": "c41ea200-bb10-4099-8b5f-aaad807bdddd", "comment": "Malware payload (Heodo)", "value": "6313aafb37ebcbfed3e14c9a75a4a2f962d34bbe", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856300, "uuid": "013a49b1-46ea-4d21-993e-2a77e015b058", "comment": "Malware payload (Heodo)", "value": "7b07b1c145f9ed0c2bbd8edbe180e5a4caa9232320cbbbf52dbaf251dd906919dcf339feee865c1fe7775bd9ccc28fda", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856300, "uuid": "2cf9cf83-9a10-42c7-a046-63cbf4960c34", "value": "T1CCE36C2576C5D9C6DB0822350ADACAFE2327BC479E7643C33158F31E2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856300, "uuid": "cb7fb2c8-273a-4d8c-bbba-3611e207e170", "value": "3072://5cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGe:5cKoSsxzNDZLDZjlbR868O8KlVH3deh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856300, "uuid": "de2c7054-7f0c-40f9-aa4f-b3406dbb8f2c", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856300, "uuid": "d6df598f-fa9b-49a7-a69f-95d59a19e81c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856300, "uuid": "636cc4ac-8a04-4d25-9ec9-9ee12c0dac1a", "value": "2022-2-3-219875b76b9d0ee8a0d09e69c1763231.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ea20fd8f-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643884060, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884060, "uuid": "ee716159-b88b-4974-b83b-1eba2b3df79e", "comment": "Malware payload (SilentBuilder)", "value": "d77b10bd868a094a1641cc871a10814f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884060, "uuid": "209a68a7-9c61-4fb5-810b-4c50f6e7b479", "comment": "Malware payload (SilentBuilder)", "value": "2edf137e12f92ce0b1987eb988ebf28e1a10141afafd68495fe876b221df5a02", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884060, "uuid": "677d25c6-087b-473d-9eff-0e626ffdcbd6", "comment": "Malware payload (SilentBuilder)", "value": "d2fed15d97324a4af861a294a24c41249dac4dc7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884060, "uuid": "697bf403-a2f6-4444-8817-3e70e19630af", "comment": "Malware payload (SilentBuilder)", "value": "0d1b5304eea3ff4a28a47c269696235a5bad479d701cdcc8450ede9aacb0a8af438160fb7328f4d8af30aab2c519f8af", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884060, "uuid": "75bef936-2cde-454a-83be-b4c27a8d46ae", "value": "T115B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884060, "uuid": "2ca31b4b-5c30-49c3-9cb8-184c133137ca", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49o:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884060, "uuid": "703e99ee-47d6-4187-834d-8bcdf889da10", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884060, "uuid": "ced0b34b-be30-4e1a-a2bf-c3549b33a41a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884060, "uuid": "2a80dd1a-ae32-4ebd-94e1-3f9fbdc9c325", "value": "2022-02-03-d77b10bd868a094a1641cc871a10814f_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30a8000e-849c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856690, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856690, "uuid": "ba2d6eff-03f7-4c18-8965-cef9587906d6", "comment": "Malware payload (SilentBuilder)", "value": "f95689ef50bb0668e97cad3796e100ac", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856690, "uuid": "8b746429-c98b-4486-b7b0-72c3aad53373", "comment": "Malware payload (SilentBuilder)", "value": "2ee261ac9a6239b2c897d92201e88a765e85e949350f0bc217cf410e64e6129e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856690, "uuid": "90b73147-854f-4df6-8d9f-ef80df2fce62", "comment": "Malware payload (SilentBuilder)", "value": "f790c91b71072bee3b702f0084847365d4c1e4f0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856690, "uuid": "5b91c9a0-3a5b-44ea-8f15-0a7815a18d30", "comment": "Malware payload (SilentBuilder)", "value": "58ad8f646d28b5856b2208cbabc5e5188dd84193a82f37e81c0f1b4ebd409867c172baa1dd0cd1070145b44a656ffe93", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856690, "uuid": "0264da20-f889-4032-a57a-6da585bf74a4", "value": "T1F6A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856690, "uuid": "fc5ea3d6-d5c3-416b-829e-c1bfd564bfc6", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd494:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856690, "uuid": "1ceecc4c-58c4-4eff-8e10-cbf9986ed715", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856690, "uuid": "970e497a-8335-408f-9b98-eb83610c4742", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856690, "uuid": "9c31f4c1-d991-4fb5-85f9-910642f16be7", "value": "2022-02-03-f95689ef50bb0668e97cad3796e100ac_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c6a6c66-84a2-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643859394, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643859394, "uuid": "2f655844-14a9-45b2-8197-687e89adc956", "comment": "Malware payload (Mirai)", "value": "30dc5b767ecb4a938627077597456f02", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643859394, "uuid": "da22d3ff-6b17-46eb-a318-2b1d0f487407", "comment": "Malware payload (Mirai)", "value": "2f27cf5a445daff1ed9b6e35f9f0306fd2ee4b06447e20625d3a248bfd981b47", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643859394, "uuid": "25763fe0-790d-4e61-b4a5-fa6f5fc9e03d", "comment": "Malware payload (Mirai)", "value": "7a9d97967b6f98fc02494c4be1836b36da65578c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643859394, "uuid": "5c43cba5-bd3c-4f89-b986-59cc9e484629", "comment": "Malware payload (Mirai)", "value": "cab0cfbcf613d31b235bf9e64a00d47256f15cd34b6f788c42527005d478ffd752db814aa6a19eaf95196aa93a6efa2f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643859394, "uuid": "770e58ca-86d5-42ce-ad31-d307badcdebc", "value": "T1C9F24B01B70C0543D2A37EB43A3B27D1E3AEEDD121E4EAC5715EE686A1B1D314296ECD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643859394, "uuid": "2480de31-e3f1-4800-aea1-2dde0c79a4ec", "value": "768:Rq14BeiPgs9ouxlXJvEjRepFQktOOCWIE:Rq1ZeoElXij4kkkSj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643859394, "uuid": "27ebb7a4-fc4f-4db9-ad8a-e351122cdbd7", "value": 35544, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643859394, "uuid": "dfabab76-27ed-477a-b2e5-1d750c948730", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643859394, "uuid": "f2878f4c-d97d-422d-955f-95f10f2ef678", "value": "30dc5b767ecb4a938627077597456f02", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39a55548-84ec-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643891065, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891065, "uuid": "3047053d-d518-4f16-83c0-1ce16935c02b", "comment": "Malware payload (Heodo)", "value": "0b3d1727adeefc86d88567cd43724f24", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891065, "uuid": "42435ecf-0196-408e-a6c2-256fd92c90e2", "comment": "Malware payload (Heodo)", "value": "2f6b23bb7b17a50cdab582454657472cd1be476e505a6c1630e2586b71598fab", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891065, "uuid": "95d1fe55-eeb7-40b0-9728-5bba40678b08", "comment": "Malware payload (Heodo)", "value": "d88e80f31740c88f6685763b7c4fa8d4337d93dd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891065, "uuid": "421eace5-e182-42b1-a44c-71bd95a4760a", "comment": "Malware payload (Heodo)", "value": "f4b96e7a084fed1e9d206913e642793492d6330e0de6ccb6e2e56a75afb70454c8083cfbb16487ab901641b7b7c3bde5", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891065, "uuid": "93a4edcd-89f6-4047-bab2-fd25bc08dc92", "value": "T13C25BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891065, "uuid": "7c11c46d-5357-4116-a4d0-a560801497e8", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891065, "uuid": "d8d88ce9-f40f-4ecf-8d41-3808bc576096", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gvFIIm2mlg:kBiaa4powXiolDS2gvFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643891065, "uuid": "13ce2359-9d70-4c89-8b0a-e7e4e383bf00", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643891065, "uuid": "bd5afb06-4704-4e93-8ac4-c00d713f4cf6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891065, "uuid": "0b214acd-613b-4ef5-a244-9df3128de34a", "value": "0b3d1727adeefc86d88567cd43724f24", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e960006e-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883629, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883629, "uuid": "93fd7cf3-53ff-4567-9be5-564fe11f57ca", "comment": "Malware payload (SilentBuilder)", "value": "8fb3ba2fc51e87bec64674db8fd8d472", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883629, "uuid": "39affffc-8951-465e-b611-78ed184637b3", "comment": "Malware payload (SilentBuilder)", "value": "2f777e34d3428d6e077c8f2d13d190f96c532117ca71179add459d0edc63b7d0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883629, "uuid": "51e7c806-442a-4582-8060-3d4bae4133fe", "comment": "Malware payload (SilentBuilder)", "value": "2745854d0ac4387cb9e252fafc6f7f7241645893", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883629, "uuid": "ce534263-a7bb-46ac-adea-1721ca29045a", "comment": "Malware payload (SilentBuilder)", "value": "82820c4510fa57c984bfc320699ac0a4cdac9a8a6b382a99c625b6c1cb1d9986f5d53f04123953aa54ac10898df75947", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883629, "uuid": "6ae08bc2-ed4a-4a8f-827f-f2f148f1e295", "value": "T1BAB37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883629, "uuid": "573546b3-c7ae-4ef1-bcaf-3401b780db2f", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49j:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883629, "uuid": "b63fea60-b621-456c-9d67-76a1a8960fcc", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883629, "uuid": "38211d4c-56a8-4df8-aae9-01acfcc1d4de", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883629, "uuid": "5f1c02e2-2b7c-4758-ad0f-0b47acbe7631", "value": "2022-02-03-8fb3ba2fc51e87bec64674db8fd8d472_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9852c015-850c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904968, "uuid": "838a0283-de6e-424a-80c3-3dbd24ce3bd7", "comment": "Malware payload (Heodo)", "value": "81bdeb54da3cc08730da1cbd04a05ef7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904968, "uuid": "5a721f3b-66b9-440d-b30b-e1d2a4017c68", "comment": "Malware payload (Heodo)", "value": "2f7834b5965bdf256cb6a49248eca6d4c383e0b64db8fbe0e3a2133a88142f1a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904968, "uuid": "c262d03a-4f55-4641-ba56-b5673dea0bf5", "comment": "Malware payload (Heodo)", "value": "8b501ed9a5557e5ddb23bed31025484b40a43c32", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904968, "uuid": "0196fb27-cb3b-43c1-8f5a-10f147f4b015", "comment": "Malware payload (Heodo)", "value": "6c0b7a2da21f0e40c56c67aaac839fa48cf766f30e282585838c8ce7a44a33b48cca11031c05b2fb2117458ff071b591", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904968, "uuid": "7ee5e7f7-563e-409b-b594-63cb6406c503", "value": "T13FD4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904968, "uuid": "cd7bf920-dcaa-4657-ad1e-58b69e671519", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904968, "uuid": "e477c17b-aa93-48b5-83e0-b2edc6c9cfd8", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBP+7+7/Q0xIop1KpR:JynoxcCOllFxBP57LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904968, "uuid": "6fbfa2cd-90f1-404f-b044-fa7d4345790d", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904968, "uuid": "4eeae3e8-52a1-495e-9c98-5f435b94f261", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904968, "uuid": "0667ce97-a808-464e-a383-0c67e322b92a", "value": "emotet_exe_e4_2f7834b5965bdf256cb6a49248eca6d4c383e0b64db8fbe0e3a2133a88142f1a_2022-02-03__161557.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a607630a-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883516, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883516, "uuid": "ab079d18-d8fb-4b77-a26e-991b6af82906", "comment": "Malware payload (SilentBuilder)", "value": "757f5ac3b307775e723456c8d124cbaa", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883516, "uuid": "8699e91d-8ce4-487e-bd6e-b6dc220957c0", "comment": "Malware payload (SilentBuilder)", "value": "2f91bcfcf366d848ab45b58fe012de7a228351988505ebf3ab5718177f98d906", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883516, "uuid": "ea14854d-5771-4b0f-9c1a-38c10f0916de", "comment": "Malware payload (SilentBuilder)", "value": "595812dfa71fc2c7d386f47b24381a7c9b5a5d93", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883516, "uuid": "df13357e-95ad-4512-9324-5aa3885f3fde", "comment": "Malware payload (SilentBuilder)", "value": "753d1cc0941d303016f29f02d762da1e4a5c7ce6e232d7a642bf3e6e4329284e95961fac25b149510b58eac3a4a4ca20", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883516, "uuid": "76f5ac0b-9ab3-48db-b7f6-4cb93e77e655", "value": "T116A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883516, "uuid": "2755ba71-95ee-419a-b5f5-6d35868d7b09", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4t4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883516, "uuid": "e02dff30-1d31-42bc-80f7-f70a3368cac1", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883516, "uuid": "c12eaebf-1a12-45b1-b308-ac9685966df3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883516, "uuid": "9714cded-5e98-4f58-ad70-26919ff27bad", "value": "2022-02-03-757f5ac3b307775e723456c8d124cbaa_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f375b516-852d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643919294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919294, "uuid": "3909b6a8-dcd5-4989-95cf-e82eeccef683", "comment": "Malware payload", "value": "62c7c8e8f6b8aa4c15adc4338a2c5721", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919294, "uuid": "24a7360e-addc-4011-bda6-69553de8fb8e", "comment": "Malware payload", "value": "2f98e00a95633b6b6d16df22b385fa90b0eb55ae91e1e1b80a497206425a8132", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919294, "uuid": "cfe4549e-0291-4ada-8bbe-973e2169e252", "comment": "Malware payload", "value": "b5a5f0a7aec5dc791b0a31c667dcca1892eb5af0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919294, "uuid": "0053dbfb-c02e-4b81-9d53-d1f3c350a09c", "comment": "Malware payload", "value": "300cfcd0ed93b6db9bcd793748420ac3072e6d6a8a7c7177f81a1df1eaabfb2d7ea2684c3d199379be19b850081437fc", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919294, "uuid": "e6a3411f-06fa-455a-b149-f06d9d3bcc1b", "value": "T1BC25CF103ECA40A1F64B153E006A73584FDD6A1507E1EADFDF44F8A7AB15CC2AA3946F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919294, "uuid": "9e24059f-ba83-4b39-9c1f-9453a863437e", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919294, "uuid": "0b0709ff-760b-4922-b09d-2c471599d6c2", "value": "24576:aKzjU3EJ7mCRpnAOxxmd3uIqUUvoq116OzvMyveFIIm2m+l7:al3g74mm9uIqUUn1xTeFIr2mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643919294, "uuid": "fb739b5e-c8ab-46ab-a4b0-9c6196521f2a", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643919294, "uuid": "0cda3112-c803-42fa-a2d5-fcac537cc1c7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919294, "uuid": "4ce348ff-9b8d-4a83-bd35-192d1d768711", "value": "emotet_exe_e5_2f98e00a95633b6b6d16df22b385fa90b0eb55ae91e1e1b80a497206425a8132_2022-02-03__201441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "376f22ba-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846823, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846823, "uuid": "9384bdb4-a74f-4748-850f-379e5d091365", "comment": "Malware payload (Heodo)", "value": "cb5b1f2fbfd018a515c5c62f480e7fc9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846823, "uuid": "63748cb2-2bdd-45bd-ac22-e49f9344d1b4", "comment": "Malware payload (Heodo)", "value": "2f9abbfa95bfc32192ea165a7e4c0ce3a72cccf0a054c521d618bf6e667f9bb0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846823, "uuid": "4af1a148-f773-4cff-acfe-ac162ae4c0f4", "comment": "Malware payload (Heodo)", "value": "9046655ec59f79425a7e4fc03893970c11943c6a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846823, "uuid": "b3409350-af73-4ec2-aba1-5a6794e138f4", "comment": "Malware payload (Heodo)", "value": "cce37d5208cbb28700d214089a17bb3fe0033267412d86a004e0e0353a1a86ed3a3bb91f52847d0a44f9f891c45ca2a7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846823, "uuid": "400d1dfb-5552-4df4-aae0-bc7982ca1c8e", "value": "T1D4E37C65B6C5D9C6DB0822350ACACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846823, "uuid": "79aaf25c-00b1-4bee-9f31-ef2644e5e0a4", "value": "3072:lcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0G:lcKoSsxzNDZLDZjlbR868O8KlVH3dehU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846823, "uuid": "2bd171e1-27e5-41b3-9f02-f3eae4e8988e", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846823, "uuid": "37feee08-df6a-48f8-8c83-1101326ee245", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846823, "uuid": "b92d93df-5f27-4925-8f74-f46e5b3227fe", "value": "2022-2-3-cb5b1f2fbfd018a515c5c62f480e7fc9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "26094ba0-84fa-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1643897045, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897045, "uuid": "e6c2ff0d-460e-48c2-afa7-9f5f41daf132", "comment": "Malware payload (RedLineStealer)", "value": "7b55c2d663f8ea15ff804dc7173c5815", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897045, "uuid": "c1545133-5a5b-4f06-a3e7-788d1df3e701", "comment": "Malware payload (RedLineStealer)", "value": "2fb7241ffdfa7525f125e6d7b18e895cfb512ebb6905d056dbe7d76e8d6df806", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897045, "uuid": "aa55f4de-d09a-4171-99c1-19e22526ed61", "comment": "Malware payload (RedLineStealer)", "value": "d5a9ad5d7151f9e8f59e59852e64b8f63cff5e4d", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897045, "uuid": "a8080764-fed0-4161-8cd0-a0e3c7f45888", "comment": "Malware payload (RedLineStealer)", "value": "c466b44de625e713f1b19218b1e7ca7b8d34fc49e69cf9440631b9bef7ca707a9f49803c32831dd2fedd5a167441feaa", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897045, "uuid": "3a298761-dc73-4b18-b8f3-8b7fb5c4daa2", "value": "T134A4892346940662C0B510728DE923FD26E69F9B13D686FB1EF01A6EBB594E5373CF10", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897045, "uuid": "d0bcd50b-7016-4af8-bc06-d38bb1a02614", "value": "05fbf7abc5bddf8d3a37a554c9a928cc", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897045, "uuid": "ed914f98-b29c-4680-ac2d-374778882079", "value": "6144:7LcdEjj6x6DU01ivzdK5Pw57g7cZHXbd7qDPT7eAzjvcsu53fPl2zLK:7WEqUg01ivzdllgY1bd7qDr7hvcpwz+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643897045, "uuid": "8a674cb5-44a3-44d9-afa7-fdf3994fe2f0", "value": 476000, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643897045, "uuid": "4b12141b-8586-44c9-8dde-fde1fcc9d2f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897045, "uuid": "7c15a6d4-e95b-4470-aa73-2213538af9cc", "value": "7b55c2d663f8ea15ff804dc7173c5815.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d1c2da67-8514-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643908500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908500, "uuid": "94df99c5-8ea2-4d7f-a696-ebd2260fc811", "comment": "Malware payload (Heodo)", "value": "6d9b07a0a6053535026bd6b9d573122f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908500, "uuid": "fc82db17-bc81-46ab-9bbf-ac90e5c3a448", "comment": "Malware payload (Heodo)", "value": "2fb912fccb597bf8c7d3038c853af10fc91e81dd5ba0bd25280bb4676e7cd5e3", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908500, "uuid": "df042800-a4fe-414b-831b-b22458df3b05", "comment": "Malware payload (Heodo)", "value": "ed918505739471edf0e96e5fe640b7838933389d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908500, "uuid": "9288d901-e7be-4d32-83e7-1c0b4a616a54", "comment": "Malware payload (Heodo)", "value": "ce95ca1c787dd229213a5e8de0db1e81e36eda7d6b247252f19216b252b6053dae6c169f345a70ec40bfd9bc9e14c19f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908500, "uuid": "5dc8ae05-72d8-4337-a8db-de159c4dec24", "value": "T1BAD4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908500, "uuid": "9fbf48e7-999c-4df2-a57c-cf1db7cc22a0", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908500, "uuid": "b150a2b2-b980-483b-8397-4dffd300e731", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBPt7+7/Q0xIop1KpR:JynoxcCOllFxBPg7LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643908500, "uuid": "23d43798-bbe0-4bbf-840d-4bb6eb814046", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643908500, "uuid": "0cfe7e57-acee-4ff5-95c3-dc188447968a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908500, "uuid": "f8b7570e-3a98-4fb5-90d1-7cd492f3451b", "value": "6d9b07a0a6053535026bd6b9d573122f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d2ac93de-8507-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643902918, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902918, "uuid": "3696a230-1701-47fa-a393-8c9a83071bdb", "comment": "Malware payload (Heodo)", "value": "d826af8d4348e0ea7c434861068cdcee", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902918, "uuid": "dd1d7eea-7d0b-4bae-bfa1-67848375c378", "comment": "Malware payload (Heodo)", "value": "2fd066d998d576471598a9e859fbccae822d65adaa375b1cd67646e2be500b00", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902918, "uuid": "80df602b-bcbb-4b2a-94e2-3e65b9abf758", "comment": "Malware payload (Heodo)", "value": "8b90fdedfbebaab1b62bc2fd7b10bcfb60df8dc9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902918, "uuid": "2da00a46-e247-461c-aeb4-d2f68fbc58cf", "comment": "Malware payload (Heodo)", "value": "71b70cdcc4432c06a3a5b1ddb10bd26274fda26ab1bccbe9eca634a1c6daa294ddcbc17aa86c6515d19229deeb418b46", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902918, "uuid": "1a0ef8fc-11dc-4796-8a41-3a49bf48c9d6", "value": "T196E39D26B695C95AD91407311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902918, "uuid": "1af0b62a-45e9-43a6-9373-e49d92b87263", "value": "3072:ocKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcl:ocKoSsxzNDZLDZjlbR868O8KlVH3Uehp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643902918, "uuid": "1467ce73-ca46-4d27-be89-9437abadcaea", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643902918, "uuid": "068196da-726f-4f82-9bb6-6be2c5f005d2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902918, "uuid": "8dbe4665-294a-42f4-a287-cd3f978ec398", "value": "tmplz2wxjk0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a9ac111b-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856034, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856034, "uuid": "134b36f0-3b9e-4126-9cc7-ee79efb0d75d", "comment": "Malware payload (SilentBuilder)", "value": "76c37962efbe6526178f568e2aba9597", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856034, "uuid": "eabbf282-a991-483d-a6cb-a1059f8b9c5e", "comment": "Malware payload (SilentBuilder)", "value": "300fbfcc17ab459e09d7dccdc37b78ce41c4f0a36ebf9dc7759492424163d2ec", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856034, "uuid": "6dbd6952-5f67-4b3d-bf85-aec47fbc847d", "comment": "Malware payload (SilentBuilder)", "value": "d08055f9e214aa9756156cc669c4af716d698fea", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856034, "uuid": "d4758aee-efb0-4bf5-9e6a-e954c2aa4fcf", "comment": "Malware payload (SilentBuilder)", "value": "dbc8cee6263ead8abcce5816ffaf1b8dc1251b6c785e4bcb4c9a49d947253eba1feca7ad45838cd8f575285a0809d562", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856034, "uuid": "2d6da608-3406-40f0-8b68-dab96de945a6", "value": "T104B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856034, "uuid": "5112e320-a14d-4dd4-902e-5376d6b8238d", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd497:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856034, "uuid": "124afcf4-6134-4ee3-9891-9322553609de", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856034, "uuid": "e71098c4-81a0-4493-9608-410cee03d73e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856034, "uuid": "a21e719e-6165-42e4-a987-87506170fb34", "value": "2022-02-03-76c37962efbe6526178f568e2aba9597_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "283f3454-84f9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643896619, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643896619, "uuid": "860d8450-fc95-413b-a1cc-2e42c2a3358d", "comment": "Malware payload", "value": "c638974f2d66cc2cfa54d4db60c23648", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643896619, "uuid": "88657d43-9c0c-45df-8b0b-f9fdc55f8d0a", "comment": "Malware payload", "value": "3080ccd24a3831867a47eeb44a48a3c1154d5ad997724e0083deb3aa64403d06", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643896619, "uuid": "4af30379-7892-4dd2-ad13-7ab051a65646", "comment": "Malware payload", "value": "1345637fe5a10768b500a42f272cc73940e1a16c", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643896619, "uuid": "c36fbbb1-cb99-4775-a208-c565e6f58916", "comment": "Malware payload", "value": "5ab403bf41e98db18dce68ca184593240280d500ac9fd4c8eb775afc7313e2786111b08cfac9af12e224b0c31d1adc8e", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643896619, "uuid": "d25bdab2-9ec7-458f-8a52-d95c38c87373", "value": "T185B3F16895924767C2274438CC7CC8E694060C47A524AE0FB8E5BE474EBDBE93B5E3CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643896619, "uuid": "738c625e-070d-4de0-9d95-b43361b0cc2d", "value": "3072:qGMm7ACVwXgusBxXspFM6CHvTnD4brjUmBO:UXCXusBcy6CHvTU6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643896619, "uuid": "6d6675aa-93bd-41b5-b4bf-267e2736ba2d", "value": 114708, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643896619, "uuid": "f89e8348-6098-4ad4-bac1-30196a83527b", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643896619, "uuid": "a2a2725f-a236-4b36-b0e0-a49cdb95ddf7", "value": "PO.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "699fcffe-84fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643898447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898447, "uuid": "dfb1ecc5-e087-4447-b3b0-bd06364c046c", "comment": "Malware payload", "value": "24d501fa8d8c39a933d342b983b0a0bd", "object_relation": "md5", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898447, "uuid": "dc842322-6c14-434f-ab31-8707935bf9eb", "comment": "Malware payload", "value": "308ffce98f49799c79605727177a0852ab2b118f25a3622f1da665e66529cb0a", "object_relation": "sha256", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898447, "uuid": "64c45b0c-62c9-45e6-bbf8-3bc1258a6143", "comment": "Malware payload", "value": "e6176aa5881b423c820b66d01fd982baac13221a", "object_relation": "sha1", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898447, "uuid": "be8b5dd4-4a7d-4b25-9235-6692fe898271", "comment": "Malware payload", "value": "6ca53e514b0f89b60b54dbd4244b5a22871ef55a035ccedb1bf610575626394ba50803b2fe34cdae2389f03c123bfe65", "object_relation": "sha3-384", "Tag": [ { "name": "DHL", "colour": "#57272F", "exportable": true, "hide_tag": false }, { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898447, "uuid": "b43d61c2-b8d4-4c9d-b83a-2ce73fd5703b", "value": "T1A0B3015885A14717C2634835CD7CC8E2859A0D47A524AE0FF8E1BA875ABCBB9375E3CC", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898447, "uuid": "e03420a9-8620-4a67-bc6d-83051154e735", "value": "3072:OnGMm7AO7zmgusBxXspFM6CHvTnD4brjUxR:qXO7PusBcy6CHvTUk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898447, "uuid": "b3d7a092-dbbd-427d-9b11-51ca7dbe9195", "value": 114674, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898447, "uuid": "cabddfa8-4b11-4cdf-a43e-c3228c9e3df8", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898447, "uuid": "19afde73-6622-4cea-917a-835b4f6298a4", "value": "DHL.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd8ec1f7-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "7687f434-bec4-4670-9dae-78235481abc6", "comment": "Malware payload (Heodo)", "value": "1e60b69235c42c7b2e304db9701ff5c9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "200b8d70-88e0-42d9-888e-6abed00ffad8", "comment": "Malware payload (Heodo)", "value": "311174c941f3a931391c2c81b7a4aef416f2cbf291a6432a0aff39190b10c521", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "1fed5fb4-fb14-4cb5-a553-1b9c3241599b", "comment": "Malware payload (Heodo)", "value": "c1aa570aa93da61fa874ce38f0180ad0f99ff7c8", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "636e4346-1c11-42a7-9723-7d120d691de8", "comment": "Malware payload (Heodo)", "value": "4d278faac530b08ee91a0c5ac8497631c524b3ed8891d3208fc5f75956da0ed41465094efe20c5bd4757a9b427eb080a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "a9f2812a-08b1-410f-ad93-2396bc388d43", "value": "T1FD64E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "438e7b09-4c85-4b12-80d2-d2465265beb5", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "3163d03d-a90b-461e-a049-83a61133bc2b", "value": "6144:83DvZRFTFbksYyljaMYDMNT7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMYwLAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910292, "uuid": "3e86a382-0770-428c-b3a9-1774afda2ce0", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910292, "uuid": "b5f25744-cbd8-47bd-8c1a-8796d5c02591", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "007ba085-a0a0-4c01-b51e-79b108a774ea", "value": "emotet_exe_e5_311174c941f3a931391c2c81b7a4aef416f2cbf291a6432a0aff39190b10c521_2022-02-03__174437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2d163b7d-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883743, "uuid": "c33d5f90-a303-4422-9033-2cd18e0a9ce2", "comment": "Malware payload (SilentBuilder)", "value": "a0c7eead0ed547431f7778b210653bd7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883743, "uuid": "8e819976-756a-41e9-b8b6-51438ada28a7", "comment": "Malware payload (SilentBuilder)", "value": "3124fa6c7902f7be83572dfe48d91911018fe2ead1f1e51979b3d1c80f76838d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883743, "uuid": "22ab2bda-e5c8-47b2-819e-bd3e6593a122", "comment": "Malware payload (SilentBuilder)", "value": "ebde9e4e3d35ef63f56a23bb432e28871a35384d", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883743, "uuid": "2a6e7be3-f0a4-4984-b828-f5f715d511c5", "comment": "Malware payload (SilentBuilder)", "value": "2692b9036920f5a0da80cf768687a2e7442ec2087ea072a0e62ace72c9a4c6409999046f2b9c644cff6a2ed3cdb7f12c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883743, "uuid": "078b696b-7357-48ed-8f62-ec15286d9bf9", "value": "T14FB37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883743, "uuid": "ed3aa0c9-4e30-416b-9126-9e6223192beb", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49n:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883743, "uuid": "bcf62993-809f-4026-9d39-6446d2d0ad81", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883743, "uuid": "15d82daf-93e6-4a57-b84b-f68875325c61", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883743, "uuid": "671bc474-4b41-4cf3-838f-4551455c1728", "value": "2022-02-03-a0c7eead0ed547431f7778b210653bd7_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "416a35aa-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846840, "uuid": "8ecc44f2-9108-44eb-9f5d-779bbbd208d0", "comment": "Malware payload (Heodo)", "value": "cb9b5919865b64574afaf5ceb657edfc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846840, "uuid": "a788d645-56b0-41be-a001-b45b9b4937fa", "comment": "Malware payload (Heodo)", "value": "3128da420bb3edd1dd5f4959593c27e3edabe4501eff01e8d121498d80f569c0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846840, "uuid": "14e2f879-3b78-4a4a-b87d-9b48a7ad2f69", "comment": "Malware payload (Heodo)", "value": "7a5217c9938f36443248ee4e1d49e88a91976957", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846840, "uuid": "efbd4adf-ae8e-4b09-be95-30eac664fa5a", "comment": "Malware payload (Heodo)", "value": "c32e43fb4f0e95f3ad57e1b7020dfde721faf341883d5a866b9cb2470b3cf961c972479ea8173254707a3324264fd714", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846840, "uuid": "d29d6aea-fd3e-4d90-807e-dcf5e27fc828", "value": "T1E9E37B2576C5D9C6DB0822350ADACAEE3327BC479E7643C33158F31E2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846840, "uuid": "11c30cdd-a7f4-4dc0-a72f-498d4dc23424", "value": "3072:ycKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0a:ycKoSsxzNDZLDZjlbR868O8KlVH3dehE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846840, "uuid": "de7e11e5-aeae-44cf-b608-2367e652b39d", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846840, "uuid": "ca487d2f-7c6a-4bdc-8057-b7feb2dbe17a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846840, "uuid": "9f4bdbd2-c784-4e13-aaaf-afef9f30fd11", "value": "2022-2-3-cb9b5919865b64574afaf5ceb657edfc.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc86fe3b-848d-11ec-9275-42010a9c0029", "comment": "Malware payload (Sugar)", "timestamp": 1643850590, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850590, "uuid": "a42f4754-2673-4159-9e60-5ae8187ce566", "comment": "Malware payload (Sugar)", "value": "1cc5b508da9567f032ed78375bb45959", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850590, "uuid": "27ea4c92-dec7-4601-ab36-e13d61fee417", "comment": "Malware payload (Sugar)", "value": "315045e506eb5e9f5fd24e4a55cda48d223ac3450037586ce6dab70afc8ddfc9", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850590, "uuid": "9ce2c3d1-882e-4b45-9524-09380048a859", "comment": "Malware payload (Sugar)", "value": "c31a0e58ae70f571bf8140db8a1ab20a7f566ab5", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850590, "uuid": "b4e97085-caf9-4f35-86c7-a338f81f79c3", "comment": "Malware payload (Sugar)", "value": "7c944eae76b8f61578d7e9b41d3dd824481a1cdd05c10357f55f35d28f1aff0bd1d421484a1b3960f3a1dc7412daf5bf", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "packed", "colour": "#4AF3C3", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850590, "uuid": "4342bd04-d8e4-4911-9921-168faae15a91", "value": "T19D43F1E3DB6FC27BEDD555B8F8C65DA3407C3B5EC2276C1BAE19090931383A096E050A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850590, "uuid": "e5bd1cfa-5d39-4fd3-af81-d72991f476f2", "value": "29dc79e4c9ab8bfa299719f434758791", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850590, "uuid": "9c0eed89-295c-4da8-a99e-7b0373c54f25", "value": "768:/UtqhQLkaTp6Qm6V+1nPJK1vb2R5QLKIynlHMCJSsb07bDXYhBhaYT4cpVxNnsZr:sTkaI6c9JKFb2R5zZMCJGvo3yoxds", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643850590, "uuid": "88a04d25-2d5b-4800-a7f9-32fbb204a076", "value": 59392, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643850590, "uuid": "a1b049bd-7b04-40a5-b486-d4605ff71f19", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850590, "uuid": "6a626adb-0464-4c48-9dd9-307978d61d62", "value": "315045e506eb5e9f5fd24e4a55cda48d223ac3450037586ce6dab70afc8ddfc9.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4f1e0773-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882941, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882941, "uuid": "2b61acda-6f22-4837-85a2-f36f5abc8b49", "comment": "Malware payload (Heodo)", "value": "a4231420d8236e13c9ef07b81674026f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882941, "uuid": "77bbd52e-7602-4375-9bc2-fd4bf2a02e53", "comment": "Malware payload (Heodo)", "value": "3171593b624c4d3ca62ac8b9c5d3fddc9a28e93a4a37a6c37e2cd4ebbf136e3a", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882941, "uuid": "311adb85-39e4-4cd1-8d38-fa4144f7784a", "comment": "Malware payload (Heodo)", "value": "07aa07bcadb6b56bb48f3d3d1782e79a771a38d9", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882941, "uuid": "277941e5-2ce5-4350-95a1-41d3c04d9b0f", "comment": "Malware payload (Heodo)", "value": "90582360a4c288809c663992c6a310e66351809a100debaf0168f3be05d9c186e404fb72012f2c26e34d0189f4c6ae78", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882941, "uuid": "39e00559-23f0-4ce4-8081-efe3c2ab17bc", "value": "T1AD25BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882941, "uuid": "b61c0233-a65b-4023-bc28-f804034fe2f3", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882941, "uuid": "2059915d-3842-4d2b-98e5-eb9c8850304e", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2geFIIm2mlg:kBiaa4powXiolDS2geFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882941, "uuid": "0efb1db3-00ec-4440-9493-582a0d904438", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882941, "uuid": "e17b0861-3135-4bdb-a971-dc65fa97c2fe", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882941, "uuid": "ef9d04e0-0174-4365-89e9-70432a92861f", "value": "a4231420d8236e13c9ef07b81674026f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59fe6bf3-84c5-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643874369, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874369, "uuid": "891a8188-c3d7-4d25-aac3-b68046f74626", "comment": "Malware payload", "value": "df0ff95b9eb04c5df7b12f5d94c6460e", "object_relation": "md5", "Tag": [] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874369, "uuid": "5cb6f57c-575b-4a77-9f87-6c68820528f1", "comment": "Malware payload", "value": "3190fc011f658d1508caea6c5d02d20ddcddf83f559c72467f655d466cf6efb6", "object_relation": "sha256", "Tag": [] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874369, "uuid": "ad0a1644-d623-430b-96d9-f08bafd66564", "comment": "Malware payload", "value": "c8444e3cea3cc5a4558024e24ddb89110153593f", "object_relation": "sha1", "Tag": [] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874369, "uuid": "48f0b399-f1fc-4619-b24f-315619d979a0", "comment": "Malware payload", "value": "20ea63c1f72ac78eb49673520658efe31c29a830ba74c127b3c459a8a2f5bd7010ea83adb6ddedd6c400c20d848c1b50", "object_relation": "sha3-384", "Tag": [] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874369, "uuid": "444e1535-8d18-46d1-b36f-73cbd4b86896", "value": "T1F94123DB3C9CE5DC43DA2FA7253EB8C0E122CCA03980594FBC52D8656480D64DBA6A7D", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874369, "uuid": "02aada00-8853-4b11-9a39-31cac3c306fa", "value": "48:toJ+XRgj6VZxIW/HCWurcTFWTFNZ2vN/xkiY5YejcS2MOAC7:7XRgGVZGWqxwTFWTFJd5Y4dOl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874369, "uuid": "ac335d32-5540-432a-8dd3-df78b5d1e3b7", "value": 2019, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874369, "uuid": "2408699a-a462-45bd-82bc-a091e648861e", "value": "text/html", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874369, "uuid": "0e7e9dd5-b3d0-40ac-a389-c9c2961c4674", "value": "18.htm", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0321c522-84cf-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1643878518, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878518, "uuid": "0a19ecc5-8dcc-4a84-97f2-afd80ae05e7e", "comment": "Malware payload (ArkeiStealer)", "value": "f08bfabd2cc3caeee9bdfb8afef2eac9", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878518, "uuid": "b8d85825-2f77-4b33-b9a0-84e757e35a90", "comment": "Malware payload (ArkeiStealer)", "value": "3195de7203698e68a7c4bae754b2d70c405e957e403eadd3169af287a36cd5f3", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878518, "uuid": "a647fe59-2ac2-47e5-86a0-f7ce9b4b81b3", "comment": "Malware payload (ArkeiStealer)", "value": "1c902feb1c2172af5042452f532b7785ea8a7f25", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878518, "uuid": "e0fe95d6-e13b-4647-b495-f263c12a34b3", "comment": "Malware payload (ArkeiStealer)", "value": "905db91ecdc4c902b35cfb874a5533111b3acf07d1af5834123f36e23abb41930385f1014ac4dfd135ee2ac40ff46ab5", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878518, "uuid": "cada7299-d7b3-4ada-a55e-69ece11b7f37", "value": "T16634DF0477D0C436F85A7431293DCAB06A3A7C32EA71C5877B96276F5E703C09A6273A", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878518, "uuid": "28e820d3-1aee-4a7c-b6de-6ef0afe2393f", "value": "26363ee2d97e8f09a6de68bb38d5f316", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878518, "uuid": "a612999f-a254-4c2e-a242-12632e9423c0", "value": "6144:jEqdJLW0rf2pkX8/gg8sxh8kX4X89wk6cuu:I8z7ukXQXQe9h6cu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643878518, "uuid": "20c17557-01c8-4c36-943b-ebd752f00710", "value": 246784, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643878518, "uuid": "fbb7bc70-91e6-4c27-93ef-01ebc201b2e6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878518, "uuid": "3db78029-85cb-4109-93d2-471c9c637bd4", "value": "f08bfabd2cc3caeee9bdfb8afef2eac9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "22a9281a-84c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643875135, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875135, "uuid": "2b48e967-479a-46fc-bd7e-659f3d4b3ffb", "comment": "Malware payload (Heodo)", "value": "7fd422f8587df48f048fa80f0f6354d1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875135, "uuid": "95a81190-c77b-47b2-8f5f-973c32876173", "comment": "Malware payload (Heodo)", "value": "319fc73c7cd3e2784b04ac8b37f91e97e481eefd6e31d1170b9e551d862e7b91", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875135, "uuid": "61983b2d-2ff2-43ab-bbd6-c15bc2fad79d", "comment": "Malware payload (Heodo)", "value": "13d732517560413bddd91d88207084e4e36516d0", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875135, "uuid": "0e77a20a-9a53-4b26-b745-7f70e400eedd", "comment": "Malware payload (Heodo)", "value": "8592182574dc8b58f2c6f0b01a8f52326abc620d0fd69556223898d8ed9e35f925e0946e5411467a25fc76274417d62f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875135, "uuid": "9d78148a-d1e2-45bf-910e-0f902ce49e15", "value": "T164E36B2576C5D9C6DB0822350ADACAEE3327BC479E7643C33158F31E2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875135, "uuid": "62654ea8-c49a-451d-af07-c55341ff625a", "value": "3072:ccKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0e:ccKoSsxzNDZLDZjlbR868O8KlVH3deh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875135, "uuid": "2b588b91-48e0-4f40-9537-b283acaee678", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875135, "uuid": "f4fe33b3-fd96-4bd4-8621-f5d27d0d1fe0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875135, "uuid": "022f29b4-ea68-407a-bd97-001fa6714dc2", "value": "EPN30748531641895.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "af8a8b71-851e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643912738, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912738, "uuid": "967cf123-e36b-4d52-a050-e3db8de8a156", "comment": "Malware payload (Heodo)", "value": "d11e04b7caf43f07a27af8d97b54610c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912738, "uuid": "8919581a-05d5-4211-abaf-47bca89fb736", "comment": "Malware payload (Heodo)", "value": "31b4b60ccd1583175995122b8ec3a3c8e89e2a2096e5fff5609f88248f972744", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912738, "uuid": "bcfa1936-079d-4881-9ad4-d4d58d476a14", "comment": "Malware payload (Heodo)", "value": "91a7bbb7815d7a854f8b54c16cc758c837ec43cf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912738, "uuid": "da9f338f-09d6-4390-8558-5e6fdba9214e", "comment": "Malware payload (Heodo)", "value": "917b1ebe7690cc234e152aade551f9eb77f9a3411f88d73c0d1345951fe3e949a8381a9f239cf281676f19c8c66ad0b0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643912738, "uuid": "d753f796-46c3-4104-a7d6-60fb49ad97f5", "value": "T1F0E39D26B695C95AD91407311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643912738, "uuid": "64777ebc-7dcb-498f-ae7c-9d1059b34e92", "value": "3072:ccKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcl:ccKoSsxzNDZLDZjlbR868O8KlVH3Ueh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643912738, "uuid": "f2cfa4c5-a868-4873-a042-1783347db618", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643912738, "uuid": "12de17d4-7694-4db1-8365-8b9d3fd6d51a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643912738, "uuid": "194532a1-dad2-445e-979d-c5dbfffb5722", "value": "tmpwd0faxpl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b00d398-8519-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910475, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910475, "uuid": "396f9d7b-5ddf-490a-88b0-a73541ff63f0", "comment": "Malware payload (Heodo)", "value": "9b336eee1bb5af62cc779b9217eaf567", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910475, "uuid": "aa3415d5-b2b8-49bb-a45d-e298cac9e18d", "comment": "Malware payload (Heodo)", "value": "31dcc8587d285f37ee9ea43c0e6bf359e4a439fa2cc907e7f0f314308162a3f0", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910475, "uuid": "e871b5ab-f00c-44dc-b470-f6ecd3543555", "comment": "Malware payload (Heodo)", "value": "7d5de58fd9f24e294a6fc140454c7e9c9026d6e5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910475, "uuid": "d686397f-b09d-46da-a567-2efc26cc6c8b", "comment": "Malware payload (Heodo)", "value": "ebe79d4fdf84eecce30d7547fcedaebfcfd51ef9de0eb8b5d4a9ea247b82b636b6610ae38316793943da178fb3b99102", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910475, "uuid": "da017ad7-60e1-488f-ab94-7b57775ce3a5", "value": "T166E39D26B685C95AE91407311DD7CAF7333BBC818E7683473249F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910475, "uuid": "06fb253e-1029-4204-9866-78bfe66ffa84", "value": "3072:fcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lc0:fcKoSsxzNDZLDZjlbR868O8KlVH3UehY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910475, "uuid": "d2d8428e-e4f0-4ab8-a283-30cdd9040d74", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910475, "uuid": "4f0295b1-1bcc-4931-9529-532710fddcd1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910475, "uuid": "5158c4c1-e896-49a5-b8c7-b38582a18bd2", "value": "tmpylw1h1ws", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "72eb0da5-84d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882142, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882142, "uuid": "d2c94606-9254-437e-be9d-d3635ac02720", "comment": "Malware payload (Heodo)", "value": "55e14c43b7d272fb47c54003d373f8c3", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882142, "uuid": "507a0de9-3f01-49f5-aa97-4e274f368474", "comment": "Malware payload (Heodo)", "value": "31e2e593a62c4be95c799158583a73eac7551e6e46f92baf1782abf933b1c7c2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882142, "uuid": "99116b5f-f056-4fb8-890a-2101af6b9db4", "comment": "Malware payload (Heodo)", "value": "092749e6dc73c6aa9bd8f83cab3fec3d998e1ee7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882142, "uuid": "f4067bf0-9db5-4508-b7a8-af278064c921", "comment": "Malware payload (Heodo)", "value": "5954bccdbb4f64dcc309cad5661d0c41d87aa03eee770ba86aba300fa28deb18d47f7fc20e03b537ee29355bd18ab213", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882142, "uuid": "1968e67e-5857-41c5-9668-c20005db56a2", "value": "T1B8249D943B114008F817757916B35482AFF0FD128DE1F98DCE96F454AABBC50BB2D8BA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882142, "uuid": "f99706cd-31af-462b-86f2-29b4f1b9c2aa", "value": "6144:ktX5TiS4CCA2Sk0t+gtVgLXZPVICFFa48Yq/dEi:ktXWAhkIVeXZPyWk44/d7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882142, "uuid": "629b47ef-036a-42d6-9050-33f68761c8d9", "value": 219965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882142, "uuid": "aa07f608-7d7a-475b-b16b-69a4cebafb0e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882142, "uuid": "806eacdd-74d0-4cfd-bff6-b9c27fd98ee4", "value": "emotet_exe_e5_31e2e593a62c4be95c799158583a73eac7551e6e46f92baf1782abf933b1c7c2_2022-02-03__095537.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8944388-84d3-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1643880567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643880567, "uuid": "83de618a-7b5f-4ca5-a462-5345c6a663ed", "comment": "Malware payload (Loki)", "value": "6633c99b2c5bebfc2b32aa2c3d8667aa", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643880567, "uuid": "6e4f2b62-1630-42ca-a9fb-dce2e351b427", "comment": "Malware payload (Loki)", "value": "3201b8a148880cd9348f4567f394e57c55e4aba7198dfff43658f4206c5cbf58", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643880567, "uuid": "d0e88642-6150-4bea-aa70-2b88017aa951", "comment": "Malware payload (Loki)", "value": "d00bf2fbcbbab2aa5ea1931a8ee1a34f913f2cb2", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643880567, "uuid": "65d17e28-6a0d-4e36-b92f-1af7a333ded8", "comment": "Malware payload (Loki)", "value": "811169d52ed3f00d127f94a2b80dc7aa816d726760d0885c898e50f5fb61dc247af04bc71a554ba8cc7e45a88c609521", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643880567, "uuid": "d38b8b72-0a2c-4d7c-a19e-4561177be56a", "value": "T153F49D53A2A05437F1B31AB86C5B9B649D3AFE117E247C4A6FF80D4C4F39261392D293", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643880567, "uuid": "ea775b99-1a35-48fa-a85f-fe250bd81bc1", "value": "bdf469379d782b5e023f8f6a4fc61c1a", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643880567, "uuid": "7e58e693-195a-496c-a2a6-c29be55cef6b", "value": "12288:ohdVikXyu1hl04YruQXGAGDrTCvnBpUkeIA/uJBPlzvlsMO:ohfVVnlkJwW/MkeIA/uPhJO", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643880567, "uuid": "d9a82157-2057-4224-8690-bfb9445002b9", "value": 744448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643880567, "uuid": "69450f9c-5fc1-4216-b5ea-61bb0756749f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643880567, "uuid": "346d92e0-ddfc-4369-a203-5807278016d7", "value": "myfile.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fa930000-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855741, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855741, "uuid": "22c6a014-19ad-4e2f-a056-ba5ed5309b75", "comment": "Malware payload (Heodo)", "value": "7c6f2f784b2ef8922457921deff494ff", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855741, "uuid": "57247d3a-a657-4698-9e89-41c098a0512c", "comment": "Malware payload (Heodo)", "value": "3213e89ec274dbfdfe44da303ad8a125bf1f92d61db371fbbcc414fda99099f3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855741, "uuid": "6c9e675f-4758-433e-97af-44daa1d33b08", "comment": "Malware payload (Heodo)", "value": "371045cad3790f537328486adf74a842deba2a05", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855741, "uuid": "e887eb49-5a41-44ce-adfe-cbfac2095f54", "comment": "Malware payload (Heodo)", "value": "a175e4e2e8e0cd9dc9c379bf5a41060478f92c75fecbc51d83ba35a6268529982a22bcf73675bbbb619454af474f7e87", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855741, "uuid": "8d4b7224-14d1-401b-9967-1224f6971c0b", "value": "T1CBE37B2576C5D9CADB0822350ADACAEE3327BC479E7643C37158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855741, "uuid": "7a55d146-430d-400c-9e69-8928166fec78", "value": "3072:YcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0j:YcKoSsxzNDZLDZjlbR868O8KlVH3dehB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855741, "uuid": "5c5d548e-cfbf-42f9-9bac-73d28295e6d4", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855741, "uuid": "1c3ec554-1c0a-4cc1-9f10-fc9597da0495", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855741, "uuid": "83852487-d826-410f-bc1c-e12f85ed8803", "value": "2022-02-03-7c6f2f784b2ef8922457921deff494ff_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "16ef10e8-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883276, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883276, "uuid": "285ceeb3-93f7-4a8c-98cb-00ff435788f5", "comment": "Malware payload (SilentBuilder)", "value": "33b9bfd1e1cd438f33e568ad7fd81ea4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883276, "uuid": "ffa3c8d0-f837-4e0b-b808-4d777d1e0791", "comment": "Malware payload (SilentBuilder)", "value": "3257569f72c94618d4e5daee1ecdfc3cad9c09bd14d60b4af7a68bca199da207", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883276, "uuid": "7a09e2e0-a0fe-4c7b-8171-db099665b07d", "comment": "Malware payload (SilentBuilder)", "value": "f2b6b16fc8a8379a1a6128e519edf50f51ec8bd4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883276, "uuid": "68ef6421-fbd9-4617-9478-2eeb92c6d4b7", "comment": "Malware payload (SilentBuilder)", "value": "2fd21a794071769fdcd3aba37eb6b6903995e66059a82650a13cd0aa316b93eaaf6c0827db453897261737b3c30be651", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883276, "uuid": "b9a46f21-d64f-49d5-98dd-312bb8b226bf", "value": "T108A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883276, "uuid": "4e60c819-9fb2-442b-ace2-bb533e683224", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4d4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883276, "uuid": "1d84e5d0-caa1-4dd0-82cc-030c70c82bcd", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883276, "uuid": "9a974aee-2be8-4dac-9fb1-e774213e10b5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883276, "uuid": "216ca292-13e8-44b4-8b5f-4592438a5f31", "value": "2022-02-03-33b9bfd1e1cd438f33e568ad7fd81ea4_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fdcf10e5-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "7fabd9a0-8357-4184-af7c-d24abb6bcceb", "comment": "Malware payload (Heodo)", "value": "e807add77a2bd5ed94c25f499baf381f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "73de698c-b4b0-413c-b466-98a20c5a6918", "comment": "Malware payload (Heodo)", "value": "32bb383e1bb3160216c298335fecb426d6ede011b44b6d0e366c902d57e3a981", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "cee0ae1a-d238-4b59-8080-b674846afdcc", "comment": "Malware payload (Heodo)", "value": "b897f3750f85b13e8711b4587ce01e0eaf4458eb", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "583b77ee-760b-4182-9066-f96c96f997d9", "comment": "Malware payload (Heodo)", "value": "31642a28bf0fc832d0a82e9e5fb4faa806759a3bc99c2f23b1ef3d1e041a8c010b9b3b6783e207e6a76d6d5e2fbd493c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "490f8798-df53-4b54-ae4c-0c70ebb294c9", "value": "T12864E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "ede7a12a-b1e9-4d2a-8dba-17cfca08bd84", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "698eb1b8-ac7b-4dcf-830d-8c2a8ccf2de6", "value": "6144:83DvZRFTFbksYyljaMYDMKT7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMY5LAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910292, "uuid": "3b89531b-04cc-43e2-8d73-fa04fda9e48e", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910292, "uuid": "0362bdf4-f46e-49a0-b60f-c133ed7ec07b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "d47c3a49-4bfb-44ba-8f16-ab599f0d1beb", "value": "emotet_exe_e5_32bb383e1bb3160216c298335fecb426d6ede011b44b6d0e366c902d57e3a981_2022-02-03__174437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ab34501f-84cb-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643877082, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877082, "uuid": "8ed22c87-66d6-4b91-97d2-9fca8e6de75a", "comment": "Malware payload", "value": "63178a217fb53918ba643c725ff9ac0d", "object_relation": "md5", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877082, "uuid": "358b0bb3-a1a8-44ec-9932-fc7360cb82fa", "comment": "Malware payload", "value": "333dc70418dce2c0a56a074aa1718ea58a52b3a9b7f4b6a7c3996bd643d02e73", "object_relation": "sha256", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877082, "uuid": "d7ced7c3-6ad1-4820-ac16-c4e6787e1417", "comment": "Malware payload", "value": "dd076a70d6fca815caf155087329861744434a1f", "object_relation": "sha1", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877082, "uuid": "57d61921-fc66-4236-9ed6-d88712453335", "comment": "Malware payload", "value": "bf2a5f6251b30cf392df2af08110510414a987cdfcfb80749747b234b29426cdbbea4d85d569cd327a299a414e410115", "object_relation": "sha3-384", "Tag": [ { "name": "img", "colour": "#F0AECC", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877082, "uuid": "6c231595-0290-48cd-ba38-660d8c084bc9", "value": "T15845128DA1C59C67E60A4AB52AB34792E5F6FE0133220947B79C4F2D2F2C9C7509F6C1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877082, "uuid": "d3530297-9bb7-47e5-8943-4582de84be2b", "value": "6144:owlifGQvMRnhZMrgMtcf3ZmZfel1D5byQfPe:ZjbdDigkcf3ZmZ01TfPe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643877082, "uuid": "29927e39-4531-46d4-9ad0-677d5d3d0ea4", "value": 1245184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643877082, "uuid": "0af00be2-f1c8-4378-b122-6b41a1d93341", "value": "application/x-iso9660-image", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877082, "uuid": "73e79330-056f-42cb-9191-4cf5a72fcf4e", "value": "Zahlungsbest?tigung.img", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "247bc05b-84c9-11ec-9275-42010a9c0029", "comment": "Malware payload (AveMariaRAT)", "timestamp": 1643875997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875997, "uuid": "3b744275-2ed1-49cf-9c64-fb049947bf08", "comment": "Malware payload (AveMariaRAT)", "value": "e11595fdf1510369db81ad0f42fbfc4e", "object_relation": "md5", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875997, "uuid": "1851da6d-1c79-4d6a-8248-30ac8b8b7a28", "comment": "Malware payload (AveMariaRAT)", "value": "334bdd839b7454cd2db9dcdc6fec0ad5575b50b9e0a0495131e0e84aa8a96978", "object_relation": "sha256", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875997, "uuid": "9fc37554-ed49-4893-8cb9-206765c51cfb", "comment": "Malware payload (AveMariaRAT)", "value": "2042273574804ae53b2f66015241210205553ad9", "object_relation": "sha1", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875997, "uuid": "3946da35-e479-44ba-ba63-737c8587c360", "comment": "Malware payload (AveMariaRAT)", "value": "efcb5bab9b0afd64bfc97b59b304071a6df25df7340d9464cc066fdbe5039dbf8f1f088e941c4c7926644d4971c49def", "object_relation": "sha3-384", "Tag": [ { "name": "AveMariaRAT", "colour": "#8ACDA3", "exportable": true, "hide_tag": false }, { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875997, "uuid": "47329691-7341-4782-aa88-33e82f3dd950", "value": "T1EB0412D8E7420CA5F5615BB0002C476985BBCC2924CA6E41167EF26519F2F7B5CE2EE8", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875997, "uuid": "b9dd3c89-134d-486f-abf1-cf07a8c6ed49", "value": "3072:UocAZyc2pCgoL/gpCYKF0q+45KzOGuDl2c0a918LO1mBVL:lV2EgoLoYVuZBzOxNJ9fABl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875997, "uuid": "0b283ac7-78ba-453a-acdd-9f858d470731", "value": 188120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875997, "uuid": "f5fc2520-d288-4948-a099-cbbf0f05b067", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875997, "uuid": "2b387844-c48b-4763-973b-8f5c4bdcc9d6", "value": "34554323654346.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3d4068b8-8503-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643900950, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900950, "uuid": "c5a1ce89-abb8-455e-b212-1286697dd73d", "comment": "Malware payload (SilentBuilder)", "value": "e0ffb69138ad801fce0440143164d4f5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900950, "uuid": "96968b14-472d-4f23-9971-b952c71b190e", "comment": "Malware payload (SilentBuilder)", "value": "3360982c0ecce75aca1fe3d5e1deba43fe55f8d3ae599a55a8256e193a7242e7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900950, "uuid": "9ece1aa0-9bbf-4713-b6e2-7d3c0c97886e", "comment": "Malware payload (SilentBuilder)", "value": "77f9cad05bd39eef002463e24d393aacf2eb25f3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900950, "uuid": "e07950d8-4648-44bf-83ce-93f7c6254b43", "comment": "Malware payload (SilentBuilder)", "value": "2f726f94dc08bac65089b8ea970e7b4a4dc26689339860c7ff75e46fbebe21bcdd8cf8245fad6a17988e85d3f75e68aa", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643900950, "uuid": "d85ff81e-f2f4-482b-81b8-bc74c932fc18", "value": "T187E38D8AF15B0D68F1A2CA3984DA4B1437B35CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643900950, "uuid": "4f7ea593-acd9-4e9d-91ef-2c1dea5d1621", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgbqudhaVYI7iQ6VOTeshRb0KwJQiAmGor:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643900950, "uuid": "a5f33b7b-bce5-4c63-9fb8-d81d305f0532", "value": 148484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643900950, "uuid": "66de5cd4-6802-4508-a8da-19b27f4c2089", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643900950, "uuid": "d26ac6ef-a1da-4c23-ae99-8c24b47a020f", "value": "tmpi5dqtqvb", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc3d0e4-850f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643906054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906054, "uuid": "f9d374b3-ab54-4b08-af0b-534eb971b8f7", "comment": "Malware payload (Heodo)", "value": "87d4d5d78e14034f8338eddd2a0223df", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906054, "uuid": "9a882521-2323-473a-bb98-d5014e3f0b90", "comment": "Malware payload (Heodo)", "value": "3368a393f51d1cf9889b05bf899a3d757ffb97bfeb087467e40ebefcea25d8c4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906054, "uuid": "9762353c-65e5-467c-9809-41fbc6bdbacd", "comment": "Malware payload (Heodo)", "value": "1370f1487444c4dc8129eb9962048cc6fd542f42", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906054, "uuid": "3f4718ec-3f10-4277-b850-71f9acdc42b9", "comment": "Malware payload (Heodo)", "value": "3f15902748962d7a8c505bb83c616e60c8ec50f7f8edc3b892b9587056bf61b9cee2853134ee09fb9ddd08e9bf404aa2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906054, "uuid": "b3f6cac5-0f6e-4abd-a71a-def3b5ee8067", "value": "T18BE39D26B685C95AD91407351DD7CAF7333BBC818EB683433289F71E6D7B6908A23247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906054, "uuid": "d0985dfb-afbe-48ad-9c61-9f8ef4dc8aa1", "value": "3072:ccKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcq:ccKoSsxzNDZLDZjlbR868O8KlVH3Ueh+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643906054, "uuid": "7d25bb5a-5e0d-488e-9a40-b3705747600b", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643906054, "uuid": "c478598d-8c15-4485-a6a5-c4263367f5eb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906054, "uuid": "c45e7072-7f30-4365-94d4-b19a23573dcc", "value": "tmpykxuf5au", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "eed44111-8504-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643901677, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901677, "uuid": "48b68fdb-c125-4443-b602-23d0b391b542", "comment": "Malware payload (Heodo)", "value": "270831d27f40e5fadedc3b705d03eeb7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901677, "uuid": "8af0f805-964d-42fa-8f51-69ede6226a61", "comment": "Malware payload (Heodo)", "value": "337cd4e06a2831cfa58ac29d150c5e1c32cb004d9a485f68f3fa3e7addf0fb8c", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901677, "uuid": "fa0a5440-9a38-49a2-b1db-19a1f5c999a5", "comment": "Malware payload (Heodo)", "value": "6557e640b2a3bba885e55675a71f68aae2a23e24", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901677, "uuid": "0f1ca341-2301-449a-a030-7f7f0e46f3a9", "comment": "Malware payload (Heodo)", "value": "9aabee3aec9e883d788006749560791beda81c852c9280670327e197c4f524c5069d2480efd131e46727588a7e606a32", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901677, "uuid": "d3a77e2d-a9cb-44cb-b59e-a9b41ce11f47", "value": "T119E39D26B685C95AD91407351DD7CAF7333BBC818EB683433289F71F6D7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901677, "uuid": "cf8b782a-4d81-490e-a498-b5c6c5954b1f", "value": "3072:kcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgI4Lcz:kcKoSsxzNDZLDZjlbR868O8KlVH3UehU", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643901677, "uuid": "c3597adb-1ce7-49f2-b7c4-0eaa3e321c8e", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643901677, "uuid": "6d4a781f-fffb-4e9d-9735-03a463551ed1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901677, "uuid": "35b8f451-2e53-470e-bec5-8bba39cb5037", "value": "tmpbjke3d44", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f51870da-852d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643919297, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919297, "uuid": "f4362395-eca9-48ff-a93e-774565ed66dc", "comment": "Malware payload", "value": "afad62e485e7300a083db90568aeec67", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919297, "uuid": "cec8107c-4695-47f3-91c3-e962e82d5688", "comment": "Malware payload", "value": "33c1339630da37c2a749eb5a88809502ae299777e6146e50acbc13cb7608413f", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919297, "uuid": "0385ef0c-b424-47c9-b286-efe3f1c538e8", "comment": "Malware payload", "value": "8151ea07d2eb1bc715a85b4d06dc63eef9d1eca7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919297, "uuid": "8589c248-bb43-44b3-9faf-b177b545c7d2", "comment": "Malware payload", "value": "934f53243be7a98d980b28bdccc7572046dc415634d8f46805fa84335a0785c8b6356597a9f6aa446e97e2bf7932c3c2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919297, "uuid": "36753eec-e996-4188-b585-e12d9fb9ba76", "value": "T18925CF103ECA40A1F64B153E006A73584FDD6A1507E1EADFDF44F8A7AB15CC2AA3946F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919297, "uuid": "97191589-c9b2-48e4-818c-13c08a7ac336", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919297, "uuid": "ae2b8d1a-b97e-4821-b280-a02ab19432aa", "value": "24576:aKzjU3EJ7mCRpnAOxxmd3uIqUUvoq116OzvMyvTFIIm2m+l7:al3g74mm9uIqUUn1xTTFIr2mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643919297, "uuid": "7419adbb-6688-41ef-bf8e-23d1fc629d3b", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643919297, "uuid": "dd6d0398-1809-4e2f-a368-2a5d256ff04c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919297, "uuid": "adffedad-1998-4b81-ac70-cb1f27f159a3", "value": "emotet_exe_e5_33c1339630da37c2a749eb5a88809502ae299777e6146e50acbc13cb7608413f_2022-02-03__201441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8f951a65-850f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643906242, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906242, "uuid": "fec617e2-aa85-4bfa-8d18-c63ffd582656", "comment": "Malware payload (Heodo)", "value": "7e6a0d752d883c931fbc33f24b1f3b0e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906242, "uuid": "7bf8cafd-8286-45d3-81cc-8184d51f106f", "comment": "Malware payload (Heodo)", "value": "341d1204f0501419dd45cad60580df7b6715bcafb8456193b9295e09b102c897", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906242, "uuid": "380331e9-a025-4ddc-9e71-705c1dd4dc62", "comment": "Malware payload (Heodo)", "value": "d5aa2acc6fc9027b4ec21b540ba187ebb80246d2", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906242, "uuid": "fc72d4fa-09fd-40e3-a76f-0840f5c6c769", "comment": "Malware payload (Heodo)", "value": "813a6202d90cad53a66e47edc219be73c4e5f8fe275c97d5309377fffdbe92318367d49e4d49df0c9650f71d061a3ec2", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906242, "uuid": "ef4a22aa-a3bc-4174-bf5f-84aa7f998ab6", "value": "T145E39C26B695C95AD91407351DD7CAF7333BBC818E7683433289F71F6E7B6908A23206", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906242, "uuid": "de9867b2-16ca-47a1-8eef-6a57ed0e9039", "value": "3072:AcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4LcH:AcKoSsxzNDZLDZjlbR868O8KlVH3Ueh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643906242, "uuid": "d05cd388-eaa5-457e-b811-e4e5a0f29daa", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643906242, "uuid": "3fca12b0-4aa4-4f1b-99dd-654411706890", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906242, "uuid": "8b938e09-601c-4fb5-98aa-8ba9f259a5bf", "value": "tmpyl1e795f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78843c97-8501-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643900190, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900190, "uuid": "2369e81e-6564-4653-bb1f-b930b54a3510", "comment": "Malware payload (SilentBuilder)", "value": "8644ebb38ee277b8043d4682cc80b7ba", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900190, "uuid": "ad84f8ad-1c30-4a4b-8c7e-131682ca6824", "comment": "Malware payload (SilentBuilder)", "value": "3451d4742544f1464874001bcd59559c98c367eeb863d04257be9e37a625faca", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900190, "uuid": "4705fadf-0e2c-450d-9f81-78728b785ea8", "comment": "Malware payload (SilentBuilder)", "value": "2e652025c498f36081cbc904b3f96f45b0840ae4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643900190, "uuid": "12256f1b-876f-49f2-9b64-927fbd7a4274", "comment": "Malware payload (SilentBuilder)", "value": "864a381c37713a37f760449321e7ec707a7a68f4fb4722e727a5061215d41296725c01055b37f83a2baba7923bd32540", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643900190, "uuid": "94545a43-5fdb-44d1-988e-811b108af4b7", "value": "T10DE39D8AF25B0D68F192CA3584DA4B1437B39CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643900190, "uuid": "63a242aa-0712-45c6-9dc2-6cc5df96c07a", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgfquZha9YILiQaVObeshRTEKwJQiQmGo:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643900190, "uuid": "f054f12a-28b6-4ce3-879d-bbf99c2cab5d", "value": 148484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643900190, "uuid": "926254e4-0510-4aa9-8617-ae744fbfe48c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643900190, "uuid": "f5f4aa2d-2484-465b-970d-47288595abf6", "value": "tmpxuhedh7l", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a87f50f-8526-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643916004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916004, "uuid": "53882cff-3afe-45c2-baa0-fa0891df60b3", "comment": "Malware payload (Heodo)", "value": "9e02d6731c576453d81e7b7402079b55", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916004, "uuid": "f5c200d2-ffbf-4c70-8233-080d7c97db0f", "comment": "Malware payload (Heodo)", "value": "346b3d846e41719ca90747ed7bc02ddf0a9fa221e1b99b16b03d7b889d36b157", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916004, "uuid": "481ad610-42be-452e-b8de-a04ec6394fdb", "comment": "Malware payload (Heodo)", "value": "a49e957035d84ccb6d63879f658cab3159ae9c71", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916004, "uuid": "f6abe4b4-5504-4cad-8419-e740d75bcf90", "comment": "Malware payload (Heodo)", "value": "414f684a5e09bcf37676e7cfce5593f03789e52fced29c2b45d514aa981952de42bd86a4dae516997d7ee7970ff5973e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916004, "uuid": "d2f69beb-b192-42bb-a406-2e2d18e88f67", "value": "T1B1D4C05472A28476E0AEA83404249B138D6E7F715FB0C4DBD7E539AE4D3D2D16A30E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916004, "uuid": "d6f0a66e-0bc6-4c36-931a-9d743a45c29a", "value": "15b471bbc15a140b9567d4daee05d632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916004, "uuid": "9edeb6f6-3a94-4088-b2f1-7a80936480df", "value": "12288:8m9+I/aI+W1QbBi3IjeuXe6q7nCP/xCMqYDl2JwDKCX:8XrbB2IjevCkMqW2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643916004, "uuid": "e1259b41-5081-4983-9b6d-9bf296771b09", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643916004, "uuid": "58d9a489-a2d2-4bd4-bd88-cd871749f72b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916004, "uuid": "0c9a7d67-3485-4e4e-810d-a8a6de593681", "value": "emotet_exe_e5_346b3d846e41719ca90747ed7bc02ddf0a9fa221e1b99b16b03d7b889d36b157_2022-02-03__191949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69547d2d-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855497, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855497, "uuid": "ea502cf5-ba34-4524-94df-1d1f79fd0406", "comment": "Malware payload (SilentBuilder)", "value": "260c8d2fc1282fe9c490dc4f6a721db9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855497, "uuid": "0dcc55a7-b47c-4894-86b7-c24f0b0adae5", "comment": "Malware payload (SilentBuilder)", "value": "3479ebe46fb1fc7ce82a88a40b76f1d2216f97e656548a994ed26434bd9b68c2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855497, "uuid": "21b57780-5c1e-44c5-bf21-ce3fac8643b0", "comment": "Malware payload (SilentBuilder)", "value": "502d8fec9fedd851b65d376689eefa4fb5ed6113", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855497, "uuid": "f472ef8b-fa7b-43c2-a612-5c90cc46e4b5", "comment": "Malware payload (SilentBuilder)", "value": "d73002c9b30e5a59f78041f8639708d575317075b05ca00d8daa3ffaf41287652034cd23a5794c08c162535ad0cc50f6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855497, "uuid": "e3ff13f5-1b98-4e80-af96-d2d12cae714a", "value": "T1BFA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855497, "uuid": "7c34cb36-2e92-4f32-a15b-4d0f44296840", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd494:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855497, "uuid": "8093582f-1dcd-41eb-baa8-cc57c2bb42b7", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855497, "uuid": "34fd82f7-48f2-4981-9a3d-f49128ea95db", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855497, "uuid": "148efc96-512b-4bcc-8667-e4fac43ba1a8", "value": "2022-02-03-260c8d2fc1282fe9c490dc4f6a721db9_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0839bc3d-8525-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643915463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915463, "uuid": "bfbf43ba-0298-43f0-8e13-3e1d04cd6730", "comment": "Malware payload (Heodo)", "value": "e96a81e5c3b5819cd84873c975861f04", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915463, "uuid": "337c1d73-53a6-4acf-a1af-701d6319ffb3", "comment": "Malware payload (Heodo)", "value": "34dd96070306d2558a07733069d62c260bd61299ed975a9e37b2d25e91634b4d", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915463, "uuid": "9b80c6b5-d30c-4237-aec1-e7a1401e3dfe", "comment": "Malware payload (Heodo)", "value": "ac5d60e29eec0356dd243bae40246dc4757c266a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915463, "uuid": "661a19fd-526b-4c48-a323-165fe65ca215", "comment": "Malware payload (Heodo)", "value": "0438b3b93d105c47a67cc1438d13c52e017adc53b495820ea04a59edc3fc945aa42112f83e89ac78195d05d42562928e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915463, "uuid": "0b839fc5-f6c9-4d12-9a6c-23babfa21709", "value": "T1C025CF11AE4980A1F50B293D1469A7A60FDCAD021BD0ECDFDF44F9A36F12CD3957886B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915463, "uuid": "ce120ea7-057b-4cf7-9ed8-e620887b01ba", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915463, "uuid": "59ea0049-fb55-45b9-8198-f3c9bdbd435f", "value": "24576:SCiv47/YUr3bti5wcjbnZeZfxan8hX1HlyOwLVttCAUXVEFIIm2mB:SCjYwLtMvgZfxailaFIr2mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643915463, "uuid": "75b15cc1-c5a8-475a-b0d6-134a19a486a7", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643915463, "uuid": "5d7b0711-339c-421c-820c-825bbd6d8b0f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915463, "uuid": "7c3c5196-fbd5-488d-86a8-8366ac2b1e8d", "value": "emotet_exe_e4_34dd96070306d2558a07733069d62c260bd61299ed975a9e37b2d25e91634b4d_2022-02-03__191057.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49a42600-8526-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643916003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916003, "uuid": "fa81ce1e-b441-4882-bca6-379d0a3899bf", "comment": "Malware payload (Heodo)", "value": "5cf0a7d07e865625dfd5137ee05c06e8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916003, "uuid": "1151820b-d877-4da0-ab26-a27ffc0deb96", "comment": "Malware payload (Heodo)", "value": "34fd06edc922a08c37c59dad3604f7c52aa98e89645718cf81ff48d9eb40f791", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916003, "uuid": "0ebc9d6a-a1f7-4095-81f5-d150be202b07", "comment": "Malware payload (Heodo)", "value": "8a53cd8f8469da422d2e08fb6af3254818247623", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916003, "uuid": "84c5ff20-ba11-4052-9ac6-ad2b75e8c9b7", "comment": "Malware payload (Heodo)", "value": "ed1b0e7d281ddbf2e44081123503388104457f36e1f25d746dbebac201d258e84ade320c81811ba14868a91a5739fc34", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916003, "uuid": "c735b848-4155-47da-8a9a-aa3702b58ea2", "value": "T166D4C05472A28476E0AEA83404249B138D6E7F715FB0C4DBD7E539AE4D3D2D16A30E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916003, "uuid": "c4f6f5fa-8e3f-4000-b1da-a4aeb2f65e96", "value": "15b471bbc15a140b9567d4daee05d632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916003, "uuid": "3f7cd599-6b03-4601-b240-b4f49fbb5139", "value": "12288:8m9+I/aI+W1QbBi3IjeuXe6q7nC6/xCMqYDl2JwDKCX:8XrbB2IjevCJMqW2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643916003, "uuid": "492a9707-5a5f-468d-aa67-74d4d7f0a0f4", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643916003, "uuid": "5fd9a201-cfd9-4de8-b6c9-bbc2394b3c08", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916003, "uuid": "cfc88a35-18b8-4106-87e2-12076cf65398", "value": "emotet_exe_e5_34fd06edc922a08c37c59dad3604f7c52aa98e89645718cf81ff48d9eb40f791_2022-02-03__191949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c2419f8-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883285, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883285, "uuid": "c09c6ba4-9a5e-49d9-a1cd-d0819c830df3", "comment": "Malware payload (Heodo)", "value": "2c5f3ae8890f2b5426ce5c0184774f0f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883285, "uuid": "60f8b1a2-cb3d-4c72-a24b-df7ec25bb358", "comment": "Malware payload (Heodo)", "value": "35453d4de22312d904f1c4a7248144cc6cbf5064e547fb0fefc25f6a519df5f9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883285, "uuid": "e96be0e7-3e9e-4d8f-8559-72535521f40c", "comment": "Malware payload (Heodo)", "value": "c916b2e21cc79951f7d981dcba4da006c58483ae", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883285, "uuid": "bd98ff76-eb58-4d93-8d1f-c48133c87c9e", "comment": "Malware payload (Heodo)", "value": "8e93082f6f0613f96b28ef1de88ecfdf8c7e00c446967c357af1e70a5c4b0fad4ea929be531684dbe0b8199ec8bea2da", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883285, "uuid": "eefec179-a557-4e3f-8f41-2f747d379d34", "value": "T1D5E36B25B6C5D9C6DB0823350ADACAEE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883285, "uuid": "6dff8e11-d111-4042-96aa-e6d4b92c9b2f", "value": "3072:6cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0N:6cKoSsxzNDZLDZjlbR868O8KlVH3deh7", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883285, "uuid": "f2d75285-6527-4f11-8630-7c2d3e32f1df", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883285, "uuid": "3a8bbf18-b91c-4bfb-87e6-88cae7de2634", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883285, "uuid": "ab28e7ab-f3fd-43ea-96b7-81a1274ea146", "value": "2022-02-03-2c5f3ae8890f2b5426ce5c0184774f0f_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a2067dc3-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883509, "uuid": "2727ac50-e082-4dc3-9e32-5926b0d1697b", "comment": "Malware payload (Heodo)", "value": "957318d13da3fa9219acebcef23de431", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883509, "uuid": "df08a4bd-f772-437e-9848-82d260657799", "comment": "Malware payload (Heodo)", "value": "355381a2a00718b249b3fbaeaa319bbf4110ff489cee8c462e1a0348398ab89d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883509, "uuid": "1bdc3525-a78e-47bd-b4ed-045fced7a446", "comment": "Malware payload (Heodo)", "value": "5e3618e756f2ee49c6862d342eb24106dba30871", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883509, "uuid": "c5187792-a249-4f7d-bbc4-72460628a7be", "comment": "Malware payload (Heodo)", "value": "5b1a7acb74e458092545b1d6ec4441a88efd92e537738eeacbce64a03aeb3541b2f8ca172175658b26550c14d5a5a44d", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883509, "uuid": "f253518d-8ba9-444d-9a21-794444704e66", "value": "T1D825BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883509, "uuid": "300b9b2c-efc0-4ba9-b5f7-bb820aafb0af", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883509, "uuid": "50268b6b-93cb-4498-abdd-0a1c4f3e0eb4", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gbFIIm2mlg:kBiaa4powXiolDS2gbFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883509, "uuid": "ebbeb64b-2143-4dc3-9a37-2ce7d68243a0", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883509, "uuid": "331c4f36-c1fb-40ab-80ed-79368dade50a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883509, "uuid": "fb2cf579-749b-4d73-8573-64bae5a1b9c0", "value": "957318d13da3fa9219acebcef23de431", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb04cf2b-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643847044, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847044, "uuid": "ab4a4195-7d3f-4188-9d4b-9affa062809a", "comment": "Malware payload (Heodo)", "value": "de9c014fc0325440b50c4e58b7c527ed", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847044, "uuid": "9ba3dbf8-9ea4-4b7a-a162-0d8e7f8ecace", "comment": "Malware payload (Heodo)", "value": "355ad673756be96903b892d5a84767ebbbdda065c151f5cfd08e3d0ac4533243", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847044, "uuid": "b15e512c-fe2b-4b00-9ff2-2f555aabb784", "comment": "Malware payload (Heodo)", "value": "d9f4319ae8e9b9ab1c64fb4dd523644a9510320c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847044, "uuid": "508f5341-80c7-46cc-8e0f-20d9e1c38e2d", "comment": "Malware payload (Heodo)", "value": "def2d650afa54c099564fbe1a616ad68502c2aef088b7efac66cfc7c27c38719d33a9870de972d65a7d24aead827d905", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847044, "uuid": "7739463a-fa2e-4bfe-83d3-10b1a465e0d5", "value": "T154E37B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847044, "uuid": "9cd062e0-501d-42ba-8f06-7e3432b2dd7f", "value": "3072:BcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0b:BcKoSsxzNDZLDZjlbR868O8KlVH3dehh", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643847044, "uuid": "4d723feb-6b10-4370-b371-1b846ca1583a", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643847044, "uuid": "d4925e4f-44f3-4a87-aa6a-70e310b36cf6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847044, "uuid": "d424c22a-982d-4112-954a-11ed2d4ea678", "value": "2022-2-3-de9c014fc0325440b50c4e58b7c527ed.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d04046f9-84cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643877144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877144, "uuid": "40916449-98b3-4347-88a2-9b8ed08c5af1", "comment": "Malware payload (Heodo)", "value": "fd437f8bf3192259306a8b2c5c3ad248", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877144, "uuid": "7e2abdf6-2661-4a28-8c8d-57929e3b1c04", "comment": "Malware payload (Heodo)", "value": "35abfc8cc0dae5e0908af95cc7e74697354ac2bc7ab9db03919372b82c8b592e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877144, "uuid": "369b806e-daa2-4afc-aa14-084d07dcc1b6", "comment": "Malware payload (Heodo)", "value": "19634c50fa88ff648e24b41d4c01918c382e0d2c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877144, "uuid": "4fff3c38-a660-4dd5-bb91-6df38692a3be", "comment": "Malware payload (Heodo)", "value": "c876b32d5507659725e42df68cd96b2e8cde6898145fcf683ccbcf9f13ee46a5a69e49a592d125b95172915cd11945cf", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877144, "uuid": "6b9b0476-1894-4ca5-b308-01051b06ac37", "value": "T1ADE36B25B6C5D9C6DB0823350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877144, "uuid": "e8ff3c6a-0363-419d-800d-5f7eea37d3b3", "value": "3072:rcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0k:rcKoSsxzNDZLDZjlbR868O8KlVH3dehW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643877144, "uuid": "b303119c-f7e0-4ec7-85bc-8d2f7b2d6a4c", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643877144, "uuid": "35f95af4-8d6f-497f-954d-806094dd0ebc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877144, "uuid": "8bd29bea-344b-43a0-a601-9900e5eb0a4a", "value": "NSR512667314OQ.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c8190905-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883144, "uuid": "a45be7d8-ccb0-4ace-9c33-b4b3eb7faf18", "comment": "Malware payload (SilentBuilder)", "value": "139a8b27f8a85a1e6d6d92c3871ee404", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883144, "uuid": "3a4b1ac9-7c3f-46c7-8092-66f07f5ec1a4", "comment": "Malware payload (SilentBuilder)", "value": "35b21fb5a438e1d675e45d46e1914e8839dd67c39281a18f825141815d762b4b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883144, "uuid": "97c8ea69-9a64-4366-b853-f05a33d3bbfc", "comment": "Malware payload (SilentBuilder)", "value": "a8b0db31395222502ad885793073b30e73ef7570", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883144, "uuid": "99ffef25-19aa-49b0-98e2-16afa0cab335", "comment": "Malware payload (SilentBuilder)", "value": "6a3d90f3ad7aa9d30bda0635771d5a1655f0825e1def8468cf60d0d1e89644769d02dd6082069978ff14f16b96b2238c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883144, "uuid": "2ff9f663-d269-4d31-a08e-ed12150a7fe5", "value": "T1AAA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883144, "uuid": "44c1a00d-7ea2-42bd-958b-38b47cc6b60b", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4J4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1I", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883144, "uuid": "0d0a1417-8ffd-4baa-a9ef-ab7c4e965b98", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883144, "uuid": "53486988-fe7c-4d59-9976-0a041c541404", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883144, "uuid": "b412fb4b-b07a-48f6-96eb-3b1da8c12636", "value": "2022-02-03-139a8b27f8a85a1e6d6d92c3871ee404_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8512cbd0-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856402, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856402, "uuid": "e3efb7c4-a1fa-49b5-8c55-3ffd7993ce02", "comment": "Malware payload (SilentBuilder)", "value": "b3f2629fd15f42d238e55c4e57320b00", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856402, "uuid": "f4ec2571-ec1f-4dff-bd2d-857fd43f3cbd", "comment": "Malware payload (SilentBuilder)", "value": "35cc6830a337b8a6dccd7d18b72aec8524f67aada9a677360aeb0720781163fe", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856402, "uuid": "fc40fc3b-e07b-48d7-99d3-ad4bf370277c", "comment": "Malware payload (SilentBuilder)", "value": "0dc65d313bf8671ee22a8da47866e5804699f6eb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856402, "uuid": "3bc2b5f4-328d-4d10-a1cc-1570a7c7176a", "comment": "Malware payload (SilentBuilder)", "value": "f5fc43cad047155dfd5bf2dffe104212015c69651add2fd5e08180a2860cc68125940c18de0b6675e0cb0b8cb448427d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856402, "uuid": "18ea47b3-a9f9-479c-a4eb-ed80eb476c7c", "value": "T125B37C5A7365884EE55A8B3488F707962333ED208B5F06477115F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856402, "uuid": "b0977b63-11b3-46ea-aba3-dfdc6fa89aab", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49b:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856402, "uuid": "055f5d27-fe9d-43e9-a75f-045f94f38636", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856402, "uuid": "37fce33f-09ee-4325-adab-48eba17b6dd0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856402, "uuid": "082f2b49-76d3-484f-a7d7-9567ff986054", "value": "2022-02-03-b3f2629fd15f42d238e55c4e57320b00_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7c991aea-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855959, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855959, "uuid": "3a9b2ad4-e2ab-41ac-91c2-9cbfa0d22198", "comment": "Malware payload (Heodo)", "value": "bab4eaed25186a89a4ccbb78dc9f8e71", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855959, "uuid": "a08470ec-82fe-4415-9a28-8e8f6b684f94", "comment": "Malware payload (Heodo)", "value": "36168e4e90ebb00fb97f11f07a21f99beba1fa49b7248c87bb114e48a869d2ad", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855959, "uuid": "f31a7776-413e-4f81-9300-ee1b0f1bb8d6", "comment": "Malware payload (Heodo)", "value": "d46d814b207ed54c2829fb5fb2941f3d900e6c97", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855959, "uuid": "4872e87e-8075-40ab-a924-da6d0257aeb7", "comment": "Malware payload (Heodo)", "value": "5a86875a5e17d759e7e5a01f2309b0ef951117aa45e5955565bf7c718a5471ee43655bbba24d52ac077ac98849597575", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855959, "uuid": "e69b2527-62f6-497e-859a-78c5898ab956", "value": "T13BE36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855959, "uuid": "1fb223f3-acb6-402f-a279-15756256c62a", "value": "3072:xcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0U:xcKoSsxzNDZLDZjlbR868O8KlVH3deh2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855959, "uuid": "76f64610-8bc0-43ad-bc38-44259d1d2279", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855959, "uuid": "3d040cd5-f7fe-4463-b252-5f1ba1e8443e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855959, "uuid": "8a439374-89c2-4b48-ba6a-410e73202e60", "value": "2022-02-03-bab4eaed25186a89a4ccbb78dc9f8e71_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c944c550-84fd-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643898607, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898607, "uuid": "86757392-83dc-4901-bc45-a6272d746459", "comment": "Malware payload", "value": "222df6d59a99496e9c06f16227ab5428", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898607, "uuid": "113c8061-fceb-4447-82fe-5a472dd5c6a1", "comment": "Malware payload", "value": "362c741c537acadbc4c9d0924383452785f2c6c013dd5b46c3d3772c6d2461e7", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898607, "uuid": "fca02a91-a03d-4403-879d-6025bf296b9a", "comment": "Malware payload", "value": "b8fbe67a7b9272fd340ded81cdc95d4e7c86b801", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898607, "uuid": "b1cb56ee-b7c7-4e17-bd0b-ffcfebbdaae7", "comment": "Malware payload", "value": "c26b123320cb6b9bf58c8ec1716bf29d36d87286eddeccc6b34f43effaff377d4cd677d1821a40ef077a7aa7406be7d1", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898607, "uuid": "a1a486e8-868a-47f0-a794-c7464f090292", "value": "T18EB3F11980E14727C2234439DC7CC8E6994A4C47A524BE0FB8E6BE875A7DBE5371E3C9", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898607, "uuid": "00c32929-73c6-4a7b-b5cc-a80ca4776619", "value": "3072:EwGMm7ADGJXNgusBxXspFM6CHvTnD4brjUm1Nj:HXicusBcy6CHvTUX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898607, "uuid": "1384fc87-912b-4a47-9ba3-589dd3dc0a5c", "value": 114418, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898607, "uuid": "a6e0be35-5d5c-4113-8d87-aeb1117113ca", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898607, "uuid": "6b0354d0-1d42-497b-b27c-40c5d99c16e9", "value": "Factura de proforma 3092222.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7053eb8f-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856368, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856368, "uuid": "066b3101-5d42-468e-8517-7ebfd3705f03", "comment": "Malware payload (Heodo)", "value": "44466c5bdfa156e71faef0f47f7070b0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856368, "uuid": "efde5922-910e-4457-83e0-c23751827195", "comment": "Malware payload (Heodo)", "value": "36964fc85c69b73f06ef338df1f79efead9009e63d1fcad5f32233cc668e0595", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856368, "uuid": "26fcbeb9-f22e-4cc5-b932-3b7bfe3bf30d", "comment": "Malware payload (Heodo)", "value": "1d67c3ee43625443b1e30cae9861c35cf775bbc9", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856368, "uuid": "e5a9a806-ff59-4dce-8496-c141fb717977", "comment": "Malware payload (Heodo)", "value": "504d9dc53150ef3cd1dd23fda531b94cdf002291f652e47228050ad980c1c3c168576d28096eaa26386c1890c1c9ccbc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856368, "uuid": "17743ba9-ac0b-4c31-82aa-7f1d629d093e", "value": "T11CE37B6576C5D9CADB0822350ACACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856368, "uuid": "8a0e46ad-5d8e-4bcc-9892-5c51f56735f5", "value": "3072:ucKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx01:ucKoSsxzNDZLDZjlbR868O8KlVH3dehv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856368, "uuid": "9b0bdcc4-bb2e-42dc-89df-6ab6a052111f", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856368, "uuid": "b93df742-8c65-497e-9e08-daa89cd8f45e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856368, "uuid": "34038966-cdfa-4848-b7ec-fee7da068955", "value": "2022-2-3-44466c5bdfa156e71faef0f47f7070b0.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "648da598-850b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904451, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904451, "uuid": "f27da893-d736-42c4-a0c6-530dbee991be", "comment": "Malware payload (Heodo)", "value": "5bfedad0f5d4ebed81e1584ca6d6209e", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904451, "uuid": "b0de2600-be5b-4710-8a77-7c88da701d67", "comment": "Malware payload (Heodo)", "value": "36d965dfe30a62967a284c3cede72b3c7437f97c7b099d9475580be4f646a276", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904451, "uuid": "d2724708-37e3-499a-853b-97fd724c5d52", "comment": "Malware payload (Heodo)", "value": "93b4d4ed07ab7ffc6362161425303892751ae764", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904451, "uuid": "0768e4d3-6788-4ffb-b68e-3bc36a8d0886", "comment": "Malware payload (Heodo)", "value": "55a94d01f4d51f3c1ed52d8530eb5cac77b62ddaaab2c9ef6bd16578dc29cb7c17963948eb5e54dbb9a4bfc6bd0d8650", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904451, "uuid": "7ec01ef7-8f96-4f33-b934-cef11c09c1ad", "value": "T191E39D26B685C95AD91407351DD7CBF7333BBC818E7683433289F71E6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904451, "uuid": "732bdc36-02e7-4498-a8e8-248973d0b7d4", "value": "3072:tcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcz:tcKoSsxzNDZLDZjlbR868O8KlVH3Uehf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904451, "uuid": "ad294b2e-ed9a-4cf4-9883-79d54742d7d6", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904451, "uuid": "907ebea6-421b-4b68-8c4e-fd11074e31a4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904451, "uuid": "6d7b7db2-b3ea-421a-b997-0fcd9a24c8cf", "value": "tmpt2orzkfa", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c0b75351-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643847054, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847054, "uuid": "ad432d2e-9e83-460e-852f-8386f62d5997", "comment": "Malware payload (Heodo)", "value": "df4b6a1acc474877fe8713f42c37b25f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847054, "uuid": "1dba0ede-a89d-4165-b79a-b71d921eb193", "comment": "Malware payload (Heodo)", "value": "36f3cfaf6ec58f169c2b159f08f1ff448e1bd3d3c780fce24719890029004891", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847054, "uuid": "41d83e5c-5de1-4e18-9cb9-b0e3c6dfe193", "comment": "Malware payload (Heodo)", "value": "0cb6a5461130a1e1f5268c87ef3c46f9d90b9f46", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847054, "uuid": "e9eb015b-a905-40f9-a4d2-df6f2fc5cf49", "comment": "Malware payload (Heodo)", "value": "c14c1b4f1078739a2f422c1d9d93b1f1f58c7ecc256b03d2edac44fdb38e10ec25bc17a779bb2110710232a21fdd5143", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847054, "uuid": "18ce89ac-42f4-4757-b681-af816e9f6c65", "value": "T150E36B25B6C5D9C6DB0823351ACACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847054, "uuid": "54d905b9-55f3-47d1-95b4-2bf52e27a1b6", "value": "3072:bcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0c:bcKoSsxzNDZLDZjlbR868O8KlVH3deh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643847054, "uuid": "37652acd-bdf8-48ca-8834-df761fc0ccee", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643847054, "uuid": "0c6bc81d-ee51-4ba9-8ecb-993e2f211ea0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847054, "uuid": "5aa79273-0fb4-4052-8710-3d91e02d324e", "value": "2022-2-3-df4b6a1acc474877fe8713f42c37b25f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b4de07e2-8516-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643909311, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909311, "uuid": "87361114-bedd-484a-aa68-46c80a8bc619", "comment": "Malware payload (Heodo)", "value": "29375b92cf099cbcd44d0f526ff3f27b", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909311, "uuid": "29d336ae-df00-4e02-bb86-ab97537f3018", "comment": "Malware payload (Heodo)", "value": "37156b2ab5c71a094b7a180a9225a742431f6dc22d93d21eb443a239b877a19d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909311, "uuid": "ff09b0b1-50eb-452e-9cff-10d63243952f", "comment": "Malware payload (Heodo)", "value": "8d6cc669d461bd5f096addfc4900931d106ba8dd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909311, "uuid": "f2f425a8-721a-4687-80fe-cb64c44783e7", "comment": "Malware payload (Heodo)", "value": "312869c16c598f547dc3c1a176c76348a1b326ae564122704b5162845d53fd3cfe16acf4a414f2f52707d0e286d8f89d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909311, "uuid": "854d801f-f509-4985-a750-bb5e963d1da6", "value": "T13CE36A25B6C5F996D70436311FDEC6EE3227BC834E6543833249F71E6D7B6908A62306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909311, "uuid": "58ffbdec-9357-40da-9f7f-77308ce4a9bc", "value": "3072:vcKoSsxzNDZLDZjlbR868O8KlVH3jehvMqAPjxO5xyZUE5V5xtezEVg8/dgL4Lc0:vcKoSsxzNDZLDZjlbR868O8KlVH3jehu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643909311, "uuid": "4712598a-08cb-4b9f-882e-4d1bb32d9e77", "value": 148996, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643909311, "uuid": "26ebb26c-7e84-4e02-8202-1e2243db4ab2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909311, "uuid": "02559e7d-ab38-4600-bf47-d0102ccd8220", "value": "tmpwacujepr", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9ac53918-84ee-11ec-9275-42010a9c0029", "comment": "Malware payload (NanoCore)", "timestamp": 1643892087, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643892087, "uuid": "7ebb02d5-3534-43ea-8e97-c1cc0af79eee", "comment": "Malware payload (NanoCore)", "value": "18a05b7cd9622e9168267b821377b3b1", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643892087, "uuid": "21eaf474-2aee-43b8-9ee9-ae17352a25d4", "comment": "Malware payload (NanoCore)", "value": "3724685e7ab37bf18b214d6139fe6d34ac3542f84f0b77f7a6bd9d3468e9a6a6", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643892087, "uuid": "0f35338a-467e-4c7f-bb31-372ef1368ecf", "comment": "Malware payload (NanoCore)", "value": "33f08a378639e77279af59cf6dc58194b4fe3a81", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643892087, "uuid": "9598e61a-1dd4-4048-9f4a-96c25214c109", "comment": "Malware payload (NanoCore)", "value": "c544f76e146cb09aa7d42ca32afb24e6c63af3366b39cfa93d3deeca97eca859546d3d65fe3c24000767aeae88ba36c2", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NanoCore", "colour": "#49BC60", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643892087, "uuid": "8992f1ff-281e-4de8-b44a-2bac3ecc2b89", "value": "T192E5337065E86A71C795B4FB180F2822A3E366C1D935EDAF01A31BB59140EB0478FD6F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643892087, "uuid": "af2ff8a6-6e56-4deb-acf7-a67f5e6162f7", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643892087, "uuid": "a69a3108-c1c3-4be4-a540-bbd406d27a1d", "value": "49152:bIcCuqTRqIsRpNcydZKh4aqNvJsMPsoSECGkgW3J/jRNUnOyW+jOyK7v+3EBT2Fy:bIc2gTpmyfaqNvJsmSTG5W1jRO8g3EBD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643892087, "uuid": "d34ecce4-828e-4068-83bc-779bacb151db", "value": 3127296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643892087, "uuid": "594c5e32-2377-40f7-aa3a-2ed188e80fbb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643892087, "uuid": "86c6eeb7-2358-4fdd-b442-963808f3d5e8", "value": "18a05b7cd9622e9168267b821377b3b1.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec1918ca-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883204, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883204, "uuid": "8d93a52f-5efa-452c-8d5d-c6e2d47630b4", "comment": "Malware payload (Heodo)", "value": "18ad27d3af2ceea24193909d82f1a1e2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883204, "uuid": "204cf0a3-aa8d-4573-a3a0-02ee826d23a4", "comment": "Malware payload (Heodo)", "value": "38291ac6a029e22f67dfb88982c5dd99e372c94f5a519c7022234fa0074b4d4b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883204, "uuid": "756cd358-3463-4d2d-b287-ed6bea698a79", "comment": "Malware payload (Heodo)", "value": "aee955761cddebb4212be5df1c2748fe880026ea", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883204, "uuid": "d5ce1745-5e8d-46bf-a996-e34b58c786fe", "comment": "Malware payload (Heodo)", "value": "8b518f8704169ead5d6861f387760cb014d924269968d11e264606b7905331598508592d25dbd25b388eea14a71b298c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883204, "uuid": "0e5df964-bb6d-4496-be2a-189508f3aa6c", "value": "T151E36B6576C5D9CADB0822350ACACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883204, "uuid": "97f087ae-0422-420b-b9b6-0601cf3917c7", "value": "3072:RcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0B:RcKoSsxzNDZLDZjlbR868O8KlVH3deh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883204, "uuid": "d3455121-c44c-459e-bb21-795ad7d6a72a", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883204, "uuid": "10548e72-ccee-4b52-843d-0edecdeeca85", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883204, "uuid": "3c1d90c2-d851-4c7e-9687-e0ba7de9c4eb", "value": "2022-02-03-18ad27d3af2ceea24193909d82f1a1e2_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "250e8a17-849c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856671, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856671, "uuid": "31fcd495-e287-4d75-be0b-c052b5964256", "comment": "Malware payload (Heodo)", "value": "82576920f3dd176ea44f912d5f5fa2bf", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856671, "uuid": "ac639300-57ac-49f8-9c01-fe88ccf92283", "comment": "Malware payload (Heodo)", "value": "3831987dc0be99cd53ccacf8204e02503640b5ea2cf5edd54d28d2d7b1a8342b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856671, "uuid": "57afddb9-8215-4c66-8c3c-a2829ec498c1", "comment": "Malware payload (Heodo)", "value": "09413fd6f826501ddc179767093be18cdfe7d240", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856671, "uuid": "b4b4dfe8-e8a1-4e54-b9e2-4ad945940c40", "comment": "Malware payload (Heodo)", "value": "7db141efd39027075fc81db70760d71e898c4bcf222e1bec6bcd1aee7513c606031062a1beaae31da95a4aa25035aab0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856671, "uuid": "e8c877f5-32c0-45b3-ba4c-bca3730bf063", "value": "T118E36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856671, "uuid": "bb59d6a7-462a-41cd-883b-4c5d20d1712c", "value": "3072:LcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0w:LcKoSsxzNDZLDZjlbR868O8KlVH3dehC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856671, "uuid": "bf9cf131-a349-4fff-beff-d94b09dad067", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856671, "uuid": "24b4b83a-d145-4e12-8721-3baa61bd8d5f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856671, "uuid": "60fe35a4-8276-48c1-ac2a-e69bbe50956d", "value": "2022-2-3-82576920f3dd176ea44f912d5f5fa2bf.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0beb94e-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883078, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883078, "uuid": "ad5d37da-2115-4b44-9f7d-d4af4182db2f", "comment": "Malware payload (Heodo)", "value": "32c946bb151a1d615d33128e4a2ccc21", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883078, "uuid": "df72f8ea-7ae6-40cf-ac59-c336c8a0fc29", "comment": "Malware payload (Heodo)", "value": "38750f803d4c1e08464686836a559f5de437fd9164dbc3251efe7806d2ec15fd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883078, "uuid": "1d84e066-0db6-4b30-927a-e534c86ba1f4", "comment": "Malware payload (Heodo)", "value": "56386b52af83c23d74fb179b1fe6ecde522aba39", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883078, "uuid": "9df1159a-47ee-4700-b5e6-c81ab9ee9182", "comment": "Malware payload (Heodo)", "value": "870c21fb321ca76dfea966a3bdc268c52e0e1c28fad4148509be104c8a96027782b472bf395dd131c3ce3e5895d10643", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883078, "uuid": "15dc9443-ed07-4705-81aa-2ad4f0a3c85b", "value": "T1FB25C0216D8A40E6FA47193E0069B3544FDC69050BE0E8CFEF54F9A66F12CC25B785AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883078, "uuid": "602d1503-33c5-438f-9111-a8c8d11fddad", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883078, "uuid": "909c7efd-37f2-4afa-9678-cf8dc03edbbd", "value": "24576:vyj4pucLsugl4zCy9fG+OVE+cXcs2vUNFIIm2m0:vzfnl9fYVoDvNFIr2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883078, "uuid": "45fcd149-d561-4cb0-8ec1-e6ed41c214ec", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883078, "uuid": "985ee642-c161-45bd-a53f-586199633faf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883078, "uuid": "ab397314-52e1-4695-9a5e-99314ad7356d", "value": "29Z6Qfj.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0fefc528-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846757, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846757, "uuid": "24cc1738-28cf-47e8-8279-14249b48f2e4", "comment": "Malware payload (Heodo)", "value": "c7fb5c8ed8e7529db54e2157c7bd97c6", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846757, "uuid": "d1391a1d-b498-4cbe-9ef7-97e013f99ef3", "comment": "Malware payload (Heodo)", "value": "38d43319ec263e118785631eaa57029a93c7894207e4c92c4aeb34ce3c9f0e74", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846757, "uuid": "34315c82-cabb-4106-bdb6-ef7c200b4402", "comment": "Malware payload (Heodo)", "value": "9920b6aac56abace159d7f405283a9b0b976e73f", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846757, "uuid": "d13438a9-c7e7-4303-9e89-232acb021687", "comment": "Malware payload (Heodo)", "value": "d0abb0d8b7b2a95698d2fbe9e81f50fd8141169576b3524276ef0ba9ce32036ef82421f27fc4256fba05172491100ed1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846757, "uuid": "f8dade7e-8e7c-4dd9-a62a-431cd6df1581", "value": "T166E36B2576C5D9CADB0822350ADACAEE3327BC479E7643C37158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846757, "uuid": "2f73004e-c674-4651-a264-8e9e53810308", "value": "3072:0cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0e:0cKoSsxzNDZLDZjlbR868O8KlVH3dehc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846757, "uuid": "4d09895c-485f-496d-a836-a5222fedcd3a", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846757, "uuid": "6244282a-f06e-491c-b286-951388c604cb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846757, "uuid": "22b527c5-7e7b-48a8-a29a-3bdb2a46eda4", "value": "2022-2-3-c7fb5c8ed8e7529db54e2157c7bd97c6.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c951e431-84c6-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643874985, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874985, "uuid": "7e646869-8556-444c-9c45-898297afee73", "comment": "Malware payload (AgentTesla)", "value": "b6e28d3ba7c758e56c26711b5b878f92", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874985, "uuid": "dc09aeb0-c1b7-4680-8da8-066ffafc5d0e", "comment": "Malware payload (AgentTesla)", "value": "390cb3ef50509c6f87645db7046118156aa18af8027f80363a36ce3bf4077170", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874985, "uuid": "a0681698-dda1-4b73-ab9d-ad31bdd7e0cf", "comment": "Malware payload (AgentTesla)", "value": "a307ed438d393e7ebba7d68db4eaf40019d1f19a", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874985, "uuid": "2645d62d-47c3-4623-9856-2db6204a6720", "comment": "Malware payload (AgentTesla)", "value": "d1cb7755f22ddbee61e5447f8ad8ea88987aac7373325cbfb20aa261e0bff476313ca571edb262100ee5a71a40ca4fd0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "r15", "colour": "#8E01A9", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874985, "uuid": "049f79bb-0ffb-4fee-9d40-fd32b6d0348c", "value": "T13AB423664BFEA15144E88C5B08EF17E712ADA2F0271F58ED32D64CB7F450B89630DB16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874985, "uuid": "11b87e1f-3a01-4e77-bc75-9c8359a062e7", "value": "12288:lOYzGaegm7sLovJJSQkwgPAx+vcHM5geor9eJ:oYzGaeg5cv/SQxC0HM5gzrMJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874985, "uuid": "c2899ba8-906e-4394-9a4f-5fb93ea794ed", "value": 522011, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874985, "uuid": "f2b65add-94e1-4f58-9081-6d5e9a5a8c63", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874985, "uuid": "631bd024-7046-4a33-824e-821261b62142", "value": "P0.r15", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1386275-84c4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643874193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874193, "uuid": "a32b26a2-56fa-4bb3-b4cd-7f0cce7cae6b", "comment": "Malware payload (Heodo)", "value": "222147d9682241ae25dbeb9b609723c6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874193, "uuid": "635785fa-7d31-4a29-a041-054d05ea41be", "comment": "Malware payload (Heodo)", "value": "396f56d94f19659ca6e7023dbac0d2d2cd449701aba946eb9d39480a9d9b6cb3", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874193, "uuid": "b7e60908-2da4-4c5b-b81d-82558bda72a0", "comment": "Malware payload (Heodo)", "value": "519f0f2058a16b1cecdaf1a967d5f8fbf2b4b74b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874193, "uuid": "1013e705-15a2-4fc3-9590-893a8dc2e0a4", "comment": "Malware payload (Heodo)", "value": "a3e8c30779bfea51c4145e2c3957763b949852e1cc76f96a06b66d32cbcb0a803388c3e395797d1c6df2b637b1a745e7", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874193, "uuid": "2a6ad754-738c-470e-88a2-9a2a60208cd3", "value": "T139E36B65B6C5D9C6DB0823350ADACAEE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874193, "uuid": "d3e00211-1c3e-4118-9e55-b4554e5c6891", "value": "3072:ScKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0w:ScKoSsxzNDZLDZjlbR868O8KlVH3dehu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874193, "uuid": "ee395812-e2f2-4b5a-9081-c5f27750bab5", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874193, "uuid": "882e9a6d-e951-428b-ae1a-6f616a20c2ef", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874193, "uuid": "5da4aad0-b524-4b05-95da-f42dae84c628", "value": "LYE-010222 STPP-030222.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a8e44e36-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883091, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883091, "uuid": "fb52c8ce-4bc1-4f7c-aa0e-9011e61e6344", "comment": "Malware payload (SilentBuilder)", "value": "08ac853a1dad6fa1d8b850b8cf272165", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883091, "uuid": "4e29512f-9f31-47ba-bf41-bc43b8397df6", "comment": "Malware payload (SilentBuilder)", "value": "398303f24522134dd5fed21e21667f99ae6689bf9e46d3f24b11ee3702c61d29", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883091, "uuid": "c423b6e4-063a-4c00-9ed1-7a14f88d26fb", "comment": "Malware payload (SilentBuilder)", "value": "96f180115a728b3fefd9c66b8723bb03cce47575", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883091, "uuid": "027ac4f9-a3dd-4e9e-8ff6-7dd7d9adc543", "comment": "Malware payload (SilentBuilder)", "value": "52fe4458d29b75b6ba248be776e97e15f7cf1aefe85102944d69b90be09621f0b6ac5c9c3a8caf69a48a2e188f9f8bc8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883091, "uuid": "2b5a8f91-a4f5-465a-a434-c78c938b421e", "value": "T1A4A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883091, "uuid": "1125371f-bc27-4c1d-b1e5-8be1a4013edf", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4Z4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883091, "uuid": "be1fe3b0-17f4-45e4-a091-05afb9fe57ef", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883091, "uuid": "2d916da4-be88-435a-9e3d-0a09a125ac2f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883091, "uuid": "ba227088-0af2-4545-8722-61fcad5cfd91", "value": "2022-02-03-08ac853a1dad6fa1d8b850b8cf272165_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "031a5933-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883243, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883243, "uuid": "7820c752-0145-4812-b289-24442762c227", "comment": "Malware payload (SilentBuilder)", "value": "2f62cd0123db758df814d3549998fabd", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883243, "uuid": "9456c98b-f9a6-410d-a7f1-2a3f69dc6dfa", "comment": "Malware payload (SilentBuilder)", "value": "398d8a8f0f937d4a2acd69a58eb4111ae21c13e2ee627032553502d29ca9432e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883243, "uuid": "8195d777-4fde-4f53-95af-cd18634ac899", "comment": "Malware payload (SilentBuilder)", "value": "17ed08f42c9fcae4069bcf82213d687e1e2e9fc2", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883243, "uuid": "3ef30f65-77fb-4908-98df-16887b02320b", "comment": "Malware payload (SilentBuilder)", "value": "e45f45f3c9b96234b019731c94969f7cd77a2e78c59592c9da06f36d3b84ba4a372cb5d71bf8c2b192bd24181d766748", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883243, "uuid": "e342f8d8-9235-476b-a59d-3ed6b507a155", "value": "T173A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883243, "uuid": "44059dd3-ebf0-42b5-8558-6896afbe5580", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd494:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883243, "uuid": "d67541be-4d8a-4fc3-869e-b37e7c579b13", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883243, "uuid": "31b29885-1d97-4254-9303-942a27b45a7c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883243, "uuid": "1f57108e-d57d-414c-a5eb-62605eb63536", "value": "2022-02-03-2f62cd0123db758df814d3549998fabd_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d7a9a38-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855450, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855450, "uuid": "70723994-c0eb-41e8-828c-f487bce7e0f1", "comment": "Malware payload (Heodo)", "value": "217276588125bdb07b02472c8e90e1c9", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855450, "uuid": "75f0ab8d-dfc7-4867-a5b2-30d1d9316c66", "comment": "Malware payload (Heodo)", "value": "39e7455b3bb09022c4c129aae8757c3a781d078de8d348e8675eaa77ab2dd89f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855450, "uuid": "9eabb610-fbf8-4b32-9113-f5893d2f6780", "comment": "Malware payload (Heodo)", "value": "48d74190bb8cd17d15d5fc78a35cad0bf2c30f7b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855450, "uuid": "7777774b-3811-4ad4-8a92-f75016cbee7a", "comment": "Malware payload (Heodo)", "value": "7069dd39fd2be9a7987f61911d4be110d7d43b2d40f370efbf5698b4d73ec6e9e1e98e793b7b467767dca9c0235bf09f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855450, "uuid": "44fc3aed-25a8-4604-9961-ae0281d98cf9", "value": "T153B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855450, "uuid": "732ab205-d329-4976-a649-10af602d0740", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49i:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855450, "uuid": "e68b7469-cadc-4448-85ee-285193a98511", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855450, "uuid": "de8732ca-1bd5-428f-a4bb-cb2833101f3a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855450, "uuid": "0328db94-8926-4128-9839-95719a248a49", "value": "2022-02-03-217276588125bdb07b02472c8e90e1c9_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e2f6346-8510-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643906535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906535, "uuid": "d0320f63-3398-4eb9-a069-2f161ea56008", "comment": "Malware payload", "value": "e394a1821a868295219b8a0349fc58df", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906535, "uuid": "922bad7a-b0d0-4f7c-af39-c2a673f1c850", "comment": "Malware payload", "value": "39f880088cdcad394b05dc22ce85143fda312d8ca09e3205aacda7e1553fe852", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906535, "uuid": "256f5fca-6f09-40d2-9b57-efe89816bed0", "comment": "Malware payload", "value": "246eba2f01f3bb5ec606dde05909a1f436a314a7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906535, "uuid": "5bb78dc3-2bff-4775-be95-d84a6f78bddc", "comment": "Malware payload", "value": "d758b274597f756552888880616548550820a3e2b7b5124a84c442cd19953980b2a902d98681ae60345b22e1b14eb366", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906535, "uuid": "b6a2540e-3453-4e7d-be95-096e3b17358b", "value": "T104E39D26B685C95AE91407311DD7CAF7333BBC818E7683473249F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906535, "uuid": "121a1cd3-43a4-4580-bc04-117e0cfff425", "value": "3072:ncKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4LcX:ncKoSsxzNDZLDZjlbR868O8KlVH3Uehz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643906535, "uuid": "22b89ffe-d4cc-42bc-82a0-83f42ad7aa1a", "value": 145396, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643906535, "uuid": "d5a28fb4-9bbc-485b-a07a-1662334ebe91", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906535, "uuid": "29533e22-323f-43b0-a0dd-d290a50c5449", "value": "tmp1b6nqfqs", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "47f35d47-84ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643876486, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876486, "uuid": "06665d79-e334-483a-ba61-ceeb99382ea6", "comment": "Malware payload (Heodo)", "value": "b2821cc4a08eb5fe094e91a5a8fc54d6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876486, "uuid": "5d5d5d2b-ab91-489a-ab4b-471b7ec98b0a", "comment": "Malware payload (Heodo)", "value": "3a7d145676ba3d8f49ff8847c1520f73de42dd4f2e67ee913f7e8d022443eeeb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876486, "uuid": "fb36c13a-aba6-43d1-af34-ea3e385e2c1c", "comment": "Malware payload (Heodo)", "value": "e47aa0f1e4d320be8a98803b35f3ffcdcde39f7e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876486, "uuid": "ce0596fd-afad-4f83-a5d1-c5e9801d9a59", "comment": "Malware payload (Heodo)", "value": "4ed56b681840ef9869170eca17fa88927784bccef9c5a09dcabf240ab8f5acb3015ad6359ab370b4153000cfcb93947f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876486, "uuid": "12fd8b88-da2a-4ba9-9c8f-d7ba5e98f27c", "value": "T1EFE36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876486, "uuid": "b4c7a596-e9e9-43b1-9e35-64c8d0b1f6cd", "value": "3072:NcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0L:NcKoSsxzNDZLDZjlbR868O8KlVH3dehJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643876486, "uuid": "af1f833a-614b-4afc-a7c5-cb7dc78584d0", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643876486, "uuid": "97096bac-12c3-44a7-b164-c52dbbc2657a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876486, "uuid": "37fb7518-05a1-49e4-bc54-20fe4f7dc22e", "value": "93634432941.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25ba60f0-850b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904346, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904346, "uuid": "14942c36-430b-4b6d-ad0c-eeb97b8320d2", "comment": "Malware payload (Heodo)", "value": "61b7ab77886bc81f8578fab57880c623", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904346, "uuid": "0018239c-b108-4e85-aaf0-42362334524d", "comment": "Malware payload (Heodo)", "value": "3aa5ca5a49e31ce8349d160e4485955a4b0bd6ea14b071e297f58608e2ebd70d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904346, "uuid": "c46ff8e4-ae8e-465d-bd57-c393eeb027aa", "comment": "Malware payload (Heodo)", "value": "ecf62702849d0b8071301d6174a7eadbbe6b612c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904346, "uuid": "2a89ff99-7010-40cd-826d-5ab74e6489d4", "comment": "Malware payload (Heodo)", "value": "6612a363d43f03dc1c7d3520191df3287ccf3498d776b981aa9f110e3e4a3f72185edca929a7c90308032f1f68a6f239", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904346, "uuid": "ed68c34f-71d3-402e-9624-dbf7da306b67", "value": "T158E39D26B685C95AD91407351DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904346, "uuid": "c9669363-c27c-447e-ac9f-949bee659357", "value": "3072:xcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lca:xcKoSsxzNDZLDZjlbR868O8KlVH3Uehe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904346, "uuid": "07f68204-c503-436d-a3c7-c2e073fa6293", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904346, "uuid": "f151d1b3-0e8c-449d-a1ed-33bde8254b3d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904346, "uuid": "7a6a52d0-69a7-459c-b2b2-5374d17bc809", "value": "tmp82o8jgsy", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d015db6e-84c8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643875856, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875856, "uuid": "27efc66b-3bc3-4922-8eea-290b8b7fd191", "comment": "Malware payload (Heodo)", "value": "5c160857779c8da6c30651c82bbd56b1", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875856, "uuid": "dbfb5d36-516b-438b-8858-734dace7bce5", "comment": "Malware payload (Heodo)", "value": "3b0158eb80a4ce6aefbab643c3ca57253d265c8c82754c4a7e31dbd64b5aa48f", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875856, "uuid": "86dc4928-70f8-4ad4-86d8-ff4c3d3eba2c", "comment": "Malware payload (Heodo)", "value": "f79988cb7c8670a85ea61b98d4790c8c2138e224", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875856, "uuid": "949fe538-8469-4eeb-be9b-dd3512404e8b", "comment": "Malware payload (Heodo)", "value": "0327880ae528bc9880b912f76d0ae0101411d941d1faa843a5df672b455043716e4bc9f8223651bec9c1d59af08210c9", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875856, "uuid": "7bc11fdf-0373-4360-81b9-1793a83216dd", "value": "T14EE36B2576C5D9CADB0823350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875856, "uuid": "ea93a810-d4a9-4c3d-8d15-8cea9d059169", "value": "3072:GcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0j:GcKoSsxzNDZLDZjlbR868O8KlVH3dehZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875856, "uuid": "3d8b8fcd-8f14-475e-8efc-fcbe235795a1", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875856, "uuid": "3ce295c5-09c4-4f58-9228-0a1bf533c5a0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875856, "uuid": "f56d8716-debd-4033-bc3a-922a065238f5", "value": "bueltel-westhoff.de.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3881938-852d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643919294, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919294, "uuid": "49d0a731-372f-4140-98d8-0a7a50ba4722", "comment": "Malware payload", "value": "c8579c99f3f77bbb7b19cad66c4ca020", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919294, "uuid": "8941fd5b-daec-4429-817d-a1dccd3c4393", "comment": "Malware payload", "value": "3b27122616212a406e54e8ddfa9726d3e744388a3afcb23a0c664591a09c88ef", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919294, "uuid": "b86eaede-ca94-480f-8bb9-28821f616057", "comment": "Malware payload", "value": "5a882a05f1ba67e05ee74d2ffcbd536313fb2756", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919294, "uuid": "00dcc22b-f8c8-4de6-9a0f-ad009e5d6e70", "comment": "Malware payload", "value": "df29e83c5a378b884f04d8930a0a90f52a531547a35f6bf6d631c4b91bb51fda62d98c02aa362adb24631d84112a26cd", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919294, "uuid": "d7a5e2bd-c5f8-40e7-b607-675ff1a519b5", "value": "T1EB25CF103ECA40A1F64B153E006A73584FDD6A1507E1EADFDF44F8A7AB15CC2AA3946F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919294, "uuid": "9b6f369f-578c-42c9-a56e-cefdfcc3c167", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919294, "uuid": "d807d02b-4939-458b-9110-fbe5e2c000ac", "value": "24576:aKzjU3EJ7mCRpnAOxxmd3uIqUUvoq116OzvMyveFIIm2m+l7:al3g74mm9uIqUUn1xTeFIr2mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643919294, "uuid": "b5b2290e-655b-486a-99cb-af96b584e921", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643919294, "uuid": "24a3edaa-525b-4849-aefa-680bd01f4b52", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919294, "uuid": "8ce0e7d5-3c67-4fa5-ad92-a5d60a2e084d", "value": "emotet_exe_e5_3b27122616212a406e54e8ddfa9726d3e744388a3afcb23a0c664591a09c88ef_2022-02-03__201441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f3ff4a0c-852d-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643919295, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919295, "uuid": "2eb4c9e6-764a-4bad-b7f4-495627710c9e", "comment": "Malware payload", "value": "eacd2a6faf98fa0d5d16ce88e5b369b8", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919295, "uuid": "fa675f7e-2819-4256-8471-557f20d010d0", "comment": "Malware payload", "value": "3b391b8a0e9457bb13705fe964cafd560ccca8ad2ed0210c64d93900c8346125", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919295, "uuid": "7ee9f75b-5926-4d2a-977f-ddacc2cc9a79", "comment": "Malware payload", "value": "0cc13261f2de9c3e24a9c6987cf133d85f258eae", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919295, "uuid": "0c5560de-fc37-48ee-83a6-414aa0270a26", "comment": "Malware payload", "value": "88324e4a8443459d8a3575c60dcc1c5522ddc8defe53a60daffea5bfcf749fd2a65ae0c07fccb29fea3d8fca5a41de72", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919295, "uuid": "2e58bac8-9863-4084-a5c3-9905a9a83494", "value": "T1D625CF103ECA40A1F64B153E006A73584FDD6A1507E1EADFDF44F8A7AB15CC2AA3946F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919295, "uuid": "ac8e35f3-e37a-4439-be0a-2510b73663f9", "value": "6bb137f0f1c013c3971dc4dc5e0dea84", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919295, "uuid": "927f8309-fc89-4250-b8cf-0c752879d912", "value": "24576:aKzjU3EJ7mCRpnAOxxmd3uIqUUvoq116OzvMyv3FIIm2m+l7:al3g74mm9uIqUUn1xT3FIr2mC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643919295, "uuid": "99a5752d-fe5b-480f-9950-2b2877983a0c", "value": 1005568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643919295, "uuid": "fe862a9b-9266-4654-a8eb-f6aedea8878d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919295, "uuid": "91970b95-08fd-49a1-b429-3f93b9dfc307", "value": "emotet_exe_e5_3b391b8a0e9457bb13705fe964cafd560ccca8ad2ed0210c64d93900c8346125_2022-02-03__201441.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c4792375-8530-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643920504, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643920504, "uuid": "33294e5c-2744-4e83-a147-4d9ccdb57816", "comment": "Malware payload (Mirai)", "value": "790439eadeaa634e8bb8d9cd1a04e634", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643920504, "uuid": "ad736c99-ebbe-4973-9d3a-16420ba27659", "comment": "Malware payload (Mirai)", "value": "3bc5e9237a886c7e87f6291b4c5c2d4b5ba0255e845a12fc002a88a1e0eb4e2d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643920504, "uuid": "25843954-afe7-4dbc-a82e-f38a23d3e852", "comment": "Malware payload (Mirai)", "value": "3d69a371388dcf677ddffe42b1d811a02f7915cf", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643920504, "uuid": "25078304-1969-4687-b638-40d604881b85", "comment": "Malware payload (Mirai)", "value": "3a17593270ceca0f66f275b06f2097e40e4b1aee8a80308632e4ae4d0bd2eaf656412351bb55623113158f83dbd65a96", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643920504, "uuid": "c19bf596-ad8d-4c0b-8bdb-3be3707b3b5a", "value": "T1089319781995F67CEEF15479E44720D628A20A08379CD1E379C3A07AFF78B0C7269E19", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643920504, "uuid": "410b1729-fe0a-4e44-9d4f-9d5bdff33ba8", "value": "1536:JLOinHQbsO3A8Hl4GgCoe3PdFD/WQ35oKfxGAwY:PnHQb5w8HCcoe3LD/WUGK4A", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643920504, "uuid": "d3ca985e-6040-47fd-b204-ca51b9887e8a", "value": 91608, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643920504, "uuid": "14f6477f-c2a1-4823-b8a5-b00baad63680", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643920504, "uuid": "1d712bec-8a85-4a99-8f25-ec85f18f88c5", "value": "790439eadeaa634e8bb8d9cd1a04e634", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "48bf6c17-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882930, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882930, "uuid": "96fdbed6-459f-4e95-a846-1bdfbf1f58b3", "comment": "Malware payload (Heodo)", "value": "47af62ea6f19843fa3a6aa823f0920a2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882930, "uuid": "6d5a3284-5fea-40d8-8143-0c772484e1fc", "comment": "Malware payload (Heodo)", "value": "3bc89fdd035c907606aa1177288e723a01d8e73fd006be881352d6bbfce7ca30", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882930, "uuid": "27ad9f65-4747-4680-896b-98f7237103d9", "comment": "Malware payload (Heodo)", "value": "8f3acfc3c9ad9bc3aad0e386c45b335d514d1ecc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882930, "uuid": "2283448f-a87b-427c-928c-888fd9ac98f2", "comment": "Malware payload (Heodo)", "value": "2648498729c360b0fb7ce5a617a3f284ad9a362c2775f4219753655d235e0e6ca162829ac1eb7392cb8b70e2da43da2d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882930, "uuid": "5c445128-6033-4f91-b0f9-8d1646baeeb5", "value": "T1EBE37B65B6C5D9C6DB0823350ACACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882930, "uuid": "27babcd9-be3b-41bf-841b-0677dc03c208", "value": "3072:VcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0S:VcKoSsxzNDZLDZjlbR868O8KlVH3deh4", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882930, "uuid": "714a8607-6664-4d09-8d31-ade124b5df00", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882930, "uuid": "7fff56f1-4978-4815-92bd-6a4b0ee88b1d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882930, "uuid": "6af5bcec-eeaa-481f-bff3-a486fcddcc95", "value": "XEA8736636047368070410045.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6b2befaf-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855929, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855929, "uuid": "b437263e-0cba-47a0-b4b9-27922865663d", "comment": "Malware payload (SilentBuilder)", "value": "5eda412d38b9cd37bb786185348e85bb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855929, "uuid": "b8fe4d4a-965c-4d38-857f-0b7535b31f8a", "comment": "Malware payload (SilentBuilder)", "value": "3bd57ce48748abc56c95c837e3f58016be47bccfaa083f9b306cb6be173d2dba", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855929, "uuid": "d3894c41-32ec-409e-80e0-73a2e7bdd9ce", "comment": "Malware payload (SilentBuilder)", "value": "08e625ef26192aa2bf32b518f6ac4c798bf3d159", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855929, "uuid": "8b8321b5-ec47-49b6-9063-a768030066da", "comment": "Malware payload (SilentBuilder)", "value": "140f6f13494986903c07deec002c1bf76d1e549d2a87054f9243fb7b5895d37db9e2edad943b8969f4c7416980edbfcd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855929, "uuid": "8711cd2f-3133-4185-ac09-85837d8388f4", "value": "T104B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855929, "uuid": "2a41aa4a-854b-4edf-bfd9-b836c007640a", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd496:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmW", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855929, "uuid": "22ce9eb6-7c92-487b-aebe-958138df82ce", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855929, "uuid": "d398b8ae-4819-4786-8638-85ccd82c07a6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855929, "uuid": "a08094af-4c31-4280-8541-617c6d9af32f", "value": "2022-02-03-5eda412d38b9cd37bb786185348e85bb_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f1d5d456-8507-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1643902971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902971, "uuid": "1f73d02a-5e55-46a8-9d92-bbdae5059d38", "comment": "Malware payload (Formbook)", "value": "699063081508ff386d3f7012e0e22485", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902971, "uuid": "19d18794-ca78-4a81-8057-d94a5de1de50", "comment": "Malware payload (Formbook)", "value": "3bea5fb4e6d7f626a3448f9815c3ed932a8bf14fc7eab5739cc5dc69de03960c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902971, "uuid": "5be36e8d-4c56-4617-8413-1185045089fd", "comment": "Malware payload (Formbook)", "value": "37afc4dd4066be38be8c5c91bab3419ecdadb2ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902971, "uuid": "6fd5e63f-e8b8-41f2-8be5-8fd60740d996", "comment": "Malware payload (Formbook)", "value": "29ec933caaa2a43cb43b3b8ebaef64475e0a678946fbc72b944395b555e09c26cefd2350c324151c791ce872f25c208e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902971, "uuid": "39b17e53-0aeb-49ea-8eaf-46457a933e49", "value": "T10ED4D07BFA4BC991D016653210BEF80103B63FDB6AD3D6063B19B3580F723654E9A60B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902971, "uuid": "6f75e681-0bbf-40d1-86ca-5de2ba32338d", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902971, "uuid": "cd0c9996-7471-4449-8e4b-8db8e138e607", "value": "12288:Gi88IyIJn4EYvQP6svfm3JmhIwZM9dIQftwR36+HJ:GiuyIJ45Q1eZ9dIHZJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643902971, "uuid": "33cf1011-9beb-471c-b749-df6342ea5909", "value": 600576, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643902971, "uuid": "8e2fd284-cefe-45a4-baef-d35a56c88e6e", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902971, "uuid": "23383291-96e1-4495-baf8-7662a17eb2a6", "value": "699063081508ff386d3f7012e0e22485", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "82bbf34c-84c6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1643874867, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874867, "uuid": "b19f5776-c6da-4650-b9c4-36af4bb528e2", "comment": "Malware payload (SnakeKeylogger)", "value": "30711c9457b13334530f1459035ae4f5", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874867, "uuid": "9e440ae4-b87e-4869-9b80-da92d64d3930", "comment": "Malware payload (SnakeKeylogger)", "value": "3bf2c48459b52f006cd4134bb1f834b8db6acca3e4b7f11d54a6974f5fdb6d91", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874867, "uuid": "2a71770b-1692-41ab-a8ce-65c830c8d0df", "comment": "Malware payload (SnakeKeylogger)", "value": "91b6560f2b803b34a30fa024539e25a7bb368193", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874867, "uuid": "9c864123-29dd-4506-810a-ef0fd824178b", "comment": "Malware payload (SnakeKeylogger)", "value": "354d109c0350d477c65af50110bc73901bf960385cacf59dd7f6361cd6c67188587302cec148f6a32939f1937f508fac", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "geo", "colour": "#818969", "exportable": true, "hide_tag": false }, { "name": "Halkbank", "colour": "#2FBAE3", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false }, { "name": "TUR", "colour": "#4C8BC4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874867, "uuid": "e9e6caed-4ca9-46db-8e2a-f0febe0c7439", "value": "T1C5550170A4AB8651F61B8870257CFA6102B231D3E9C60D38537D7645DFEEE993E8860F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874867, "uuid": "4e6e4f7c-1c46-4bf2-9de2-50c4626d9296", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874867, "uuid": "7bc6613c-5c75-49a8-9ea7-3f32c1e16eae", "value": "24576:ahVOV9fy94DIOBmVCoLYFRA+o2bH8dg/QE+GEt5YP+4Vo9gT/j:a65DIOoVCysfoYcdLEBE7YPJVo9gv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874867, "uuid": "8b57e8b3-4e09-4157-a3a2-627eecf7bade", "value": 1311744, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874867, "uuid": "7a2a0f28-10b1-470a-9925-652d7d5d15f9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874867, "uuid": "fc5e8a56-35b7-4900-a15f-0383ef79f695", "value": "Halkbank_Ekstre_20222501_073653_270424.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23f5aec7-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883727, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883727, "uuid": "81a41e48-86f0-4405-bce7-df6837dddcc5", "comment": "Malware payload (SilentBuilder)", "value": "9f176f64bf2791b108fce26062f7bb13", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883727, "uuid": "6b371eca-61a2-4ffe-8f4c-fbbf757f9be3", "comment": "Malware payload (SilentBuilder)", "value": "3c67e3df0ae162e048baaa60632bffc4eb15318b84432302d7a1c2368f0c5a5a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883727, "uuid": "f70452e6-5b40-4c73-82e4-804751d2f23f", "comment": "Malware payload (SilentBuilder)", "value": "04cf1790faa7017468be319fd46fc678852011dc", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883727, "uuid": "df9c7cab-0b95-4aa2-8552-7226b3363adc", "comment": "Malware payload (SilentBuilder)", "value": "9cc13a4e74c44b444f01cad5073e609cfe57f295c05e67210ee2eda468f6e41ef211a867ba5f58491b4924a6a5602e98", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883727, "uuid": "fdd14a67-1792-47cc-a730-4cf485eec0f5", "value": "T120B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883727, "uuid": "341423c3-5d1e-4ffd-bf69-f87cf4fe1e97", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49P:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883727, "uuid": "5515e934-6bff-4c65-9441-b6bc14b672a2", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883727, "uuid": "d27e300d-9bff-4c4f-9253-91ef052787b3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883727, "uuid": "6b8fa735-8412-4e2f-9c51-e8eb42098937", "value": "2022-02-03-9f176f64bf2791b108fce26062f7bb13_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a5c5118-84dc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643884168, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884168, "uuid": "eab77cc2-0563-4697-b0f3-2a4b659e1e2d", "comment": "Malware payload (SilentBuilder)", "value": "f1a779a0d8900a20c6d63b9f6890eab4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884168, "uuid": "26bda23a-dcd4-473f-a927-0955caff4ac3", "comment": "Malware payload (SilentBuilder)", "value": "3c8c09837a03ece48178b036c216412475dc9ac13bfd581ca78c202adc103427", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884168, "uuid": "4beaf66a-8328-4a48-83f7-ef66c3f79731", "comment": "Malware payload (SilentBuilder)", "value": "66b11e8cb0c1a88343ab061894c1cd91ecf04126", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884168, "uuid": "01baeb3e-b0b6-4ead-bec8-465da17154ac", "comment": "Malware payload (SilentBuilder)", "value": "cf568081236aac378f6608e67f0822889ff60633bbf893297a82c0428b05a3b4ac542ea105cb7e7448f88f47e116d07b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884168, "uuid": "e6005396-0c73-455f-b7ff-cad0d488f852", "value": "T184A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884168, "uuid": "f7893d88-64b7-4b9b-98a7-b411152ecf41", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4Z4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884168, "uuid": "2fe277f4-4b81-41b5-a5eb-ba4157c25413", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884168, "uuid": "2d471ae3-e481-4c67-848b-901b1ff45ed8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884168, "uuid": "f77a5437-8987-4ce7-a2af-7a813fba271f", "value": "2022-02-03-f1a779a0d8900a20c6d63b9f6890eab4_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69eca758-84c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643874825, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874825, "uuid": "0b74af99-68ca-4bfe-adfb-98a83eee850a", "comment": "Malware payload (Heodo)", "value": "1d6d8f0c3b7f9b41b7612b9d86daa452", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874825, "uuid": "5200f819-0a05-4782-b6c6-0ef5b7167ab2", "comment": "Malware payload (Heodo)", "value": "3c98ed70fb0e5881e5e92cf0c5d39926b0974f9c1350db7eb7343b3232b222ad", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874825, "uuid": "3bd2efae-0f6d-40e7-b4a0-0d86233ee8c0", "comment": "Malware payload (Heodo)", "value": "fb79f626814e3eb0f4aa8df0e0e76c0d6171dadd", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874825, "uuid": "8294d772-2dca-4aeb-9748-965c038f6675", "comment": "Malware payload (Heodo)", "value": "123d88fdbb6deb93e05f65a4748eab1bc70977b85dd26056a98559feec49a4c1c8a4ca4208c69a432877a58f0bbca749", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874825, "uuid": "83b20d2f-01d7-488a-9a3b-c417e0e18df3", "value": "T124E36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874825, "uuid": "18195c17-3425-446e-ab21-f817d10b9e4a", "value": "3072:4cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0y:4cKoSsxzNDZLDZjlbR868O8KlVH3dehg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874825, "uuid": "2a9a8ed9-55fa-4a61-9fc8-7067ac87c600", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874825, "uuid": "7b280f5e-ed70-441b-a6de-4987f6a11f73", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874825, "uuid": "51a1115a-87e3-43a3-b477-0cff4ad74f8e", "value": "MOC-010222 VWQM-030222.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "da3de413-84fa-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1643897347, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897347, "uuid": "0573404c-29e8-45c7-be34-52292c25d168", "comment": "Malware payload (Loki)", "value": "5aa743245595558d160d412d38ac7892", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897347, "uuid": "bb4b5b61-e5d8-4035-bab8-361faf9a3c0c", "comment": "Malware payload (Loki)", "value": "3d051094fe20dbff81b3ba7b876f9e74a66ca98db57329c09e69f3b3124f1c07", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897347, "uuid": "b48cd5b5-3a34-42b9-90bf-087a19bf226a", "comment": "Malware payload (Loki)", "value": "2b8f303d405982d08d90ba41f767c76bfcf0657c", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897347, "uuid": "cb762e1f-15b9-4360-87b2-49600a665684", "comment": "Malware payload (Loki)", "value": "44d851ffc460e8f51a147c0335d07fb39f8026b91b5e09eb0c6a3ee3692ada7877f70ff6c90ad0ec89abc98d6263e2a9", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897347, "uuid": "174601cd-8e02-4006-9232-bda86e498d0d", "value": "T102B41286B651E866C6EDC8F809E1C4BF97F892122763013BBB1967FFBE111656E04207", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897347, "uuid": "a47ab2cb-1256-42a6-a657-42bbd360605e", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897347, "uuid": "a2ca11ec-1e2f-4b38-8f7e-adc27ba39ecc", "value": "12288:03hLFczkQzO0RsSq4knBy084UfONd1ZZyc0BDENx+:KhxczpzszzwnYXZZ0BW0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643897347, "uuid": "ecb9da62-beb5-4e65-a2e8-81cfc2076b93", "value": 511920, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643897347, "uuid": "7b4aa5fd-c25c-49fd-83ba-d85b5a4dd44a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897347, "uuid": "fd772cd4-d343-4038-8e86-174a0b85ce44", "value": "E-Statement.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3496a5f3-8508-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643903083, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903083, "uuid": "8af185a8-df66-4990-ac37-c9ca331af337", "comment": "Malware payload (Heodo)", "value": "9864a9537980c1190865343d75c42e3d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903083, "uuid": "3da7abf5-3636-4802-8c8c-286fd38d2934", "comment": "Malware payload (Heodo)", "value": "3d216f945973dafd11461a138f71719bf58e4f1b10549c35723f488e23802c62", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903083, "uuid": "6314ea50-4a74-414c-97ca-bbb441c8b312", "comment": "Malware payload (Heodo)", "value": "b9226f6dcaf8d5d303aa2681ea371cd1f5058ad7", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903083, "uuid": "12087447-d0bb-4051-9e53-d04654f716b9", "comment": "Malware payload (Heodo)", "value": "57760336ebe1bd57b1a1c656e375edba7e0f64376fb10911d20d10fb0b8416d5ea9ec018daafdc6722910652faef34fe", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903083, "uuid": "fb2296d6-a435-4df1-9313-540883213eb7", "value": "T1D1A3BF4DE1130DB8F2E5D43AC1485E107BB702DC88827B1BB684896DBF9C2F9565F27A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903083, "uuid": "8cea5794-fdf2-449c-98c4-36fba042125e", "value": "3072:57vjgqu8hahYIfiQOVOveshVf4KwJQikmGo2:57vjgrbtO8eOaDPk1o2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643903083, "uuid": "4cbe7d8d-f284-4ddc-9c27-8024ddc69db8", "value": 105976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643903083, "uuid": "380334c0-1613-4dc4-b635-4624a2e88995", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903083, "uuid": "c6e6bcb7-6270-4aaf-9d49-df21598113b2", "value": "tmpv7xpg_3q", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56ed83dd-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882954, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882954, "uuid": "80e1d6d5-20da-4001-8b3e-f368da6a2c66", "comment": "Malware payload (Heodo)", "value": "067dff9d62573a2c23b987caf37d00ee", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882954, "uuid": "e4bc9586-7582-4f34-a475-20cb8666c5f2", "comment": "Malware payload (Heodo)", "value": "3d4f773937ca029dc6cf34991aeda75ba3f81ab38aea8640b27ca01832701e8f", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882954, "uuid": "cdfa1b9c-b7a0-409c-b68c-7067317af3b9", "comment": "Malware payload (Heodo)", "value": "bbd32c8267dd4cf925ba741da45a277bfca8c479", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882954, "uuid": "1a9edb7d-e954-43f2-9307-1d9efdd40138", "comment": "Malware payload (Heodo)", "value": "8abb244b917cfd5c6952f0f1daf6840f4cb83490ba870549ecfa31a19a35948b85200a2c9913d9bde316e9834f12537f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882954, "uuid": "81877d09-2dd9-4a74-a86a-6bdfebe026ae", "value": "T1CF25C0216D8A40E6FA47193E0069B3544FDC69050BE0E8CFEF54F9A66F12CC25B785AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882954, "uuid": "48a59a2c-4a7b-48e0-8ed5-e765048a8482", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882954, "uuid": "f49a08cc-5f06-4486-91f1-a315302ee801", "value": "24576:vyj4pucLsugl4zCy9fG+OVE+cXcs2vUgFIIm2m0:vzfnl9fYVoDvgFIr2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882954, "uuid": "4d44fbec-ee68-423f-9176-5f0f055ce763", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882954, "uuid": "a2a51684-da54-433e-bdab-3d6a240a0f92", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882954, "uuid": "407a6e27-31c3-4a09-b341-1575ccec59b9", "value": "067dff9d62573a2c23b987caf37d00ee", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "30ae6fe5-84d8-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643882460, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882460, "uuid": "a79dae75-a3fb-4c2c-8683-efc711013164", "comment": "Malware payload (AgentTesla)", "value": "a9aee138de89a6d131c1ebea67884524", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882460, "uuid": "90f13dd8-2219-4f4b-9efb-eea87a037609", "comment": "Malware payload (AgentTesla)", "value": "3d66e45674214db609e7a116642f6e574438499905d2e38df1f4a60b64320b7d", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882460, "uuid": "b4f172a2-62dc-4d63-ad16-ec69f53ab509", "comment": "Malware payload (AgentTesla)", "value": "b3bc6457269891f0dd1628c8c958913c3487b294", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882460, "uuid": "c7b5246e-d8d6-430e-aec9-b5680afec6f8", "comment": "Malware payload (AgentTesla)", "value": "f1b169f29e5e470242acf28c7d833f20d6afa663760c8a4ea7d1024a599614298b595554b3907152c6de465d464c87f0", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882460, "uuid": "733afa0f-6758-4012-904f-f017b129ef16", "value": "T188C4F1A1F6974682F45BCA317139B85102773EE7AEC6DB191328F20C0BB76544F76A0B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882460, "uuid": "dacfb198-43f1-4b4d-88a0-b19fbe64fa1f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882460, "uuid": "302d8489-6d7a-4863-9d7d-661b780f6e1e", "value": "12288:8J7p36dJMp3IQO/U7EgaVdboUM3B2jQOMbJq/EXJ:vdJMp4WOxoUIIQOOJqcXJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882460, "uuid": "f8f38f7d-7678-4818-8bbb-4fb86843f2a1", "value": 577536, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882460, "uuid": "8ae0b130-65fd-4a70-b06b-33ce0ac27403", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882460, "uuid": "cd9c1e81-c0df-4f4d-85d4-b15f077ebdec", "value": "CMhxzSXq.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c06199b8-84bf-11ec-9275-42010a9c0029", "comment": "Malware payload (njrat)", "timestamp": 1643871964, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643871964, "uuid": "a28e1e41-5cc4-4af9-9ace-2f23b5f0b61a", "comment": "Malware payload (njrat)", "value": "ab3c1f05aaf4cac261fc3fd28618bb81", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643871964, "uuid": "1baebece-611c-4ea1-bbc8-d7abdd9d3084", "comment": "Malware payload (njrat)", "value": "3e7cf8b2e3f6d13ecfccc5eb1cfb57dfe12303e3315500cecf37f53687a3c784", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643871964, "uuid": "c5fff7a4-c8e5-4ce8-8aba-0a79c589e1d3", "comment": "Malware payload (njrat)", "value": "92ecef74c844c9863fa5b5e7ced12c1ee648dbf0", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643871964, "uuid": "92ec8b7b-87cc-4d65-983a-86379aa59a3c", "comment": "Malware payload (njrat)", "value": "dfe5232163a1159009544a8c3ee18ba997b165e8a894547593b66a96408af1ba621af35561f9be2d631b1d59c76f6bc7", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "NjRAT", "colour": "#E5B690", "exportable": true, "hide_tag": false }, { "name": "RAT", "colour": "#C46D93", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643871964, "uuid": "e9899e21-3f75-46e5-acbf-d138fb1d24bc", "value": "T191752302BAC14CB2E1B31C765739D721B97975602FB6CACFA390195D87A15C0EF31BA2", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643871964, "uuid": "7499adc4-6a76-47b3-8ed8-03a348101c44", "value": "b4070734502a100c8f90bbd445995533", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643871964, "uuid": "01056d79-5f50-4579-a258-0d05df3446ed", "value": "24576:lGHCm8uPdJuwN7ikkIiYO2OLlGgKkHb9SPAL6PgH23fpC7hxc9/fdKifXC+0Ek7U:MuWzFhkAMBDKkHOPgWhC14dwY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643871964, "uuid": "e268a97d-0d39-4d35-87a2-188b7879b02b", "value": 1609120, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643871964, "uuid": "ac6ab347-8274-4126-bb23-ce106164b2f8", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643871964, "uuid": "a9c4ccbb-7ee3-4b7d-9e65-ac40717dc8bb", "value": "ab3c1f05aaf4cac261fc3fd28618bb81.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a007ce8-850c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904971, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904971, "uuid": "efa7a509-9562-4b63-90e8-820793104f46", "comment": "Malware payload (Heodo)", "value": "faf28bf95485debc8b793de385698c18", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904971, "uuid": "19d0a7fe-170c-42ad-8578-a4df09e75c98", "comment": "Malware payload (Heodo)", "value": "3e9f5026d37b68e98ca63d11b87b810404e5fb9abf5376932cc811469d3937e4", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904971, "uuid": "3e90cdc9-225c-42ce-ae73-78c0c0547c3e", "comment": "Malware payload (Heodo)", "value": "8987a199210c783f393995991fd7724b0f5f16e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904971, "uuid": "e277eabd-e756-4d96-ade6-0b7e035cd4b3", "comment": "Malware payload (Heodo)", "value": "6023011d60116d3e11f9f6bd2b480d48052294fc9b07a18226c5706a1a6e4cf8a86b8079574d1e18430ba3ffc50413a9", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904971, "uuid": "8d2f073f-5028-4577-8be0-0152d8177a1d", "value": "T1B3D4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904971, "uuid": "6211a62c-946a-4932-83e3-91871a43abdf", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904971, "uuid": "49d76ef4-7987-492a-a7cd-cd0548bcc341", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBPq7+7/Q0xIop1KpR:JynoxcCOllFxBPF7LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904971, "uuid": "cdbc1638-a3b4-47e4-9eb2-a5cb0b99db6f", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904971, "uuid": "784d6559-3691-41ef-8013-56b2c1cad963", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904971, "uuid": "aa488ce6-6740-4d8f-b63c-82eccd38d71f", "value": "emotet_exe_e4_3e9f5026d37b68e98ca63d11b87b810404e5fb9abf5376932cc811469d3937e4_2022-02-03__161559.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "20469bbc-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883292, "uuid": "f3ca27e0-5e00-4386-8d38-9017d3d862ce", "comment": "Malware payload (SilentBuilder)", "value": "3659f13810dc3f0a7130efb763c8f115", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883292, "uuid": "91e1dbb5-927a-416a-9dd7-a369a642ab50", "comment": "Malware payload (SilentBuilder)", "value": "3eb894eb2126b5e3cd05ed024172b6eebb99dbf856e119d18c07981e36bc4f35", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883292, "uuid": "7542eeb6-86e3-44c2-a946-66137200dc2a", "comment": "Malware payload (SilentBuilder)", "value": "6a685cc0cc86e33c7fb8da5fd3a9ab9513b07c43", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883292, "uuid": "fd75ed0f-0868-4c36-a60e-05abe0037136", "comment": "Malware payload (SilentBuilder)", "value": "ea621d28e23ddc18cff17c693c8fa20777b15f6e06a10e49072ca0e4c735707d0b13f1318739ceaa968cd62ba31d85cf", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883292, "uuid": "ac6c0e69-cd3d-45a1-bfef-71e5dc766d1e", "value": "T1BBB37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883292, "uuid": "32f21658-9395-402b-aaa3-fd0010be7a09", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49r:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883292, "uuid": "563abf56-439c-4d63-b611-fe16263e4d67", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883292, "uuid": "981d53fb-1271-4fc7-9e22-18088aacae2d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883292, "uuid": "d0b18ba5-9627-480c-86a1-5aeaf00d44c1", "value": "2022-02-03-3659f13810dc3f0a7130efb763c8f115_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ad00a3ae-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856469, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856469, "uuid": "81c9b5b5-92c5-4549-80da-699698c1c49a", "comment": "Malware payload (SilentBuilder)", "value": "c06022bef4c3a1f6ae24ee0367899510", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856469, "uuid": "88ecbd40-4923-4252-90cc-ac3ead0f8a0a", "comment": "Malware payload (SilentBuilder)", "value": "3f4e0970aa3949857d41e4ec98d04144ea70ba3f855a32cfc8d430b15871c355", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856469, "uuid": "c32e1fad-46dc-4d45-9813-71dc4d10ebfc", "comment": "Malware payload (SilentBuilder)", "value": "babbf1fe01bd52692af08c06b38521318e27ca54", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856469, "uuid": "5ce0e012-02b7-43c4-a30d-9842da0f569c", "comment": "Malware payload (SilentBuilder)", "value": "c854a06931be20606ca7dfb09d54d78b1884d91fde3b9b2a57ae27ffb0bd2cb97584b0017a0294734a09eee2b7d11cc8", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856469, "uuid": "d319e18c-8a55-4834-b2c6-587a67746b8b", "value": "T169B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856469, "uuid": "bfd4c7f3-51e5-4dc7-ad7f-b0c2ef28903a", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49K:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgm2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856469, "uuid": "4ab5897d-3243-43de-84af-9fe5b66dcdb0", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856469, "uuid": "158ffffa-eb29-4b83-b21d-7e9c31825db4", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856469, "uuid": "35d91544-f7f6-4d57-a8e4-afa75185a3f8", "value": "2022-02-03-c06022bef4c3a1f6ae24ee0367899510_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "06db42f9-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883678, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883678, "uuid": "76fddb82-c2d5-4b1d-a945-3e7a6f01cf57", "comment": "Malware payload (Heodo)", "value": "bb85353df4b7024adf2485e420a7943f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883678, "uuid": "4276bf15-4d77-4fa8-afe2-eb6232f78f4d", "comment": "Malware payload (Heodo)", "value": "3f9cb61fa67bf923c7a201f578dd5b1f032047a5e203a9e5f43a154438b60deb", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883678, "uuid": "f2cf0c90-3ce2-43bf-ae2a-fb61cc05de83", "comment": "Malware payload (Heodo)", "value": "26a2a0e7fa80afb2227df969b2c1b70c96c7a063", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883678, "uuid": "0daa4fe0-e723-4f20-b0c7-fd2eb6db4208", "comment": "Malware payload (Heodo)", "value": "41ccb38b1681a92fd1898f5cbd634b1a5ad5c94f538fad6e8a8cf5f749fff37d35506e8f22d1baec26a8558fabe132f0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883678, "uuid": "ae86d4d8-88b8-4db6-a120-764c6071fac2", "value": "T177E36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883678, "uuid": "536b796b-c92e-43c3-aac4-c4348bca7bc2", "value": "3072:EcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx05:EcKoSsxzNDZLDZjlbR868O8KlVH3dehb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883678, "uuid": "04cc439e-d1e0-4586-9b0b-7e2713e90a5d", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883678, "uuid": "7d5c760c-c531-405a-9ee9-b56959d09c98", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883678, "uuid": "08b4bfd2-271e-41a0-9d68-61d394bb49fe", "value": "SGT5745068308741601.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7630e5ac-8536-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643922949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922949, "uuid": "c95bc4a2-81e2-4af1-89af-e8867ff31501", "comment": "Malware payload (Heodo)", "value": "790c12351abbd474a0002c49a5f2fabe", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922949, "uuid": "f24d0809-4be9-49ee-9d5c-767a4342a1f6", "comment": "Malware payload (Heodo)", "value": "3f9e292e9bebe0b4b935a89503c06bb653f5dcfa661b545030a1d4f7bf70b04a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922949, "uuid": "3cf388f0-5c7e-4325-9b27-6e7c758b26c7", "comment": "Malware payload (Heodo)", "value": "856dc24855d4f0cda6d17276f21e275999f60f70", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922949, "uuid": "682ff42c-854b-4ad4-9621-d7f08b19996f", "comment": "Malware payload (Heodo)", "value": "e203d14bba21ffa5ca62df3799fe0f8faa734194b5799f26c85327310d7f241e579aa5ae97076b8b3284de1d63762a95", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922949, "uuid": "d42df9c7-0cac-4794-9c89-e7c6f2d222b7", "value": "T19B25CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922949, "uuid": "9f23d5c9-8d31-4414-95e5-89138c9fa9db", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922949, "uuid": "dd7fc5d8-0163-44b4-a908-0716f7099119", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyPpFIIm2mHv:exyq2kpWGWRCLWeNWO1tyBFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643922949, "uuid": "a014f0e9-c1c7-417b-bd58-41e9cfa0ff4a", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643922949, "uuid": "a3bfad15-235d-4e82-b7a2-721a9e2c2d70", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922949, "uuid": "ee6cf82f-c231-44af-9fdc-a3d9972b1023", "value": "emotet_exe_e5_3f9e292e9bebe0b4b935a89503c06bb653f5dcfa661b545030a1d4f7bf70b04a_2022-02-03__211533.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c5cccd5b-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643883140, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883140, "uuid": "98e13061-4158-484b-89cd-417c5530f5dc", "comment": "Malware payload (AgentTesla)", "value": "2bb0b9ac024ab9c68bbf49310e70e973", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883140, "uuid": "dbf2ec56-96a1-4f26-a43a-2bddc4cd2883", "comment": "Malware payload (AgentTesla)", "value": "3fae03a1107f399cadae46253725811e9a2e5f713d98cbe529eff0925c7ecd34", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883140, "uuid": "1675363a-235a-4707-9560-3c7b573aa501", "comment": "Malware payload (AgentTesla)", "value": "da7250e84805d01268fa34d8eaa279d660602770", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883140, "uuid": "d762ffc1-61c2-4640-a3d3-2c0a89367690", "comment": "Malware payload (AgentTesla)", "value": "a918f61f3ef51f8df578f96b4ba2aa6ad2d0c5c627b343823526d3c979520021f73a5658b5fd3b39c8e43017a14c6060", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883140, "uuid": "84aa192e-b1f4-42bc-a97b-ee0907a0d65c", "value": "T110B47BC5E98459A0DD19AB716A37CD3582237EFCA874A41D29DE3E373BFB2931026053", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883140, "uuid": "b78cbe4f-abfb-4cb5-8184-d732adb50852", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883140, "uuid": "21b1b6c1-8f54-4387-aefe-06b4e27d9a9e", "value": "12288:NP7r9r/+ppppppppppppppppppppppppppppp0YMg/K/uvXu5k0Dc9MEHKcD6SX:N1MbydcS8OSX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883140, "uuid": "463b2f39-1528-4698-8d7c-c8fae2175eb1", "value": 495486, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883140, "uuid": "9485697f-3102-4545-8a48-1b882cd9682f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883140, "uuid": "b3eeac23-1b84-46b1-aeaa-f24569b8caa2", "value": "S000449252092990031-022_02..exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9fed079b-850e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905840, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905840, "uuid": "d6cd3467-87de-4342-b9a2-e5c5ef286d93", "comment": "Malware payload (Heodo)", "value": "02c63f27be157d3532f4da4c814e07d2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905840, "uuid": "210a2294-9108-4864-87c7-eb6ba20263df", "comment": "Malware payload (Heodo)", "value": "3fb929a6f4bd5c6bf42e64e92dc6a19683e7cd0d41706114930b5d469481907e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905840, "uuid": "9262ea97-64a8-4796-adac-23532da22b00", "comment": "Malware payload (Heodo)", "value": "809431b82e024c913f1f0649077dd8d19eea4fc8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905840, "uuid": "94acd989-eb33-47d6-8a0c-993c13e46947", "comment": "Malware payload (Heodo)", "value": "c9a2ee6ec75e30821154f23c5392b68d768139f7994cf6bf0c3da61bb0422af3f657ffdbd3d3556f470cc3dcfe883d80", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905840, "uuid": "9343bad0-13e7-4fcc-8a01-8c83cf875935", "value": "T171E39D26B685C95AD91407311DD7CAF7333BBC818E7683433289F71F6E7B6908A22207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905840, "uuid": "b6b636f8-c82c-4d55-9e8f-5f55b24e886e", "value": "3072:JcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4LcY:JcKoSsxzNDZLDZjlbR868O8KlVH3UehM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905840, "uuid": "f37c9f40-aecc-404f-83b3-c4ce9414f417", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905840, "uuid": "221a139b-046a-49f9-bc10-cf7c28b66cfa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905840, "uuid": "3f143a4c-ce0d-4cc7-be74-58b6fcc68bc8", "value": "tmp18206h88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "57c980a6-853a-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643924616, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643924616, "uuid": "1d1ef2c1-7dcf-4d7d-8396-189946c83cf7", "comment": "Malware payload", "value": "a621ad0b04318a2b7bbca8bb807131d1", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643924616, "uuid": "b4a11fad-abc4-421c-b748-c70f9393ac88", "comment": "Malware payload", "value": "3fc1a097d2957f9a7b3d8526d17ff889f9aa77152fbeaa1f3b671426743def1c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643924616, "uuid": "1e9335c7-5a87-430c-8c73-08a1bf86abea", "comment": "Malware payload", "value": "61003ae36a5e62c9f9664994cc624d949f46d5e2", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643924616, "uuid": "5221d03b-ca5e-4321-a1a6-9c2145c68a36", "comment": "Malware payload", "value": "9338de2917820ee5bf40221b4193ef524972af5fe59d8763d119af95c3883506ac7ed6b7e0a5f75943a04b5eda41d18a", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643924616, "uuid": "0483a232-9a5c-4ce0-a9cb-e9875c279506", "value": "T1D925CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643924616, "uuid": "6cf683c7-bd04-4ae3-a64e-7cef5328ad78", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643924616, "uuid": "5ef07989-33bb-4a32-ad08-32d1b9ea011f", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyPoFIIm2mHv:exyq2kpWGWRCLWeNWO1tyQFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643924616, "uuid": "1312e398-0e85-4806-abda-c649565b68a7", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643924616, "uuid": "a54cfd7d-04f5-42e1-a0e8-d7adfc80f5de", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643924616, "uuid": "3cb3a77d-24b5-4777-bf93-74cf561a2556", "value": "BkQb2L3oq0acv.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "dc237788-84e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643887902, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887902, "uuid": "acbb0336-b2e2-4896-a385-073f956499e0", "comment": "Malware payload (Heodo)", "value": "302f4d43cd2fd03bfc0b2ece568d982a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887902, "uuid": "3eca809a-88df-4b0c-a647-15a5ae5729b8", "comment": "Malware payload (Heodo)", "value": "3fe62ba6180c9d1f20560a26d7d2ce801480dacc2908df81284f46b410df98d4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887902, "uuid": "032a9ca3-bc63-4476-9e70-6456ec3ef683", "comment": "Malware payload (Heodo)", "value": "109eb3750893f960777a88842f9d58f6b1affe66", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887902, "uuid": "be6ed060-d372-42b2-89ee-fa6f6e3e14f0", "comment": "Malware payload (Heodo)", "value": "efc4ff3b3bd925b042f3f4a0ae0a1718d0d82689691050688df04326678bff79c8388c7e5891e22f999e7f5675ce64bb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887902, "uuid": "c44db777-b18c-4758-9b3b-dffd0e795f6b", "value": "T1BD25BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887902, "uuid": "5f5938ff-3b26-4adf-b6f3-5e9975ea86f6", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887902, "uuid": "b3f5c147-d421-47c6-872e-600a7f58984f", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gGFIIm2mlg:kBiaa4powXiolDS2gGFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643887902, "uuid": "fedc1990-f68c-4fb7-9bcb-48b35fd76862", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643887902, "uuid": "84770562-55c7-4cf1-b36f-07386faf07d7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887902, "uuid": "61e43b97-135b-48bc-bcf6-c1f41da5aaf2", "value": "302f4d43cd2fd03bfc0b2ece568d982a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f580280a-84fa-11ec-9275-42010a9c0029", "comment": "Malware payload (Loki)", "timestamp": 1643897393, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897393, "uuid": "7686c8b7-59fc-4262-b115-a01aa6d10778", "comment": "Malware payload (Loki)", "value": "44b62812ddb2898be6e928af2cde97a0", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897393, "uuid": "62c0e5e3-290d-4702-80d2-de8c02b42a95", "comment": "Malware payload (Loki)", "value": "40627d9acd7ec645d079b7196204afa9e08e0338502c769170a961541c57a9d3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897393, "uuid": "e717b002-7c12-46fc-98c4-963728424dad", "comment": "Malware payload (Loki)", "value": "2e5a9f3721fd5addaea99bc3bea39d8bbd5bc756", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897393, "uuid": "0cbd7e6c-8c1c-4f20-a53c-9dd6bfc3a086", "comment": "Malware payload (Loki)", "value": "3e58a099a89e7df562c1aa668d8349ca260052018fb6c5c70f1e753db3a32f8e017dd06973f61d64cbdb6f17cf63b2c3", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Loki", "colour": "#D4868A", "exportable": true, "hide_tag": false }, { "name": "Lokibot", "colour": "#9C190D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897393, "uuid": "cc36af87-f613-4c2a-8825-a94a8c375e7b", "value": "T17494F0A978D0D596C6D632382F97CA79D3B66D09055252272BE53FFF39FD2032206282", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897393, "uuid": "2372fec6-8fef-4d3e-a49d-0a0473e3d9b7", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897393, "uuid": "36021528-ba49-47ce-b628-97855ca717e0", "value": "6144:jw4olhKTerNjIm1vxr4xFnLaNOYl3HasT9P:ZoloTW91vxr4nLaNVn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643897393, "uuid": "b3f2d38a-4620-4f14-8998-e2ffd51bad3d", "value": 413341, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643897393, "uuid": "4d1ad21e-9f12-4e3c-80fa-2b3edb4bf202", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897393, "uuid": "0824e650-de9a-4b72-a8a4-6226336fb0cd", "value": "TRANSBUANA (2).pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "59d0bd1d-84cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643876946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876946, "uuid": "fe2801a6-1091-427a-af4d-258394c193a7", "comment": "Malware payload (Heodo)", "value": "de070949c8f4c174b1975be1907aeb86", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876946, "uuid": "293e82c2-c6f2-499a-8162-40e94008f922", "comment": "Malware payload (Heodo)", "value": "40b756ab945082f9de4d904620f963e5fe34ab9e1b3b05f4a94cf230cece8e83", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876946, "uuid": "e18c7917-b0c7-4666-b632-b170f16ce9d4", "comment": "Malware payload (Heodo)", "value": "838e1ead878528ea51b2e0334fd373d012973c57", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876946, "uuid": "303da5e0-6b64-4686-8846-5ff14472a6bf", "comment": "Malware payload (Heodo)", "value": "d8d28458bf9637f8dca656235d25a7a0b250d7e955ef3839c93149491c21331c164d524a7b7618e0366472655db4df3d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876946, "uuid": "48b240ea-9814-48ba-a8c5-be1846a99766", "value": "T1FCE36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876946, "uuid": "f6965ccb-ed70-4fde-ae8b-96727f4530d0", "value": "3072:JcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx09:JcKoSsxzNDZLDZjlbR868O8KlVH3dehP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643876946, "uuid": "12592666-9b81-4829-8c15-39b72d1e0e51", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643876946, "uuid": "4c7b6268-cdc7-47fb-acf2-dba38eb1560d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876946, "uuid": "4a61b410-c153-4a9a-bb48-76fe6cd95e15", "value": "AK-2159 report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6e4bef45-850c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904897, "uuid": "74cdb80f-8566-4a0d-8307-1e55c1f8d3b2", "comment": "Malware payload (Heodo)", "value": "337d84b82774d4528e37e13c271eea45", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904897, "uuid": "cba7b8a2-7c96-492d-82bd-59ee3d16034a", "comment": "Malware payload (Heodo)", "value": "40c86af1fe1a41278b6bb2c6e6d19f625732114faff5e70997295b3cb9bdcb03", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904897, "uuid": "c6b81ae9-7167-4e8f-a618-b47e78fc6881", "comment": "Malware payload (Heodo)", "value": "4030222255acd4a2fc2ea9c5506343c837b52ba3", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904897, "uuid": "07289e93-c18e-455f-9460-b6a08f0df7a9", "comment": "Malware payload (Heodo)", "value": "eb35efb6c711965a3bb7b4be8ba321e7dd989dce216362391f111994121a008e70030d811f23d6392bb82a9491481f47", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904897, "uuid": "9ea0d49e-5f20-45c0-b829-331d759b2793", "value": "T187E39D26B685C95AD91407351DD7CBF7333BBC818E7683433289F71E6E7B6909A22207", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904897, "uuid": "899e3429-4134-4fb6-800e-2d3a45591c6d", "value": "3072:LcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lct:LcKoSsxzNDZLDZjlbR868O8KlVH3Uehp", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904897, "uuid": "4ca775b3-d1d3-4aed-b718-561ec448a1c9", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904897, "uuid": "758a35e4-1f14-4ecb-8180-c3e5123de329", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904897, "uuid": "d6e2e980-f2d4-460e-933c-2b7d42d4dcad", "value": "tmpqv7ue5wo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "33a01c66-8506-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643902222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902222, "uuid": "7a89e78d-44fb-421c-ba34-25cc7b08a6ca", "comment": "Malware payload (Heodo)", "value": "271ea1accb76f1c44cd3289746ea2e9a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902222, "uuid": "2278daa9-5105-4291-b15e-c556ca6f89c4", "comment": "Malware payload (Heodo)", "value": "40cb7da79b8da6323feda6228670a4974ebc5484a4e70ce3cbb69a9ee9a945c6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902222, "uuid": "500f4ff1-7acd-451d-a6cd-a18a6c408f17", "comment": "Malware payload (Heodo)", "value": "9f5c796285b544f55bcf84b89ab7cd27ee143fdc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643902222, "uuid": "2776f9e8-15a4-4146-ae9e-ae0b0992034f", "comment": "Malware payload (Heodo)", "value": "f1c8f68339c9edbdd849968200f874677a25701c86912a4f58c31db444a2bf5ef32eecc4a0f35070fe4e3c17142cdc70", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902222, "uuid": "4ce7076c-ad05-496d-b162-bafd9fea330f", "value": "T156E39D26B685C95AE91407311DD7CAF7333BBC818E7683473249F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902222, "uuid": "cf9f2edc-f12a-49cc-bbc1-467d7b724c52", "value": "3072:lcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcb:lcKoSsxzNDZLDZjlbR868O8KlVH3Ueh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643902222, "uuid": "2a249c5c-7e3f-485a-8a2d-fd51e28a9f69", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643902222, "uuid": "293362a0-e8f0-4692-afbf-d6221cff3387", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643902222, "uuid": "a886d8bc-d714-47ba-9438-717863c2d941", "value": "tmp1jjkr03y", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "76e36ebd-8536-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643922951, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922951, "uuid": "d1f0a1a2-7685-4bb6-ac53-68ad1f6fdeb9", "comment": "Malware payload (Heodo)", "value": "37fb2d973705b1dad0ba3a061283745f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922951, "uuid": "066e0934-0c9a-4ac1-814a-c8484594c785", "comment": "Malware payload (Heodo)", "value": "40d73e8564c87f72d8d14f07807cb1aa61dec4b1fc856987382d07a4e9aa8968", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922951, "uuid": "0d7ddb49-24df-4955-8fee-a07da7249fd8", "comment": "Malware payload (Heodo)", "value": "302053a2b021539aea949d4d5881d06658d1f6cd", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922951, "uuid": "82619c60-0af2-439b-a5b1-55e59a59c2fc", "comment": "Malware payload (Heodo)", "value": "15dab46fcda6e5de5c48957fc7ae808d87b0314fd8853f23774eff596a6723d98c617d57ff6e561e3a3a36e264b099b8", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922951, "uuid": "1c4110ca-a5ed-4568-a072-7fc99251207f", "value": "T1FD25CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922951, "uuid": "602d3ceb-6d9d-4c4c-b06d-3270d295e599", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922951, "uuid": "c5bb7466-ce00-4bdd-a46f-61654b0f6a96", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyPwFIIm2mHv:exyq2kpWGWRCLWeNWO1tyIFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643922951, "uuid": "61334b4e-b76f-438d-a97b-cc432a98cc74", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643922951, "uuid": "b2cd3251-7bd0-48e9-9854-511e9744e408", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922951, "uuid": "f614d3f7-da14-47e7-abc1-dfa69a202101", "value": "emotet_exe_e5_40d73e8564c87f72d8d14f07807cb1aa61dec4b1fc856987382d07a4e9aa8968_2022-02-03__211536.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "742b26ec-8536-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643922946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922946, "uuid": "bac1e4d9-e916-4f4c-9152-3ce52465f865", "comment": "Malware payload (Heodo)", "value": "c829d1b87cec8779e6bbd863dae8b53a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922946, "uuid": "1e1dbed8-aabe-4a73-95e2-236048b21f19", "comment": "Malware payload (Heodo)", "value": "40e81a57f0df8fdbd83f74b0c9c5f7f3c55e103fa288606a99016cb6b9b7c670", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922946, "uuid": "99834e07-799f-434c-bddf-aaa8d58cf1d6", "comment": "Malware payload (Heodo)", "value": "10093ba9bc6c992e841c439a770fc3677784376a", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643922946, "uuid": "8d00c076-ec19-4e50-becb-7c1b8cffab67", "comment": "Malware payload (Heodo)", "value": "139c4e2f34e3bb6260eef9a1242eb443050da8547f226b62a67131c535c068aeb9757e8d0d2c52218fd5e5cab6fdc610", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922946, "uuid": "b4b5a328-3e6b-4cee-a555-8f09ea7166b3", "value": "T16E25CF51AD4A8096FA4B293E007A63648FECA81107E5E8DFCF44F9A76F21CD1973C45E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922946, "uuid": "85275ecf-b5fe-4319-9a04-fe7f614ede61", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922946, "uuid": "08a1456d-7f1e-435f-904d-3bf9388a2f17", "value": "24576:eLTJyoT2k8nRahk1AFnkRCLWctN4DBE1ZekTyPBFIIm2mHv:exyq2kpWGWRCLWeNWO1tyZFIr2mP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643922946, "uuid": "fb3017d8-f43d-4dfe-afb8-ccb46ac7ac59", "value": 989184, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643922946, "uuid": "ce0345c1-4a3a-4e72-a81b-4a96c3bdf011", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643922946, "uuid": "fcab3dd8-3437-4a0a-92ff-6fa01c7e87ed", "value": "emotet_exe_e5_40e81a57f0df8fdbd83f74b0c9c5f7f3c55e103fa288606a99016cb6b9b7c670_2022-02-03__211532.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e7732a0-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883799, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883799, "uuid": "7eb2dff2-4121-407c-916b-5a216cfc23bb", "comment": "Malware payload (SilentBuilder)", "value": "a67ad06e1d3994546e61ba5e4408e652", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883799, "uuid": "f1d6f9b8-401e-41d7-a1f4-0691340d9c5f", "comment": "Malware payload (SilentBuilder)", "value": "41283ef6673d6e86ada3e46309d93bf322787b99ea569ecb814af8e354c6ca68", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883799, "uuid": "eed6e574-4a3e-437f-a1e2-cdf82c41c13b", "comment": "Malware payload (SilentBuilder)", "value": "fa455a260b7f28b659d1782c3be517fe8b7e3915", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883799, "uuid": "4610ab30-f11a-4745-8b96-6e779eeaa7d4", "comment": "Malware payload (SilentBuilder)", "value": "c0e6ea834f9c1ce6e8a490dd0db08568d5bac61e39051c859001775961e533163d8d58400adddf64abf8e6bb5b897afd", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883799, "uuid": "b05631e4-5b9e-460d-9b29-ae23de169487", "value": "T10DA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883799, "uuid": "1f1c2322-729e-4153-9ea0-0b1a7d50a5f8", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd494:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883799, "uuid": "8f826d47-882e-421d-80cf-28a956f3ea8f", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883799, "uuid": "e34623d5-1b50-47c2-a989-ee79b2bc1144", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883799, "uuid": "6c287e9e-fc27-4e66-81dc-6196e4a63167", "value": "2022-02-03-a67ad06e1d3994546e61ba5e4408e652_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e20da14-850c-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643904817, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904817, "uuid": "748c84ba-e062-4c36-a6c8-4016cf15a8cf", "comment": "Malware payload", "value": "1fa082a8e0a675c13030b7068748d853", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904817, "uuid": "449884be-05be-44dd-9bd1-7881311f3aa9", "comment": "Malware payload", "value": "4151c57f04c27a2dd58b892b6fe79b10c03dcbd59aa06c81dbd11f2d6a32abea", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904817, "uuid": "18493c29-1127-459e-8430-c58479112d7a", "comment": "Malware payload", "value": "3930f8ef21a9b9ebc9fec3fa817774c0fd4fbe7b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904817, "uuid": "646ddd96-be80-47f6-84b3-c802e31f6e79", "comment": "Malware payload", "value": "9d7a34080edd3827e43dc3f61ed0ecf2a7403975d10da8e09622ea0fc52ef17b1312c03a20886cf84ab1ce27d8c13307", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904817, "uuid": "a1cd78c0-da1f-4472-85d7-e6ab8b253341", "value": "T1E6E39D8AF25B0D68F192CA3584DA4B1437B39CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904817, "uuid": "ad247242-c01d-420d-9715-f2645547ec29", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgfquZha9YILiQaVObeshRTEKwJQiQmGo:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgfz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904817, "uuid": "eb0e88db-b989-4bf7-8c10-09fd2647bf37", "value": 148447, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904817, "uuid": "a270d89b-5b13-46e3-a734-63f5a50cc984", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904817, "uuid": "c4662e86-044a-40ed-84d1-8956e8d07654", "value": "tmp7sdixp5v", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "352afc69-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882897, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882897, "uuid": "c545b01f-9c04-4581-97f0-80e06994330e", "comment": "Malware payload (Heodo)", "value": "58cd313c695407bb22beb207c50b5cd2", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882897, "uuid": "10631c8c-e24b-4491-a8f2-79353b0387f8", "comment": "Malware payload (Heodo)", "value": "41564c1ceb99e78fa498ad23d875fa15e7aaad450c532e0a0aadcd0c63d37cf4", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882897, "uuid": "9fd258fb-301f-4667-9d25-540febc5aeaa", "comment": "Malware payload (Heodo)", "value": "9fdf10e4117daa14c50e36bd75e264acef31139d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882897, "uuid": "a411c64b-ec5d-4bec-a95d-2c849a04ffd4", "comment": "Malware payload (Heodo)", "value": "75cebd12470888b2f34774ea0b4de59af5d811d5e3aae57cce9b4e50564f7c24ff77d99c71d6076523e924242fc94614", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882897, "uuid": "7578e12a-62b1-4f4b-b8a4-4ded22e4778f", "value": "T19425C0216D8A40E6FA47193E0069B3544FDC69050BE0E8CFEF54F9A66F12CC25B785AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882897, "uuid": "62e060d3-56cc-4ae6-9dc6-7dd4a7b8005c", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882897, "uuid": "da158e03-11be-4b9c-b218-367f88d8b5a9", "value": "24576:vyj4pucLsugl4zCy9fG+OVE+cXcs2vUvFIIm2m0:vzfnl9fYVoDvvFIr2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882897, "uuid": "5d9d2772-db6d-4a3d-9925-cc18db6cf830", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882897, "uuid": "0caf73fd-d691-4a9b-8d81-c03bace66ce5", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882897, "uuid": "ee1a1b95-6d62-4242-ad47-9051802fb698", "value": "58cd313c695407bb22beb207c50b5cd2", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ef489d52-84f6-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1643895665, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643895665, "uuid": "8f4b2dba-16b8-4e45-9a02-eda7ead9c827", "comment": "Malware payload (SnakeKeylogger)", "value": "d5aa75bb3933557562574ca8b3257000", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643895665, "uuid": "9e69aa75-3511-4633-a2ba-d6e89a997213", "comment": "Malware payload (SnakeKeylogger)", "value": "41920913663df199683fb9f2970f4da7d73048ee8d639cc79939a20930b49910", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643895665, "uuid": "e91edd30-ed2b-4b81-94ff-fcce5fd14d9f", "comment": "Malware payload (SnakeKeylogger)", "value": "51e83d28e858eb9a72b6d1970e9fd5ddde9f0306", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643895665, "uuid": "303f2357-c596-49a5-bad4-a19e86e19bf6", "comment": "Malware payload (SnakeKeylogger)", "value": "ba9fe478f7723f03eac04f052345ed452c4c2207a7bf482442976fd16f7a7df3ec6424fc9c17465b88f624b52b2af13d", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "SnakeKeylogger", "colour": "#5385B9", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643895665, "uuid": "33712b36-4e00-4afd-89bd-c5f8a838d933", "value": "T15EA4E3CC74ECAC91C00846F02735D1EDE1F46F011DAAEA01BABE3E919355B95AF66B0D", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643895665, "uuid": "a10d868f-c03e-46c5-aaef-571233deb27e", "value": "099c0646ea7282d232219f8807883be0", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643895665, "uuid": "e309060a-f9aa-487d-a31d-2c19bb69aa07", "value": "6144:1wW4/Ub0SOrVKa0hbdUCeyJHsLe10yT8SPsPMfVoE1v49ZsNPsFuwLmpIGpSgKG+:eUoSOrVKa0hbdUC708JoFcaFuH+ij2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643895665, "uuid": "32fe1b54-63b4-4c4e-986a-4a04e904671b", "value": 469615, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643895665, "uuid": "1033f2ce-2b0a-4785-8458-eb51f35b77e4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643895665, "uuid": "1079f241-4466-454e-8538-778058df8ddf", "value": "43456789098765431`123.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0835f16f-8525-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643915463, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915463, "uuid": "8b731914-6e84-45b3-9c45-4e495c05df2c", "comment": "Malware payload (Heodo)", "value": "0060db231a4122f97168a6d6b8c39ce9", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915463, "uuid": "c4c6ae73-a28c-4d55-802e-cc2c7fca44fc", "comment": "Malware payload (Heodo)", "value": "41b3d1d265ca41099de9627cf8112419d2122b141b971214c9d1f18a0fd71f8c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915463, "uuid": "f4fd17ec-5765-4d93-9965-76d0327cce08", "comment": "Malware payload (Heodo)", "value": "f00a2387fb3baf43769b70916983360d1ad84eea", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915463, "uuid": "8d392787-65c8-4192-bb40-c644a5dae3b2", "comment": "Malware payload (Heodo)", "value": "696c9d0432d98cb1b9b8e9b477518fa52a698fd13ef1db1c92e44ea78d124609733889df43f65a1bde69ef449a16074e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915463, "uuid": "a3fca2f2-d1a0-47a8-a464-ec3b0d4361b1", "value": "T14625CF11AE4980A1F50B293D1469A7A60FDCAD021BD0ECDFDF44F9A36F12CD3957886B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915463, "uuid": "4bd65acc-19c4-40fd-8127-16d3fe5b4e91", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915463, "uuid": "d6afc023-4650-46c9-b3e4-4ba1ce8d1b6a", "value": "24576:SCiv47/YUr3bti5wcjbnZeZfxan8hX1HlyOwLVttCAUXJEFIIm2mB:SCjYwLtMvgZfxailuFIr2mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643915463, "uuid": "95e42bb3-a72d-442d-a2df-674e03697206", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643915463, "uuid": "da9e2be6-089c-49cc-b479-173c9a65fa14", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915463, "uuid": "a7d9aaa1-0895-42a2-bb9b-4fe0d9d10a0e", "value": "emotet_exe_e4_41b3d1d265ca41099de9627cf8112419d2122b141b971214c9d1f18a0fd71f8c_2022-02-03__191056.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8679f355-8522-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643914387, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643914387, "uuid": "a77bbc81-9d7e-44af-83ef-eb9361d1e4df", "comment": "Malware payload (Heodo)", "value": "a2d4bec24e0401575b22b0af25ccaa6a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643914387, "uuid": "a5ca6942-023f-4f22-80e9-fc76b950abb4", "comment": "Malware payload (Heodo)", "value": "41e13289227dbcadfba1ce89032d970e8aa764512a905ddb2ab49d8c77be519d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643914387, "uuid": "4886ed38-936e-49a9-8c4d-f341cc828458", "comment": "Malware payload (Heodo)", "value": "d1c625147039f93254bf7c61691827f095810765", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643914387, "uuid": "1941eee2-7337-4481-a1b4-48834e1ca03d", "comment": "Malware payload (Heodo)", "value": "b0674dbc92098403c07264d928c0f334172438cb3b4508840422cc7fffb4d5429e81a361f2791b2109ba1b900085f184", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643914387, "uuid": "c9ebe1be-5332-44fe-b85e-21f9fd27f75a", "value": "T1DDE39D26B685C95AD91407351DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643914387, "uuid": "9fa7ce05-4dba-4c19-9207-736b7fcc9e0c", "value": "3072:1cKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lc1:1cKoSsxzNDZLDZjlbR868O8KlVH3Ueh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643914387, "uuid": "84c15238-a900-4ac2-83a0-fe08597a9e36", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643914387, "uuid": "b24bc905-f21f-4d14-bc26-4f8521aa54e9", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643914387, "uuid": "28fcb971-8e04-4319-b9c7-dd1ee4a4d851", "value": "tmphu1aqcyj", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "13e5ad4e-8500-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1643899592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899592, "uuid": "48247ef6-6d45-4d24-8086-f30ff1d60ab6", "comment": "Malware payload (CoinMiner)", "value": "25982cbfee82ec33c8a1c879ece423cd", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899592, "uuid": "583f8ec1-dd56-49db-b029-dab067bc00ff", "comment": "Malware payload (CoinMiner)", "value": "41e99d281f1093e49ef23383633e481b3a18afd2386f94371fb215dec16ba2a0", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899592, "uuid": "31c1013b-2347-4a4d-9056-d957e7648bfd", "comment": "Malware payload (CoinMiner)", "value": "4b446f914514220b39f918175f2c960098c09e90", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899592, "uuid": "8c800680-fc50-4c6f-89e8-1c113970352c", "comment": "Malware payload (CoinMiner)", "value": "4ef2ad5f53fd0c9f2015464933e7a52cd2e3c8d1cee3c738e459be63ee296ccac9fd077c241e4915f8c58b480761e025", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899592, "uuid": "a24154a0-e0bc-4431-99b2-ddec090e6541", "value": "T1AC9533BD59310F97D38E0037FB484BAD8CB2E8B46E359556C39648F962246FB6650CCC", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899592, "uuid": "bdc43353-2996-416e-b4d8-72f3ea831b6e", "value": "02549ff92b49cce693542fc9afb10102", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899592, "uuid": "b3732032-a134-47f3-8d3e-781f532ca4c1", "value": "24576:aTV4XGrg9hvZOOa5fJjDPjwPzWOTxAl+Hl+zg2pPxy6Yll77vJpFkmMMuna:cDkhvZnmOPzWQKCl+zgapBYlnc", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899592, "uuid": "da848cd6-664e-4796-829b-f8dc1c0b18b3", "value": 2040832, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899592, "uuid": "b6067185-f96d-4be3-b233-f952f18a8bdf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899592, "uuid": "70f4a72c-cb1c-47c7-974f-987ac02bfbd9", "value": "25982cbfee82ec33c8a1c879ece423cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "950ea5f2-849c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856859, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856859, "uuid": "a4c0453d-a308-44d7-b5f3-4a635d90017b", "comment": "Malware payload (SilentBuilder)", "value": "8bd9f90498c86b239b8506f46c364af3", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856859, "uuid": "78a48141-14ab-4f1c-a352-987d743d8c29", "comment": "Malware payload (SilentBuilder)", "value": "41eef1ef7ff211683172a848c874f5818d85564d8a640b2e3a1ffc1db5c70969", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856859, "uuid": "7c0dd03c-3885-4d06-8a53-068d300806d6", "comment": "Malware payload (SilentBuilder)", "value": "6e1d94efc09f2fea6f4d4d3ff144ab5db554223e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856859, "uuid": "6108fa70-7a97-459c-966d-17879ae0bcab", "comment": "Malware payload (SilentBuilder)", "value": "6109659023b427310049a697a615237e0568188d7a48ea8d3ac49ff19b7164ab0637711d845a061db843cb12a1481e14", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856859, "uuid": "79fe3c4b-8764-49f0-b6a4-bb00e9c42cc6", "value": "T162A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856859, "uuid": "baaa49ce-d2f7-414d-ae22-273ea1e0204d", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4p4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856859, "uuid": "bd9588d2-6f4a-4713-86f4-39d8cc3fc578", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856859, "uuid": "98701fe4-8805-4071-b7a5-807c04370081", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856859, "uuid": "ffaf5c0e-7234-4f93-8b3a-1ca38a8ab27b", "value": "2022-2-3-8bd9f90498c86b239b8506f46c364af3.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "73814cb0-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883431, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883431, "uuid": "cdf9e360-b0ce-476a-b485-d2ab93638798", "comment": "Malware payload (SilentBuilder)", "value": "6057198f6ec6a34bfb3691917eab6d3c", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883431, "uuid": "06e6714b-4abd-4854-8238-72f80051ae57", "comment": "Malware payload (SilentBuilder)", "value": "421ecec956514d0e8dd860f9720fcfb7bb17bc7ba9d6fd0a42be1c0ade3d7d7a", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883431, "uuid": "0573ddf0-909f-48bc-8b1c-c58025d7ce29", "comment": "Malware payload (SilentBuilder)", "value": "b3ae989d98d11f348a183b045d55d27e22f81d72", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883431, "uuid": "29c00ff0-e949-41fe-9729-735406aa8e04", "comment": "Malware payload (SilentBuilder)", "value": "4d5657ee35bf8ff7ed4af85afc40c8147282d22265bd0e290a38e70d035091c085fc83a70d126af587b9e738d3912be2", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883431, "uuid": "428baf6c-b04e-4381-8890-d9138604b693", "value": "T142B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883431, "uuid": "3c590007-7eb9-478b-862c-d24ba1077dd8", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49r:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmf", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883431, "uuid": "98ea2dff-e9a8-4ba9-985c-3f1bfbfe9304", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883431, "uuid": "4d979c73-863e-499a-87bf-a6dd50d99c6e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883431, "uuid": "9f7ec0c7-c23d-47cc-990e-b8dfb91f4c45", "value": "2022-02-03-6057198f6ec6a34bfb3691917eab6d3c_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4ab8837f-8526-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643916005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916005, "uuid": "12fb035e-a02e-4231-92e8-4d45f761386d", "comment": "Malware payload (Heodo)", "value": "79daa6553ef461c8dc5a3c99eca0fb1b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916005, "uuid": "13437088-9d8c-4030-a6ee-587ca994a416", "comment": "Malware payload (Heodo)", "value": "4290625a5625d56de3bd8cdd2cc3950be245253d9d7e5cc9c3973ffedb7c236c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916005, "uuid": "ec4844b2-afde-450d-bcad-a3a44cf010ef", "comment": "Malware payload (Heodo)", "value": "8a392f6c26bb664b52d01078defec0e0b4da9fc0", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916005, "uuid": "6906ed1d-2958-44a2-ab9e-b5bc19b3876b", "comment": "Malware payload (Heodo)", "value": "167e9515e92499b295cd6b331fc29a1366088e1d667c1dd8c4972e4bd010d42e1839f3ed4f3bf989910fc50db5e4c736", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916005, "uuid": "5c42fd12-a682-44c7-a250-73d01c5159b8", "value": "T174D4C05472A28476E0AEA83404249B138D6E7F715FB0C4DBD7E539AE4D3D2D16A30E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916005, "uuid": "8e31daed-8fd2-4a98-a3ef-f3df122871cd", "value": "15b471bbc15a140b9567d4daee05d632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916005, "uuid": "9ec850f6-6b1b-4702-9f81-faa28b6b19a2", "value": "12288:8m9+I/aI+W1QbBi3IjeuXe6q7nCI/xCMqYDl2JwDKCX:8XrbB2IjevCHMqW2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643916005, "uuid": "c3a22db7-17c5-4f10-8644-4ff38f3f1a86", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643916005, "uuid": "969c4506-47b1-4fa8-94fb-0e3654e821cc", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916005, "uuid": "a122dbad-44c6-4838-9b70-58cc41eda75b", "value": "emotet_exe_e5_4290625a5625d56de3bd8cdd2cc3950be245253d9d7e5cc9c3973ffedb7c236c_2022-02-03__191950.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7bbcafeb-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883875, "uuid": "2e122a53-9b59-46f9-b21d-b212d4ed5b2d", "comment": "Malware payload (Heodo)", "value": "905d37f4a82bffe3d4cd064b585f4399", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883875, "uuid": "ba6711f5-1c2d-4766-9a57-d55066ba34e9", "comment": "Malware payload (Heodo)", "value": "42cb1a8d05ea21364c001564174a50d2d406c6940ccc9069142e4bc5692e7481", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883875, "uuid": "6e76b3da-3c62-4af4-b429-b1ee377bd75a", "comment": "Malware payload (Heodo)", "value": "626eaec0e1d3f2e8d49a744ed25ec51aa25d2878", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883875, "uuid": "f11d1fd8-138f-43c0-96f9-71f166292403", "comment": "Malware payload (Heodo)", "value": "5fc18e793c08290543bf6ff57f2a078c285d04457ec3dabd0b9378376f007cd37e71e6b17b0b36a129e8195a2e4ff656", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883875, "uuid": "b0976554-14d6-4556-bea8-d4768b2c4e10", "value": "T17CE36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883875, "uuid": "e528188c-1cfa-419a-ad2f-64edb19b32f8", "value": "3072:5cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0i:5cKoSsxzNDZLDZjlbR868O8KlVH3dehY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883875, "uuid": "4f6bc28d-8cc2-48d8-8431-9914229bfd1d", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883875, "uuid": "63904c2f-eab2-4d61-88b8-eeaeb76fab6a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883875, "uuid": "77cc1680-b934-407f-b267-e7778c15ea70", "value": "2022-02-03-905d37f4a82bffe3d4cd064b585f4399_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "054d97c5-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846739, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846739, "uuid": "75b44717-a0ba-466f-ae19-576d492211a1", "comment": "Malware payload (Heodo)", "value": "c77dfc0f5356a69fc5fbbb52a80ba65e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846739, "uuid": "83136569-4404-409e-a8f1-344a8abfb27a", "comment": "Malware payload (Heodo)", "value": "42d370d12bea3eed279a330e63e75a0d34f133c8bb2388c92b9b65e8094bf691", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846739, "uuid": "15bc55ae-e5ec-4cd1-87ad-303a7297b723", "comment": "Malware payload (Heodo)", "value": "5f7d14e00740f486646ac281c0f3ec18da08d304", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846739, "uuid": "be5ca826-f2d9-435c-b129-e28f3747e965", "comment": "Malware payload (Heodo)", "value": "c9357b3ee3720c8b5249ae46055d45f87f9d5347f8bba86973a184b43c65de57f114f9428f4752f8d58b971faa8a866c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846739, "uuid": "639f0b53-5f9f-473c-8201-8c9886624e04", "value": "T160E36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846739, "uuid": "41332f5b-5505-4138-9d3b-9283d2509d6f", "value": "3072:bcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0s:bcKoSsxzNDZLDZjlbR868O8KlVH3dehm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846739, "uuid": "a685e7fa-d7eb-4247-8fa5-2d6e65cdf824", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846739, "uuid": "bc908fe8-8064-4d69-978a-9fb4de7233ca", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846739, "uuid": "3c9f39ed-c28b-478e-9a36-71924e841fa3", "value": "2022-2-3-c77dfc0f5356a69fc5fbbb52a80ba65e.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1e5a65cf-84f9-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643896603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643896603, "uuid": "395664ee-04cc-4984-8d18-da381874a4fc", "comment": "Malware payload", "value": "b01d4f4e2c95b43a55f60d399f0462e9", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643896603, "uuid": "cf4372e7-c73d-4f75-8206-54cdc34ef489", "comment": "Malware payload", "value": "42dad88019bdfa1290b7db038592aa272cbbda1cfd3f710da1158ad935a2fc56", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643896603, "uuid": "84648357-e3c4-4e14-8185-64f4af8746b0", "comment": "Malware payload", "value": "55e7568648428e7d3d2fd0c07eef06220f8ff479", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643896603, "uuid": "d263d6a8-801e-474b-8469-0ce2d9c66a63", "comment": "Malware payload", "value": "02230231688421c24044bdda3ae700972223c2487618d0b36c281f12921fca0668e9dd64790952ff734fc253d4638e94", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643896603, "uuid": "2239fdae-ba03-4be7-8895-b39087cb5919", "value": "T1C4D633486CA3D676F806CC30116992F55DF32C2906495E4693183DEA8DF34EEADB3B72", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643896603, "uuid": "7ba7e9a9-d0be-48b8-804d-eaa2b9272d62", "value": "ffe3cc63e5a1efb4d2f4cc004c584646", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643896603, "uuid": "9d583625-d8f0-4ed4-a9f2-e7a1e08fbaf3", "value": "196608:Vr/G6t291n+TeW7hiPbqCkvJC+F+0dh7scOz40dPkla7SQZh1myK2HE3wLQUYFP:N/Gr/n+TeuhiuP1DTmdxpHEtFP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643896603, "uuid": "ab5cac4b-a955-4e80-992c-3f58d96497fd", "value": 13091532, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643896603, "uuid": "80b71603-2248-4cfb-81d9-fc44d978c1e7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643896603, "uuid": "ac0a0b7a-af5e-4b8c-8f50-8b496f444074", "value": "b01d4f4e2c95b43a55f60d399f0462e9.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "246401dd-84c6-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643874709, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874709, "uuid": "031a7aac-1791-46a2-be04-94a8986a3089", "comment": "Malware payload (Heodo)", "value": "773d8e0c1096499ed0c0aec18bdecab5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874709, "uuid": "96df58ca-118f-49d8-8cff-604101d2b78f", "comment": "Malware payload (Heodo)", "value": "42e9510c4ec700ed9b48da83b8fb6b8fa235788d3f74c000476a680c403a6404", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874709, "uuid": "46fca379-33d9-4149-bbb9-90754ced19b4", "comment": "Malware payload (Heodo)", "value": "957718128f94de70d7949a5f85a4b8f8483722fb", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874709, "uuid": "046678f5-de6d-462a-a57a-b77935caa566", "comment": "Malware payload (Heodo)", "value": "9b17c186234e00004ecaf2d157f133aebde2d93c2a999c984ec51d5ed0bb35cc01ab16a56967e93d84975ce54ae2cbc4", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874709, "uuid": "684180d5-7d31-432b-975a-c210912c8b0e", "value": "T160E36B25B6C5D9C6DB0823350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874709, "uuid": "2d5d489e-2878-4d04-a574-a25150fc37e8", "value": "3072:NcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0Z:NcKoSsxzNDZLDZjlbR868O8KlVH3dehT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874709, "uuid": "72360c6c-7217-408a-948a-2739ef0cf1b5", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874709, "uuid": "6e912866-df84-40d4-8f84-7135fd253568", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874709, "uuid": "e1955aee-f324-4e1e-9cf4-6b234b10cc0e", "value": "Invoice.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d667a9af-84b9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643869424, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643869424, "uuid": "c35ffa7e-9eee-4a9c-8b8c-59e974f2d6d8", "comment": "Malware payload (AgentTesla)", "value": "404601ae178f55430a19544c16dc0536", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643869424, "uuid": "413f6e0d-a9bb-4acc-b31d-6f679cbc713d", "comment": "Malware payload (AgentTesla)", "value": "42f91293880e8e401bf311a892a95e169571b5e205bb4933a4e1bf0b69d8240f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643869424, "uuid": "e367ec97-ef7e-4e1e-9659-0822eba8918e", "comment": "Malware payload (AgentTesla)", "value": "716d3ce7a1d4acfa2619b27045ca26a097f17113", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643869424, "uuid": "9adc2883-3231-4c51-8a46-0bc8bca828f8", "comment": "Malware payload (AgentTesla)", "value": "99dbce1d52f28b710dda11b0cc8838f04e28f818cea8058880bba302b371cbfabe75b79a90dfc0cefeda1e6e4b73f725", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643869424, "uuid": "c00e712a-1216-4e13-a921-b76f6d1f140f", "value": "T151B4AEB4A1A78590F10BC974257CFD6502B231E3A9CA0D3927793645CBEEF953F8860E", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643869424, "uuid": "0b2e59c2-a62f-4d9e-b2da-6e1e78f33665", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643869424, "uuid": "4ec1af3b-c08c-49b5-948d-2440f888c351", "value": "12288:lVO7J9ayGnze55WCMKhAuUTX7BEquaMso7:lVOVXGnzUy9uIX7Bfu3s", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643869424, "uuid": "92783819-59a5-46b9-9f75-dc5db5b749ee", "value": 512512, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643869424, "uuid": "1af61fcf-2361-42d2-afe5-b129a3471369", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643869424, "uuid": "2ac1fcd7-81fa-4f19-9582-eb3a5592ec6f", "value": "JL2wDdK8TpHnyzZ.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc01f2b1-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910289, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910289, "uuid": "a995ffd2-3a9f-4254-8d76-b86dca6fdc36", "comment": "Malware payload (Heodo)", "value": "849034f056b20939dbbf5e06ed50eb9b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910289, "uuid": "b214610b-b0ad-460e-9dc6-5893b03a4e49", "comment": "Malware payload (Heodo)", "value": "4366de9fa0e0e3cacd5544e3ccd2d37f1206c5cf4b3b85c35ddb7226edee5466", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910289, "uuid": "fcec43db-3fcb-4af4-a5ad-c801dce991c9", "comment": "Malware payload (Heodo)", "value": "2a626ae024cc2bd5ed899c07dd61003c50160d2c", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910289, "uuid": "76ef420c-27b3-4942-827e-be1e7eeed102", "comment": "Malware payload (Heodo)", "value": "95c2c40c653526fb3647bb120eab79f53e02ef2498fa870ccde14382bdefb1e6b76e7ef7cf8b07b008b0dde14bb4a550", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910289, "uuid": "6907fb4b-57cf-4648-b726-f4317be74e0e", "value": "T1A164E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910289, "uuid": "c57b79f5-cfb2-475b-a670-97d0da6a6d18", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910289, "uuid": "25965271-9cb8-4145-ad6e-50608ed94ead", "value": "6144:83DvZRFTFbksYyljaMYDMET7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMY3LAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910289, "uuid": "5bf25fbf-e96d-414d-94bf-a7c469637648", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910289, "uuid": "9873b557-c9d1-43e2-ac36-8c14d527b123", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910289, "uuid": "cf1f5e92-26c2-4533-a455-d06fb502922a", "value": "emotet_exe_e5_4366de9fa0e0e3cacd5544e3ccd2d37f1206c5cf4b3b85c35ddb7226edee5466_2022-02-03__174435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "74fd8f62-848d-11ec-9275-42010a9c0029", "comment": "Malware payload (Sugar)", "timestamp": 1643850362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850362, "uuid": "f6ceb8bb-a481-42a7-9d23-398e132a9028", "comment": "Malware payload (Sugar)", "value": "62e71ceb5d18c53e216d9a0116eee1ad", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850362, "uuid": "35c5300c-df0c-41cc-ab2c-f311a541de13", "comment": "Malware payload (Sugar)", "value": "43e4a6830f54f3bd039b90f0a27ad19a9f2bb673ab990f34dc201c3b102e056a", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850362, "uuid": "aa781fd7-a31e-4248-937c-46f2caded82e", "comment": "Malware payload (Sugar)", "value": "62b865ec05c518252a52564c7cf3f68893e6f85e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850362, "uuid": "b67de479-7083-43c4-9b3f-4ed2ba57e2c4", "comment": "Malware payload (Sugar)", "value": "d83959733c4892fffdb8efb7ed38520a1f3e048e84bc9e7c37dd9d01422bab9e01ed8008ab0ce171c5ea7ba89d70681f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850362, "uuid": "a3a1cf93-1485-465e-acf4-16321d168a52", "value": "T1A8D37C37B982C13BC0754D79DE16D2DAB629BA303E38189F75D85F0D9C392825A7D382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850362, "uuid": "7c01f173-d3de-497b-b65b-2265fbee5b75", "value": "5d2d74e0bbb1bdaffd94b2514a46e47e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850362, "uuid": "cdec5cdc-c4b1-47af-a94d-8925708ddebd", "value": "1536:dJ6miN/d+ucYLJrpTR/ky1lcSBdeKWFKVsu5jmZIFncKDCzHQvU/NjwGg64+:amecYLN/ky1l1iClmZYfezHQvYdZ4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643850362, "uuid": "8dbb5860-815f-412c-b41c-14f7bb4592a2", "value": 141824, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643850362, "uuid": "e1984fa2-e6cf-4121-b255-cca421f1f917", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850362, "uuid": "9f495121-3124-42d2-8705-e853a247e987", "value": "43e4a6830f54f3bd039b90f0a27ad19a9f2bb673ab990f34dc201c3b102e056a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "39daeec6-8517-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643909534, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909534, "uuid": "782364ec-ccfd-4d99-903a-914a6bf26a2c", "comment": "Malware payload (Heodo)", "value": "0e93a02ac5aefe357ad36994c76823a5", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909534, "uuid": "8ad70cb8-b86d-4d28-9b15-07d893f7bdcf", "comment": "Malware payload (Heodo)", "value": "43e74e6f95f27f476afaee99792287015c656086fd066f7170e161ee4dfaa2a2", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909534, "uuid": "1ec1d0b5-98db-4aa1-b02e-b14c7f84aa84", "comment": "Malware payload (Heodo)", "value": "94514104fa9c2d2b87441af10be5493f42d26804", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909534, "uuid": "5d89973c-5250-4171-823b-e9f82deb8301", "comment": "Malware payload (Heodo)", "value": "5b3d3aec03f31bd9b0cbacb6d981c2509fd5e6b7b74ac997eff31e311e68749f245fb266f9b4f9f3b890d38c3e286bf0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909534, "uuid": "d815c1c9-da1c-4b5c-ac44-55a72258ec96", "value": "T1F6E39D26B685C95AD91407351DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909534, "uuid": "507816c7-bf86-481a-a509-9acab0b93f02", "value": "3072:kcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lc2:kcKoSsxzNDZLDZjlbR868O8KlVH3Uehq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643909534, "uuid": "ba9e400a-6a68-47c6-bcb2-b5d43fe7266f", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643909534, "uuid": "02cf4d9f-58d2-4660-a7cd-203961aee1f0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909534, "uuid": "e705c170-fb44-4ae6-9f58-58a8c8b922f5", "value": "tmp45ai_2x7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e73aa3d6-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856567, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856567, "uuid": "47e76bdc-f42b-4b9e-9f4d-e783663b2671", "comment": "Malware payload (SilentBuilder)", "value": "d511668eccae005eed4dcebf996ce63f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856567, "uuid": "4f1191f4-9d13-449e-9b64-3a4ad85e8dc6", "comment": "Malware payload (SilentBuilder)", "value": "43ebbd079490e87a8d0cf34999a2108aaa58f7dc5432facc780f6599401e5ec0", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856567, "uuid": "29ed7166-bad2-4bcb-9e1c-07c963b05223", "comment": "Malware payload (SilentBuilder)", "value": "e470eb4369c9080aafa79136a24f3a1c69e6407c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856567, "uuid": "2f01a7f5-d96d-4bb7-8c2f-785523e07ae1", "comment": "Malware payload (SilentBuilder)", "value": "b2214e4242a65594250af40360fb070a522d36c79012ff437b2f1e2b4a7c575eb6773a388b3eb0b5aa39af28191ddecc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856567, "uuid": "387f8e25-0d1e-4249-a218-dd17b8e009f3", "value": "T184B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856567, "uuid": "71c2abe4-ff98-4215-bf0e-b811b2183724", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49X:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856567, "uuid": "81b8871e-e742-4124-ad1e-8a86ee7f9588", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856567, "uuid": "b5961d42-f9c3-46ae-837c-4e2352fe1bc1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856567, "uuid": "a0e0d66c-003b-4fd1-b902-f9f22651033b", "value": "2022-02-03-d511668eccae005eed4dcebf996ce63f_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "801f1da0-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855535, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855535, "uuid": "ccd48673-ec14-4012-b902-db76e1d9995f", "comment": "Malware payload (Heodo)", "value": "4b8e95c1108afa5f73af986654c3e712", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855535, "uuid": "52aa81da-7ab4-4023-bf54-260cda92a5b7", "comment": "Malware payload (Heodo)", "value": "43f0ba02eda9ee3f0a5abd5a5fd19b662ccbb88366e612a6eb27b4258e639d71", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855535, "uuid": "5896fe26-1d2a-4252-ad7f-bafa295a11ab", "comment": "Malware payload (Heodo)", "value": "006de8ca25b6b44e8ccbe3ac85521868afbb4997", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855535, "uuid": "4ab0155e-4fac-43e8-b484-dd12cbeb67b6", "comment": "Malware payload (Heodo)", "value": "9a01578f4f26f1cf4ded510f5cade6faffdf3e8b65a2b7100ddb92dc9ee032b5c67d985d9fd9888bb2aed1f9579933e7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855535, "uuid": "7e558c0d-36fc-46f5-bc04-e3ec7e5c222c", "value": "T1D2E36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855535, "uuid": "2c168c12-7325-49c9-a171-cdc44287626e", "value": "3072:1cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0d:1cKoSsxzNDZLDZjlbR868O8KlVH3dehb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855535, "uuid": "f2bc8b9a-a193-44f0-81c7-806a0719e83f", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855535, "uuid": "941449e4-7fd9-410f-8fac-b16b1a38e942", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855535, "uuid": "c7082809-39a7-4155-91b9-06065cc59952", "value": "2022-02-03-4b8e95c1108afa5f73af986654c3e712_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5d6939ca-84ff-11ec-9275-42010a9c0029", "comment": "Malware payload (RedLineStealer)", "timestamp": 1643899286, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899286, "uuid": "b690ce57-8e19-4684-9cb6-c24fefacc714", "comment": "Malware payload (RedLineStealer)", "value": "0f6c6d0cc9e75accd654ba65d5a58f77", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899286, "uuid": "d17913fd-604c-493a-a4c1-16d4f869c625", "comment": "Malware payload (RedLineStealer)", "value": "44162c70a77cd897fec36313ee660ba4c4df34fb96e62d3a1a8b8ca0b26a9a3e", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899286, "uuid": "a684fef8-1784-4335-acfb-feb4928fba4c", "comment": "Malware payload (RedLineStealer)", "value": "ce7b77efe68d18ca4e859ed9a3dc3798cb73d781", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899286, "uuid": "16156f85-eb4e-4403-894e-168954b252ea", "comment": "Malware payload (RedLineStealer)", "value": "7d540fd1187948fcac7a08711cf7faf0aef1d8562444d514e2c650e7548a26b7b0a46e47fa7ffebaa04c2cfc3e5f069a", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RedLineStealer", "colour": "#0C3887", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899286, "uuid": "bd2913c7-fc4d-4d4d-a4ae-05bf1d993070", "value": "T188E4F110AF90C035E1B726F855BA9369B52E7EE1DB2060CF63D06AEE56786D0DC7130B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899286, "uuid": "ac021a1f-e433-4123-ab36-b0060b8183e7", "value": "6f6aeb6fc382a28ed1adc7823a20786d", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899286, "uuid": "e8e0deb8-89b7-4e6a-bc66-76f58ef633f5", "value": "12288:PWh5hln+pwC/F2DyxPvckMcakkodbmIkQqzJo0QEjdR52YiGZ6oFoKYtP:+fCN2DUsCeopfAJoDEB2Z06TKYtP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899286, "uuid": "ef6130ef-aa3f-4922-bbd5-bd0330e7c1c7", "value": 693760, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899286, "uuid": "9902d671-8a79-4819-82ec-6997cf1166a7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899286, "uuid": "00d6992c-144f-4aeb-847f-48f989d467e8", "value": "0f6c6d0cc9e75accd654ba65d5a58f77.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9875c159-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855576, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855576, "uuid": "a4ec365a-fd3f-4be2-8a16-cb9ab5dcddeb", "comment": "Malware payload (Heodo)", "value": "5b05c4e772eec9292d144b2ef7f32deb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855576, "uuid": "cd9ffd12-8777-49a3-a42c-4d875e454380", "comment": "Malware payload (Heodo)", "value": "441dcb92a31eee467e5439de08f2b73f45e34d67d3773966e06964abaf8afc08", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855576, "uuid": "d287ba24-62ab-460c-9801-add77df15abf", "comment": "Malware payload (Heodo)", "value": "c100aaa398cef2bfe0f59863ab96d4213dfd2e4c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855576, "uuid": "ee38624f-9939-4b71-8fec-c97a22cd0819", "comment": "Malware payload (Heodo)", "value": "4ae82743c9b4e4ce0d1847dc7394633e6d0048ca7a81c3e4c264ec2038b2dfa9446f7cb356354be792ef2638e14f6c2c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855576, "uuid": "83cbcf09-5fdc-4488-be87-bc3ec63054dd", "value": "T1F0E37B2576C5D9CADB0822351ADACAEE3327BC479E7643C33148F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855576, "uuid": "1ad84b14-cb5b-4958-a021-a304a9e5803c", "value": "3072:OcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0P:OcKoSsxzNDZLDZjlbR868O8KlVH3dehl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855576, "uuid": "61699fdd-bb75-4f46-ac0d-d6863a91cfee", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855576, "uuid": "cc94a146-783f-475a-9929-f32845f1284a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855576, "uuid": "a16257a8-7e3d-4933-9c41-edec69dd1734", "value": "2022-02-03-5b05c4e772eec9292d144b2ef7f32deb_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "93804689-84cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643877042, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877042, "uuid": "801e6e05-70c1-4a87-b39b-9e1bf7291784", "comment": "Malware payload (Heodo)", "value": "87b3cd15515532d4a793181016cab6f7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877042, "uuid": "e0d76c45-5743-47f4-bb01-10a7bf1eab4a", "comment": "Malware payload (Heodo)", "value": "445581efa749fb47120be859956ac9a7822e54de652620c8c4da06b5fd0870e8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877042, "uuid": "9ac68949-ece5-45c7-9a26-9a69b19244df", "comment": "Malware payload (Heodo)", "value": "81a8e0c9127b5cd220fba1e06e11b112f0eec38b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877042, "uuid": "d04264f9-9c3f-41ea-bc30-2ec8f768a00c", "comment": "Malware payload (Heodo)", "value": "4f403d2a315a83508c1da7f378aad4260896ef23f79feb1ecc951f1263b4fe8b327e525684fc1243ba66f10aaf14ed89", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877042, "uuid": "8b765b8b-18b5-4891-b07e-7fe1720609a4", "value": "T1C8E37B2576C5D9C6DB0822350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877042, "uuid": "a67777d5-3b44-4b44-9896-0c261f2c6a35", "value": "3072:CcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0F:CcKoSsxzNDZLDZjlbR868O8KlVH3dehD", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643877042, "uuid": "c280475f-4636-4882-adf6-63574c0fd116", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643877042, "uuid": "e0566989-7413-45ae-8307-a0fb87968bfb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877042, "uuid": "70defdc2-db35-4d63-82e3-af34c2e0f452", "value": "799104793239851685.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "785c8929-8530-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643920376, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643920376, "uuid": "ec4f00fb-4b76-4b02-964f-68367a551e95", "comment": "Malware payload (Mirai)", "value": "c41b142c9f26c8a3992149d4b982977c", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643920376, "uuid": "ff2cb128-0f32-4356-9c9d-821015bc1736", "comment": "Malware payload (Mirai)", "value": "4477c148aed25cec94f1500a61e5519474e5dad67c43fe02e377727038312983", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643920376, "uuid": "96c7fc14-1a09-46d9-af50-817f6b3627e7", "comment": "Malware payload (Mirai)", "value": "91251c95c70458f561a5da9ffbf617601fd092e5", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643920376, "uuid": "25b23f67-946b-4ccf-805c-47e37b57051b", "comment": "Malware payload (Mirai)", "value": "e6cda34b95db15be97059ad8ed294f6c11640391d87d56d5bd75d6c8cf5e8b60fec91338b05447a58ed4270eca158e4a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "powerpc", "colour": "#AC591A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643920376, "uuid": "c5a9363f-dbcc-47d2-90a3-656a9de1d08b", "value": "T17103F0ECC38D8DE7D0BA13EA0CEDC7C95BE906A036B4429A06143F74252642B52DECA1", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643920376, "uuid": "2998354e-5087-49e1-88fc-7b31d314ab83", "value": "768:bOSsaJgNfkvB9uU2vP5kvgJH/Z49oNT9Ax4uVcqgw0RTWXl:bWaJg0ubPSGHiJx4u+qgw01WXl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643920376, "uuid": "b2916029-e98a-4b69-b5e4-21c04142b0d4", "value": 40012, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643920376, "uuid": "29b1c526-f0ab-4c0a-8ad4-0e43ecb154dd", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643920376, "uuid": "d37e9878-eb2d-477c-a000-e61a54951d48", "value": "c41b142c9f26c8a3992149d4b982977c", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e75c504e-84ca-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643876754, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876754, "uuid": "0a0a37d3-658a-4206-8cc5-85ea59438024", "comment": "Malware payload (Heodo)", "value": "e25efdf64666df40c52a14f4675e98d9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876754, "uuid": "dd49a47c-615a-484d-8b62-06900d069d3c", "comment": "Malware payload (Heodo)", "value": "44ac1a29ef39818d9ba436cd0e55f5f44c6e11952402ad046d329e4153278ed4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876754, "uuid": "e79f0864-f75a-42d7-b1f6-7c3f4d212884", "comment": "Malware payload (Heodo)", "value": "48438bfd543a954cc718900e660580e908536f44", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643876754, "uuid": "acea2d33-9fb9-4a48-baff-1e9f9878a76c", "comment": "Malware payload (Heodo)", "value": "1f6ba8ce12aab8a27522e10f3e52cefb65d95d8de9e7fece7b729010e762f0b77163841c5d6c28dcff4be2fe813428f0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876754, "uuid": "47139044-be40-4b02-b2ab-4f9fcba0ff56", "value": "T15DE36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876754, "uuid": "32aadd15-cd7b-448f-8285-421884fa3be9", "value": "3072:3cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0U:3cKoSsxzNDZLDZjlbR868O8KlVH3deh6", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643876754, "uuid": "99a5cf39-8655-4cc0-8139-cf1c70347fbf", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643876754, "uuid": "263f9295-8b64-4b9c-b566-65136c432a0d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643876754, "uuid": "8c78b41c-850a-4c3e-8bbb-6a2cb0b5d5e9", "value": "2022-02-031506.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b0940896-84f1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643893412, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643893412, "uuid": "1bb4c4bc-b873-43b7-9edc-1047f7c3362f", "comment": "Malware payload (Heodo)", "value": "7d260afcfd68f3310e1f6ccd863bb23d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643893412, "uuid": "358cf273-3507-46bc-a4eb-bdb042f5f3e7", "comment": "Malware payload (Heodo)", "value": "44c5e56de3a11f3084c300ef0f46b9a5d774c480cee43bedabe045c00fa3b680", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643893412, "uuid": "844c1e19-8e80-4477-8cfc-a6cb2267a914", "comment": "Malware payload (Heodo)", "value": "68c59f187904213ec64fa8e26b878dc69beb991c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643893412, "uuid": "3db20f1f-4bd8-4396-816c-5e205f679ede", "comment": "Malware payload (Heodo)", "value": "c10a2e41ee170624d871fb002feafd51dec167c73a178dcc6b1383576cd74494b6e72b1eb876f7d98f476ed969971707", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643893412, "uuid": "edc72e0f-5ad5-4d98-a4f2-e350e793e0d5", "value": "T178E36B66B6D5D6DAD74913310ADA8AFE2327BC438E7603C33158F31E1EBB1509AC2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643893412, "uuid": "dac61ca5-561a-4341-bf2b-1a3886f5f6b3", "value": "3072:bcKoSsxzNDZLDZjlbR868O8KlVH3AehvMqAPjxO5xyZUE5V5xtezEVg8/dgXGx0I:bcKoSsxzNDZLDZjlbR868O8KlVH3Aehe", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643893412, "uuid": "4327cb28-1bba-4ec3-858e-b975fbd5bd61", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643893412, "uuid": "815cc7e7-ba5f-4f8c-9aed-99222f7517ff", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643893412, "uuid": "b52986b3-c3c0-4bfc-9719-d6d11a3cb037", "value": "bg_0302.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52a82385-84dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643884235, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884235, "uuid": "c621cd41-c23d-4068-85b7-b947554ff7d4", "comment": "Malware payload (Heodo)", "value": "d8e8b107a2cf29e1b8d6cd0da9a9ced8", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884235, "uuid": "dc9eb52f-131e-4997-b0c2-82dc0e25152c", "comment": "Malware payload (Heodo)", "value": "44e62574ff38f720d8c09d361ad27c123f3d572d01b47464268c687db1f49429", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884235, "uuid": "947ca70a-4de2-492e-9543-6fe789d84cf6", "comment": "Malware payload (Heodo)", "value": "76c9505093b7e2c99f0243f73d879cb0e0afb8d0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884235, "uuid": "598cb364-b25c-4edc-9b25-a0741d51cd43", "comment": "Malware payload (Heodo)", "value": "610aa3187eb174204f1ced3320cdc65ac2885a10f70b1846a4e34639932970a336bc76a2fdcbea21e0f44dc7c999f65e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884235, "uuid": "543b293b-60ed-46af-b868-02dbfc5d6bf8", "value": "T1EBE36B6576C5D9CADB0822350ACACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884235, "uuid": "995d6014-dd99-454c-b8ec-3e0c91e97bdf", "value": "3072:HcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgzGx01:HcKoSsxzNDZLDZjlbR868O8KlVH3dehT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884235, "uuid": "462b6320-3fbb-41e1-a602-4c2f96777416", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884235, "uuid": "927f09b7-c883-44cb-8574-5655af38f03c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884235, "uuid": "54960879-3cd6-4e98-8b5a-c4d3b12629ea", "value": "2022-02-03-d8e8b107a2cf29e1b8d6cd0da9a9ced8_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "241cc19e-849c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856669, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856669, "uuid": "36e25467-2e12-469c-85d9-29715fb0c429", "comment": "Malware payload (SilentBuilder)", "value": "f7f1e6a77d299a478423fa134ea71965", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856669, "uuid": "c3566520-72da-4646-9cb3-83cc5eafd2ca", "comment": "Malware payload (SilentBuilder)", "value": "451485ddfba273da0b4e2ae7ed2dc7e9cc18dd4d34eebea8ee25cb2e475a12dd", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856669, "uuid": "8b9b134c-9a14-44c4-89d7-133415086511", "comment": "Malware payload (SilentBuilder)", "value": "a35312aba0b05e553ed954e04618306379f506a0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856669, "uuid": "da7225ba-3d57-4ed6-863d-0fab45c57954", "comment": "Malware payload (SilentBuilder)", "value": "219724eab342ab879e5543ac4a7460531fa3b2ee6eb553a78a0f5e764c74f54853f2c42e48b6f4eb11ff16f3c0b9a16c", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856669, "uuid": "d1997301-59e8-48ae-ab7f-efbddf532440", "value": "T113A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856669, "uuid": "2768d754-481a-48f3-9dac-21127ae10e9d", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4Z4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg14", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856669, "uuid": "c09c625e-6c77-42a8-b5f4-00d1ef37542d", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856669, "uuid": "27cd3762-bb8a-4c5e-8001-cd6fe273b0d7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856669, "uuid": "7486247b-6bdc-4c4f-a605-958041ebb46e", "value": "2022-02-03-f7f1e6a77d299a478423fa134ea71965_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fde85270-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "5db55934-9ab0-43d1-9799-a6fc0575078f", "comment": "Malware payload (Heodo)", "value": "f0d57340a6a3d583a294cdf5f816cd0f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "aa3b8306-0be4-4af9-b233-eace668276d3", "comment": "Malware payload (Heodo)", "value": "455f45ccaca170d406a50c6882a1e73aa74e8582672db58cb06bca5ff4b080f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "d88b0916-9f10-4bcd-90c7-c34b7509f219", "comment": "Malware payload (Heodo)", "value": "30cd19fa1cbbd9f184e3cab42292e687d208f87d", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910292, "uuid": "df66c5b0-abf8-41dc-a3bc-a506b827f52b", "comment": "Malware payload (Heodo)", "value": "e7d543ed573941eb8e807c8165f19827f9c8c88a78f42bb2d8b881dd4dd48d9ebf7fabf448edd8ed7dea0a7e81f9712c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "c0a20b0b-e6ef-41a2-b8fb-0d19adcd6cfe", "value": "T16E64E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "4b832bd0-5b61-4994-a2cb-d50e2e89893a", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "8a7dd0b5-afce-44fa-ac04-725c4e56a99f", "value": "6144:83DvZRFTFbksYyljaMYDM0T7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMYbLAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910292, "uuid": "63f9c888-5c54-4b2b-970b-f272eff27c64", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910292, "uuid": "20b13963-5b9f-4b27-b3f4-61c3628445ae", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910292, "uuid": "1282fa3f-fc8e-4645-b05e-bcda7122f443", "value": "emotet_exe_e5_455f45ccaca170d406a50c6882a1e73aa74e8582672db58cb06bca5ff4b080f7_2022-02-03__174437.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4a4a9370-8526-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643916004, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916004, "uuid": "ef001fb9-3496-443b-8775-1b9708d2f6a3", "comment": "Malware payload (Heodo)", "value": "e1babdba6b1a11f94e4130228faa266a", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916004, "uuid": "7bf591da-13f2-4a37-807d-189a115f3252", "comment": "Malware payload (Heodo)", "value": "45608c2e465ce3ae7c65b4afd5edd86d80ade8f21b892561a34cf6a588c844da", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916004, "uuid": "76287364-a461-4e37-a1d2-9576c01283e8", "comment": "Malware payload (Heodo)", "value": "aade978e72e9715f58dafda3a4f7a7228480ee66", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916004, "uuid": "b1eb71f4-a188-4522-88b3-d3951d08203e", "comment": "Malware payload (Heodo)", "value": "1daf4b5acaeb69856f9c2d2ceb61f5bea42dd8ade8b53e6d773f8746ad421fc5b386abf9d1b70643bd86c0e018a58c93", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916004, "uuid": "2a81cdfa-1bff-4dbf-acd7-def4e0ae9dae", "value": "T182D4C05472A28476E0AEA83404249B138D6E7F715FB0C4DBD7E539AE4D3D2D16A30E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916004, "uuid": "79528ef9-23bb-45b8-88f3-93282d456d5c", "value": "15b471bbc15a140b9567d4daee05d632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916004, "uuid": "e7712855-417f-4ef8-924e-af3b2ac2e7ab", "value": "12288:8m9+I/aI+W1QbBi3IjeuXe6q7nCt/xCMqYDl2JwDKCX:8XrbB2IjevCyMqW2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643916004, "uuid": "7135743c-33ca-49f3-b0c2-6ced8e040531", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643916004, "uuid": "7dca7926-72bb-4559-b64e-58817736b2d4", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916004, "uuid": "4207682c-7522-417a-a884-47f8dbace26e", "value": "emotet_exe_e5_45608c2e465ce3ae7c65b4afd5edd86d80ade8f21b892561a34cf6a588c844da_2022-02-03__191949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "69862ba4-850f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643906178, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906178, "uuid": "3a806f24-1c68-4756-970b-ffec2a2795db", "comment": "Malware payload (Mirai)", "value": "209648d11d046833dffc9939deb25ca7", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906178, "uuid": "98f011aa-5938-4e72-8b1b-0fbeabbe69de", "comment": "Malware payload (Mirai)", "value": "456dc4615e9c24474fde3cb18f78ead54089e76f444938387c476c2049779202", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906178, "uuid": "4bc1e888-2ef2-4392-969a-b5e10ea0a65d", "comment": "Malware payload (Mirai)", "value": "3c7d1744811f879a02eafb58a9871e9d95f8286e", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906178, "uuid": "7a7cf352-4674-4ebb-88e9-574cb1b22ba3", "comment": "Malware payload (Mirai)", "value": "91837bc7c0207cae9db0c1dd3efb6ef9342eb902720ff1b7f6aa56cb52f21de8b20dff10a41c34135504c90b4f520c73", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906178, "uuid": "512eba8d-e70e-4e0c-9508-81a949281da6", "value": "T120336C23A4C180FDC89BC2BC9F9E763AD533743A1366B16963D4BD225E4DE215E4DE20", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906178, "uuid": "a0fd94b2-5e04-43f8-b5d9-b391536f8378", "value": "768:1Qyi3bCh7YL5WuJTMbGojmt2+7KVmzJyo3mkx43HTWT3udl8c/iITOOL:4CB+5fRojmU10JbM83ud5/i", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643906178, "uuid": "71675df6-c50e-498c-b78a-5f89ddfc9f5b", "value": 50584, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643906178, "uuid": "133c7507-ef39-48cc-8d77-92f6f7fd031d", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906178, "uuid": "cf194868-5fa4-4c5f-b72d-af0a6ec7fe08", "value": "ahsok.x86", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b9e57621-84fc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643898152, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898152, "uuid": "de5a2b60-fb32-4813-a215-d28e453a506d", "comment": "Malware payload", "value": "ef6153c159832d0d7e707b1f193d5c06", "object_relation": "md5", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898152, "uuid": "d539132e-ac74-43d4-b134-3f5fdeba7a34", "comment": "Malware payload", "value": "457dd353eb154787c120e99787ba5a294129c8839c46198b1a0f80457918f2d4", "object_relation": "sha256", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898152, "uuid": "12b26606-6fce-41e5-aecc-4a220a59210a", "comment": "Malware payload", "value": "869afffb20faf27c078cba2c7a67efc5a01778b4", "object_relation": "sha1", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643898152, "uuid": "8601f6e1-9077-4c4c-91ed-95ab02e75023", "comment": "Malware payload", "value": "c46cfad1bd45cfb2ada452c3a76ccddd41f251355e0a27156b0a171b3cd37a823c590eaa1c8a2faae0cbc1cf36491c89", "object_relation": "sha3-384", "Tag": [ { "name": "VelvetSweatshop", "colour": "#07D017", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898152, "uuid": "e466eac3-677a-4570-82dd-b074cd110bf7", "value": "T19D141206B6758885EBAF1B340EA13F1A24FCDDE861E11F721302FA5BAE787207415766", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898152, "uuid": "d96d79d5-4b7d-4867-bc08-21ea30fdd928", "value": "3072:mHalV/1nHiga3AER5Kh5wrevBcB/6fc8GEzrDRhcdA86hPDkGYI:WUVdH2vRQmreyBv8FF8F6tD1YI", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643898152, "uuid": "1628cca1-032b-444a-aa4d-725262209ce4", "value": 197064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643898152, "uuid": "e8cbdbe0-78dc-4806-93cd-ebcf77bc49f3", "value": "application/encrypted", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643898152, "uuid": "d460c897-5b01-4172-83f2-08f2e915c1b6", "value": "3.TOM 59 ME Exhaust valve spindle Landing report.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8ab701d-84c8-11ec-9275-42010a9c0029", "comment": "Malware payload (CoinMiner)", "timestamp": 1643875816, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875816, "uuid": "92a4e449-7c5a-4c64-b6c0-a6051ec4bf4a", "comment": "Malware payload (CoinMiner)", "value": "eb41768fbf45c80561f054f452baeb18", "object_relation": "md5", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875816, "uuid": "61ba2daa-8d99-4ae6-9331-e7fe0415b5f1", "comment": "Malware payload (CoinMiner)", "value": "45b0edc9f4942281a49d9692c2f75d3208954dd304bb767c795376b32a83c673", "object_relation": "sha256", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875816, "uuid": "05d350a5-2126-4d0a-b98d-c3a80536d49d", "comment": "Malware payload (CoinMiner)", "value": "a13ddbe67dca696535c512436dff7fe04262ac85", "object_relation": "sha1", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875816, "uuid": "cc0e59cc-b24c-4bb2-845a-b9a8103f1ec0", "comment": "Malware payload (CoinMiner)", "value": "5cc7376fbd37210a061d993ce35d8e9bf3cd597a27fd6c5d9728ab6e2fc8de13d87d6253a22abfaf0c9fd2bc622e1ee1", "object_relation": "sha3-384", "Tag": [ { "name": "CoinMiner", "colour": "#B30460", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875816, "uuid": "99f6d769-004f-42fe-9869-f7e7f1d7de4b", "value": "T192153315ABE4FC31796BE2B393149F4AFE58D559838E837CF621847A5CC4923A013AD2", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875816, "uuid": "bb26b940-4c05-4d24-b977-b7189d7f6b2b", "value": "24576:yy+jMkaTDtuF6kYK2MS6+wxaD21EtYlsVVRylcOJLrTkHul:yyFkaTDtuMkxrU3t9icaLMul", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875816, "uuid": "3bee9bcd-d5de-4f18-b5f3-0848bcc116d3", "value": 905200, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875816, "uuid": "64df86a6-dcb5-41a4-8bc4-d71b9fecbbf9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875816, "uuid": "0c9e12c9-0851-461a-8938-b85f462e5d0d", "value": "eb41768fbf45c80561f054f452baeb18.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "51584a8a-850e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905708, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905708, "uuid": "21e3ead9-6b30-46bf-9d0a-aae00ed45221", "comment": "Malware payload (Heodo)", "value": "701b9081547f0488f65fc29d28996cbd", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905708, "uuid": "18ace124-ab55-41ff-b1cb-a96f8bac883a", "comment": "Malware payload (Heodo)", "value": "45d1a24764b1ae326f771aff79a857dfcc2adca5078e8744bfa7316b0e7230ff", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905708, "uuid": "8e5c4c5b-228f-4411-9b43-d3c61dc54ef6", "comment": "Malware payload (Heodo)", "value": "170a837f8e1da7765bd7bc522d835584d7227281", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905708, "uuid": "32719836-225e-4b71-8873-a21557fda17d", "comment": "Malware payload (Heodo)", "value": "c7072b29ccdf54049751b55b7ef79ae846f375a4e8d60276e18d53667c2e24b2b909dd690642c7add787f6f4e7817719", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905708, "uuid": "4e5a7b5e-c523-4975-b476-29127ada7044", "value": "T1C0D4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905708, "uuid": "b4d7e779-eb3d-4d8f-8208-f2444c0dacaa", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905708, "uuid": "d383a249-d803-4ec1-a219-69b1bc6c46b9", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBP97+7/Q0xIop1KpR:JynoxcCOllFxBPQ7LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905708, "uuid": "d7d2389d-629b-4bf1-8505-bd96cd6d6eb8", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905708, "uuid": "af24d76f-8a78-47e6-a0d6-69a3f7b3befb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905708, "uuid": "c26d00eb-a9f2-4459-b623-7e8f2ecd6eac", "value": "701b9081547f0488f65fc29d28996cbd", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c1c90c3a-8514-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643908473, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908473, "uuid": "90f2db6d-9eb3-4c18-854c-56e033cf35e8", "comment": "Malware payload (Heodo)", "value": "21e9aff243b952d95c41adfd47099b05", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908473, "uuid": "b0f7be18-488a-46a9-aee6-61857ed3a325", "comment": "Malware payload (Heodo)", "value": "4642127c137b03d7e7a87557243ed08d4e44f0678ea1eec1a47bf1f51f9569b0", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908473, "uuid": "0cd50a56-237d-4026-90cd-ca108ae3ec73", "comment": "Malware payload (Heodo)", "value": "e0d7c4cfd370187de61959255143af49a5a219fd", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908473, "uuid": "f088bfed-de1c-4405-9068-a013357158b4", "comment": "Malware payload (Heodo)", "value": "21fc6f26166f315b5c4e6da0bb271affe5a4df04ebde315627d1124a285e2710c6d4971741659dd7eeefbd4a44472185", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908473, "uuid": "5fa87550-d897-4f47-98ee-8d6eb529e050", "value": "T12A25BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908473, "uuid": "9d77e0db-eec1-4ee5-b5b6-d78f4534572a", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908473, "uuid": "d395a82e-08f2-4dc6-b213-830179ba7093", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2g0FIIm2mlg:kBiaa4powXiolDS2g0FIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643908473, "uuid": "b2f8f98a-68d3-4c3a-aa82-670ea09311b2", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643908473, "uuid": "23dac8dc-d4d9-4c55-9dfc-8263984e4dcb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908473, "uuid": "dc438768-608e-48ac-9bef-ef362d4b9be4", "value": "21e9aff243b952d95c41adfd47099b05", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "11fa6631-84f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643894005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643894005, "uuid": "1b9f9519-2493-4d41-94a2-a477a1e7292d", "comment": "Malware payload (Heodo)", "value": "531627758ac1ba899b326b17caa658e4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643894005, "uuid": "010e874a-de92-4006-b038-2994429437ee", "comment": "Malware payload (Heodo)", "value": "46512c1a2580d8c4009743cf91d9246823ce10d98f06de358ef921886e92f589", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643894005, "uuid": "3caa8ba7-ca33-4e76-8f76-8b03451d14a6", "comment": "Malware payload (Heodo)", "value": "f411031759d1ce6734a565ac48ec071ef5fd0525", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643894005, "uuid": "33bdf4ce-6243-405c-a78d-43c96e0fad85", "comment": "Malware payload (Heodo)", "value": "e24841e4821bd647b15fde9acbf72c9aba72e140ca06d84425e89c7e3e3dc29d4c2536f8a3d16d8a5825d84f1125c569", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643894005, "uuid": "76de090d-ebd3-4aee-b9be-46a379b7603a", "value": "T1B525BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643894005, "uuid": "713ce07f-03cf-46c5-b373-77247ccc6dbf", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643894005, "uuid": "7fc88a61-7e48-4a00-9314-fa682af25504", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2g1FIIm2mlg:kBiaa4powXiolDS2g1FIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643894005, "uuid": "fefea67f-4ce7-4652-bca2-5f52890d6176", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643894005, "uuid": "ab05af51-3754-456f-8bd8-299777eba887", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643894005, "uuid": "58addde6-8bd7-416c-9562-b1089a292f70", "value": "4tSJGvI.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2a56e9c4-84d8-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882449, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882449, "uuid": "17a11264-247d-45f7-b784-a70f9985e167", "comment": "Malware payload (Heodo)", "value": "33533da72260836edefb19dbcdd6563a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882449, "uuid": "7c38ca08-280d-4eff-8f28-1222d53bf39e", "comment": "Malware payload (Heodo)", "value": "4667154d1794a3786b31297cbb2c0f6691192f2ec65bf9e24b2ea3b894d34a5d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882449, "uuid": "d3d633ac-43f6-41a6-ba3c-7234b244e1fe", "comment": "Malware payload (Heodo)", "value": "73fa18cabd1b5fa0e1ab0de38a741337412f487b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882449, "uuid": "6f031b0e-c70a-48e9-9199-f480d5efa19e", "comment": "Malware payload (Heodo)", "value": "44a56f9d3a11a3f5fa7cd8273a530bcbdbd797c0a711ffa30256cb0db50ada8781087b797e9d694f33cb5f55cb59b587", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882449, "uuid": "4e5bb338-538a-4187-b9ca-3897c8c86e56", "value": "T180E36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882449, "uuid": "b4593f3d-07f8-43fa-b386-c91f7901d416", "value": "3072:KcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgzGx0L:KcKoSsxzNDZLDZjlbR868O8KlVH3dehJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882449, "uuid": "6eb684bb-0c01-45c8-b492-aa45b6bbfc8e", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882449, "uuid": "d261475a-338d-491a-81c9-e7804747e398", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882449, "uuid": "1bbd3c26-eed7-4c48-9697-ac5a727e5f99", "value": "ED2454346194.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "90637fe4-850e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905814, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905814, "uuid": "100de03a-439f-4f64-b5ad-daba30a833cf", "comment": "Malware payload (Heodo)", "value": "87b2198931914ea0ff3613e8bd15769f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905814, "uuid": "88274d45-64af-4c77-8133-1c29b3140f71", "comment": "Malware payload (Heodo)", "value": "46769d97e1122b78a3ea45ce6313190d4f0796fbbc3bdbb5a3f7f6e4dc80bdd4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905814, "uuid": "5222694b-6a24-495f-8342-12ab2ee442b2", "comment": "Malware payload (Heodo)", "value": "944cbac5bc197a40005f3017e222f671cda3596e", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905814, "uuid": "83876043-f03a-4bb8-b801-449ff986e1c3", "comment": "Malware payload (Heodo)", "value": "393348b490269e91639f565413538f349fe8f5f71113b695d975460baa97516a55d15b8b946335400599d2f0c0792017", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905814, "uuid": "eb81f266-a25e-4007-ac03-8cacde5b5cba", "value": "T155E39D26B685C95AD91417311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905814, "uuid": "6bee6e7d-cbc5-4538-8976-8e8eeca4b92e", "value": "3072:GcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4LcP:GcKoSsxzNDZLDZjlbR868O8KlVH3Uehr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905814, "uuid": "687e7092-db9a-4cb6-bee9-3346bab61d1d", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905814, "uuid": "4accf4e6-a813-4c07-bcba-057bfa6aea18", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905814, "uuid": "26191d4d-af05-41a6-825a-68d4f198bd05", "value": "tmp2qoe52p0", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ec029818-84df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643885781, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885781, "uuid": "324dccfa-5a59-4a70-ad87-7329fe56a069", "comment": "Malware payload (Heodo)", "value": "aba455504fd6715a69c35f599d687bd2", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885781, "uuid": "80808e9f-4883-41f8-9eff-4575eca76437", "comment": "Malware payload (Heodo)", "value": "468f051c2b5e0ebafd76cc5d573c7e864586c788672ac351564246a142cb60af", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885781, "uuid": "54c80e39-1217-4c52-8779-e7a37fddd78c", "comment": "Malware payload (Heodo)", "value": "a746c1440ba39ff605a3ea4399dfc3686a6e7afd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885781, "uuid": "fc603821-17f8-4f1b-bd4d-e120141cc979", "comment": "Malware payload (Heodo)", "value": "a091da76eb03c2aa585a7996f4e97ab87ff09b11886a61d7a12b8ff4ba60f44a5459339834d4251cdcca285e0ff25975", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885781, "uuid": "fed0071a-6f2d-4ea2-8a45-dc445bb09b10", "value": "T1C6E36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885781, "uuid": "5cde8aaf-8e1f-43e0-ada3-5e848de768bd", "value": "3072:icKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0n:icKoSsxzNDZLDZjlbR868O8KlVH3dehx", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885781, "uuid": "0c8c7307-919a-4a4f-a984-4d22147e1bee", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885781, "uuid": "1c55cff7-4213-4356-a719-a1ae7b8343a7", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885781, "uuid": "a67b2040-0e25-4764-9bfa-3da0c9aa0f3d", "value": "2022-2-3-aba455504fd6715a69c35f599d687bd2.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b23a4d6c-8514-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643908447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908447, "uuid": "ea9eaf30-9d3f-46bc-82b9-63cc0c224532", "comment": "Malware payload (Heodo)", "value": "6173608835f0752bba2051917a7c9b16", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908447, "uuid": "9776c2e8-37c4-4c55-b5b9-e2cafc090aa5", "comment": "Malware payload (Heodo)", "value": "46be9db2edfe5f8c65afb9805e86866799df54532b586dde2e1f17bd92823af2", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908447, "uuid": "bfc4cdd3-d2ca-44b5-a5cf-5ddb8b66e963", "comment": "Malware payload (Heodo)", "value": "68091839fc223bc6c4bf51853c29ff32a939d189", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908447, "uuid": "b3790a4b-0e87-4a93-9110-8edc661685b7", "comment": "Malware payload (Heodo)", "value": "19a7e671292083895c2bd529dca6bf2890f19ce68a7abd916ae3840d33f53c52206e33968c70a0fbbedad670e2d47be3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908447, "uuid": "e47c523e-76b9-4ce7-b568-367fedec35cb", "value": "T1C225BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908447, "uuid": "a8fb24fe-1d48-47f2-a19c-03b43ebe4f0f", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908447, "uuid": "b956bf7d-d15a-4f96-9aa7-13f717bd9bc2", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2g2FIIm2mlg:kBiaa4powXiolDS2g2FIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643908447, "uuid": "6fea90f3-3e6c-4106-b378-0de36238f874", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643908447, "uuid": "7076cce3-50c6-4bcc-b09d-96b8d4ff10cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908447, "uuid": "b2d4d48f-2971-4eb2-82b0-00f60acb0acf", "value": "6173608835f0752bba2051917a7c9b16", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f5d16922-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856592, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856592, "uuid": "44725039-9c53-4abb-b7f8-351436722bdd", "comment": "Malware payload (SilentBuilder)", "value": "d70c82084abc695399943d6a967695c4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856592, "uuid": "6d8c608a-86db-46b9-a927-cb699f01db0a", "comment": "Malware payload (SilentBuilder)", "value": "472da491bddb61854fc7dd2d20c3fdff8928e4b542bf7b4e4c395e923eb1786d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856592, "uuid": "f9543e56-160c-4b23-aa9f-6b1ca9f9fbc6", "comment": "Malware payload (SilentBuilder)", "value": "d479aa581967db360bd73d6ba2af365393f589f8", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856592, "uuid": "d1d0e336-606c-4735-b139-fb8d34724c66", "comment": "Malware payload (SilentBuilder)", "value": "874c8dd064e1ffebaa1371d36bcdcafa5e64b2a6ff97c4cfa227fdf99b37aa183a270e4c7d3692fd453e6ee10f0f3180", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856592, "uuid": "5253c941-16a4-4442-a25b-33003aad158f", "value": "T1D9A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856592, "uuid": "f1179472-3790-434e-b3db-e61ce65d75be", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd494:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856592, "uuid": "5d7eeab5-1fff-4b71-9d00-4e3eff122a5d", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856592, "uuid": "b6cf6bae-359c-4255-9b88-934c53389465", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856592, "uuid": "886f4b1a-a90d-4816-8042-d105e64aef02", "value": "2022-02-03-d70c82084abc695399943d6a967695c4_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "763d4369-84ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643890308, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890308, "uuid": "deebf002-8dae-4cc7-be22-09dca38e0bb5", "comment": "Malware payload (Heodo)", "value": "5aee91dd1a6983f182e113b65205d2a6", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890308, "uuid": "ddb128a5-3f43-451b-ae89-a447794420c4", "comment": "Malware payload (Heodo)", "value": "475fd1af219d374c034c1040e64da1461988dcde5b1488a36c32bb13a519f5a2", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890308, "uuid": "b54193f3-03a8-4a94-af31-94fa87f21688", "comment": "Malware payload (Heodo)", "value": "023a020f2c5e5f85199d7fe480ed3e5056e24802", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890308, "uuid": "eccd37de-0cbe-4927-9cb4-444b5d3f836b", "comment": "Malware payload (Heodo)", "value": "07df56a38bd73f43a3c016c3e4e094e08f1ade6088c946eb32c20f32455282fe849f136da65dc39cac270a0d8a2f39b1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890308, "uuid": "4be217c9-bc34-4b0d-88c5-53777ca6069f", "value": "T1E125CF516D4980A1FA0B293D107A63660FEC690117E0E9EFDF05F8E75F26CC196788AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890308, "uuid": "53c68d26-1f53-49c5-9606-9cad5569cc60", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890308, "uuid": "eb7d07fe-48a0-4335-a8ee-d559eb7b1e13", "value": "24576:O77NlW4ZujpK630cavFuwNUsjk6opl2VD+rNtl7ifTI5dTpyvFIIm2mHL:6W4Z+LEtvFuwDjVK7GTC7yvFIr2mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643890308, "uuid": "830d5194-e030-40da-bd9e-96b53e5e8867", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643890308, "uuid": "072a9811-c51a-401c-8ca5-61876020f21a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890308, "uuid": "dafc6ca1-8a80-4bb9-8a79-6f85e61d9910", "value": "emotet_exe_e4_475fd1af219d374c034c1040e64da1461988dcde5b1488a36c32bb13a519f5a2_2022-02-03__121139.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bc419e96-8508-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643903310, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903310, "uuid": "455f9dd7-5039-4fd9-ad1b-5f0512d3cf7b", "comment": "Malware payload (Heodo)", "value": "e39fda4e756bdbbaf78cb772df0f17be", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903310, "uuid": "a50b9f2c-3d30-43ab-8905-8f57d5efb729", "comment": "Malware payload (Heodo)", "value": "476254283d958bb7698593e9f97c61e2914be0cbae0812b19c985d2510835d20", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903310, "uuid": "1c33d44d-4d0e-4fcb-8995-23857272dbf1", "comment": "Malware payload (Heodo)", "value": "9e2372b90e26b7fc763992a3b00bdbb475047ca4", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903310, "uuid": "492c1ca1-0d84-4323-bf25-026918a5e24d", "comment": "Malware payload (Heodo)", "value": "ccf12a18a439c0d2740c37d96e549b0106454c0dbe00be41b01b843f3e7e1d683b14ef2cb48d9c3c876bf30d0b799c62", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903310, "uuid": "1a6454a3-3ca6-4aa1-842a-a81de448cd57", "value": "T182A3BF4DE1130DB8F2E5D43AC1485E107BB702DC88827B1BB684896DBF9C2F9565F27A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903310, "uuid": "4536fd93-8668-40c8-9de6-9efa32bf963c", "value": "3072:Z7vjgqu8hahYIfiQOVOveshVf4KwJQikmGo2:Z7vjgrbtO8eOaDPk1o2", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643903310, "uuid": "3bb4da62-643b-46e4-be71-813b9c4e0bcd", "value": 105976, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643903310, "uuid": "4fbda4ce-be99-42c3-8853-695473324938", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903310, "uuid": "61343cad-c004-4061-bebc-b12ed480fa70", "value": "tmpq258cy88", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fc922a29-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910290, "uuid": "ddc509dd-c578-4593-9712-4c0a18b15efe", "comment": "Malware payload (Heodo)", "value": "23b65034a3779b9afd80b38f3d6b0d8f", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910290, "uuid": "6ffc5531-47f3-430a-9071-2270545ce300", "comment": "Malware payload (Heodo)", "value": "47bf851f20061b6922b317f0ca567ce9192fb014cd26132558d2301da2d8f991", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910290, "uuid": "0207d933-82db-462e-9dac-5b38cedebb9d", "comment": "Malware payload (Heodo)", "value": "461f332438405c13a6a4faca2e73edeeb62e1616", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910290, "uuid": "f59d2cf7-5013-4c49-a352-30aca1c2b1f6", "comment": "Malware payload (Heodo)", "value": "e685de67446da8d291972331049b0b4b26ac92b68de8919d97a74f779d28d746991be331444bb1f42ef2ed3be33e7710", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910290, "uuid": "74aa372f-f2df-4543-8578-c45577fe612c", "value": "T13A64E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910290, "uuid": "f76c3709-6051-4ad8-9990-d124dd9c93bf", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910290, "uuid": "6e0db72a-7df6-453a-a6de-fff05a19a00e", "value": "6144:83DvZRFTFbksYyljaMYDMyT7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMYpLAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910290, "uuid": "2d5fbc57-b49c-4863-bf8e-49fbd7fb160f", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910290, "uuid": "8d8a814c-29dc-4de0-ac09-d041d4dff93c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910290, "uuid": "ab6ea8ae-6eca-42aa-8d7d-6f7cd59c5fd1", "value": "emotet_exe_e5_47bf851f20061b6922b317f0ca567ce9192fb014cd26132558d2301da2d8f991_2022-02-03__174435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "448335a4-84ef-11ec-9275-42010a9c0029", "comment": "Malware payload (RaccoonStealer)", "timestamp": 1643892372, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643892372, "uuid": "9a463b4f-db32-4081-892f-c40a6d2d79e4", "comment": "Malware payload (RaccoonStealer)", "value": "a456ec69f73325c2115d7b01a25e88b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643892372, "uuid": "bb456974-2fa9-4111-933d-10ceb20e5c97", "comment": "Malware payload (RaccoonStealer)", "value": "47cfc46cf65a5efb244a0d4d9c07fc4ad66915e7e02af5ea9416012275344165", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643892372, "uuid": "aef33a11-645e-4261-b03d-047ffcd35fce", "comment": "Malware payload (RaccoonStealer)", "value": "28f2441967352a801970b9a31875e5322914dd14", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643892372, "uuid": "43314fac-34bc-4278-8ed6-a19babcf3876", "comment": "Malware payload (RaccoonStealer)", "value": "5ab4cebeb59c573b772da88a29041b3d85b22e2438f40277f967c1e0d8a0b65a05288e82eb8d943bda4aced0f8ce5dd0", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RaccoonStealer", "colour": "#C0516A", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643892372, "uuid": "e8defe04-d61e-403a-a222-fd5b14590876", "value": "T18CF4E100BBA1D435F9B712F4067593ACA93F7AA25B2461CB53D12AEE5B346E0DC3131B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643892372, "uuid": "a7373ea0-f38a-4c67-b6c9-b56bb1574a5c", "value": "aa2b22e8e3b96fd546a63d71626f45a6", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643892372, "uuid": "34dc5f59-71c8-4da6-b0ea-79e1fa1eef5c", "value": "12288:HIPL+lsFkPZNYhTTCeRgG9uNKMDPThsyDmi48jeHe/bLImf2BP5Hl2Zzgh34gmn0:HahAZNYhusXcNKMDPHmieccmf2BBQZgZ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643892372, "uuid": "3272e887-7aed-409b-94cb-aef51368e8b0", "value": 751136, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643892372, "uuid": "58340604-5e69-4d0e-9990-5687fe5d638a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643892372, "uuid": "cb763c3b-1b2f-4317-8e93-f09224867462", "value": "a456ec69f73325c2115d7b01a25e88b4.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98fba0f4-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856436, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856436, "uuid": "3f9be58e-9714-40b7-8cca-3788f479460f", "comment": "Malware payload (Heodo)", "value": "50dae95d2e78a080494113a42844aeeb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856436, "uuid": "aa29f098-f0ce-48dc-b4ac-1f140da5b361", "comment": "Malware payload (Heodo)", "value": "4807d190acb8e1be23da83932f1db274e660b7ecbd2c64b4baa691871e0cdec9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856436, "uuid": "063d9aa5-8a7c-4846-8a88-7b6ac8a1bee2", "comment": "Malware payload (Heodo)", "value": "19786b502851135c86823d5b6dc4b8aed4515ce0", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856436, "uuid": "06a89993-91c3-43aa-b224-43bc06b0c361", "comment": "Malware payload (Heodo)", "value": "da35f63ad724bd20dc65b95730bba175bea2cbf1306f2fb4af793bc3598b93e78f11aa7b3618d2cdb68e6f51baf33d54", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856436, "uuid": "61d17cb7-e5f1-42d1-8f5a-454568cc21a3", "value": "T100E37B2576C5D9CADB0822351ADACAEE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856436, "uuid": "f9fd0276-174c-4628-ac30-19174c743435", "value": "3072:ocKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0+:ocKoSsxzNDZLDZjlbR868O8KlVH3dehk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856436, "uuid": "1baaf2c8-ae31-4821-be0a-1240860c5ba8", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856436, "uuid": "8c9ed572-af59-4e2b-a29f-21d0181d6fa5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856436, "uuid": "98a19aa2-f50f-4595-9cf8-7dcbd4ddff79", "value": "2022-2-3-50dae95d2e78a080494113a42844aeeb.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "6067d3d2-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846892, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846892, "uuid": "2e536fe7-96b9-46cd-a621-2bf60719ebb2", "comment": "Malware payload (Heodo)", "value": "cff8f316fd0ec197596bd7427e74182f", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846892, "uuid": "aacd6b7f-434e-4b5b-9263-bd703c8dcb1e", "comment": "Malware payload (Heodo)", "value": "4809a43084e62a0282b9c439622a5c73b000e1edc960e7a3f24f933cd914b0f1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846892, "uuid": "2807484c-2664-4d95-b49a-d456eb832a4c", "comment": "Malware payload (Heodo)", "value": "0c52c8db967e1e237c8bd5e29df09b720374aa55", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846892, "uuid": "85dfa36e-3f44-4eb1-9810-c44b5d319f87", "comment": "Malware payload (Heodo)", "value": "52bc8799f00ea5bc2636555f3dd18c4d6501cac30e489d089c9e9c4a0cc14466a0944fa79123b36493ffed6fd505d29e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846892, "uuid": "0498e223-ab69-4a05-a0a3-7b7bbf4eb9ef", "value": "T185E36B6576C5D9CADB0823350ACACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846892, "uuid": "3820b812-ead4-4578-af5a-83890d075d74", "value": "3072:HcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0S:HcKoSsxzNDZLDZjlbR868O8KlVH3dehM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846892, "uuid": "914898bc-5435-4bf7-81e3-18af40431628", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846892, "uuid": "6ffada5f-a4ab-44ba-b0f4-25701c8a8433", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846892, "uuid": "c790176b-8bab-4dc0-8fa2-516ee8696963", "value": "2022-2-3-cff8f316fd0ec197596bd7427e74182f.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "8aa247aa-8504-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643901509, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901509, "uuid": "3fd85c15-812f-427c-9197-1059a9c34d16", "comment": "Malware payload (SilentBuilder)", "value": "b51afc5f5564d536cdf70b6c524ff8e8", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901509, "uuid": "882314ac-151a-4a8e-8dc8-1d487f102939", "comment": "Malware payload (SilentBuilder)", "value": "4813409ff235b511122293c4dfdaf82f7c31fdfeb30752548d4bb5e44bcf3be4", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901509, "uuid": "368c4836-5817-4d92-b495-d32ec122858f", "comment": "Malware payload (SilentBuilder)", "value": "5db7f79cff82b2daea7e5137cb156e9506eff9a9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643901509, "uuid": "ae47d158-2547-4e5d-bdea-0c2f33d91d75", "comment": "Malware payload (SilentBuilder)", "value": "0a5db2064bff94ab494e6181952dce272f3da7dced0a661cd421cbac88ae14c324b93a62a3d4dc82809e3f241d7bf206", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901509, "uuid": "cf3ebaa9-5d74-41a9-bfe0-fe6186b7f11d", "value": "T172E39D8AF25B0D68F192CA3584DA4B1437B39CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901509, "uuid": "858772cd-a10d-4b82-aa7b-a16a7766d585", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgfquZha9YILiQaVObeshRTEKwJQiQmGo4:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643901509, "uuid": "efabda94-1c2c-408b-bc67-27a1591ed674", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643901509, "uuid": "0bfe9e33-6737-45cd-8db6-17eed5ddc814", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643901509, "uuid": "ad5ace59-d0df-4a12-bd82-edf67f3da223", "value": "tmpe2tpvm_d", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a38b6530-84cb-11ec-9275-42010a9c0029", "comment": "Malware payload (DBatLoader)", "timestamp": 1643877069, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877069, "uuid": "0afa7949-a377-4869-b7e9-06a28a3d125e", "comment": "Malware payload (DBatLoader)", "value": "517ec0fda3be877620d4c9b88dfd5a14", "object_relation": "md5", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877069, "uuid": "2e8e2ea0-d197-44af-9307-7e000e89919f", "comment": "Malware payload (DBatLoader)", "value": "4877dd469af0e1ac31efa295325a3024d10abdc0a7eeaf74fe5b4eb9d0518bd9", "object_relation": "sha256", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877069, "uuid": "a236e9dc-3be6-4abb-90f9-9246c4d47b6a", "comment": "Malware payload (DBatLoader)", "value": "ef6946d02ddd809ce6482dbaa44d802ef3a082be", "object_relation": "sha1", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877069, "uuid": "f5f18012-0139-4f69-a803-2a47f05f20dd", "comment": "Malware payload (DBatLoader)", "value": "9456f98e82229180f4ca624d156c347519389417fbb1abf124adcebdc84c5edbb6e5b8998c6888a5982cbb1c43ee6f98", "object_relation": "sha3-384", "Tag": [ { "name": "DBatLoader", "colour": "#FA1270", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877069, "uuid": "d41e0bfe-7ff4-4e0f-9fcb-8ecefcb563e1", "value": "T1FEF48DA3E2D04D3FC22F1A398D2FC7E468267D107D28998A36E55D4C4F38691A936DD3", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877069, "uuid": "487dc18f-977f-45f7-aada-ba0344486fd0", "value": "ccc06143f4196eda2c10effb3cd98446", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877069, "uuid": "38b5e7be-430e-4e11-a498-f438e4f03adc", "value": "12288:z1X3FPdRtwqQQROhlSn2D+X94IpnkE02+V7bnNlplmw:5HptwqQcOhlSnLN4IVQ77Nlp3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643877069, "uuid": "c896af95-8843-4f03-b0e7-ffa3ec755977", "value": 733696, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643877069, "uuid": "4e291449-d536-4404-9771-535c445cca2b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877069, "uuid": "97d8fa35-904e-4b63-80e8-68fecca57460", "value": "Predracun u prilogu.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2f652551-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855400, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855400, "uuid": "0aaae8ca-428c-4473-b0c6-a9a82b021257", "comment": "Malware payload (SilentBuilder)", "value": "12a62ae066cd2a43f3eb671654b873e7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855400, "uuid": "a844213f-5929-4d6a-ab97-ec1b93e9e72f", "comment": "Malware payload (SilentBuilder)", "value": "488c50b9c40248b74330858a3296d34e4cf1f1e20477a0d8a220c796c454f1cb", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855400, "uuid": "3f8d59d1-db60-426d-b2f3-cda833cb1285", "comment": "Malware payload (SilentBuilder)", "value": "ccef520d06deb24d167cde8872ee216550b97006", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855400, "uuid": "75bf37f3-5bb6-489d-a367-eddccc4dc098", "comment": "Malware payload (SilentBuilder)", "value": "008fe257e9f1fd08d1c09facf5be337941a387eb0110400758fc04dffab2e316461398150687aca9bbd309b22cdb2026", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855400, "uuid": "872a81d2-b527-4046-a8ec-909b9572e3ef", "value": "T14FB37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855400, "uuid": "c8535230-227d-4a98-85e0-83165e2f65b5", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49H:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855400, "uuid": "b06a6e1f-1f0f-42c4-ba6a-838a0304e627", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855400, "uuid": "ee6bcd57-b183-4418-86e9-ac7badf144fd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855400, "uuid": "436a4fd9-fbfa-4b5b-9d0b-eb258d875aba", "value": "2022-02-03-12a62ae066cd2a43f3eb671654b873e7_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bba434ed-8516-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643909322, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909322, "uuid": "98221a04-a6c3-426e-99a2-f442fb5fb6f4", "comment": "Malware payload", "value": "1e48f4302172962d505df68b9d4c37ae", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909322, "uuid": "d85e2f75-0b6a-483e-927b-15a7ee72ddbb", "comment": "Malware payload", "value": "48b96a4435634bf0a7850891114e7171efcecbece9f91385805770a15f0536fc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909322, "uuid": "b66e1a1d-bdc4-47f5-9157-fc6776ed18ff", "comment": "Malware payload", "value": "c22e5d87d4e4ae89b3055f03c60b191c8c5178fc", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909322, "uuid": "b4c602da-2926-4409-83c5-36b1f0a57e5e", "comment": "Malware payload", "value": "b6a32973dcd956b45f71c57c5b361335ebed16bcc07bdecbfee7f82d89f5672cd80e9cb8906825b56caceedc023cd71c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909322, "uuid": "aa11d6bf-5322-44f8-9f5e-f1a3bf5020b0", "value": "T16373B0BEBA5E8C89FC05033A65E34AB7234BBDC54FA20382775EF7069BB42904617117", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909322, "uuid": "22030ac2-7697-4628-9406-f22da3f4de82", "value": "1536:vcKoSsxz1PDZLDZjlbR868O8KlVH3jehvMqAPjxO5xyZUE5V5xtezEVg8/dgL4oH:vcKoSsxzNDZLDZjlbR868O8KlVH3jeh1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643909322, "uuid": "d5db0b40-c481-4031-ba13-5bc0386ed8ba", "value": 76057, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643909322, "uuid": "ec344bcb-f060-42fc-ab0f-b2efb6ea5819", "value": "application/CDFV2", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909322, "uuid": "2d652dd2-4793-48e6-b321-ced89d2ac7ee", "value": "tmpmaqhxbgo", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b8f62a63-84ff-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643899439, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899439, "uuid": "fae3642f-2eac-4b06-9442-affe3ee0be59", "comment": "Malware payload (AgentTesla)", "value": "f8b3f133c59a7cdf5b7534fa7090ee1a", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899439, "uuid": "487d3a3b-86b6-4749-a027-bee64ca4aacf", "comment": "Malware payload (AgentTesla)", "value": "48e160f6786fe23cf8adacefc49210cab80b24fa0f6d1d7f389e7ade098e2f7f", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899439, "uuid": "c92da0c4-272d-4f32-a792-2d7c4589b88e", "comment": "Malware payload (AgentTesla)", "value": "e52e5172f4c250e7b23015fd76c4ecbacb081cf1", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643899439, "uuid": "cc23f0ce-7097-4deb-8667-75ac9d4b1c67", "comment": "Malware payload (AgentTesla)", "value": "4f3f4053e2ccecc37d73fb3f40213f6d1a020b9aef6c3ab9fad2212e67023e697ccffa35a2bab14f3e53f88177d6a72b", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899439, "uuid": "4e1a2fcb-9e44-4ab2-b193-e0b1c456ad75", "value": "T118D4AE75353A9B02CA3FEB382360D2795FE5AE35E322F52D6CD8758E04B2A014E71917", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899439, "uuid": "4fb5bd5f-62bc-4f5f-9318-09bf09421eb6", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899439, "uuid": "b552446d-65d9-47ef-a249-2d4d351e4a44", "value": "12288:NjApwf9ztdKZ2JYzJ0PgQ43FN39zzAtnF3zn8:NjAKf5mZ4YF0P+XNwtnFjn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643899439, "uuid": "d093db8c-9b3c-42ff-b540-d0985400e5c0", "value": 600064, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643899439, "uuid": "c80885a7-0970-4458-961d-44d45665b4bf", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643899439, "uuid": "3aa8e20a-c83b-4636-8f94-62c7927f2f35", "value": "SAMPLE INVOICE.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "afd8516f-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883103, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883103, "uuid": "c2d653a7-5958-47bf-b296-bef327a7293e", "comment": "Malware payload (Heodo)", "value": "044591c1844e4251de0a4474f4ea70f5", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883103, "uuid": "c85e45e9-2084-4eda-94cb-0af8630875e4", "comment": "Malware payload (Heodo)", "value": "4907456810f02d4806f92c96ae40fe38c0172e4e4b09586fc55f8cab9251b7ad", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883103, "uuid": "e21b9001-20b4-4537-ac13-f0fab6148aa3", "comment": "Malware payload (Heodo)", "value": "ede88de3f42abffd276277afb7f7c840e98d4a1e", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883103, "uuid": "5d9e59ec-5c3b-4ffb-b3bb-9c101670d3ca", "comment": "Malware payload (Heodo)", "value": "5d073466f60214f5522105f80a37afcb8993106391fae8bad97c478078dd7c4b98374eb00cfc02c57fb2401d767a0b93", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883103, "uuid": "3e257594-4654-4cfa-8563-47102b5a09c0", "value": "T14EE37B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883103, "uuid": "a3de1229-c4bd-410d-80b0-d3452ea38bc2", "value": "3072:lcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0l:lcKoSsxzNDZLDZjlbR868O8KlVH3dehn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883103, "uuid": "83868eec-b948-431e-8cde-eae05b4dbc50", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883103, "uuid": "4a1650ae-b34d-4b8d-a2ec-0bbda13f7f74", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883103, "uuid": "659237c3-96e1-478e-8214-d0fd8c00d925", "value": "2022-02-03-044591c1844e4251de0a4474f4ea70f5_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "24fe46af-84df-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643885447, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885447, "uuid": "7e0e7787-c0f5-44ff-8f97-b6b0a1a29b53", "comment": "Malware payload (Heodo)", "value": "800e48a89bf56251963e7e06384fdf6b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885447, "uuid": "d6e4ce29-ca70-432e-8001-c047b72e9d0a", "comment": "Malware payload (Heodo)", "value": "493a2389e9eda7fb062304965da0c6b01ef048f17a9cf8601aa3aa890c9ec8a2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885447, "uuid": "bce62c76-0f76-4cf4-b034-c63c6f2bb108", "comment": "Malware payload (Heodo)", "value": "82459f332e93419ddf275e788c31cc41aa8c2347", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885447, "uuid": "fbc88d73-f5ef-4cee-aa51-febe829a1716", "comment": "Malware payload (Heodo)", "value": "ab6176c68e663402b94b20e6d752add87226ac1c950f3d200bd51035ad19c2ccc81d51d8796f3c1d00fea9de22b407ae", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885447, "uuid": "761d71e9-e310-4707-a7d3-8adbc04efa29", "value": "T1C6E37B2576C5D9CADB0822351ADACAEE2327BC479E7643C33148F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885447, "uuid": "17b0b889-3ff3-49ad-bcad-51e791b1e505", "value": "3072:kcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0U:kcKoSsxzNDZLDZjlbR868O8KlVH3dehq", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885447, "uuid": "f51c5519-8f35-43df-8130-0183cd801c66", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885447, "uuid": "e307c917-da29-47b9-9a24-058b319785b1", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885447, "uuid": "91b0ff6b-109c-429c-a6b3-c308c9c8826c", "value": "2022-2-3-800e48a89bf56251963e7e06384fdf6b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e9d5139-84ec-11ec-9275-42010a9c0029", "comment": "Malware payload (Gafgyt)", "timestamp": 1643891073, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891073, "uuid": "ea919275-dd4d-45e5-8d2f-100f4a553943", "comment": "Malware payload (Gafgyt)", "value": "6185aeb4e1b4bf51813d0ff127b77b7e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891073, "uuid": "6f3ef9b2-0b01-4026-9708-4550f74554aa", "comment": "Malware payload (Gafgyt)", "value": "494aa9acd7b73344dd59224d7d86e0a7d4daa45488a70d7963de1031fb76b415", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891073, "uuid": "f83604d1-d09c-40b9-90e2-f07a834550fd", "comment": "Malware payload (Gafgyt)", "value": "c22958068769f634cb22b6978f1deba9775e010d", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643891073, "uuid": "29333fa3-240a-4c73-8af8-86d314b0759b", "comment": "Malware payload (Gafgyt)", "value": "4463ea1e4180902c49c492e44a6ecfa99daeee2fca3ba55afc0d5d0cca04d1966f1a26d669347f8779f25d3b62b48e6a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "gafgyt", "colour": "#8C9C05", "exportable": true, "hide_tag": false }, { "name": "mips", "colour": "#CE983B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891073, "uuid": "7a653c25-5a8f-495e-ad97-f50f1c783421", "value": "T18914747E7E21AB7EE168863207F76FB0D39521D326E19341E1ACC7185E7524C189FBA0", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891073, "uuid": "dd8bbb59-16fb-43e1-88fa-dc788806d69b", "value": "3072:Ui/Cyk6tdTJOkurLsIAeoN3i5hUqpgqm3d/sgAlEm/zpfE1z/icz3q:msXuUzeJ5hUAmdnEEm/zpfE1zacz3q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643891073, "uuid": "1a5dd06e-95c8-40bd-b874-c03c42acc086", "value": 206546, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643891073, "uuid": "8aab3b73-d40c-4aac-87d8-9190822196ff", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643891073, "uuid": "12520da5-24bf-4378-be6e-73e835351db9", "value": "6185aeb4e1b4bf51813d0ff127b77b7e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcacee5b-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883661, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883661, "uuid": "9f2e3585-71d4-4c49-b0ab-8ea2721ab098", "comment": "Malware payload (SilentBuilder)", "value": "98e5abdc436682a6a24746c3b7f24961", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883661, "uuid": "138526fd-b3b9-4236-9728-07cbc42da288", "comment": "Malware payload (SilentBuilder)", "value": "497a809d4c7b8757dcc7114d9aa073133b7fe63f9d5d5e4de6d895aaf4df3d45", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883661, "uuid": "75c49db5-34e7-455a-aeca-22d7ba80a749", "comment": "Malware payload (SilentBuilder)", "value": "e7ee12818b046a21fcfda400ee11ebff6ca995b5", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883661, "uuid": "3a52b82f-0284-4bd7-b1de-58476b2ee825", "comment": "Malware payload (SilentBuilder)", "value": "f4db5cfe41c4c5e935398b67d7bedcbf6698522e7f9d3ff12049834d778a2d5be4372d9e9f6e44faf537752d98fd36b9", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883661, "uuid": "c098a353-6019-4f0c-9145-73338823e260", "value": "T1FBA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883661, "uuid": "87ae43aa-51b9-4f51-9646-bb6b25befa2d", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd494:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1U", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883661, "uuid": "7f3c3407-9036-453f-af67-5e265bd51713", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883661, "uuid": "97fc7231-6156-4c00-9c18-3ca04f4f0804", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883661, "uuid": "c09b8f82-f2c5-4847-a708-20419c5fe0af", "value": "2022-02-03-98e5abdc436682a6a24746c3b7f24961_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b043f527-84e2-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1643886969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886969, "uuid": "9b32653d-b5c6-4749-b800-cbadaa2400aa", "comment": "Malware payload (Formbook)", "value": "4b7e07726acda0d06a25b53d8b4e409a", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886969, "uuid": "acc513f1-3256-4dc1-af47-fb1212a13f38", "comment": "Malware payload (Formbook)", "value": "499229109e2b187386c7896c854e7aa1d5955b4930e30b11da222ea3a099ae61", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886969, "uuid": "7720470e-18fd-48fb-8032-320247b22625", "comment": "Malware payload (Formbook)", "value": "56416e881bdf15844aa3c0265180b03116df7117", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886969, "uuid": "092cede5-4a1f-415c-baf9-39485c92f521", "comment": "Malware payload (Formbook)", "value": "17c1659e72c5af4d604fe9069f86a35a6b037e399c6c3a202cda3c20d2566bd826d4ec4098047286f31f7ee328419c7e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886969, "uuid": "5de8309d-d81f-4430-88af-9aac9435ff5e", "value": "T14A342324D941FE80AE79C5F9DB06E07A452086E07E4FF8E22D58B827696C77CC279C16", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886969, "uuid": "537ac72e-50a8-4371-bb77-1051abb4468d", "value": "6144:3JdiUdQDAXObs31JVEjruEaE/QtYvD9ByY:PnQDA441vn1E/wYJv", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643886969, "uuid": "5967d9d0-d66a-409b-aa8a-25aa6903fcc7", "value": 245182, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643886969, "uuid": "6e626307-fffd-423e-9e79-3f230a09b9fa", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886969, "uuid": "4f3bd4b5-5136-4847-8591-362671171968", "value": "1643877030.Vfc11Iba802cM247502.dynamene_remittance copy.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3f486b55-84f3-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643894081, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643894081, "uuid": "95717599-6f5b-433f-b346-3be134ba78d3", "comment": "Malware payload (Heodo)", "value": "0733f726eb200efcb4efc3ce8a80b96e", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643894081, "uuid": "5393bbc3-229c-4f57-948f-f964baf8bb7b", "comment": "Malware payload (Heodo)", "value": "49b1fb00b9b2aeb0fd549d2c7a33d9845ee72263f97d978c60b853937c0e93f7", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643894081, "uuid": "29e248c6-c8a3-4b39-ab1d-4ee1d6a9a323", "comment": "Malware payload (Heodo)", "value": "1ad22f426248ee8a1fc166a838ff9498f4fc72bf", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643894081, "uuid": "1c09fe5c-0f29-45a0-9b04-792b56a5df9a", "comment": "Malware payload (Heodo)", "value": "5cf6354d2d09866af3f73aadc64323e17de9db2d94e225e3fdce11d3c8e38af50523653aa449c2fdc9a864de0d5739a4", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643894081, "uuid": "74ece1d1-4509-454a-bde4-3344104ad6da", "value": "T1F025BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643894081, "uuid": "47324db2-4bda-4b0c-b3da-3ca3a59abaf5", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643894081, "uuid": "087963c0-d258-47fb-b607-b23fa4a5d222", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gvFIIm2mlg:kBiaa4powXiolDS2gvFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643894081, "uuid": "51ef5a79-14d2-48ba-8944-51489a9ca64b", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643894081, "uuid": "85788d01-cf75-41c5-8b30-ee3a51100c82", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643894081, "uuid": "bd948f4a-3ddc-4336-a919-742b564dabd7", "value": "2Uvy.dll", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bb2d2e27-8514-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643908462, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908462, "uuid": "54abc527-a5de-42fe-8305-4b2031db46bf", "comment": "Malware payload (Heodo)", "value": "00fb5bba183f90e1ab6b06a2e9e7fff7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908462, "uuid": "3275a07f-a380-4a04-ac3b-8e587c23b942", "comment": "Malware payload (Heodo)", "value": "49d4461c281440b1439ca8690decea773d35bc568e2149c8f34906b9cc774fdd", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908462, "uuid": "7f64a98a-e004-4097-8f95-547c6524761d", "comment": "Malware payload (Heodo)", "value": "71a69a49fee1411ce676e535e74cf910e1aadfa4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643908462, "uuid": "876e92ef-fbab-43d3-9911-d28e221e144b", "comment": "Malware payload (Heodo)", "value": "34aad1aa0465562281d815322f04d5fed22a8b4feda030add25c2780419881d8f0ac241dc5255e566f756a935487c3cd", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908462, "uuid": "23e9ba84-7e04-4ad3-8bad-150700852772", "value": "T18E25BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908462, "uuid": "963d7f34-d833-497d-95fe-1a79d269d11f", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908462, "uuid": "9970f383-f950-46e4-a516-b29e27455481", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2g8FIIm2mlg:kBiaa4powXiolDS2g8FIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643908462, "uuid": "0f7a8a2f-1991-4dc8-975d-9dd6cd90b8fd", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643908462, "uuid": "59bcf6eb-f009-4b54-b09d-403fa28b97ee", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643908462, "uuid": "82611198-517f-44d0-8143-857b14188409", "value": "00fb5bba183f90e1ab6b06a2e9e7fff7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d0d0a7f2-84d7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882299, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882299, "uuid": "8db51152-a151-4a83-a10b-13d015b4a1e0", "comment": "Malware payload (Heodo)", "value": "da7201a885a00bd9661482b4d017186f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882299, "uuid": "945e3215-3627-4000-a1b9-dab4cb8783f4", "comment": "Malware payload (Heodo)", "value": "4a21b5b403cdfb4b3aae89cde82b7f321a0a940136403433d2762a3b61543ece", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882299, "uuid": "0eaee2c8-119b-4060-9c4b-02dc8ae14c32", "comment": "Malware payload (Heodo)", "value": "b5e6b0b78ac4059c1d69a08689b3c057e4d3f650", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882299, "uuid": "a8bdeb3e-52a3-48c2-b565-72efa911648c", "comment": "Malware payload (Heodo)", "value": "70c042d7837de1dd3b0ee30a98c232d016c2a8f930cf53749fea2b275b0151c4308de00f07e9b40fd23fbdf76f8fcaec", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882299, "uuid": "d04195c6-98dd-42a6-8dc9-95a590f341bf", "value": "T1E525BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882299, "uuid": "767ba0ca-d1b9-47b8-9ad5-2ae7317963e3", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882299, "uuid": "206ca7af-a38e-4e89-af72-b813773e9a79", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2g7FIIm2mlg:kBiaa4powXiolDS2g7FIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882299, "uuid": "10d12626-85a9-4c65-8481-33072cef40ec", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882299, "uuid": "782df2bd-54d5-40f5-91f6-ea822d3d9a9d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882299, "uuid": "0195174d-fd34-4733-a78c-d221703c318a", "value": "da7201a885a00bd9661482b4d017186f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a505fdf6-84cc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643877501, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877501, "uuid": "f27e64f1-b384-4b12-a95e-b7762e10be37", "comment": "Malware payload (Heodo)", "value": "ff1a55adadd5497f89674bf55472aabc", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877501, "uuid": "0a9eb817-6bb0-46f3-897b-83531489a0bf", "comment": "Malware payload (Heodo)", "value": "4a389831fcd49d0e19c4d22b37abc3b480bb931f7d45e1c9597d47f807f81949", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877501, "uuid": "e6f3c6e2-9f1d-406d-bf6a-c537e60d24d5", "comment": "Malware payload (Heodo)", "value": "fe817278906083014ccc6ceca31a1fac24476a4f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877501, "uuid": "b41c1b29-c667-4505-ab6c-7154cc6003e8", "comment": "Malware payload (Heodo)", "value": "90e72938b0d078f10c8dc572bc18c1f0da4e5a0310c6e90a4e82dc112efe7cfafc84bb6a9cf398b43a37996d8052088c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877501, "uuid": "54e25346-81b7-4378-a1ba-53fabbf492b6", "value": "T1FEE36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877501, "uuid": "446d84aa-cc04-4d20-8de2-0aea9daa81e1", "value": "3072:+cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx08:+cKoSsxzNDZLDZjlbR868O8KlVH3dehu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643877501, "uuid": "34ef3891-b5c7-4e00-849b-26f02c135f33", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643877501, "uuid": "dafb5aef-dd05-4443-899a-3d49b6a8269d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877501, "uuid": "320f5fc8-cb2b-4171-956e-1a35205de298", "value": "XI0413767378294680725.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e3a1a26d-850e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905953, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905953, "uuid": "e3f94d27-086d-401e-a380-9b845cf8a22f", "comment": "Malware payload (Heodo)", "value": "194d8f4795796b6cf6caf1f1aaae56f4", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905953, "uuid": "37d804f8-090d-48e2-9922-0b0d4517c193", "comment": "Malware payload (Heodo)", "value": "4a5ecfea999e5563fa5c29556bb5502916c60ba254535a6d49dd5450aee8d763", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905953, "uuid": "f8249bcf-87e0-418e-92da-311bb7447370", "comment": "Malware payload (Heodo)", "value": "9d9ec53575f9f98441bc0d4a4ed4c1ea5955a1a8", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905953, "uuid": "cd9add42-9273-440e-8d92-c0dba82bdc97", "comment": "Malware payload (Heodo)", "value": "0c361383075eca273446e0b61159f0e4cf410dd368b3ec2102764afdd7246fb4448fd35bf9fe56ccaa42258ce0ff1880", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905953, "uuid": "5cc2d20b-b345-46e1-9e03-e37c45ea6170", "value": "T179E39D26B685C95AD91407351DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905953, "uuid": "78e91189-7e36-4619-a479-f54e0b02ae3c", "value": "3072:JcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcz:JcKoSsxzNDZLDZjlbR868O8KlVH3Uehn", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905953, "uuid": "9c770e87-50f0-4233-a926-4c8b312d3f30", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905953, "uuid": "51411e60-3f6b-40b2-a82c-3bafb11373ec", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905953, "uuid": "9d594c89-c08f-41fc-90dc-3821bbaaa43a", "value": "tmpos4ez98y", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a10af19-848d-11ec-9275-42010a9c0029", "comment": "Malware payload (Sugar)", "timestamp": 1643850317, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850317, "uuid": "fbb14391-bcc6-4348-b4a6-5296e6f4c48f", "comment": "Malware payload (Sugar)", "value": "17c7b47b68f75df9eec21698decad5b4", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850317, "uuid": "ea53ac2a-5c97-43f9-930f-17701ba18ffa", "comment": "Malware payload (Sugar)", "value": "4a97bc8111631795cb730dfe7836d0afac3131ed8a91db81dde5062bb8021058", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850317, "uuid": "52cc952f-f19e-4186-84af-c54198a169e7", "comment": "Malware payload (Sugar)", "value": "a4854ce87081095ab1f1b26ff16817e446d786af", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643850317, "uuid": "de2d8606-9530-43a5-ae2a-62e4a3a524e8", "comment": "Malware payload (Sugar)", "value": "b12f992238ee7b5e572c4cd4c616a9a6441bc8783d96bcefb44fbe0f4a347f95571ec1c23f9a6cac6c98db24bf4048d1", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Ransomware", "colour": "#D117B6", "exportable": true, "hide_tag": false }, { "name": "Sugar", "colour": "#16C577", "exportable": true, "hide_tag": false }, { "name": "unpacked", "colour": "#9FA24D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850317, "uuid": "737a0c10-958d-4435-b4a9-7e8e13658cda", "value": "T193E37C37B982C13BC0754D79DE16D2DAB629BA303E38189F75D85F0D9C392825A7D382", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850317, "uuid": "e37ee2e4-e0c1-44e0-94ec-4245a2c739e0", "value": "5d2d74e0bbb1bdaffd94b2514a46e47e", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850317, "uuid": "b00a1114-abb4-4554-b7c7-84ac081c027d", "value": "1536:WJ6miN/d+ucYLJrpTR/ky1lcSBdeKWFKVsu5jmZIFncKDCzHQvU/NjwGg64+:TmecYLN/ky1l1iClmZYfezHQvYdZ4+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643850317, "uuid": "113292c7-57a2-4871-84f3-47fa183b2c3d", "value": 143360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643850317, "uuid": "d90ee18e-8473-476e-b638-24adc6e092b7", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643850317, "uuid": "1ad164e6-2908-46b7-aef8-faf6d0c6525d", "value": "4a97bc8111631795cb730dfe7836d0afac3131ed8a91db81dde5062bb8021058", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c55b08a0-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856510, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856510, "uuid": "81e0f69b-eab4-46b6-896a-4fbe7745d3a1", "comment": "Malware payload (SilentBuilder)", "value": "ccf1533bf5401caea1652403e871e1dc", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856510, "uuid": "70758c42-b68d-4b23-9948-e041776cdc20", "comment": "Malware payload (SilentBuilder)", "value": "4abefce1dbed9403ee65fa5f8591672b8dd1041372a6b8d20668ea5ce68ec883", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856510, "uuid": "4fc0ee81-5b20-48ed-a865-50a622f9deba", "comment": "Malware payload (SilentBuilder)", "value": "1612c1fd82f53b3f9597ab1e8562b42d6c2253f7", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856510, "uuid": "ab5e21f7-3616-4fe5-9fd6-6a3b7491fcb7", "comment": "Malware payload (SilentBuilder)", "value": "8fe7b5b0f7fa05ff62be1aa34465639ffa76daf963ce6d621a14071ec5f94b4f2936853086f4e3780f24b01a18604bd7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856510, "uuid": "80b56df1-d8a3-4d94-aee6-6351d30a18b9", "value": "T19BA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856510, "uuid": "a734b0b0-dd0b-4457-aeee-f6c89ad90062", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4N4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856510, "uuid": "3b5d2600-8f00-4e52-b738-18b7c079435d", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856510, "uuid": "75b39083-eceb-4fd4-a026-dd274bf6d035", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856510, "uuid": "5282e042-8a3d-4842-bd26-86941f284481", "value": "2022-02-03-ccf1533bf5401caea1652403e871e1dc_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fd2f6b86-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910291, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "c97fcde3-2911-48a8-85e1-42a1a8080d07", "comment": "Malware payload (Heodo)", "value": "a27f59e75f02b9a1f5c229604687968b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "edd1eb8b-8582-4fe0-b224-21ddd57b4184", "comment": "Malware payload (Heodo)", "value": "4ade2479688cbedc1d3eb294cd838af37764f3bd1ac56d81745304d3f1092841", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "3ac42395-1a99-44ae-a6f2-74666e98bb48", "comment": "Malware payload (Heodo)", "value": "e7f616461b67749755d23695d336136b707fd363", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910291, "uuid": "d7d0c469-2fd0-4be8-a54a-48bb2bfed723", "comment": "Malware payload (Heodo)", "value": "39ce914654eeb000582602d4149c29f4ff6ea4a9ce7f75a647ba8dde38235d73fa134078a6b20a34541d852e187300c1", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "a5422707-bf28-4883-85f1-31e8338369c8", "value": "T15664E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "04274e5d-db70-45f6-8eaa-dd99c2cc6886", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "377fc609-c7d4-435e-a17d-9d6a0217fea0", "value": "6144:83DvZRFTFbksYyljaMYDMuT7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMY5LAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910291, "uuid": "542cd14e-04f7-4b3e-b3af-ec6920dfc1cb", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910291, "uuid": "b5670225-037a-4661-a4d7-0b3a0b495461", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910291, "uuid": "3097b046-37d0-4802-84b6-cd30c49500d1", "value": "emotet_exe_e5_4ade2479688cbedc1d3eb294cd838af37764f3bd1ac56d81745304d3f1092841_2022-02-03__174436.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "25901dde-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855813, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855813, "uuid": "167f5803-8ad6-438d-b61c-96f527a037a2", "comment": "Malware payload (Heodo)", "value": "9330978d04e707be390631a0cb807395", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855813, "uuid": "523e0d0e-aee9-4f49-a142-7dc2eb0482d8", "comment": "Malware payload (Heodo)", "value": "4b372e8eaff6bdef6519af35f6a1fc8219bb8b48fd063761e72764a796201797", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855813, "uuid": "e72dc71a-cdb9-493e-a3d9-c8dbe081e11e", "comment": "Malware payload (Heodo)", "value": "c7bd5ab733dd336017f9814a02480278004adfd6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855813, "uuid": "e0d5e99a-5635-42f9-8f8b-d1b9c693effa", "comment": "Malware payload (Heodo)", "value": "cb2603e47762ce79602adc072ef1c1a37d82ac1e106de22d2386ca4d80e27acbf0ad93bfc3f1cfffbc0e93953e900335", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855813, "uuid": "e99f1d7a-540d-4c53-9a60-0655e830fcbe", "value": "T179E36B25B6C5D9C6DB0922350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855813, "uuid": "8eda9e47-db39-43d0-958f-2a4dd3844409", "value": "3072:6cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0B:6cKoSsxzNDZLDZjlbR868O8KlVH3dehb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855813, "uuid": "0c75a91a-222b-41f6-81a5-7665b4191a2a", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855813, "uuid": "5c2bc46b-691a-4a1a-b682-4dd12d726a7d", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855813, "uuid": "a7a0c976-ccb6-4875-ad1e-68a749cde2e0", "value": "2022-02-03-9330978d04e707be390631a0cb807395_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "511abe1d-850a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643903989, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903989, "uuid": "db15d870-7a1f-49f4-be10-978877b78fab", "comment": "Malware payload (Heodo)", "value": "795a71157650997dc25bb9032bda6fe6", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903989, "uuid": "2669867b-718a-43c1-8a29-30c4d3ebe6d1", "comment": "Malware payload (Heodo)", "value": "4b3a8aa842a319328495cfdad0ca05281b90b6c03a59d1a25d92d2b782d41469", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903989, "uuid": "7d49af5b-7d3e-4cba-82ff-7ffed6017a4e", "comment": "Malware payload (Heodo)", "value": "76fcf73d96b7191edff499a1c70f9631346f9d1e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903989, "uuid": "cec4ee3e-08a4-46b4-bd55-10733bfbd438", "comment": "Malware payload (Heodo)", "value": "4031d4cc531d35f7fa36aa7d898b0617f9ea773fe2333d3ec3caf6ef6b5110fc2cfd4d770b415d75b3a99656f7f78430", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903989, "uuid": "34027821-26fe-4ae0-b438-9c3e86646348", "value": "T15025CF516D4980A1FA0B293D107A63660FEC690117E0E9EFDF05F8E75F26CC196788AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903989, "uuid": "e86ef453-2cd9-4722-849a-50d8363511d9", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903989, "uuid": "45cccb6c-6dd5-497c-acb6-59e0821ee36f", "value": "24576:O77NlW4ZujpK630cavFuwNUsjk6opl2VD+rNtl7ifTI5dTpygFIIm2mHL:6W4Z+LEtvFuwDjVK7GTC7ygFIr2mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643903989, "uuid": "d18d75a4-2498-4b0b-9f38-6caba3d5d2d2", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643903989, "uuid": "7cb9692b-fea7-4d81-9d72-968d62d3b61c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903989, "uuid": "43a832c6-1315-4d0c-aea3-7d0a8da45ae6", "value": "795a71157650997dc25bb9032bda6fe6", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0b563d21-84dc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643884115, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884115, "uuid": "291ce65e-e895-49fa-a5b9-9c6f316406df", "comment": "Malware payload (SilentBuilder)", "value": "de6352276564f3b8c71b53cb33404ba4", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884115, "uuid": "94f88fac-acdb-493f-bdce-cfdf85c77e4a", "comment": "Malware payload (SilentBuilder)", "value": "4b940f2e055f593ec921fd4517e2825aa483a46d0491da162fbe191d2d5728c1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884115, "uuid": "2dbdfc9a-fd7e-4264-be12-28ed431794eb", "comment": "Malware payload (SilentBuilder)", "value": "48ce48e972d3e75491e92a8990082e22f84d50f6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884115, "uuid": "69f9e682-fad6-471b-ad89-190dc66ff6a7", "comment": "Malware payload (SilentBuilder)", "value": "7ff13c712ac9c2368f983b4d4d0bd8a3bc9978cd30c300f66184250125e6017c147bb6ea6ea3153cbf9ebe076d80c917", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884115, "uuid": "afbc93fc-60fa-4d00-b42e-ddb640558a61", "value": "T1CDA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884115, "uuid": "63f0c022-b3e3-49bb-b284-cfb589f56033", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4N4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884115, "uuid": "5bde1dc4-64d0-4732-8434-7e988e4acea6", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884115, "uuid": "741e342f-1682-474a-b53f-dd36e1cd54fa", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884115, "uuid": "703e3a0e-e1fb-4d7a-8e53-1ac3c2b4620f", "value": "2022-02-03-de6352276564f3b8c71b53cb33404ba4_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "ff2ebf32-852e-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643919743, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919743, "uuid": "1bc36a0a-e4c7-47da-8d98-410fa3b517e6", "comment": "Malware payload (Mirai)", "value": "43baec9883d1256c56c8ccf3db995738", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919743, "uuid": "224a0266-17fa-4c76-b692-583e1f071786", "comment": "Malware payload (Mirai)", "value": "4beb12efd8e27cdafffc07d278772cef64103e1645078a953b4921a853032ecb", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919743, "uuid": "bf67feac-b3e4-48c1-b9cf-9e6f51d7dc6f", "comment": "Malware payload (Mirai)", "value": "13944d63afaf3ca37f811676adfa04d2033121d7", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643919743, "uuid": "2cc0e314-a55f-4bce-b6d9-4906c65a2e70", "comment": "Malware payload (Mirai)", "value": "e4bc45d07a4e89280cb58a679ec7cd310efcbecbb88e26eb7d02ed515eaa47b4d471fa029cef06f730a672929db3bbe4", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "intel", "colour": "#6F8ECA", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919743, "uuid": "5146b38a-ccd8-4deb-94ec-28127349fbe3", "value": "T14D03F1C7ED813378E0450030DD1B79EF84A4E61E7348B4A7BFD06823DEB1B18686AB51", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919743, "uuid": "e36066d4-8830-4773-95fe-0e945cbe52ad", "value": "768:9jJE3H0X0ZbS2fKCWaNzePvtYkgRojnLoPwLSL8zLWEwAiu2xrnbcuyD7UfyqG:BCUEBOxNgRojLoYII9whu2xnouy8qqG", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643919743, "uuid": "49c03ce4-9145-4ca9-b09c-17e5ef03154d", "value": 40568, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643919743, "uuid": "efc20571-6fb8-429c-bba7-37627befffd2", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643919743, "uuid": "25c67457-f6bf-4ea1-985e-18c0120fa14a", "value": "43baec9883d1256c56c8ccf3db995738", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1b011c34-84c7-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643875122, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875122, "uuid": "ada2181e-2d7d-4a62-ab77-ecc440b2020d", "comment": "Malware payload (Heodo)", "value": "8cabb0e23dfb701c22bf0c1dad2e6efe", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875122, "uuid": "30a9bab5-7742-45f3-8ce7-7f12c073f814", "comment": "Malware payload (Heodo)", "value": "4c0032ec66362713d33e6041f22b00db864f3478826b1b73123502431b07993b", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875122, "uuid": "184f9bc6-d15c-4ab0-a202-29dae3fb3d23", "comment": "Malware payload (Heodo)", "value": "3b40dcc94a0554ee189fa969e837eaaedf4a99ca", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875122, "uuid": "fb563cba-2319-4875-a167-34de91819364", "comment": "Malware payload (Heodo)", "value": "52ddc3b93bb5b857f04f21e6a6e16879ce28918c887e60c4bb5297130ebf9a19d99ede40a479453bb3343327f0ccc9d6", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875122, "uuid": "37ddda51-47af-4793-994b-7769534dc55d", "value": "T157E37B6576C5D9CADB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875122, "uuid": "b2ce7107-f7a3-453f-969b-e0a9a14f6e29", "value": "3072:9cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0g:9cKoSsxzNDZLDZjlbR868O8KlVH3dehy", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875122, "uuid": "38ccc64e-363b-408f-9571-7fa007cd9071", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875122, "uuid": "7295c2d1-2597-4b91-9b5f-90e8eeb49663", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875122, "uuid": "f28e67f9-a705-4162-9e3d-ca928d130285", "value": "HXR816668078ZV.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4b57ef5e-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882934, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882934, "uuid": "4953011f-54c3-4ddf-bbfe-af987ee6ec3c", "comment": "Malware payload (Heodo)", "value": "7648b4e52fe0725e1120d98286ccd34f", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882934, "uuid": "4eecd3ad-2e69-410a-9aec-367d4da8221d", "comment": "Malware payload (Heodo)", "value": "4c383e3508506f3468b5a827db83c3992513e1b2dd5911b8a86d5b4e809b59e8", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882934, "uuid": "51c87387-d8bb-4176-a6e1-39583e6abf84", "comment": "Malware payload (Heodo)", "value": "bc774a8d0b2b7db3da110cef676a6dc1d69175fe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882934, "uuid": "982f1ff8-c9ed-4a67-a99e-09bde8f4c0dc", "comment": "Malware payload (Heodo)", "value": "89b0eabee7267abb0432f8cf4a5d027189e773aaf11b35072cc3826a38c7d1341a74297f7fbc4048083aa1e7736de1fb", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882934, "uuid": "bd26baea-03d5-400a-933b-d02dfef257c2", "value": "T16C25C0216D8A40E6FA47193E0069B3544FDC69050BE0E8CFEF54F9A66F12CC25B785AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882934, "uuid": "3b65fcec-a741-4690-8f51-cc611c700370", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882934, "uuid": "4f8d24ac-10d7-46d6-bb98-1ca089358a25", "value": "24576:vyj4pucLsugl4zCy9fG+OVE+cXcs2vUcFIIm2m0:vzfnl9fYVoDvcFIr2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882934, "uuid": "a5f51841-a5c9-4593-b481-b33d3b5681d3", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882934, "uuid": "48d1fb14-78a8-41a7-bef5-fdee448a8231", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882934, "uuid": "b1103d7f-7229-488b-8b2b-c07b2d1c3879", "value": "7648b4e52fe0725e1120d98286ccd34f", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "f2fb1692-84e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643887940, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887940, "uuid": "e65e7003-dcf4-437f-be77-ba49dab2bd35", "comment": "Malware payload (Heodo)", "value": "9658fe5e451b325850117b9e2bb1f339", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887940, "uuid": "f93a0ff1-df6d-4bd7-a891-16eba13ca795", "comment": "Malware payload (Heodo)", "value": "4ccb69344b6da4ce7e4a499e143d5ad990e02fa8450a99531b6a2c900bef13f8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887940, "uuid": "bd10efeb-f0e1-4534-b1ba-7936fe8f216d", "comment": "Malware payload (Heodo)", "value": "70451117b92af7d95cba02a3bc8e2a872b469692", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887940, "uuid": "0fc33351-498a-4712-aded-096201247533", "comment": "Malware payload (Heodo)", "value": "f2bcd2fee729ae41355a8fbfd2f9a77b76d85308f1f02008562f3bf39daa0e1966c44bc7d78128d7b914ffede87f963d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887940, "uuid": "c0d6c838-6b1d-401c-a872-899388aee603", "value": "T191E36B66B6D5D5DAD70917311ADA8AFE2327BC438E7603C33148F31E1EBB1909AC2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887940, "uuid": "880caea1-4647-4d71-9a5c-5be619b09cfe", "value": "3072:4cKoSsxzNDZLDZjlbR868O8KlVH3AehvMqAPjxO5xyZUE5V5xtezEVg8/dgXGx0p:4cKoSsxzNDZLDZjlbR868O8KlVH3AehT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643887940, "uuid": "939be6f5-6f7a-4a99-8c6a-72c2e5ed1cac", "value": 147968, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643887940, "uuid": "3131008e-a876-4d27-83d9-918ab3c38707", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887940, "uuid": "db82a95d-01f8-45d3-abe8-23439c35f10b", "value": "ewh_7733409377.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7b182285-8484-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846507, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846507, "uuid": "824ad081-f663-49d2-9cd9-7ec18da14759", "comment": "Malware payload (Heodo)", "value": "9380094da1751579eb70a2f76c9305af", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846507, "uuid": "b8b859aa-dfaa-4586-ba24-a5b16d9a568e", "comment": "Malware payload (Heodo)", "value": "4cead8b698abf24fb5cec2bbe4812e356eb5f67c71fe0f7f5532195a18514132", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846507, "uuid": "da29710a-aa12-4735-8c0a-e6c0c86f9f65", "comment": "Malware payload (Heodo)", "value": "678d0248ddc690d4af9ffb9297b332bbe42fd128", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846507, "uuid": "787ac3ca-3e6f-4bdb-b9e8-1da7579fdf5b", "comment": "Malware payload (Heodo)", "value": "b742f269bcde29113da8e15981fbdbde5a94fa2233256ad4afd0bc53f75e48c36ef7d3fc7458e99a99f9ef1a26ac5513", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846507, "uuid": "c063fb9c-d7f2-4b73-bf88-ea78572d02be", "value": "T13925BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846507, "uuid": "abceed60-7786-4a88-b1e0-26f820463ee6", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846507, "uuid": "f1e320a2-6e47-4df3-b684-bdb4ce3248bb", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2goFIIm2mlg:kBiaa4powXiolDS2goFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846507, "uuid": "7a3f140c-568f-4686-806d-5af19a6d6a39", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846507, "uuid": "7427bff9-4439-4949-8233-af5483df4292", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846507, "uuid": "e63a25a5-e3b5-4776-942e-2c70cafba700", "value": "emotet_exe_e5_4cead8b698abf24fb5cec2bbe4812e356eb5f67c71fe0f7f5532195a18514132_2022-02-03__000141.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "78dd245b-8508-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643903197, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903197, "uuid": "333418cf-f956-4bf7-bdd0-75b650b0db5d", "comment": "Malware payload (SilentBuilder)", "value": "4d3f9622d154eb1e8d1405d1fd1c84df", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903197, "uuid": "56bbafbb-38b3-4481-a43a-246f52b80052", "comment": "Malware payload (SilentBuilder)", "value": "4cfbea3df54b1e80281cf5975d6a0db1a3507ec64eef8f98ee4bb3dda999f949", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903197, "uuid": "8134d1b6-461a-4858-bec6-bc45b35baa47", "comment": "Malware payload (SilentBuilder)", "value": "01582bebeb9739c0d9fdb69e0cd27a3e1aae215f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903197, "uuid": "a94eaf77-d016-482b-adb1-f98b92d21d18", "comment": "Malware payload (SilentBuilder)", "value": "07cc452347de662105e5474715925962fc07a0c84416623e5b1af4b62f635f93782f7fdf80142b4ec56e1a3896def852", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903197, "uuid": "daa7388c-d775-46a2-a5a2-4c78ecab5cbb", "value": "T106E38D8AF15B0D68F1A2CA3984DA4B1437B35CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903197, "uuid": "42618983-bf8d-407a-bdbc-e0e611af0997", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgbqudhaVYI7iQ6VOTeshRb0KwJQiAmGo/:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgb3", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643903197, "uuid": "9872defd-1621-4b3f-9020-79b9d0f40ba5", "value": 148484, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643903197, "uuid": "1492350c-82db-4ba6-be1b-799b3e60f6c0", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903197, "uuid": "7f572621-f9b8-4713-8f6b-63104bbd35ec", "value": "tmp6e4ygs89", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9862dec0-850c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904968, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904968, "uuid": "cfc32579-ddad-4ee7-9e83-cddb2e11fcbc", "comment": "Malware payload (Heodo)", "value": "5cebce15c62b098ec9833096917f7cb0", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904968, "uuid": "92536036-8305-48a6-9bd9-5a918bee2590", "comment": "Malware payload (Heodo)", "value": "4d4081f0805de23fe0ade387a10f16e9dffd2bd0691c43cfdaf66f0fa6fe8df6", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904968, "uuid": "7b242015-677d-43c2-b183-b85392273339", "comment": "Malware payload (Heodo)", "value": "1026b4bf500e84e7ca87772368cc41298667f4c7", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904968, "uuid": "ef5ac3d6-87d4-49e6-a48f-2cba7d5a3f3f", "comment": "Malware payload (Heodo)", "value": "5f5b0ea6b31a0dace9b205ff43bf5e6bd51d63d0b03f2e7ff855aefe174dc965f601fe283887b32cfa03317b0a8bd52e", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904968, "uuid": "6c1eeae0-b589-43f0-be05-e6f5cf44d170", "value": "T1C9D4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904968, "uuid": "37b973ad-037b-4085-9bde-cf785411038f", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904968, "uuid": "42ae772a-ce2a-4d51-94c9-cf58bc0cb8b2", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBPw7+7/Q0xIop1KpR:JynoxcCOllFxBPj7LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904968, "uuid": "7e382d92-3716-4cc6-8b21-98fd7cd5b867", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904968, "uuid": "a9255a0e-11da-4ab5-bb5e-c05bb3b919eb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904968, "uuid": "e186eb65-8fe8-4401-ad15-ed973e4db30e", "value": "emotet_exe_e4_4d4081f0805de23fe0ade387a10f16e9dffd2bd0691c43cfdaf66f0fa6fe8df6_2022-02-03__161557.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "954f12fa-850b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643904533, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904533, "uuid": "9f08c726-da3f-4b1b-9466-0660d42f290a", "comment": "Malware payload (SilentBuilder)", "value": "469f26c0f9a954e396cee2274de3bc8a", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904533, "uuid": "16b6caa7-f700-41b5-94e6-a00204954bec", "comment": "Malware payload (SilentBuilder)", "value": "4d5471ecae66d0ed76b8561bead1eac4034f59c1c6565682f37fc5371bf76b8d", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904533, "uuid": "3fa849ca-c364-4992-9662-d2d5886c1e4b", "comment": "Malware payload (SilentBuilder)", "value": "486b403f0780f7585e71e6f9b067a2a0e96dd87c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904533, "uuid": "410acc3a-0f75-4b5b-9c56-be522f5f531b", "comment": "Malware payload (SilentBuilder)", "value": "dd0fa44b9b1294b4bd826a43b0408d50fb710ed08800cec8b70ea8d1177e5f153fc51c80b5b7a91d18646e289fb4f6e5", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904533, "uuid": "1f1e7ef7-bc22-4718-9aaf-9cecf19acb91", "value": "T111E38D8AF15B0D68F1A2CA3984DA4B1437B35CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904533, "uuid": "ea17cc99-5bbc-4b32-aa7e-ad372540a425", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgbqudhaVYI7iQ6VOTeshRb0KwJQiAmGoN:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgbd", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904533, "uuid": "60271759-71e8-47c4-a959-b02a4d104818", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904533, "uuid": "7a0ee538-ed74-4259-88b7-42d9ab7b0199", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904533, "uuid": "32906343-3b09-4e3a-b16e-58751494972b", "value": "tmpo9tbk2k7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "52834ca8-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855459, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855459, "uuid": "e411e332-9e69-4321-9949-e6dcd293b33b", "comment": "Malware payload (Heodo)", "value": "3017e4d3b4ed5a4a15a6d359aa087202", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855459, "uuid": "a49a9619-2546-44c9-bffe-63179f16acb9", "comment": "Malware payload (Heodo)", "value": "4d9d77e6f7e5057f275579c4ececb53c193de981893bb32178934ddd1cf9f6c3", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855459, "uuid": "fd7f7877-c989-4c5f-8a68-9ac6f74112cd", "comment": "Malware payload (Heodo)", "value": "732860c661c10bf898622e03d9ca620b505bf46a", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855459, "uuid": "91a64f9d-5168-4eca-915f-8b61445bb4b6", "comment": "Malware payload (Heodo)", "value": "cb574e97ca1ef1e642dc52d4e84b76fbda825d15a1c463a847fabf4189dddb1d2b0fe6ac3947cd6f9e66ef526a8f26c4", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855459, "uuid": "c67ec2c4-51e7-4b63-86c2-b0dbf670926c", "value": "T1FEE36B2576C5D9CADB0822350ADACAEE2327BC479E7643C37158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855459, "uuid": "837780f0-a5dc-4e13-9ade-1c70cbc3be4e", "value": "3072:xcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0W:xcKoSsxzNDZLDZjlbR868O8KlVH3dehg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855459, "uuid": "073efb5a-4980-421f-9368-48eecb5e0905", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855459, "uuid": "473ea23e-6dad-4850-8fb3-21601ce8a8bc", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855459, "uuid": "353cca0d-bb74-46a0-872e-94f54b300554", "value": "2022-02-03-3017e4d3b4ed5a4a15a6d359aa087202_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "cd00c6c0-84a9-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643862536, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643862536, "uuid": "786971ea-8fbb-4b60-b61f-a8bca491584d", "comment": "Malware payload (AgentTesla)", "value": "a260559902f75bb5c9d673d8b705ea4e", "object_relation": "md5", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643862536, "uuid": "1dfd15c1-5296-4239-a76a-15ed4bd02e3a", "comment": "Malware payload (AgentTesla)", "value": "4db2acc2f2b8055da388aac774131ae93f679f9eba097aeb93ec456c74f96de3", "object_relation": "sha256", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643862536, "uuid": "ffa9d094-2ea5-4775-b0f7-9be7012b2d3e", "comment": "Malware payload (AgentTesla)", "value": "077e095478310457605c7954223b51f008ee4e88", "object_relation": "sha1", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643862536, "uuid": "5283ed2a-9b58-42db-b015-fc44423eb025", "comment": "Malware payload (AgentTesla)", "value": "2a36ffdd589b698ae17a32dc4aa2da3c0924eb6974d50ee6953541b92a43d7a82ce0ab3d79ac42ca438dd902beb568de", "object_relation": "sha3-384", "Tag": [ { "name": "7z", "colour": "#63EB83", "exportable": true, "hide_tag": false }, { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643862536, "uuid": "bc5ab13e-6c9d-4ed9-9e02-b3f593466831", "value": "T164C423913DEB44FCF42AC024255BF1D478DA27FCEC81696C48E67D2C8D7CE251AA6A08", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643862536, "uuid": "2ce9aa8a-1221-410b-9b3b-501b3a0d4c12", "value": "12288:MtPM9lwTPyDCAZxarJZJQ1L9gbm8PRmKmY3phZC0kLdvZw5e4C:MtP0wT67gqL9gbx/TXUVinC", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643862536, "uuid": "ce5a0730-4075-44b3-9424-9d39e6cc89c6", "value": 577939, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643862536, "uuid": "3fdb922b-99fd-4c98-b7a3-eee22dbdb812", "value": "application/x-7z-compressed", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643862536, "uuid": "adf1bc81-5fde-437b-a7fe-1cfd92cda0f7", "value": "a260559902f75bb5c9d673d8b705ea4e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "d489dee6-84e4-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643887889, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887889, "uuid": "d1f3b7a1-fb1f-4249-b9d0-b36e741595d6", "comment": "Malware payload (Heodo)", "value": "8797a8c25d2ab039967840c41e6bbf6a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887889, "uuid": "4e8ea23c-dcda-42ae-8b33-656a3dc8ba59", "comment": "Malware payload (Heodo)", "value": "4ddd79c8ea2342193d22c997e20e81e71068696e46351e4428d6b1906a0389d5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887889, "uuid": "f56f798b-feae-4b5a-ae36-4f5d0a7370b9", "comment": "Malware payload (Heodo)", "value": "9a3e78987e6802918a28fefd1db50bc32253279c", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643887889, "uuid": "61f21a12-10a8-438b-82dd-a1dee10b83f1", "comment": "Malware payload (Heodo)", "value": "8288fe01290e8c177638048e2fe77b3fc715420e3eb115daf07c589e13b757be3fcb2d4fa90f367844e69d243ec20f3f", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887889, "uuid": "85d50640-7317-46a9-9897-d3d8a84bcd86", "value": "T1B725BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887889, "uuid": "c9e8ba17-820b-48ab-a541-b551a6e16d9a", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887889, "uuid": "eb08d24e-ade6-470e-87db-1a4da750a487", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gMFIIm2mlg:kBiaa4powXiolDS2gMFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643887889, "uuid": "ff2b2478-541b-420e-a192-b958a2c97f9d", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643887889, "uuid": "585b0a3d-5a55-48d1-b9f9-0b7bfebab613", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643887889, "uuid": "6e8cec7d-4ae5-4c68-bac8-8f4b7b69ebe6", "value": "8797a8c25d2ab039967840c41e6bbf6a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "12b2ce38-850c-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643904744, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904744, "uuid": "d2d03d65-803d-4305-9f0b-98da7ccaac38", "comment": "Malware payload (SilentBuilder)", "value": "4bc5d7789ff045d911110aa62daaaa6d", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904744, "uuid": "322950f0-302c-4157-a642-bd86f3fdbe06", "comment": "Malware payload (SilentBuilder)", "value": "4e191ca8378747f27ac4fa3f9a15ee0382b3dbb20faee8ea96c706b3859a71bc", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904744, "uuid": "d112be71-c477-4a23-be46-1c3e1323478a", "comment": "Malware payload (SilentBuilder)", "value": "f04998bcb9e9d9ed22b70911ac3d97133a67acbf", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904744, "uuid": "e5d9eed6-1ec9-4e30-a0fa-aa1fb6ffc8c0", "comment": "Malware payload (SilentBuilder)", "value": "48416e08e3014110b9959df959e6a6a319dbb73a218365ca312d033ec927be9b066407514a51726773259ecd7aaeb100", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904744, "uuid": "542816c1-0850-43a5-ac37-c2b7c5db054d", "value": "T1AAE38D8AF15B0D68F1A2CA3984DA4B1437B35CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904744, "uuid": "80bff53a-ad98-40ed-9e16-74bd0085b06c", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgbqudhaVYI7iQ6VOTeshRb0KwJQiAmGox:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgbB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904744, "uuid": "b70bc191-a17b-44c9-b137-1d9e6ab61175", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904744, "uuid": "ff36ce5e-ad69-4e6d-a963-68d8404ed856", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904744, "uuid": "7dc79690-e42e-49a8-843a-2e23cb25b65e", "value": "tmpb6wba2xf", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "996f2cf8-850c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904970, "uuid": "d9d99e6f-f6ad-4545-b038-fbd8614b38ca", "comment": "Malware payload (Heodo)", "value": "4bb67fd4e0236a84cf36e71791811580", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904970, "uuid": "7c209689-e8a9-4e51-be2b-852061f34657", "comment": "Malware payload (Heodo)", "value": "4e29460a83956bc7bfd478b38959b12da42846eced683af8d8e422221e3cabe0", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904970, "uuid": "c1b5c9b1-9fd2-45cc-abf6-84f6e4796277", "comment": "Malware payload (Heodo)", "value": "ace11dc2e228a46155b1dc59eb9f352542b155c5", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904970, "uuid": "0e0833c8-1047-438b-935f-c6eeade828e0", "comment": "Malware payload (Heodo)", "value": "b10e85d17b8d718425951c8782c3f80ad48362ab8d8c3e93e03fd2824e21e2e5610b77c93443b8fdc4fb15f3a9214d78", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904970, "uuid": "77781540-e261-462e-94b1-da150c7a3b90", "value": "T127D4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904970, "uuid": "4a75dfa0-8f04-46a7-a3b9-1e2332da9bf1", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904970, "uuid": "a91e7af8-03be-46db-905c-4094fa40c0ba", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBPr7+7/Q0xIop1KpR:JynoxcCOllFxBPm7LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904970, "uuid": "24863f0a-b82e-4e5b-891b-27e4d2f59479", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904970, "uuid": "23e9f2d7-ec9f-4efe-a837-2c0b3e4948a9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904970, "uuid": "c3a55945-e228-4cc5-9b70-43cc2efd73a7", "value": "emotet_exe_e4_4e29460a83956bc7bfd478b38959b12da42846eced683af8d8e422221e3cabe0_2022-02-03__161602.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "43381a9e-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855862, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855862, "uuid": "43c98f5c-b940-4916-980a-f91f438023ae", "comment": "Malware payload (SilentBuilder)", "value": "5a6c0dacf350dde67359aa6c2e65f27e", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855862, "uuid": "ab4183b8-86eb-4d22-a3f0-5ba44d5cce95", "comment": "Malware payload (SilentBuilder)", "value": "4e37f3d5ef7dda7f5d52a06870703aa2997075c850ad90f01f9bba0094dcb230", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855862, "uuid": "7d4b36dd-a514-42b4-980a-b5f0f26af9c6", "comment": "Malware payload (SilentBuilder)", "value": "b4eff9ae3fdcf4a3e9e47b67975adb1524148def", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855862, "uuid": "791c4e0d-94fc-4a2c-b226-ef05c268782a", "comment": "Malware payload (SilentBuilder)", "value": "63eeb79a3aa1be002dd0d3bd164565fbd9ae55444e9ac19e76c03338529554a278d090cec5d2e50c5519a87dcd861ebc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855862, "uuid": "263e4176-015c-420b-a1eb-b11b6153f280", "value": "T122B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855862, "uuid": "c013935b-88f7-46ae-9d82-582a94defae2", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49X:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmb", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855862, "uuid": "1774bc3a-1f22-4bb0-aec7-d3e14dfa0256", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855862, "uuid": "4e339dd8-6227-4edd-9b04-6df0014b47f8", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855862, "uuid": "979568ee-ff97-4c4b-b975-369f14325d5a", "value": "2022-02-03-5a6c0dacf350dde67359aa6c2e65f27e_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2296a6ad-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855378, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855378, "uuid": "ac54c631-79ce-4f00-90cf-15519b96ff74", "comment": "Malware payload (SilentBuilder)", "value": "0d79d3f12bb2cf2e13d348087076f587", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855378, "uuid": "bfda3d70-671f-44f3-9d97-ed64cae2c47e", "comment": "Malware payload (SilentBuilder)", "value": "4e68a8c69c5d21338ed012abf04b219315f4106cfc4c1c2f0bfe6b3ad8cc1e33", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855378, "uuid": "09b11320-c73d-446a-a36c-6eeb36459f8f", "comment": "Malware payload (SilentBuilder)", "value": "75de283694e69cd9cb7a1abce4391073aff8038b", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855378, "uuid": "1e40ba88-168c-42c9-bb17-a62b42fff3ae", "comment": "Malware payload (SilentBuilder)", "value": "af0550a627088630f9171c338ad53cae3921728ba7a48477d66c860ef08f0882f55161e8eb267129d098f244b6aeed70", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855378, "uuid": "d453fbcc-c4a3-4717-ab06-654f213d7f2f", "value": "T1F8A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855378, "uuid": "08e7ed19-4509-45bb-a7ee-bcbdcfd8c0bf", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4p4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1o", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855378, "uuid": "3833adda-5ad0-42cf-8bf4-e445d3074591", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855378, "uuid": "a37723d2-7cea-47f7-8f07-f8961d7377e6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855378, "uuid": "3b3235e3-5367-40b8-9c27-4e09d503b89e", "value": "2022-02-03-0d79d3f12bb2cf2e13d348087076f587_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "087330d3-8525-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643915464, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915464, "uuid": "08c9253f-d4f4-4b09-981d-262fe8d6498a", "comment": "Malware payload (Heodo)", "value": "8dfb5545e47a703b49dc0c9486572be4", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915464, "uuid": "3a1c2730-091b-456b-ab8d-ad1de60ff36a", "comment": "Malware payload (Heodo)", "value": "4e6be25a21c45c0d4063435473b06895abacebca8c9807654e6ccaf2006ecd2b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915464, "uuid": "dd39a635-1b2b-4e50-8132-45dc4dfa5718", "comment": "Malware payload (Heodo)", "value": "56e29733808283fc7e3dd3ab43405ee73e702363", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915464, "uuid": "b0799243-b861-4fd7-925c-2fc8ebb31d43", "comment": "Malware payload (Heodo)", "value": "e0f411e4dda48a9c9bc4d4fdd7271d526626295bce9150610a13e16399951e17e619a2fef21858b2fe456fa6a69ca0e2", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915464, "uuid": "430ca92a-77ed-4ce0-9af2-ff3539944a87", "value": "T1A925CF11AE4980A1F50B293D1469A7A60FDCAD021BD0ECDFDF44F9A36F12CD3957886B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915464, "uuid": "863b7236-14aa-41df-8ec8-93a3bd6eff57", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915464, "uuid": "c9743cc5-a16e-4eee-8faf-9768055c9824", "value": "24576:SCiv47/YUr3bti5wcjbnZeZfxan8hX1HlyOwLVttCAUXvEFIIm2mB:SCjYwLtMvgZfxailEFIr2mB", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643915464, "uuid": "e0a6822e-5e4c-4824-a72b-d7fc6460843a", "value": 1000448, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643915464, "uuid": "d6796441-3062-4619-8cea-bc96bc823bd2", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915464, "uuid": "e56ef6b4-bb0f-45e0-9746-065a982229b6", "value": "emotet_exe_e4_4e6be25a21c45c0d4063435473b06895abacebca8c9807654e6ccaf2006ecd2b_2022-02-03__191054.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bef81503-850b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643904603, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904603, "uuid": "2d2b7a76-3a16-44a4-9ae8-63e59f59cd4a", "comment": "Malware payload (SilentBuilder)", "value": "1d306688a6c82665cd790e3029b549b6", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904603, "uuid": "4a5c9d5d-9c11-49b2-ba7d-32d312efc7db", "comment": "Malware payload (SilentBuilder)", "value": "4ea1957113856c01cc5a95b83e3cfb95edbd45e8d8b604c4a466c0138e189b95", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904603, "uuid": "cdd54d6b-0255-4398-91df-2a0bac7b2a7a", "comment": "Malware payload (SilentBuilder)", "value": "108d581def37b0e77edb46717db1149d497c83a6", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904603, "uuid": "462d2bf1-33b8-42b9-a78a-776d5847ce15", "comment": "Malware payload (SilentBuilder)", "value": "3262066bc8f9f19ae28a6049b907792302cf3390d9aaa79e31cff188b8ffac2caabbd2e118b3d4506e1549d2a73e3c16", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904603, "uuid": "68ce2e02-b12b-4563-9d76-67e346984a60", "value": "T118E39D8AF25B0D68F192CA3584DA4B1437B39CA84E5717477658B32DBFBC6E0061723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904603, "uuid": "5f12481d-4117-401e-841b-4bd847abf89c", "value": "3072:fMKpbdrHYrMue8q7QPX+5xtekEdi8/dgfquZha9YILiQaVObeshRTEKwJQiQmGo4:UKpbdrHYrMue8q7QPX+5xtFEdi8/dgf8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904603, "uuid": "ac77160c-f2a5-4d67-ae3d-c77438a82a8f", "value": 148480, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904603, "uuid": "fcd6f6d3-41fa-488c-a15a-45487500c3e6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904603, "uuid": "956924b6-d475-49ca-aabe-00d255c7d548", "value": "tmpy8w866mx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "27395b24-84bc-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643870418, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643870418, "uuid": "ba958c84-5880-4dd2-b66b-f08acaf706c0", "comment": "Malware payload", "value": "1c70294dba38efa1cc674e36f259b3ef", "object_relation": "md5", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643870418, "uuid": "6288560b-ae58-4b41-b97a-45fa5742d8df", "comment": "Malware payload", "value": "4ea3aebfb511656f903ba2a9f2c57651d64feee07492a0fc738b87adcb5d7cd2", "object_relation": "sha256", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643870418, "uuid": "baafd166-f3e9-42d6-9be4-67b883c4f4fc", "comment": "Malware payload", "value": "cca2b8608b8f1b5407f0ea1eedaf5a28d8ed05f6", "object_relation": "sha1", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643870418, "uuid": "c82a04b0-9888-4886-9f0c-ec3bf787cc65", "comment": "Malware payload", "value": "4fae8c5308751173f5d9232251905a7a4f029969417669354b1fb711904547820c71fea9fbd9ede34f7ca583b4b46d2c", "object_relation": "sha3-384", "Tag": [ { "name": "ppam", "colour": "#050D9B", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643870418, "uuid": "1f54f16c-c863-4c1d-a0e1-6008796eab24", "value": "T16FB3F16C94D14717C2230839DC3CC8E295464C47A524AE0FB8E1BA8B9A7DBE9371E3CD", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643870418, "uuid": "cd5afd16-ebfd-46f5-8604-d99b0dd5e821", "value": "3072:7GMm7Ay15ggusBxXspFM6CHvTnD4brjUmOug:DXyBusBcy6CHvTUK", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643870418, "uuid": "fc0c3840-560a-4194-8929-5427d5ba439d", "value": 114735, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643870418, "uuid": "77669d8e-d5a4-4d5a-9042-ed3bf4afd7db", "value": "application/vnd.openxmlformats-officedocument.presentationml.presentation", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643870418, "uuid": "10455564-a3d5-40ac-b8fd-cd9b97b3b899", "value": "PO_000105.ppam", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a41c2d70-84c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643874493, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874493, "uuid": "c2e7bf0c-8625-4dc5-98c2-83ac3eb54d64", "comment": "Malware payload (Heodo)", "value": "72e3a6949c7f33a789290706e5afacde", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874493, "uuid": "80a923a0-ca4e-4114-ba97-bdc6e4ff394d", "comment": "Malware payload (Heodo)", "value": "4ec044f195346c9de4ad2774240e8eeddd7a70930bc9c756ceef9040a6cd1870", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874493, "uuid": "5993d094-b134-4932-81c7-12d402bcc1bc", "comment": "Malware payload (Heodo)", "value": "f05149c5ee7ee12cdc3d8155a839eda7304c1a7b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874493, "uuid": "da4d0d55-7604-4d0c-a131-439e56f63786", "comment": "Malware payload (Heodo)", "value": "31563e45e1396c8486d780e9e671700f67d65c96905ad52f02ed2041915126710edb95eecfe7ca0aa3bb8170cd501e51", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874493, "uuid": "5752ad60-e251-4396-b1fa-0c08b80918ac", "value": "T128E36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874493, "uuid": "b9c144a8-e8e0-4bf4-b664-d99dabcca994", "value": "3072:zcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0X:zcKoSsxzNDZLDZjlbR868O8KlVH3dehl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874493, "uuid": "e162b285-763d-4a74-891e-b2485261c145", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874493, "uuid": "2c29f72d-76d5-4e5a-98bc-9ee6620e9a50", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874493, "uuid": "eed84946-09f5-4e52-b7b8-0d195e92198f", "value": "GV-7128 report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "35936a37-849d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643857128, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857128, "uuid": "bf807553-332c-48ad-89d1-363142b4a5b1", "comment": "Malware payload (Heodo)", "value": "fdb06deac3f2c10473644ea0c6273868", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857128, "uuid": "99ccc606-e4ce-4d07-a9b2-9171fef5ba7c", "comment": "Malware payload (Heodo)", "value": "4edf51e08c4e836951db90f67d742d6c145a948fb87f1df7355368bfb1cf14db", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857128, "uuid": "b2ab44fe-c62f-468a-9256-a0b36be6d9d2", "comment": "Malware payload (Heodo)", "value": "998eea62cc09be23bfd487a8ec41a6a6b0a64fb1", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857128, "uuid": "006af038-8d79-4fa3-a143-a806ced76168", "comment": "Malware payload (Heodo)", "value": "6bd2dd1e2afbaabaea331289f658cd08b5c667a389299ff450f83bd1229603f34f3aeef5b5812bc402b4d2a3096188ba", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857128, "uuid": "81db205b-8088-4ee8-9631-fb18879191a0", "value": "T185E37B2576C5D9CADB0922351ACACAEE3327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857128, "uuid": "0fdb4466-d0ff-45db-a1cb-0187a643e7cc", "value": "3072:5cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0x:5cKoSsxzNDZLDZjlbR868O8KlVH3dehj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643857128, "uuid": "fd6ef33c-4b53-4367-8a8a-2f76f5e83e6b", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643857128, "uuid": "6acb3b8a-830c-4666-8111-22be4acf2a03", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857128, "uuid": "b0f8e198-41ea-41a4-909e-c4c1a2ea403e", "value": "2022-2-3-fdb06deac3f2c10473644ea0c6273868.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5f61a0a9-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643855480, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855480, "uuid": "f689323a-895b-48c5-9a85-c956a9ef3706", "comment": "Malware payload (SilentBuilder)", "value": "23cc7879e79290b55145c3cdb91b91f7", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855480, "uuid": "810bfdfa-3932-4d66-ad46-0d4a24dac436", "comment": "Malware payload (SilentBuilder)", "value": "4efbb74dea29dacd8dd1b39eedee694f540784cfea226b4b56365ea08315d1c4", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855480, "uuid": "8015bf7f-d9aa-4be7-bb37-4121c6f3aeff", "comment": "Malware payload (SilentBuilder)", "value": "55c931c4b037e22cc0e1af6fad2988b0c3e7ae14", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855480, "uuid": "3436f662-a500-482b-acb4-c2d548caee6c", "comment": "Malware payload (SilentBuilder)", "value": "f78450b32f841668386b8b823c0ec51bbc2fca06625a88b5016324a2fe5882ec9bd4d12be8bbbad45a4a6e478b4f316a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855480, "uuid": "bc110991-f3f6-4e57-9f6c-c82b4853d749", "value": "T132A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855480, "uuid": "b864a4d4-0929-4e50-84ec-2205cdeb0ef2", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd454:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855480, "uuid": "d0c27b96-ee29-4d46-bd42-90b6a21ee50f", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855480, "uuid": "fb462694-fa77-4490-ab65-1a15fcc797f6", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855480, "uuid": "e9b837b5-7829-4211-afb3-7ab36c36608a", "value": "2022-02-03-23cc7879e79290b55145c3cdb91b91f7_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0879a63d-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643856193, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856193, "uuid": "2989c890-e537-4122-b55e-d04a0b4c24aa", "comment": "Malware payload (Heodo)", "value": "0ec7a344e90b4ea51add59d7bd6f4d6b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856193, "uuid": "56585f4e-e828-42ec-8e3a-44b511b9c092", "comment": "Malware payload (Heodo)", "value": "4f04e35b8862a0cd98c7e5703ef94fba7d11abe9d69497d45da74ef6d09fe8a2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856193, "uuid": "598f0785-dc32-47a9-bc95-3c37d12152e4", "comment": "Malware payload (Heodo)", "value": "b4c61b82213f2ce7faab08cb7badb02caf0df289", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856193, "uuid": "c5093bc7-07a4-430c-ac0b-d1f66daa227d", "comment": "Malware payload (Heodo)", "value": "d24e019adefc5ca45551a810d6a39a615bb1664b3fe06aa337534145be833ae745a48f0ee7e3e9876c1ed607b71de1f3", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856193, "uuid": "bda100c0-07aa-4c41-9798-5f4d756a2a87", "value": "T1E4E36B25B6C5D9C6DB0823350ACACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856193, "uuid": "753de17d-e2dc-4f11-951e-78828caa4aaa", "value": "3072:YcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0K:YcKoSsxzNDZLDZjlbR868O8KlVH3dehA", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856193, "uuid": "001b2997-862a-4740-93b0-cc8921ca8cf7", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856193, "uuid": "bc369b4e-1093-4f3a-acb4-5368dd74d026", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856193, "uuid": "c582f845-ace9-4c34-94e1-2db49d09c7c5", "value": "2022-2-3-0ec7a344e90b4ea51add59d7bd6f4d6b.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c16551a6-851b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643911479, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911479, "uuid": "e0a311f7-1dba-4c85-9b15-8d7d24a96dd9", "comment": "Malware payload (Heodo)", "value": "9a96ced9f5d8ce13b2f114f2b98f1354", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911479, "uuid": "1a601d60-6baf-4dec-b0b9-99bab5604d33", "comment": "Malware payload (Heodo)", "value": "4f22e01b0a1cd8fef0eec21c66094595b089d82c8d74ca5b09984bcfd108a4ee", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911479, "uuid": "270fb436-3f96-4520-8155-22d0210c0ca8", "comment": "Malware payload (Heodo)", "value": "80e493675bb4cbc885b430894d98c6d1acff6422", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911479, "uuid": "b374ff73-e846-4e9d-9f61-691afd0cd271", "comment": "Malware payload (Heodo)", "value": "68b24b57128699071605610692aaff91d4c639c19469430767680d12d0ee12a3b6935baa53abddf254ea96d11c80ae38", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911479, "uuid": "5a726b8e-443d-465c-96d1-c9e183e5fefb", "value": "T19CD4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911479, "uuid": "33c961b4-f615-4ebc-8fb8-061daa7d119d", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911479, "uuid": "73098360-3556-4421-8093-5afbc6a8f0df", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBP37+7/Q0xIop1KpR:JynoxcCOllFxBPy7LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643911479, "uuid": "61b81831-84ff-4791-9e8d-908d770c2a53", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643911479, "uuid": "30d2638e-b38f-49a5-a9a1-fe00f48f7b6a", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911479, "uuid": "91d08dc7-e9dd-48db-8a89-16d80fc3a872", "value": "9a96ced9f5d8ce13b2f114f2b98f1354", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98e2bd00-850c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904969, "uuid": "e7644a9e-0076-4aa0-b48f-ee47398681a1", "comment": "Malware payload (Heodo)", "value": "ab7bcfff356a1bed830f14cc18e5de81", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904969, "uuid": "5a42bc33-7904-4c75-93f2-55111c965db3", "comment": "Malware payload (Heodo)", "value": "4f2e61f1472fb4a22f058523a3d05c9597a463e243f4a357adf6e2439a9a7ebb", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904969, "uuid": "89853181-3b56-4d35-806a-d94bcdcbab1d", "comment": "Malware payload (Heodo)", "value": "0e3e277e7f53f228afcfdd3406f9bb78a36ce8da", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904969, "uuid": "6dad2fc4-7369-4708-a81b-4338408b1060", "comment": "Malware payload (Heodo)", "value": "9a43887246d089be64c5046a2f2c95e6c80184a8ff6df522f0c42d4069227114a485701214ef6d88793e3ba6950ed208", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904969, "uuid": "632c9e7d-72e3-42f5-befb-c6c789a4057d", "value": "T164D4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904969, "uuid": "90bae011-72e7-46f3-8ace-98d20282f260", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904969, "uuid": "9115818e-a573-433b-9b90-c9ef2d6cf2e2", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBP77+7/Q0xIop1KpR:JynoxcCOllFxBPW7LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904969, "uuid": "1e1891ed-ad42-456f-aed1-275423fe1650", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904969, "uuid": "c68027bb-78ba-4453-b632-ea82b7a3e512", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904969, "uuid": "9b66f22e-852e-4018-9d2f-f8f430d7ab9f", "value": "emotet_exe_e4_4f2e61f1472fb4a22f058523a3d05c9597a463e243f4a357adf6e2439a9a7ebb_2022-02-03__161558.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a1a84a39-84ce-11ec-9275-42010a9c0029", "comment": "Malware payload (SystemBC)", "timestamp": 1643878355, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878355, "uuid": "8c3a8b05-f962-4891-b04a-4b545e68847d", "comment": "Malware payload (SystemBC)", "value": "c28c72944827aecc6e64211f91d082cd", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878355, "uuid": "315568b3-8efb-4cd5-801c-db6d6357d7db", "comment": "Malware payload (SystemBC)", "value": "4f8fd85bcb3dbb5d82d3194a2ac9742a8f0696685b69d425b1384d29e2260bf3", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878355, "uuid": "7cc1bdd4-1745-4d8a-b181-9c4307984ca7", "comment": "Malware payload (SystemBC)", "value": "478e292f63cacdc9d43e095ce5ef7a3accb68cde", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878355, "uuid": "bb55d012-e768-4d25-b597-ee2e6e5a6563", "comment": "Malware payload (SystemBC)", "value": "8258dd6c89aac0f0afcec54331fc061c2a158f5f42d80abf87bf14e2e1fdead57e6cdbca7ad874dcd844fa402a3cf95f", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "signed", "colour": "#FECC99", "exportable": true, "hide_tag": false }, { "name": "SystemBC", "colour": "#A89B59", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878355, "uuid": "15e0dc2d-cb3f-40ef-89e5-4dc16cb13b64", "value": "T144A522567360D5CFE82A0A78892225B307637CAAAE71E55F70487B0F0CF1742457BBA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878355, "uuid": "0488cac1-4e30-4688-8c8e-ae970a42f5f7", "value": "872b100893e71f42afaaaf7ec1213694", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878355, "uuid": "b8f1283e-4522-4dde-a95c-4ec6d785de43", "value": "49152:pTLOo2UHbZL1t4l9x5RJRDRZRw4A3NJxSVNp/:p3Oo20R1al9R3DNHA3NJEl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643878355, "uuid": "9e3263a3-17bf-4fa4-a7a9-0f9dae2d0dcf", "value": 2082904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643878355, "uuid": "49e8728c-d33a-484a-ac19-dac703ac6c7f", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878355, "uuid": "b581a714-08eb-464d-970f-f87d427cad1b", "value": "c28c72944827aecc6e64211f91d082cd.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "614d22aa-84c5-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643874381, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874381, "uuid": "c7e2c23c-a9cf-4ee5-a05a-286e6446bcee", "comment": "Malware payload (Heodo)", "value": "0f6011bb251f75bc52199030d1762b34", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874381, "uuid": "013061d8-275f-4474-85b3-c33f76b72975", "comment": "Malware payload (Heodo)", "value": "4fe3119f0490ebfe857411eca7d7aaf9652645a2592fdc79a72100b0dbaa0478", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874381, "uuid": "eb5a75f7-c9d5-4dfb-9924-607c05a08b00", "comment": "Malware payload (Heodo)", "value": "e294b132bd597dbe1938ac8566b6d68edc134ebe", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643874381, "uuid": "319c927e-c2bb-4576-8c09-6a26c74de5fb", "comment": "Malware payload (Heodo)", "value": "36cc662e113d99e9cff0959139631350ea40017ffaa8de22f619b966d6bfea15239ed49a782446b716afd9adedbf2a18", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874381, "uuid": "b5be7693-4251-4ec0-aba7-4647bf26f918", "value": "T131E37B2576C5D9CADB0822350ADACAFE2327BC479E7643C37158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874381, "uuid": "bb8ad96f-4b0e-4c64-b009-f583c45c28e3", "value": "3072:QcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0F:QcKoSsxzNDZLDZjlbR868O8KlVH3dehP", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643874381, "uuid": "6df1be38-7ec1-46d6-ad50-d51cd55a115c", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643874381, "uuid": "abc5eaf2-7d69-41d4-91a3-904fb62a35a5", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643874381, "uuid": "023771ac-e4b0-4a1e-ae78-cdfaaff3a59c", "value": "EN-1376 report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4c5a7b7c-850e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905699, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905699, "uuid": "79ade19f-8dbf-4f84-9851-5d2ad4a4ec7c", "comment": "Malware payload (Heodo)", "value": "f753b79ab7381d7549bf613d35a2af63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905699, "uuid": "f6ca841d-bdf5-41be-aa37-eaf7d95df9d3", "comment": "Malware payload (Heodo)", "value": "501c1b2c4543401ddc5d76b67eb6f3b974580ea798234fcd354dbe36eb64fb5d", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905699, "uuid": "6e6441de-cd73-49ac-8527-796c32951fe9", "comment": "Malware payload (Heodo)", "value": "dab69868e8fb82503393a3f5f30269086f23050e", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905699, "uuid": "2e5b5aca-bf1a-4fa6-8895-0e8603616bdc", "comment": "Malware payload (Heodo)", "value": "490545d2bef8747e2b27bc6d8c8fdaf0bd1c28f35d6f2a7e73492a6d628663b5c50c8fe87b59e1804a026ec64a2be6c0", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905699, "uuid": "e2f5d1c5-3282-4fa1-98c1-c12192f7977e", "value": "T1CDD4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905699, "uuid": "eb2f510b-54f5-4bb2-9699-e0e88e4c18fe", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905699, "uuid": "3f7d68aa-6bf9-47bf-b4c3-3084adabc154", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBPD7+7/Q0xIop1KpR:JynoxcCOllFxBP+7LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905699, "uuid": "694909ee-bd48-41f0-b079-17d2ed568914", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905699, "uuid": "a350c649-5b85-4c48-803c-fb670f1523c9", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905699, "uuid": "2cab0f91-67b2-4022-a569-da49fe710433", "value": "f753b79ab7381d7549bf613d35a2af63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "00001f9d-84c8-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643875506, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875506, "uuid": "51b14496-1244-4db9-8c85-0fc7f06c0371", "comment": "Malware payload", "value": "4aad935375d4878ef2537fe213dfd75b", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875506, "uuid": "5099a020-884b-4f3d-a22d-e804d3940522", "comment": "Malware payload", "value": "508814de4daad6b63bd68ddd4b87b2428f1405fe03e4afcc0c6e058e85fbe181", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875506, "uuid": "2175333b-4813-4621-aaa2-be86c0f14910", "comment": "Malware payload", "value": "35e5f82da0d2a2d9cf7439477ec3691c8a9c6c10", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643875506, "uuid": "84f3d906-a5fc-481a-b0c6-6c66e6c953f3", "comment": "Malware payload", "value": "7e81d521113a688f5b8eeaca836188754470f67314b7257402ae4fd34f5ca45c8cf91cee366c1ec210d6701f495fccc6", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875506, "uuid": "36d3ab8d-6a39-46e2-89a7-cfccf1e4c72e", "value": "T177D37C1122AC0F5BC67E4BF86174A64503F97F266621E2694CF770CFA4D6F011B12BA7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875506, "uuid": "37091de1-c6a8-4024-bd78-26b709334d63", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875506, "uuid": "d5957295-6033-4cc6-8440-3c1ed5ede643", "value": "3072:jRcsxrzSVVVrVtuM1rcbgv+VKVwvRDdVvD+mXte:TdSFrVAMrMOWNDF", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643875506, "uuid": "9c0b685d-67f6-4a4c-babd-1833b4416f96", "value": 141312, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643875506, "uuid": "59c43dfa-0d52-4f01-83a8-91d3e207fa0b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643875506, "uuid": "9319a449-1093-4ec8-9e44-d8f7c45559a8", "value": "4aad935375d4878ef2537fe213dfd75b.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4e63bab8-850e-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905703, "uuid": "e29edd28-284a-43eb-8039-97323cf6feda", "comment": "Malware payload (Heodo)", "value": "5fa5c037c978b9a29f272c1cd83332ac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905703, "uuid": "ddc9a15e-766f-4678-9f68-182ad8b74a43", "comment": "Malware payload (Heodo)", "value": "50b1824afcaea08949f93551223f4bc4999e3bb5bb14dfeffc2006030effaeb5", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905703, "uuid": "12f00259-99e1-43f2-9c16-787fd035c9b5", "comment": "Malware payload (Heodo)", "value": "a34a752eb98e6ddf2bee8cd3be3e5990066fa288", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905703, "uuid": "b306f9b5-7c65-4f40-a64d-96d963009c16", "comment": "Malware payload (Heodo)", "value": "087456dc582e9b117062d4c59ba6b5b49d2e6ad956adae31186816e27f467d5e4b184434334b504b457f8a3bc209e349", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905703, "uuid": "d3bad9da-930a-40ef-be7f-332d085cea7b", "value": "T116D4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905703, "uuid": "efb315b4-713d-4320-acb2-e5f47705d1ef", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905703, "uuid": "56ca8c53-0162-4af4-9ef1-4bfcf12ad0a0", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBPs7+7/Q0xIop1KpR:JynoxcCOllFxBPv7LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905703, "uuid": "74071cc8-2e61-4fad-8524-8a3606cb85eb", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905703, "uuid": "54b3c1d1-695c-493b-8d08-0020c9efa84d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905703, "uuid": "0041c1f6-b334-446e-ad24-ea42572cd81f", "value": "5fa5c037c978b9a29f272c1cd83332ac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "65552a8e-8485-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643846900, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846900, "uuid": "6151c9b1-b701-4e38-ac74-4631fb86b34a", "comment": "Malware payload (Heodo)", "value": "d1d05f1c2cd5ab456e97eca5702ea525", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846900, "uuid": "9f9a88e7-5a2b-491c-ae66-37f73995326f", "comment": "Malware payload (Heodo)", "value": "50e629bdeb8eeb9339aad4e0c4b24d572f6e611061ee073dedffedefee62fdf2", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846900, "uuid": "db835891-1fc7-4717-80e1-bb6b8ed4bfaa", "comment": "Malware payload (Heodo)", "value": "3ea2d0b5bcc97ec25eff300484ad004f68468caf", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643846900, "uuid": "920a79f7-877b-4954-8f13-71171f7484be", "comment": "Malware payload (Heodo)", "value": "955553f7319460b40ecd050463e6fcedb0da78d0e773ccc7b15ac2acc888e3bdcaa40d1872d587ddb595ae5dac98a587", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846900, "uuid": "fcbcac45-bdff-4c21-895d-6628cb533fae", "value": "T1FFE36B6576C5D9CADB0822350ACACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846900, "uuid": "a76cac01-aaa7-4f00-a269-ddea83b6575b", "value": "3072:8cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0R:8cKoSsxzNDZLDZjlbR868O8KlVH3deh/", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643846900, "uuid": "8a65267a-0b65-4554-8571-863204524c65", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643846900, "uuid": "8012037a-7e0f-4aa2-a66d-74d39be32d75", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643846900, "uuid": "4c398d77-8680-4eaa-954a-0a7a3eed19f2", "value": "2022-2-3-d1d05f1c2cd5ab456e97eca5702ea525.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "557c4010-850a-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643903997, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903997, "uuid": "3ad71583-41bf-4946-99db-afc9300370ed", "comment": "Malware payload (Heodo)", "value": "84f682d0b7a81521ae5a3433b9856fb7", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903997, "uuid": "91c4ca63-1499-4fb2-9c80-3a01a9239884", "comment": "Malware payload (Heodo)", "value": "50ee255d1ee6410b7221c4323374df4b3de41d4b2e63422d271cb1dbb6c25e22", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903997, "uuid": "903fd040-d412-4e6a-8134-6dc9fc56b269", "comment": "Malware payload (Heodo)", "value": "457946e2d7f4139433cbf5f61b21787cb53b47cc", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903997, "uuid": "f88fc16c-b552-4dd1-bb80-41e22906c7d3", "comment": "Malware payload (Heodo)", "value": "5ae835a2896712cf771d63ce70089d47e547cc2c0b2ce328c21c7fcc913d42fe7ac138ec8352ecff6fe2f8cd477a9f55", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903997, "uuid": "43ccd63b-9bcd-450e-a18d-d23d7b11b15d", "value": "T13425CF516D4980A1FA0B293D107A63660FEC690117E0E9EFDF05F8E75F26CC196788AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903997, "uuid": "0fd80e7d-a752-4bd1-93ff-c2f75969c60d", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903997, "uuid": "dd152b5c-dddf-4dcf-9424-faf9a511281b", "value": "24576:O77NlW4ZujpK630cavFuwNUsjk6opl2VD+rNtl7ifTI5dTpy7FIIm2mHL:6W4Z+LEtvFuwDjVK7GTC7y7FIr2mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643903997, "uuid": "f91fb1de-c791-4870-b373-831fb5605abc", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643903997, "uuid": "bdc6b0d9-b241-4b20-9c42-beadeb05830b", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903997, "uuid": "452999bf-1c15-48ad-a404-16219d8392d6", "value": "84f682d0b7a81521ae5a3433b9856fb7", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "138b8ad9-8508-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643903027, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903027, "uuid": "b62cd17a-75c4-4421-aefc-c2f0fbbe7e4c", "comment": "Malware payload (Heodo)", "value": "bad2264002da5ebfda7ed7a93c2b2c82", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903027, "uuid": "588fac34-ab75-4f6d-a079-113c3f041bb5", "comment": "Malware payload (Heodo)", "value": "511003e4f56cd09a396790f35fb25a5c7a75c5609fc7b3f401b381a43117b033", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903027, "uuid": "b1c8cadb-5c9f-4896-87cb-eeb47bafb48c", "comment": "Malware payload (Heodo)", "value": "e1a21e62bd089e7729122dbfcf292798c208a33a", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903027, "uuid": "345b693c-84f4-46c6-8273-3b9b44be5a4f", "comment": "Malware payload (Heodo)", "value": "77972961b880fa7d17662cdab8ef8b5259b1cc7f52091cba01e9bc09677954ea272d264633a77db0985add7cad83234d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903027, "uuid": "dbcc9134-cb1f-45f3-8ff3-d68fd1e06d02", "value": "T115A3BE4DE1130DB8F2D6D43AC1485E107BB702CC88827B57B684896DBF9C2F9569F17A", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903027, "uuid": "e6f1481b-0227-4294-b08a-eb1e03544071", "value": "3072:h7vj5qu8hahYIfiQOVOveshVf4KwJQikmGoL:h7vj5rbtO8eOaDPk1oL", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643903027, "uuid": "69649f01-19dd-4c31-8def-dc651d3ab1ec", "value": 105965, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643903027, "uuid": "3145bfca-0a71-423c-afe6-50b5ebd6e460", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903027, "uuid": "4d6488bb-fe9d-4a19-a0fe-101624ffbc31", "value": "tmprkcu8d_r", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0af3b875-8496-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643854050, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643854050, "uuid": "3a774bf3-3900-4865-8a78-7176562c4fc3", "comment": "Malware payload (Mirai)", "value": "40ee45ad16629757d18222be2dde3c63", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643854050, "uuid": "dafa9f0b-70f9-4d32-b00e-af865e516f57", "comment": "Malware payload (Mirai)", "value": "5121e57abbab6c965d3f5c655e3c0947d5e788b97b3144caf4dfd3ae4de4e19c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643854050, "uuid": "cb4a5890-f49a-4822-8708-c21b3cb86432", "comment": "Malware payload (Mirai)", "value": "aaef4bf0365046138de9618f2ef2ca3302c8ba7b", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643854050, "uuid": "704205e3-6a7f-4204-9d56-05327116b516", "comment": "Malware payload (Mirai)", "value": "3436e85effc07d185ae324684f43f3865b2c1ffe3f0b9e1a24d007a998e9ce8e266c984322fda9dff9e1c5ca83d07569", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false }, { "name": "motorola", "colour": "#68384D", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643854050, "uuid": "a24998e8-6fd9-47a5-8852-72d7fdab37d7", "value": "T1D61308D7F800E9BAF81AE73B88530406B230F79602821B762367756BFD762A40477F85", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643854050, "uuid": "75249572-d68d-43dd-b4f7-33ea8c8fcc84", "value": "768:HnSlIs4TwPhRXT2ja88KyrcIY9qxEdsV7aDj7v+dfj4l+Z+IP0+:HSmvU5IH8TTY9qGdshSj7v+dfUl8+Z+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643854050, "uuid": "b87cc8cf-d96c-4e7a-a87c-ed4bdc66c4e1", "value": 43052, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643854050, "uuid": "11ca0ac4-316a-4ff8-ba14-86d278a52b4a", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643854050, "uuid": "4add8830-a6a8-4931-9f9a-a8043bf4ccfa", "value": "40ee45ad16629757d18222be2dde3c63", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "bf23a8b2-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883988, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883988, "uuid": "51520df5-c5ce-41f7-96aa-18dce31cc875", "comment": "Malware payload (SilentBuilder)", "value": "c6a48e93793f4bbd4a939cfae3a6a665", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883988, "uuid": "cf205bef-32f9-48e4-bd94-70677f39f034", "comment": "Malware payload (SilentBuilder)", "value": "51366a3784a01f6541c0c9a6e21215d317aa31b25185c0f8ca28efae58690a5e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883988, "uuid": "a2ab26ca-30e2-4730-9648-3495ff114e30", "comment": "Malware payload (SilentBuilder)", "value": "1b845f4b5d09f6636735ce1385fd39861e183438", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883988, "uuid": "c5db962d-4d16-46ca-8753-50da11666eb0", "comment": "Malware payload (SilentBuilder)", "value": "372ae3bdb1d3c522f0f76a0e56ce1e8477cd5a2a2464608ad401208896dc86a3f6cf2a6ca2cc8300147e5a476b045dc1", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883988, "uuid": "be163555-04bf-4a6b-a3f8-3a5409fbd8b6", "value": "T183A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883988, "uuid": "85bf25b6-14ab-4e30-ab37-4df1c2260407", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4t4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883988, "uuid": "0e45eb02-e34c-4d0f-920c-805215dd25f2", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883988, "uuid": "70cb942e-698c-4c08-a3a6-c052fcdc48ce", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883988, "uuid": "5e22b82f-2ddd-4a70-ae96-97024bfa3ddd", "value": "2022-02-03-c6a48e93793f4bbd4a939cfae3a6a665_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0feaf8b-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883508, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883508, "uuid": "9fb04213-70a6-4bf2-98f3-9265bbe29036", "comment": "Malware payload (Heodo)", "value": "5155ff123379ef6ac3981ed00c93dc67", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883508, "uuid": "103d54f9-a839-44a0-ba21-f8849c4644fe", "comment": "Malware payload (Heodo)", "value": "51620ecee00bc555a4cae411878d6532f36400fbc171271f0eb156f6dd40464e", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883508, "uuid": "bb260525-2d8a-4a5e-884b-5156e356e56c", "comment": "Malware payload (Heodo)", "value": "792d8dca57a8919a4528207806c58714524003ef", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883508, "uuid": "403eaa6c-8b14-4784-a62d-ffb77e34931e", "comment": "Malware payload (Heodo)", "value": "c80a75aa90cda91285b8c5c418bef84b6786f52c4121c5b3584bd0814e430baf0c948354775e6cf40c1240e65f317d1f", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883508, "uuid": "2db6c3f2-5ac4-4ccf-b2e3-7dbefe4f4200", "value": "T189E36B2576C5D9CADB0822350ADACAFE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883508, "uuid": "57d57254-5b45-411e-aa71-3af1f05b2570", "value": "3072:FcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0F:FcKoSsxzNDZLDZjlbR868O8KlVH3dehz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883508, "uuid": "0258958c-d14d-4deb-a4e4-f64742127527", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883508, "uuid": "566b721c-6b02-486e-bad7-2bd6a16e9b94", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883508, "uuid": "de163ba3-6009-449e-b9f4-ba9b75d93462", "value": "2022-02-03-5155ff123379ef6ac3981ed00c93dc67_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0259601b-8517-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643909441, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909441, "uuid": "8055a851-bff7-4015-8e71-2ec31b5d2599", "comment": "Malware payload (Heodo)", "value": "37c3d2b5c48c6c754f2c5d9876c6285c", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909441, "uuid": "79d40f77-0052-4a10-9abe-27b6ac25224e", "comment": "Malware payload (Heodo)", "value": "517370b7cf736f4a06c5aecbc3eb67f8d3e7dc25dd8984d528064d33479d0ecf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909441, "uuid": "8577a673-b585-4351-b13d-90b643228dc2", "comment": "Malware payload (Heodo)", "value": "b68784b57b4711716c789b55531d46cb4f69258f", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643909441, "uuid": "858fa9b5-b2c9-4e03-9d24-4baab78c9486", "comment": "Malware payload (Heodo)", "value": "f9370befc7278323130f7edf0a22efb54f1f89cdbfa356390a29b9b37187f41a987275051945e9915470eac2a61e462b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909441, "uuid": "cd3758c8-a202-4ddd-b325-7c9ffc07d385", "value": "T152E36A25B2C5F996D71436311FDEC6EE3227BC838E6543833249F71E6D776908AA2306", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909441, "uuid": "e57a3895-d077-4df6-aec5-63340224f374", "value": "3072:qcKoSsxzNDZLDZjlbR868O8KlVH3jehvMqAPjxO5xyZUE5V5xtezEVg8/dgL4LcO:qcKoSsxzNDZLDZjlbR868O8KlVH3jehM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643909441, "uuid": "824c26c6-cd5f-45ff-8c35-175c8d1b4271", "value": 148992, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643909441, "uuid": "fa3346c7-9f18-444e-8c08-bb9fb1f8175f", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643909441, "uuid": "308a8975-b9d8-48b8-9328-a969d24a1b1d", "value": "tmpc5z3ppbu", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9a02f52a-84cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1643877053, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877053, "uuid": "3254cfe5-a87e-4537-a83e-d80a8ea7ec3c", "comment": "Malware payload (Formbook)", "value": "1a5bf5cf28acc0bd2efc2cbc3d0223d3", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877053, "uuid": "ac04f157-8c06-4724-a4f3-b205eecc3ad3", "comment": "Malware payload (Formbook)", "value": "517acaa0fc12dc40dad4da883fae8767e994614b0e0ed28c9c5792737eba259a", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877053, "uuid": "8234a54b-0267-42d0-aecd-856869971961", "comment": "Malware payload (Formbook)", "value": "5a758e52985fb8de161007083e75d3f251c0bba4", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877053, "uuid": "fa7d3b20-34e2-4a1b-b3d6-fa0a362a628e", "comment": "Malware payload (Formbook)", "value": "87e1758669e361a2ee58bfa19e2f3391324f70937637ba4364f59e3d5043b113b2087c3589cb12ce1a01ac5f71f6a701", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877053, "uuid": "f6490636-e071-48d5-a32b-5ff9097e5313", "value": "T168B533C0EB254101FF42847A264D7A7148BF11A7163B5E968F7974FE893C4C26E0DBEA", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877053, "uuid": "d292adec-75a2-4b37-bb02-3810eeb58a95", "value": "49152:4cg6j0AJOzEdujvwfgwYq3XXsVpY1ox3FFKfOIYAXL+F5K+:4cLj0AJOzWuz43n0pYy1FUPXLEK+", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643877053, "uuid": "6f485c50-12ee-437e-ac22-d2068cbfb3a1", "value": 2277224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643877053, "uuid": "30100f3a-80ea-44ab-9f07-0d0c91377fb9", "value": "application/vnd.openxmlformats-officedocument.spreadsheetml.sheet", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877053, "uuid": "917a399e-b9b3-414e-aac6-322c03a5489b", "value": "invoice copy.xlsx", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a7d82f0e-84cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643877077, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877077, "uuid": "638bcb8d-9ad3-4415-81a9-1b38ee923bc8", "comment": "Malware payload (Heodo)", "value": "8906884582a7868019116b48a4a1e3ba", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877077, "uuid": "8133a49b-61c2-4028-819c-1451cd5e11cb", "comment": "Malware payload (Heodo)", "value": "5194bc66c35b988ddc5b5c15803b6eef8762a3a6436dc34e1d90342af3849cb6", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877077, "uuid": "0718c5ad-2b71-407c-8570-7ae051581599", "comment": "Malware payload (Heodo)", "value": "cff3a8eec584e70e15ce3de0d3ccc4180308eaf5", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877077, "uuid": "3ccb4bc7-745c-4fd6-83f7-2080427039c3", "comment": "Malware payload (Heodo)", "value": "40497b4fd9435349ba84c466d88eb7a975cf13d75f25db658cc2c461d5732f971203d78ea130e11124dfee2a15a2609d", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877077, "uuid": "9015ee82-f605-4dbf-a065-f1545c1c9955", "value": "T1E5E36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877077, "uuid": "26036be7-96fa-469f-ab17-5185e249e692", "value": "3072:bcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0W:bcKoSsxzNDZLDZjlbR868O8KlVH3dehM", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643877077, "uuid": "6796350c-8ee6-4ec1-9b2b-a37bd3a16792", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643877077, "uuid": "9033a932-fb08-4ed5-8e25-46ba230916ae", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877077, "uuid": "d5a6c68b-3ef9-41fa-8991-41ee309ddc47", "value": "UE-9451 report.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4d9f1f1c-851d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643912144, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912144, "uuid": "82671ddb-ddc6-4abb-a2f4-db64b149723d", "comment": "Malware payload (Heodo)", "value": "94bb2d81fa59c8bcbe0ca928410cf77f", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912144, "uuid": "94471cd0-9747-49ca-8953-e93c034d3ed5", "comment": "Malware payload (Heodo)", "value": "51dbffa1061b87ad18944035f49717a3977f58525a18522a62922efd7da71975", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912144, "uuid": "e2b86c1e-f08d-4047-a2d3-ac1a37be5fba", "comment": "Malware payload (Heodo)", "value": "6d915c69fe8f87a6a42be145630a459b27082c89", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643912144, "uuid": "62fdf2c7-8c0b-41ba-8db8-42bfef0ff6e4", "comment": "Malware payload (Heodo)", "value": "7c35f24150e0d3b50c2c2f18da1db99a64ee9a796b73d5f88c969b00a84daadb4f4754c9f0e45a150be675fe53342c1c", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643912144, "uuid": "0cbcd700-0279-4a0c-9541-91677549040d", "value": "T1C5E39D26B685C95AE91407351DD7CAF7333BBC818E7683433289F71F6D7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643912144, "uuid": "b7213159-fad3-4f7b-aa4d-1c4f7fd793b9", "value": "3072:4cKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgi4Lc3:4cKoSsxzNDZLDZjlbR868O8KlVH3Uehm", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643912144, "uuid": "25c9662c-18fb-402f-8270-152099591dc9", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643912144, "uuid": "5c8c1186-dcc0-4a4d-9273-2912dda7075c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643912144, "uuid": "f49c6372-a40b-4706-84f6-ba647844fb68", "value": "tmpjucsiazt", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "254eca3f-8486-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643847222, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847222, "uuid": "260cc1fb-16f8-45e0-88e0-89b0be3076a4", "comment": "Malware payload (Heodo)", "value": "ed2659c68db18c407885cf2bcd71e46a", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847222, "uuid": "687357bf-a82b-490f-b38d-1f7da1693c46", "comment": "Malware payload (Heodo)", "value": "5215975e52c0125af390bb19e914d124ba4cdc0995efabfa79ea27279a3177b1", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847222, "uuid": "47afa991-7f44-4363-930b-5171ff382e64", "comment": "Malware payload (Heodo)", "value": "ab62ada89cca4d4c875d2c2673fbac69c4d393cd", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643847222, "uuid": "a1303a5c-268d-4830-b86c-a52990b7e336", "comment": "Malware payload (Heodo)", "value": "08491b079ace39cc6eea50ffca5fcc37d04f5962ff14c1129d4bf53a065e7f212613a3d4b506faa14fc5a2d749f2e37d", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847222, "uuid": "f3318fdc-c659-4cd8-9686-e516115c119c", "value": "T172E36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847222, "uuid": "f0fd4ee3-e4b2-48fd-a7db-af509e7805e2", "value": "3072:NcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0e:NcKoSsxzNDZLDZjlbR868O8KlVH3dehg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643847222, "uuid": "a4f5db6c-9477-48c5-9ebe-928ecc24553c", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643847222, "uuid": "49c29533-913a-4510-9032-2e8f7c14438e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643847222, "uuid": "55d0c916-8309-4dd2-a537-563d017395f3", "value": "2022-2-3-ed2659c68db18c407885cf2bcd71e46a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9c4b0dc4-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883500, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883500, "uuid": "9a5be8e4-63e4-4820-81ce-d0b76449f811", "comment": "Malware payload (SilentBuilder)", "value": "70c23b754bf4ed9cabe7e036a26ab4ae", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883500, "uuid": "69691b6b-e932-46cb-ba8f-4f3dd7c3e9b1", "comment": "Malware payload (SilentBuilder)", "value": "5216e82173fd7ce647b6030a7b29e8b391ee7aa516116034890b56ddc02bf466", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883500, "uuid": "aab8085d-a005-4c93-8096-3c39474ce1fe", "comment": "Malware payload (SilentBuilder)", "value": "cb24198af8adfc2a064fd2bf4d86a486a498b788", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883500, "uuid": "e90c0aeb-b64c-42ee-b371-fc45dfbf4eed", "comment": "Malware payload (SilentBuilder)", "value": "65d4034748a5779933c6f88aa1eb32042f2d1af66f3078668863a740d60efd2131f374a8dba443b2a1f9ca1a112aa5e7", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883500, "uuid": "6923c928-4e72-461e-b04c-4d0aac6586c6", "value": "T17DA37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883500, "uuid": "7a15266f-6f06-4f9b-8402-cf7ae8d1c631", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4N4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883500, "uuid": "8ad87924-4dfa-4683-85aa-23256748ea33", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883500, "uuid": "2bd38b13-772b-4045-82d4-9dcfd98d0753", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883500, "uuid": "a39d5d68-4cd1-4bed-a793-1a1178a8353b", "value": "2022-02-03-70c23b754bf4ed9cabe7e036a26ab4ae_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1fc4c14f-8499-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643855373, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855373, "uuid": "330d80c9-be11-48d9-a90b-1d1fc080e860", "comment": "Malware payload (Heodo)", "value": "155e82463c4d2cc4729a1cf401332f16", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855373, "uuid": "b3a908b2-8a93-47be-95b8-0629a7345618", "comment": "Malware payload (Heodo)", "value": "523238b177068fb410b258183659e05c9bddf2e3d3cd52c094ab4a5df2acea7b", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855373, "uuid": "0b695bfa-bd07-4d26-bc5a-bb53d94d4bd3", "comment": "Malware payload (Heodo)", "value": "a1e12bba63645ec9ec98d0057b61a78ebe885626", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643855373, "uuid": "f3c3b7ec-9629-4631-bb3a-62d318de7e4b", "comment": "Malware payload (Heodo)", "value": "cfc3e91084338e1ef585197db7649a206256312bbeb6feefba450f42d7ab21c18e3d766f29b2d7a41236748770ef3dcc", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855373, "uuid": "db7de3f2-677b-4fad-a85c-181ca8cbf1ec", "value": "T1CCE37B6576C5D9CADB0822350ADACAEE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855373, "uuid": "cb98fdb2-5f6c-40b0-a501-3fcb1d0d2ca5", "value": "3072:mcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx02:mcKoSsxzNDZLDZjlbR868O8KlVH3dehY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643855373, "uuid": "3382a04b-5156-464c-a3a9-ad2510ed6b1e", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643855373, "uuid": "aac6316f-b089-4277-b551-9e58a95641d2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643855373, "uuid": "1d006986-58d8-40ea-84fa-d664888a6aac", "value": "2022-02-03-155e82463c4d2cc4729a1cf401332f16_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "56358dcd-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883812, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883812, "uuid": "549018d2-a75a-48b1-8076-2aac22ea66df", "comment": "Malware payload (SilentBuilder)", "value": "a73b6ac70d5fe9968b30a5a25ffcfe69", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883812, "uuid": "80fafb6d-ee32-447d-8f0c-7b97ccbe6528", "comment": "Malware payload (SilentBuilder)", "value": "524cce3c01f8842f29426057e9f68f21d124bf47321c1209986176e3105d8ed9", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883812, "uuid": "19e95120-c92a-4d6f-a0c9-45628591708c", "comment": "Malware payload (SilentBuilder)", "value": "7e4087da4389be4ef07301becd955ed1313f1a6c", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883812, "uuid": "083b2062-77f6-4a7d-aedf-ac20dfe14e70", "comment": "Malware payload (SilentBuilder)", "value": "e789d08ee5d1af6e33ba4b6ef41aae3344e8dcccc53fe63eab2753522d61f0259c186b76425cb4bd0a1c9e1ad663797b", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883812, "uuid": "3aab3227-cddf-4f93-aed3-1cb24dbb6b7e", "value": "T145A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883812, "uuid": "5519ad51-d6f9-4c8e-8912-d8fda3794e63", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4d4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg10", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883812, "uuid": "d2d6c4c6-03ed-4937-a14e-8f79b814344a", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883812, "uuid": "9ead7375-8e92-4ba3-894d-29d41dba8845", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883812, "uuid": "0c1865cc-369d-409e-ba65-6162149c21bc", "value": "2022-02-03-a73b6ac70d5fe9968b30a5a25ffcfe69_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "23d79e48-84e0-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643885875, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885875, "uuid": "e1b3fec5-cc3e-4ae4-baeb-3d00a2ce2d72", "comment": "Malware payload", "value": "0917fa630a2362b243048a1fbb6123a7", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885875, "uuid": "b5eb1edf-02bc-4b9b-bed6-5a212bc296af", "comment": "Malware payload", "value": "525e65171ae087a5d835f7e3838101c81fa88390c498011891f44e67b3983c7a", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885875, "uuid": "d191d4f5-4bb0-41de-9482-8e8efac7174c", "comment": "Malware payload", "value": "03cf1586257c0d97e1ea163a300ef1d40b6495ec", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885875, "uuid": "65ec1d18-0ac5-4bc8-82e3-13a2f916aa79", "comment": "Malware payload", "value": "e4b92cbf436bcc2a718467c2737db2787922d24553ef17fe33faefda3015f57a265de8984f86ee5416d2852d6864a3af", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885875, "uuid": "f166ee74-08ae-4c48-a2bf-f49d0576325b", "value": "T162F6CF52714AB2AFD04B9B79A927CE417C3D63B046204D07AABD3DBC6E73D8127C9D18", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885875, "uuid": "d1d78e16-f13f-4ab8-9385-3ffd6ee96e7b", "value": "196608:0268l+2N7x0rQSsQNNQFNHHH5k7/lKI+5W0Ag/2FpgS:0268lNN7xQnatHZkDYI+EI/L", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885875, "uuid": "67105feb-62a0-4246-9af3-2e3b09fe9ccd", "value": 16441344, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885875, "uuid": "70aa9e42-104c-4cd3-9eb9-b8623533ffba", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885875, "uuid": "630a0031-28c3-4308-8c83-331731bbc5b1", "value": "525e65171ae087a5d835f7e3838101c81fa88390c498011891f44e67b3983c7a.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "de8a0a26-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883181, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883181, "uuid": "35139eab-fcce-4b96-8e37-8f84f85bf224", "comment": "Malware payload (SilentBuilder)", "value": "1ad22e6c8921a14e1cf607fda64f30bb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883181, "uuid": "5a41e349-577a-469f-84b4-6cd59a77895b", "comment": "Malware payload (SilentBuilder)", "value": "5296fcc1979ed13c270467da3e6a64805a8133e278c4280a5e6f481c65218852", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883181, "uuid": "76564143-4d4e-4d06-9bb8-f609bd2eb811", "comment": "Malware payload (SilentBuilder)", "value": "0700edf8db75b487a7b92d1d2bfd3f99e98411b4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883181, "uuid": "f47796a5-44cf-4a7e-a85a-3c888333f318", "comment": "Malware payload (SilentBuilder)", "value": "53804a792058d325d06450bb710a30fe198acd94c8ab3e06ef4bd8246fe874f637347b2b38ac4c949e02ddfabffbca82", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883181, "uuid": "5e9ecda1-9052-47c5-ac31-fec44b3b5623", "value": "T194B37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883181, "uuid": "3dd6cb6b-d054-4559-b7e9-564433838978", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49u:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883181, "uuid": "e217f509-ada3-4cea-a4c3-fb4fe3a9e210", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883181, "uuid": "dd72f992-c549-4ec1-ac53-c55ff0a8b18c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883181, "uuid": "c0440d30-b7df-4783-a23c-f87509baa340", "value": "2022-02-03-1ad22e6c8921a14e1cf607fda64f30bb_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "451113f3-8526-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643915995, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915995, "uuid": "f82dd00b-be09-4b37-b2f0-8f2d8842f6c3", "comment": "Malware payload (Heodo)", "value": "f936d4c87ad8fda4896dd3675b4dafbb", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915995, "uuid": "c485dc91-e773-4299-82e4-bd6cd31f5834", "comment": "Malware payload (Heodo)", "value": "529838742e4a2bcdd9cda638289b2614156d5fb19708c0cbb31716675a8b571e", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915995, "uuid": "0fc96354-8c28-4312-b546-7d2840829689", "comment": "Malware payload (Heodo)", "value": "cae92acb455b79f387bc5567849c698090c11f76", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643915995, "uuid": "6c2ac015-8077-4a6c-bc85-da4a9eca7712", "comment": "Malware payload (Heodo)", "value": "7e95221ba41151b0266bde8d537bebff6c9e1f08d0cc51048174fbf3f901f557718bce2732148c30338a9ccd38d4ae6e", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915995, "uuid": "c3c1b5eb-b036-410a-9967-494ca823dadb", "value": "T19BE39D26B695C95AD91407311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915995, "uuid": "9d3b64fb-19e4-4276-813a-85125f9f0dbd", "value": "3072:ccKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcl:ccKoSsxzNDZLDZjlbR868O8KlVH3Ueh5", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643915995, "uuid": "309d52d9-638d-4be6-8390-d676fc9f6de9", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643915995, "uuid": "602165ed-d5f6-4a32-b802-e4c92e54a105", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643915995, "uuid": "ca42ecdb-393a-482d-b72c-b401a910fa95", "value": "MEDIA 10.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5b5d7241-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883820, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883820, "uuid": "6560a0cb-ecb6-4fcc-ab2a-21a57266f1c7", "comment": "Malware payload (SilentBuilder)", "value": "a9387f96e8cd4ee69271fa4abab2a286", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883820, "uuid": "df01c376-3337-4d03-ad4b-6a271a46871a", "comment": "Malware payload (SilentBuilder)", "value": "52c2c20cca39686c9fa7cdef2cb120dbeaaf716f108a4924ccfa4755b686a6f8", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883820, "uuid": "49c6ed17-2f8f-4bc3-ab31-e1c0d0842c4a", "comment": "Malware payload (SilentBuilder)", "value": "3b0de712d289c39469996e3357066b3f37b917cb", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883820, "uuid": "278f55ca-c23e-4779-be8e-a8b69c87bc91", "comment": "Malware payload (SilentBuilder)", "value": "a7c6839ca1cf4c0a5059227016e8b92bbc6ff1a59c5f2462ecdc22d1262d5e3606d14d45a05c36a357a3bb6d0fe41ed0", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883820, "uuid": "d27c9eb7-dcbc-4497-aa34-9f01a51ea8b4", "value": "T194A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883820, "uuid": "92770ade-8bc0-42a3-a412-df4075620468", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4N4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1E", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883820, "uuid": "6c5f74e8-d991-4153-a761-99651b960863", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883820, "uuid": "b9629b3b-a656-4296-a085-f5b1af267e07", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883820, "uuid": "1d8d2e67-58a7-4b3b-9005-6d6baaa336dc", "value": "2022-02-03-a9387f96e8cd4ee69271fa4abab2a286_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9dfe1603-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883503, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883503, "uuid": "f87de2f4-6ab6-4d26-b5b6-87499c7f9194", "comment": "Malware payload (Heodo)", "value": "68195acfec461427d0f0a9dff6f959d1", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883503, "uuid": "f0f3309e-a07a-43e6-8b20-86d997de21bf", "comment": "Malware payload (Heodo)", "value": "52c2f157c78dccf089464418b3a69cb1fc55c02a0756a76b024faf0828cb171c", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883503, "uuid": "47a022ed-9874-43c3-960f-dd04b7b6d05c", "comment": "Malware payload (Heodo)", "value": "08709cbad42ed1fd7f1fd55a793965378cc549f4", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883503, "uuid": "337d0592-d9b2-423e-bf14-572f7cb4dcf0", "comment": "Malware payload (Heodo)", "value": "f23265e58884dd15d6b9b5f948486b4bd33dd8d373fff45a5292d5f00ef256e5c4be8f241e669d378cfdd43876414943", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883503, "uuid": "ea8647d7-e28d-44ca-957f-4d4defec6744", "value": "T17B25C0216D8A40E6FA47193E0069B3544FDC69050BE0E8CFEF54F9A66F12CC25B785AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883503, "uuid": "24c5e943-08a7-4a30-a487-44ae7631afb5", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883503, "uuid": "d4debbef-8b5d-4a88-8938-34850113803d", "value": "24576:vyj4pucLsugl4zCy9fG+OVE+cXcs2vUeFIIm2m0:vzfnl9fYVoDveFIr2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883503, "uuid": "c480d5bc-7a26-4f54-8502-7d501055a17d", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883503, "uuid": "d65a30c6-da8d-4f04-b965-f77563d6415d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883503, "uuid": "66757cd5-c742-48a5-89d2-0753c3fb3b9e", "value": "68195acfec461427d0f0a9dff6f959d1", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "64a58f18-850e-11ec-9275-42010a9c0029", "comment": "Malware payload (RemcosRAT)", "timestamp": 1643905740, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905740, "uuid": "1eb27adc-b615-4a15-932f-d087d90a1100", "comment": "Malware payload (RemcosRAT)", "value": "812896a4e7a143f57da6d649426a75f9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905740, "uuid": "f7334387-bb79-438b-99fd-bb5893feb90f", "comment": "Malware payload (RemcosRAT)", "value": "530a69f329279f3e067392e32cc128551ad35ef31095ee5720a35336b7e7d5ac", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905740, "uuid": "21e1f573-9e08-4a45-873b-e9573901d33a", "comment": "Malware payload (RemcosRAT)", "value": "97bfeae933521910a56107fd20e17310b3060729", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905740, "uuid": "ef370c32-962e-4a8e-a475-21cf4f2a6691", "comment": "Malware payload (RemcosRAT)", "value": "21ae4c2a18c7526562cacbe207890db6db93862775e51c371baec812a5b11bb1d21565b1c238bddbbf9cde8aab22790a", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "RemcosRAT", "colour": "#F55CA3", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905740, "uuid": "dd85b51b-22ad-4173-a2c7-c477003dda71", "value": "T101A4AD11B9C1C032D17252700D29FB759AFCBC302935597BB3DA5D9ABE700C1BB2A6A7", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905740, "uuid": "f1b9378f-3f1e-4df8-8f24-9cebb3d25990", "value": "1f15bed3346039b42bc33c9080047f8c", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905740, "uuid": "69aef72d-b3e4-483a-94a9-405eeaf7e515", "value": "12288:CegN0jfYLclGb0bVT6e+MT2MffZS/g8SYo:kNywLclGIeMT2MXZR8SV", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905740, "uuid": "85e006d8-9b7b-4daf-812e-3237744148a3", "value": 474112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905740, "uuid": "a3100ba0-0e56-4860-af35-7df077d3f128", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905740, "uuid": "5fe84b10-97c6-4b80-b010-ccd03242095f", "value": "812896a4e7a143f57da6d649426a75f9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e672d28b-849a-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856136, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856136, "uuid": "bd380b2b-5ff0-4524-9bb8-b030a51b0bf0", "comment": "Malware payload (SilentBuilder)", "value": "82a6d877b49dda9a4dd7c1debbad611b", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856136, "uuid": "097eac99-d257-4dfa-ba08-fd90289eb724", "comment": "Malware payload (SilentBuilder)", "value": "531f0b610dd85736176dff3beae3f41b5b2e05362a45f1ae5a476682d6eb577f", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856136, "uuid": "e74d2142-4bca-434c-abfa-d1400c39db93", "comment": "Malware payload (SilentBuilder)", "value": "d19331aaf12ce4004b984f0710cc75a932a8d7ae", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856136, "uuid": "fd0c151f-f2fd-4980-a084-a18f0fbb8a63", "comment": "Malware payload (SilentBuilder)", "value": "fb537185dc63d622bc2da217e34115f02e4809aca4d2017b5153b8f37128d0009ce7e9ecbe7dc3b327f5bc54fd387848", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856136, "uuid": "b998f5bd-9f27-4538-ada3-9ed4dff7c7cb", "value": "T1A4A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856136, "uuid": "834720ee-7a58-44e0-a664-7d007ae25bec", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd454:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1Y", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856136, "uuid": "7dfe3a82-413f-44e4-a9ba-d43aeacab69e", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856136, "uuid": "a1c8f13b-8064-4250-8817-a49fc8804a72", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856136, "uuid": "bcbe2149-31db-4558-bb9a-7a49d5af7046", "value": "2022-02-03-82a6d877b49dda9a4dd7c1debbad611b_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0aa1850-84fa-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643897251, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897251, "uuid": "eb321cfd-b699-4645-9f74-767647f1b398", "comment": "Malware payload", "value": "1c59026f89f46911e0500d12b12ff0ce", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897251, "uuid": "cfbd0109-7df1-4e10-8a61-2e6e11c7054c", "comment": "Malware payload", "value": "533e0a8309d0bf554eb362e9c8d59eb3e3387176ab130ad6b153523bcddcf877", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897251, "uuid": "2e266a4f-7ea7-4b77-939a-c6edc205f76c", "comment": "Malware payload", "value": "219aa7301d7e1aabc5a892951b7f1602def9f4ae", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897251, "uuid": "0f880e19-cec7-448d-9189-e134742da7e0", "comment": "Malware payload", "value": "658c65ebfdcb9fd1c1f2dbc4d67f8c5096a0dace778f492f2e166f6047634d4f25088206e28a5f6ddf2985788c265aec", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897251, "uuid": "0ae62bdc-4586-4254-af75-964db1c6558e", "value": "T1297523BD1A463E00C7CD85BCC5A1108B23F4279391AAB5CA9CF610A59A2D7CEFD1B4D6", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897251, "uuid": "30f14910-bac4-4501-95d6-6b27ff02d4c9", "value": "24576:3mUc/2q3wzzSdZbvYLkClcYttL1yn6KRb6sqz14X17ypZVvbuhZUT+:2Uceq3w+dZrYACactL1yt6sqz2X65bw", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643897251, "uuid": "defd200f-1320-494e-8b44-e40d82eb606b", "value": 1573516, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643897251, "uuid": "c141432a-196e-477d-bf3f-ff7f5d8943ea", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897251, "uuid": "392465fe-9ab6-4459-97a4-e9b3dbac8a70", "value": "1c59026f89f46911e0500d12b12ff0ce.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b2c76b36-84cb-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643877095, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877095, "uuid": "5d7499d3-d119-42cd-a8b7-32062e71974a", "comment": "Malware payload (Heodo)", "value": "fcad1a4c4f78b9e9792bba176632eb23", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877095, "uuid": "db7b7f73-bcb1-49b1-be51-89fa5c900387", "comment": "Malware payload (Heodo)", "value": "53467b745a91fefd8c176e7ddd29f4243b690104e90a24e360524d7fc74bcf82", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877095, "uuid": "56d3a769-f561-4c69-a31f-980c6f087c36", "comment": "Malware payload (Heodo)", "value": "43da9d1c93e71e2ca32d6d34a9d894eb632a4902", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643877095, "uuid": "15d8bc09-de5f-472e-92d6-3388ea7a5c93", "comment": "Malware payload (Heodo)", "value": "85352a357ad425257c2f9bc44dc36774e7435c7f6aa22bd5cf1d515d2f04bb33ff6a8daae9b9e55ef22fefbf16c8083b", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877095, "uuid": "4c77b536-a67c-48f0-b35a-7aaeaa1662df", "value": "T1D9E36B6576C5D9CADB0822350ACACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877095, "uuid": "c15353bb-da3b-4dfb-9665-793eeb632cc3", "value": "3072:/cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx0C:/cKoSsxzNDZLDZjlbR868O8KlVH3dehk", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643877095, "uuid": "ee9ecd0d-6bb8-48aa-9390-f988ac53c5c8", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643877095, "uuid": "1aa02d3f-99c1-4d0a-bfb5-2b7eb36ce237", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643877095, "uuid": "d6b96f91-f006-45ed-82ce-632ca4989f57", "value": "InnovincConf.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e0065b31-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643883613, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883613, "uuid": "5eb8e51d-991a-4dca-b5ed-e972751daf44", "comment": "Malware payload (Heodo)", "value": "671019edd6e5b5d5164230488d649b18", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883613, "uuid": "a1252ec2-8c65-4911-9311-6126c49e7a33", "comment": "Malware payload (Heodo)", "value": "538f45d1dbc9a22f202bffd9d95f6f95156b93405414addac5b8c506795de217", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883613, "uuid": "ce2ff7cd-6572-4b25-9c49-c87245adf580", "comment": "Malware payload (Heodo)", "value": "97d442180cf92118ad02b7009a12eee9fa673362", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883613, "uuid": "8b592f62-213d-45bc-870a-53d568f848ba", "comment": "Malware payload (Heodo)", "value": "a017c8b55db4c28445923d53e1e113318f023d365a18b83dbf5f6f880dff1204e33943be25b9fba801f363b6360c9346", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883613, "uuid": "7afe3015-7f1d-414b-b65e-e87ee21db753", "value": "T14BE36B2576C5D9CADB0822350ADACAEE3327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883613, "uuid": "4382c610-3c6a-4ffc-8987-1cff43983a12", "value": "3072:fcKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgDGx0z:fcKoSsxzNDZLDZjlbR868O8KlVH3dehl", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883613, "uuid": "418dd8c0-9a1d-45ee-9224-0ce9261fcc42", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883613, "uuid": "fb582a55-0de7-429c-af15-98945f89a17c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883613, "uuid": "8333fb10-d6d7-41c7-848e-a88e93ab285e", "value": "2022-02-03-671019edd6e5b5d5164230488d649b18_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "9164a730-850d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643905386, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905386, "uuid": "da35c0f4-60cf-41e1-ad3b-f3a8d60ca785", "comment": "Malware payload (Heodo)", "value": "75ad059dbd84b35275aac62739f370b7", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905386, "uuid": "1ef6544d-9a7f-4820-84f9-b326ba373bb8", "comment": "Malware payload (Heodo)", "value": "540c56a594f4d97d8822fb5d3b3587095def8e19d395b32805e1c19cc6c2cb89", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905386, "uuid": "2311ba7b-80a3-4ec6-b101-f1cfbb14faf0", "comment": "Malware payload (Heodo)", "value": "ca80d28d6d9e2cd9f6e7dea0027ab8df43de8e5c", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643905386, "uuid": "d76c2265-bbfe-4daa-9ef6-e86a7426d873", "comment": "Malware payload (Heodo)", "value": "8fa7082edd669e043ec438540b7dc6cf2157edf43b95cd1ab926859da783bd322655d3bc84ca6307f9f7c66ad9f13ac8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905386, "uuid": "4eb6a7f8-9280-4140-a9df-0c62099353d5", "value": "T19CE39D26B685C95AD91407351DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905386, "uuid": "8cff89ec-d378-402c-bc14-5264dd4e77f7", "value": "3072:rcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lct:rcKoSsxzNDZLDZjlbR868O8KlVH3UehR", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643905386, "uuid": "658d0497-7b8d-4b64-975c-e74f8f775e2b", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643905386, "uuid": "38845920-d23a-4d9e-a998-768840c0a0cb", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643905386, "uuid": "331be2fc-f862-45d5-afe1-f1fbae15ce90", "value": "tmpxhxbsn4a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "98bdb72f-850c-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643904969, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904969, "uuid": "e3a03ef2-121b-4b02-9840-7997201337ee", "comment": "Malware payload (Heodo)", "value": "803a85e49068c526d147113f0f8cca7b", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904969, "uuid": "69f35acb-9788-4716-91db-214e6d936d24", "comment": "Malware payload (Heodo)", "value": "5440265a051dc829432be70c8d6d10c7694946a5393b27b2c1de5bb559f2eecd", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904969, "uuid": "81a551dc-c5af-40ff-9524-195ece67e2bd", "comment": "Malware payload (Heodo)", "value": "b70e71b603d8499c2104dd729ae9c9a06791449f", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643904969, "uuid": "2e3f3b8d-a310-4a27-acd4-c8a04b692791", "comment": "Malware payload (Heodo)", "value": "6fe9aea7994d62fb8c0310b24975c16d81b479e80428752120b1de7e8bf6be032523035259861bc9d3a1e31b592f89f6", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904969, "uuid": "353f941f-0dee-4d67-a46d-1ba5a79f3b23", "value": "T169D4D01032525531E47FA83808145B02896D7FB25F70E9E7E7E536AE0D7E2D26732E2B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904969, "uuid": "fb4e07ff-d107-42c6-96fc-aa9adb2c1d56", "value": "b9f8de16582cbde137fb46ff67f27488", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904969, "uuid": "7587bbb4-df91-445f-953c-d45d51fd3591", "value": "12288:JM7IInWhxQohUR0Oll7BHKYBP57+7/Q0xIop1KpR:JynoxcCOllFxBPs7LxIop1KH", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643904969, "uuid": "e47c951b-a339-40a5-a107-5f32b3cde908", "value": 648704, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643904969, "uuid": "de5d8cd5-c5e1-404b-9e4b-628bc240c515", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643904969, "uuid": "6bd579b9-4448-429c-90e4-4a02a74afa72", "value": "emotet_exe_e4_5440265a051dc829432be70c8d6d10c7694946a5393b27b2c1de5bb559f2eecd_2022-02-03__161558.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "fcca2bd5-8518-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643910290, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910290, "uuid": "484a267b-bd74-4500-9301-60a4242a7c53", "comment": "Malware payload (Heodo)", "value": "fad8e54618b1236c3f0c7fc8ecef5676", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910290, "uuid": "304ebb76-d6a5-46d7-b066-813fd265cd40", "comment": "Malware payload (Heodo)", "value": "545c36a683434997c8fd13a2e028b24a8c254681e8b5a9981a1c282288db786b", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910290, "uuid": "40000e3b-5e68-44aa-94b4-36a7c1aae6dc", "comment": "Malware payload (Heodo)", "value": "e588e0d59344e22d9a59bd8eb96d35c2a2983548", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643910290, "uuid": "f569bc6d-4c2b-4d7e-bd37-39c8fd03180f", "comment": "Malware payload (Heodo)", "value": "c61e57190fa711917537cde5d374f1d29f5a5beae2bf2f9f2fa0f6aa211f2c0f62e2dd604b4ec8506ef3f51da8de9555", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910290, "uuid": "c43a4c68-7a72-4aa6-ab2f-8e786c0eb604", "value": "T1C464E002F1C2A1B2D52F1532316AE67A6F3C76109712CDEBDB984CF65F363D18634A26", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910290, "uuid": "d2f4d077-2e9e-4cf1-a0f7-a4ea63c36b22", "value": "1f2625d8cbde95b8a56d0ba2d95bab06", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910290, "uuid": "e1113af7-4ae9-4633-a681-5c9817bf0d6a", "value": "6144:83DvZRFTFbksYyljaMYDMST7k+At+5fAzHKP5hET++oRFToJ5w:83BZbttaMYdLAtgpPox5w", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643910290, "uuid": "9db42c91-1831-4866-9455-99aee232b7b6", "value": 331776, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643910290, "uuid": "34eb52cf-f363-47b1-af89-11ce0d435a53", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643910290, "uuid": "8977e923-19c5-499e-9806-9ba1a6514782", "value": "emotet_exe_e5_545c36a683434997c8fd13a2e028b24a8c254681e8b5a9981a1c282288db786b_2022-02-03__174435.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2873f616-84dc-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643884164, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884164, "uuid": "a88d2767-6c19-4b87-a14b-f3754c0ac51d", "comment": "Malware payload (Heodo)", "value": "eac362b73bddfbd41b5e191a743143c9", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884164, "uuid": "8253f589-b400-4eda-ab35-755c36b6ea75", "comment": "Malware payload (Heodo)", "value": "54d9d738e7da72a06f8602051f60eb726b91b2ac97060b6fb028a63d3b71c6b8", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884164, "uuid": "178fb788-2194-4161-821b-ccd1c686879f", "comment": "Malware payload (Heodo)", "value": "70a19a3b091105383e6ffad98f5735db4f0c2b2b", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884164, "uuid": "e9883c8b-bb4c-4389-9325-39c420dc8bd3", "comment": "Malware payload (Heodo)", "value": "01eaca6cbe93792ebf299dbf8c8a23149dcfe8f9e928825d198e46038b9052d35f0baf1e96d6db95fd9a49e02cb6d5f0", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xls", "colour": "#0C8A06", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884164, "uuid": "b0ca0033-eed6-44e9-becf-5d0cf8a30afb", "value": "T16EE36B65B6C5D9C6DB0822350ADACAFE2327BC479E7643C33158F30D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884164, "uuid": "795a7a8b-2ae5-4906-b90f-40b3ef178902", "value": "3072:2cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx02:2cKoSsxzNDZLDZjlbR868O8KlVH3deh8", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884164, "uuid": "ec426097-ca95-4a9b-afdf-176a75dfa85e", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884164, "uuid": "de779c50-0eeb-460f-be2f-b1ad2c517c6a", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884164, "uuid": "520009b5-2d53-4ef1-ad1a-ba50a04e2154", "value": "Rechnungskorrektur2022023624120283.xls", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "49fd8f36-8526-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643916003, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916003, "uuid": "55b82113-e599-46b7-a938-48d993f66d43", "comment": "Malware payload (Heodo)", "value": "8c3aa39f9199bd23a116aecc1ed90de2", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916003, "uuid": "a75c7dd2-4f50-4834-a0ed-b6443fdf769a", "comment": "Malware payload (Heodo)", "value": "54fc4be9bfb128285b4842cca2963ee3e7fc785797e0fe7d03569fe32513a21c", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916003, "uuid": "a626741d-f167-41a7-84f3-03b4d8d0a34e", "comment": "Malware payload (Heodo)", "value": "b7ff3ac5524dad87079b8d12ab1484abcf1e2313", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916003, "uuid": "919fa002-5864-482c-8541-87a8ca24bd89", "comment": "Malware payload (Heodo)", "value": "1f731fcb60429c877a3cc86f1c3b5d65720be96ae3549e0b959ed888d49489e55228105d3d41637da86bee5fc9574a23", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916003, "uuid": "46f3c7b8-4140-45a9-a339-12769a25c7be", "value": "T1BCD4C05472A28476E0AEA83404249B138D6E7F715FB0C4DBD7E539AE4D3D2D16A30E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916003, "uuid": "85e4e07e-58b7-4241-812b-578fa568060f", "value": "15b471bbc15a140b9567d4daee05d632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916003, "uuid": "8a73aa5a-c7e8-482c-8eaa-5a5b1aa223fb", "value": "12288:8m9+I/aI+W1QbBi3IjeuXe6q7nCS/xCMqYDl2JwDKCX:8XrbB2IjevChMqW2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643916003, "uuid": "c98d62d2-3e5a-4e1c-ada1-2127f209e204", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643916003, "uuid": "f972aae5-4ed2-4c7d-b25f-73cff64b92cb", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916003, "uuid": "2bc7e476-68d8-4974-9328-34b96def201b", "value": "emotet_exe_e5_54fc4be9bfb128285b4842cca2963ee3e7fc785797e0fe7d03569fe32513a21c_2022-02-03__191948.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "89040edd-851b-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643911385, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911385, "uuid": "96738b16-6803-4e2d-a9c7-baa9c391552b", "comment": "Malware payload (Heodo)", "value": "b3ad34c94b8d657a874ff3ca8022f8d2", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911385, "uuid": "b6e40bb6-9cc3-4aa0-bb38-1d2d6cf5496f", "comment": "Malware payload (Heodo)", "value": "55150f9cd4c1785e4c9922898f637e1b72f011c237a04d4e44565b15e999cfaf", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911385, "uuid": "b4926f98-63fb-421e-8a54-78b64def1ce7", "comment": "Malware payload (Heodo)", "value": "3fdb00a01758440fa6755ca8b40bb9cbf34db2b9", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643911385, "uuid": "6401ade5-ccf5-4a7f-92e9-ae5dd22a78af", "comment": "Malware payload (Heodo)", "value": "32042080dc36404c23124dfcf9f5cc767756d8d06c6a5b1d03b9a460600bb9778a712d17a49ef2db184feb4b9950802f", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911385, "uuid": "bf0e89a5-6dfe-47c7-9bf9-8ae3c6ea9362", "value": "T117E39D26B695C95AD91407311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911385, "uuid": "ca0ba0a5-9952-4ecc-bfc4-ff378390ed47", "value": "3072:XcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcm:XcKoSsxzNDZLDZjlbR868O8KlVH3UehS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643911385, "uuid": "38c8b6ef-b9b1-4a4c-b8fc-131359fcb886", "value": 145408, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643911385, "uuid": "3d88af81-f00d-41c9-af7c-ae8313943af3", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643911385, "uuid": "ee741a93-db8f-415d-b410-96bef5d6faa8", "value": "tmpt4pgyebw", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "40b80471-850f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643906109, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906109, "uuid": "dc4dd745-a3b8-4266-b09f-77ca5b672426", "comment": "Malware payload (Heodo)", "value": "f781356effb9e2ce2fca93b2f605d554", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906109, "uuid": "c0fd4b6a-e63e-42da-a27f-35167937638e", "comment": "Malware payload (Heodo)", "value": "556b3655aad77f93a43ce665207ba7e4277033ef59aa7382c052e0eb2e9502b7", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906109, "uuid": "6c1a1264-a3f3-43dc-98e9-9d7b5d0cc07e", "comment": "Malware payload (Heodo)", "value": "562e38ede52c67d23dfc3537c60f07ddac6d769d", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906109, "uuid": "49ca16f2-4950-4819-af1c-e5c01aed8361", "comment": "Malware payload (Heodo)", "value": "2c8bfc548f3451ab922f0988fa94981ae86563c2d97797ed4d7bf668c8529dd72b4a90cafce742a298421d08e5699ab8", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906109, "uuid": "1a269149-44c9-421e-9a30-a7544ff10f36", "value": "T1BDE39C26B685C95AD91407351DD7CBF7333BBC818E7683433289F71E6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906109, "uuid": "1f9b2eff-28db-417b-9832-a0a56c6698c8", "value": "3072:YcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4LcW:YcKoSsxzNDZLDZjlbR868O8KlVH3UehS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643906109, "uuid": "9e51e739-5d7c-4134-96a6-d302525a3ef0", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643906109, "uuid": "47880291-d679-4018-802f-fab75878088c", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906109, "uuid": "6c1fa98e-3702-40dd-b52f-7aed9358e269", "value": "tmpxgv6x66u", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "606c1b2d-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882970, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882970, "uuid": "ffb7f9fb-ea6d-4d84-b65e-750c1873e249", "comment": "Malware payload (Heodo)", "value": "8d705516828c4d6a4ee7dfb9de4478b9", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882970, "uuid": "ac2320b6-a947-4cfd-95c0-52345c76bda6", "comment": "Malware payload (Heodo)", "value": "55bd46ad5c7cc0dc1d56639a1703a9efd38d7618db22fed3ad412b763967965e", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882970, "uuid": "0e879509-a9f5-4b5a-b869-23e8cca3dbcd", "comment": "Malware payload (Heodo)", "value": "d00693ecf6ed2002f513346a7a8fa616229ca2b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882970, "uuid": "5e59dfba-d0f8-4d54-8d60-27295b29cc04", "comment": "Malware payload (Heodo)", "value": "9ec4182ea29336c66aab9a177fdfb69f9745d5d2b1ce19d7ede66f9c8fac2cda09c392c5e2750df2dea4f724837dfbf3", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882970, "uuid": "2107911a-02da-4ed0-b196-10c7386a966f", "value": "T1B425BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882970, "uuid": "9dc2319a-e65b-4940-9484-e2fb90235b11", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882970, "uuid": "62911f61-dfd2-4623-9945-f0d8684e2555", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gPFIIm2mlg:kBiaa4powXiolDS2gPFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882970, "uuid": "1e64c3e2-97b7-47b1-a3b5-4321bc482ebc", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882970, "uuid": "edcf193f-519d-4ec0-bc58-40e7e582cea1", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882970, "uuid": "863d836b-e85e-4528-a28c-32c137638e07", "value": "8d705516828c4d6a4ee7dfb9de4478b9", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "7afd1b16-84e0-11ec-9275-42010a9c0029", "comment": "Malware payload (SnakeKeylogger)", "timestamp": 1643886021, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886021, "uuid": "46c2c23b-8857-4fd9-aae3-051f4894b74a", "comment": "Malware payload (SnakeKeylogger)", "value": "b601e19aa7158624770769618ae9a7a5", "object_relation": "md5", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886021, "uuid": "204442c3-6840-4ab5-aa8b-46792b49ec41", "comment": "Malware payload (SnakeKeylogger)", "value": "55c349bac8fd1f52d509f18c49d73c963a6b836b31a574311f42b472381e1d45", "object_relation": "sha256", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886021, "uuid": "d40dbdee-11bf-496f-a986-de11c0c7fba2", "comment": "Malware payload (SnakeKeylogger)", "value": "628b3d782514f4900e55b200986492cd0bc57679", "object_relation": "sha1", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886021, "uuid": "e6f2c3a2-7087-4338-a23b-456792e48d7c", "comment": "Malware payload (SnakeKeylogger)", "value": "12e8735a50ded190754927aa0115fadc2e3f5dcf92b7d99abd4307a268d5892500f9558aa488cfba7611abb9b55c33f5", "object_relation": "sha3-384", "Tag": [ { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886021, "uuid": "c3bf26c2-d4b2-4acd-bfd5-19dfc115ff02", "value": "T15574234D5BA385DDFE85B9DE3B33EA241735C9EE00B60687CB1DC44F02F4AB95268218", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886021, "uuid": "2bfa8f9a-2134-4116-908c-a4aff97194e8", "value": "6144:fo4w3VKiOCG/mUrXcKzZFOgl0QnvJJc9Mbmz0uQvHHrXiNIuTj7At+rYmy6sp+:QFKiOHX7cKzTOKvJJc9CmKnrUTj0graS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643886021, "uuid": "f2f1c188-0dd0-4104-b617-2df93a0632b1", "value": 346479, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643886021, "uuid": "d793c5bc-1528-4ba9-a8b9-6519504991da", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886021, "uuid": "5d857421-c567-451e-9609-d361dccf6b21", "value": "MV ACE SHIPPING TBN.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "75bc3900-84ea-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643890307, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890307, "uuid": "7d28c64b-02f8-4e64-81d2-4dba63c3c51c", "comment": "Malware payload (Heodo)", "value": "ce80f6a6f972f773227d027f5abb0a72", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890307, "uuid": "97f8ab9a-afd4-4108-a9c8-e3d3e22977e4", "comment": "Malware payload (Heodo)", "value": "55d282ddc6b82b58287ed86524668dd3396b8ebd7e3a391fa8ed4a6124db7f31", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890307, "uuid": "18f01598-bad4-4bec-b125-384a056820b3", "comment": "Malware payload (Heodo)", "value": "281f7f45bcb5b5c778e70b4526191d652a844c30", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643890307, "uuid": "e12ac2ed-288f-4b4f-bef2-9159778b855d", "comment": "Malware payload (Heodo)", "value": "f016fc5a4b68376e47b02eee0b14b3269b1b1b4d85bf788798ce5df8e7b611a78635a0e2f4c9b608743b0bdd71b2f593", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890307, "uuid": "6e03bce8-b86f-44f1-963c-2ae639d9dab9", "value": "T1CF25CF516D4980A1FA0B293D107A63660FEC690117E0E9EFDF05F8E75F26CC196788AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890307, "uuid": "f064f7aa-bf2c-4d04-a7e9-b54cfaa82813", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890307, "uuid": "e25fa93c-bb25-4009-8bc5-b23a2a8c828a", "value": "24576:O77NlW4ZujpK630cavFuwNUsjk6opl2VD+rNtl7ifTI5dTpyrFIIm2mHL:6W4Z+LEtvFuwDjVK7GTC7yrFIr2mr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643890307, "uuid": "d9aa12e9-fd19-48b9-b3be-e9a69c26f665", "value": 995840, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643890307, "uuid": "45bfd231-8a9f-439b-9b2b-2ec44697f605", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643890307, "uuid": "11e8f1eb-759c-4280-8201-81e90ebae15b", "value": "emotet_exe_e4_55d282ddc6b82b58287ed86524668dd3396b8ebd7e3a391fa8ed4a6124db7f31_2022-02-03__121139.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "63303bd0-850f-11ec-9275-42010a9c0029", "comment": "Malware payload (Mirai)", "timestamp": 1643906167, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906167, "uuid": "02041d2c-81a0-4e47-b12b-d7ebb2d2b5da", "comment": "Malware payload (Mirai)", "value": "d12661105afc472fe57f0305feffe4b6", "object_relation": "md5", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906167, "uuid": "948d3e99-ccdb-4a12-9818-bf2ec5b5bbca", "comment": "Malware payload (Mirai)", "value": "55ed327699365573113cd6bd715071aad670620ebbec7580883a04202caef347", "object_relation": "sha256", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906167, "uuid": "5f934a8b-ed0c-4918-9086-5ac457ee3028", "comment": "Malware payload (Mirai)", "value": "5509f98d8375b9977f8a0664493e63bbf6acaef7", "object_relation": "sha1", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643906167, "uuid": "976ca54b-60a6-4b39-b641-90b45ad74ec8", "comment": "Malware payload (Mirai)", "value": "73430bf738e12cff0ea0496addf06ef69d4eb39c636c93c9c18c340994dc42c29fd78a5f6fa3d07d2279d995d9b9aa55", "object_relation": "sha3-384", "Tag": [ { "name": "elf", "colour": "#CD6A22", "exportable": true, "hide_tag": false }, { "name": "mirai", "colour": "#19EF39", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906167, "uuid": "1689b12f-4cf3-45fb-99cd-46992f52cfd7", "value": "T1DF63E80AEF514EBBDC6FDE3706AD070135CC944722A93B363674C928F65A64B4AE3C64", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906167, "uuid": "881d6f8b-366e-4e5b-b732-c7d73359eec3", "value": "1536:nx3wH9h9Sr2gQ4ZCfdirtrtkEAs6+Lkn1:x0arJNaF1", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643906167, "uuid": "0f43f3b9-10ae-4095-941b-dfec248c7d1e", "value": 68548, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643906167, "uuid": "2b869326-7aa5-4a83-9340-a79828b139d8", "value": "application/x-executable", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643906167, "uuid": "050ad477-0da4-4cce-b0b7-d973e4ab4763", "value": "ahsok.mpsl", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "a0615fb3-84e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1643889949, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889949, "uuid": "470df051-2b21-4abe-acfb-0c0287ac71bd", "comment": "Malware payload (Formbook)", "value": "fcb629c33c0beb749b56bef596f219a7", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889949, "uuid": "288dda00-5c2e-4ede-a6e1-c65fabda0401", "comment": "Malware payload (Formbook)", "value": "561fbcd624248dadb76691e9be7945fb928af98707bafe82e7cf4add00ac2097", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889949, "uuid": "fd11bbc0-3563-4d44-8bf5-a9dba855cbf9", "comment": "Malware payload (Formbook)", "value": "88b2d5ee0e3d8b2f7aeda41b631a71e7ba5dfff8", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889949, "uuid": "a32c5c1c-4df1-4f76-85a6-0ca6c97f6e3b", "comment": "Malware payload (Formbook)", "value": "27f359ff7a2516fa512698764a3401395854e3baf6cbe9fed2b83dec53fba2435bb3f0f07443817800c394fc1e76892e", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "zip", "colour": "#60FA63", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643889949, "uuid": "1f1b4e4c-30f6-44ec-ac32-d7e8099aaac3", "value": "T18D842300D20F94F7B13E22A9DCBF86BDD91157D71B22B9C3487932419B5A4D62FE489C", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643889949, "uuid": "5c666260-5c47-4577-81ed-bc781b4063a1", "value": "6144:estdK7YaFLOC+Tc1P0lgktSyQ9KXm2zMqT1/+1Yr0CneT56bcS3OzkirL4Qs+8cX:eOOYaFLO/A1egk7UcgqB/+1rCe01YFrT", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643889949, "uuid": "17328ebb-7a2b-439f-908f-459c98c2891c", "value": 389627, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643889949, "uuid": "199113da-cadc-44f7-a161-a7fbf1d9ddb1", "value": "application/zip", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643889949, "uuid": "28ac7b75-74c8-404f-b0d3-51260040ea22", "value": "1643857501.Vfc11Iba659bM121683.dynamene_Quote order#098799.zip", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "526e2947-84d9-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643882946, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882946, "uuid": "3a5484f3-52d2-4135-9680-97486d3e7454", "comment": "Malware payload (Heodo)", "value": "ad464e5e4cd64d774c630ed4c6867f8a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882946, "uuid": "8282cb97-ce52-40d5-ac39-a1114fabf6cd", "comment": "Malware payload (Heodo)", "value": "563dc6dcb505433688efbfb5c0bdd6662470fff444c21057c2ec6d56f6dc7dfc", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882946, "uuid": "dc12ca8b-cfbb-41a7-b883-4d71e6775136", "comment": "Malware payload (Heodo)", "value": "ce8b928fa7598d227060331925122d4f8f323ebe", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643882946, "uuid": "48823985-a8a2-4b16-81f1-b6e8a0f5d0a9", "comment": "Malware payload (Heodo)", "value": "010d4db8d30e72b7e2d95922b7994a4e662507df952ccd576bef23e780175b610bb267c747758061409ad4a151bb5f65", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882946, "uuid": "8f35b300-9a15-4604-90a9-c4534a66b463", "value": "T1E625C0216D8A40E6FA47193E0069B3544FDC69050BE0E8CFEF54F9A66F12CC25B785AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882946, "uuid": "dbe6c948-bab5-4e6a-81c5-a3e1cc8199fa", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882946, "uuid": "e80e1678-b958-4608-84ae-7e51bd2efd2b", "value": "24576:vyj4pucLsugl4zCy9fG+OVE+cXcs2vUOFIIm2m0:vzfnl9fYVoDvOFIr2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643882946, "uuid": "bfc87553-9c91-4930-8b5a-c16f13a5deff", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643882946, "uuid": "ec8de042-7977-41a2-8502-70a6565ba854", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643882946, "uuid": "78007ba9-78d9-458a-83d0-42a0fe7d4adb", "value": "ad464e5e4cd64d774c630ed4c6867f8a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b756600e-849b-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643856487, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856487, "uuid": "d67baf61-f395-4aac-a165-226cf29e0c39", "comment": "Malware payload (SilentBuilder)", "value": "c4f65501d52cbfa5d454d06309545720", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856487, "uuid": "76bea7a7-b367-4984-9294-af03bbd206fb", "comment": "Malware payload (SilentBuilder)", "value": "56532b3b7d53d554f06eabb4df025b7de78cab5a16db27b732e8f3086bba7297", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856487, "uuid": "74158fc8-e2d6-4efc-a8d5-5f6f78319cc2", "comment": "Malware payload (SilentBuilder)", "value": "9455a9fb9f807135e78f3f6bc5a5c5a315d0ac17", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643856487, "uuid": "17faf2ac-0a2e-4691-b204-4544f838ca30", "comment": "Malware payload (SilentBuilder)", "value": "0b03649d0d4d3f661188f3b2c33971181adcc3bcc02dfdee473e5c520bd4b34e0c4338495db057c8eccd103edf253a39", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856487, "uuid": "ed5a54b2-4f99-45f2-98c8-5fa0a48eca28", "value": "T1CCB37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856487, "uuid": "2fc0d44b-b142-4420-8a14-87396d432583", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49n:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmr", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643856487, "uuid": "28badfbd-46b1-44a9-a74c-1f46add183a2", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643856487, "uuid": "8849409d-1f65-4073-b02b-e1c2c788455e", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643856487, "uuid": "aab40dae-fcf7-4638-b236-84ad6282fcb2", "value": "2022-02-03-c4f65501d52cbfa5d454d06309545720_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "657d42a7-84dd-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643884696, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884696, "uuid": "767b9490-09b9-4409-beb9-96a3a33e24b5", "comment": "Malware payload (AgentTesla)", "value": "6387c687f53c3a90245ec4345737423b", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884696, "uuid": "c2b903ee-47f7-4cd9-b7c3-b789e4f38a21", "comment": "Malware payload (AgentTesla)", "value": "565f200243196fbea869679ffd71a3cb8a24609a027bcc40abaefa5eb5eced67", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884696, "uuid": "e0ac7610-6c3a-4ed9-8d56-f759de422cdf", "comment": "Malware payload (AgentTesla)", "value": "dc20976e04cdc56dfdeefed40a2dca29adf3ea2c", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884696, "uuid": "fc006d50-b140-4f97-9ff9-f5048794c548", "comment": "Malware payload (AgentTesla)", "value": "976f7bd819d63279b9c66eef26b0f4572cf4ad99083581d3b7a96469c77c660e8109829a221ba01d0834e1100b1b64ae", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884696, "uuid": "b85af654-bbf6-4e40-b6bf-2e4960969f17", "value": "T1EDD4D06BBA4BCA80D016543211EFB45107B63FDBAED3D6053B5CF3180BB22664F9A54B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884696, "uuid": "25bfc588-1240-4c54-959f-09a4e797fa3f", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884696, "uuid": "9a4b8d53-a573-48c8-82e9-e6f37bb33d1e", "value": "12288:N9TJKL6J6ivjx6lXTsvxn+0IghR0RG8xwf4yizOvS4bTp0c057J:NtAL6J56ds5n+0FgGBfXiyf/Cc0JJ", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884696, "uuid": "c9b871c8-96b8-425e-8fd8-40b7292c8b82", "value": 646656, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884696, "uuid": "a7f40d27-d64e-498e-82cf-048f7aae03d6", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884696, "uuid": "20f0be98-bc9a-4f44-892d-5d6894756f71", "value": "0818M00051-72965-USD-SWIFT MESAJI.bat", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "df4e4532-84ce-11ec-9275-42010a9c0029", "comment": "Malware payload (ArkeiStealer)", "timestamp": 1643878458, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878458, "uuid": "ec70d9bb-6389-43d7-8f4c-108b10a3e093", "comment": "Malware payload (ArkeiStealer)", "value": "9877314f0ca0860891ee5f8ba9ca0747", "object_relation": "md5", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878458, "uuid": "f0c4334a-4076-419f-bc42-6dc9fd2e37a3", "comment": "Malware payload (ArkeiStealer)", "value": "566e3c41fdeb0bf647f6e4058304c3fcd77f04c991beb8cbc485a0c180e567ea", "object_relation": "sha256", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878458, "uuid": "e4502225-75c8-4a7a-8cad-9cf146faba02", "comment": "Malware payload (ArkeiStealer)", "value": "b2f9fa96ff79d3962c5aafc6818121806f8bdbe9", "object_relation": "sha1", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643878458, "uuid": "3f7a45d2-38db-47b3-a632-c552e0564d4a", "comment": "Malware payload (ArkeiStealer)", "value": "3a9c19c8a60eadb6663174b8e0028678388e3fe53e1075abd5161a49401fe386e7b286725de568e4ee8d19da33345fd7", "object_relation": "sha3-384", "Tag": [ { "name": "ArkeiStealer", "colour": "#21CE25", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878458, "uuid": "1eaf2724-1485-4222-bffc-f589dcb68f9e", "value": "T19E34DFD03A81C0B2C9979435DD3DCBA21B3BBC311A7481067B966B2F5DB13D1DA2A71B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878458, "uuid": "6cd9dee3-1dc3-4782-af58-cd758e07fa05", "value": "a1c07a7168f5449ce53309d29c4b81b5", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878458, "uuid": "7884aaf8-6b9b-4055-bba7-5769ba3bf5ad", "value": "3072:/VEY0n9FL2zwn8T4XGl52Eg5XCFZM+to60wy4zuyh0eEHow5X94za:tEl9FLr8TuYFZM+to60wOQQX94a", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643878458, "uuid": "1afb76bf-00f2-43a0-9952-4c653fcbcbc5", "value": 247296, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643878458, "uuid": "567fbe08-034a-4814-9996-f8808ee4d545", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643878458, "uuid": "a63f1e25-e2d5-418b-a2ab-ce6242074c7b", "value": "9877314f0ca0860891ee5f8ba9ca0747.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "b21aae03-851f-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643913172, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913172, "uuid": "d0e8cda3-a7dd-4711-a12d-16f913ae86ca", "comment": "Malware payload (Heodo)", "value": "04d215e611c84273d9d5d7615aaeba06", "object_relation": "md5", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913172, "uuid": "b2fb2bb6-8005-4ad1-b280-c435e6f3a3a3", "comment": "Malware payload (Heodo)", "value": "566efdf22a9374d1410bbe528ec2c1dfd99a0cd3de8343dfd7cf1f194ebb8154", "object_relation": "sha256", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913172, "uuid": "7c478c93-24dc-4ae0-8c8a-5c5c174b6ee0", "comment": "Malware payload (Heodo)", "value": "02bb9009141a0633f376f82f99db1bc39b0cbd33", "object_relation": "sha1", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643913172, "uuid": "c1016983-2350-4a0b-9ca7-557bddadee38", "comment": "Malware payload (Heodo)", "value": "d3a27f9c81b56fc53814ead264c970f72ab08eca6160ed3bac71d12491a6612d18606f2f5362ec58fedcb406a2b071be", "object_relation": "sha3-384", "Tag": [ { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913172, "uuid": "51da573f-1671-426c-b7a6-90a841682746", "value": "T1C6E39D26B695C95AD91407311DD7CAF7333BBC818E7683433289F71F6E7B6908A22247", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913172, "uuid": "c53012c7-ab90-437e-8a44-e9de4b10435c", "value": "3072:YcKoSsxzNDZLDZjlbR868O8KlVH3UehvMqAPjxO5xyZUE5V5xtezEVg8/dgp4Lcc:YcKoSsxzNDZLDZjlbR868O8KlVH3Uehg", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643913172, "uuid": "d1308401-9e1c-4f31-a18f-70d6d2dbcfb2", "value": 145412, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643913172, "uuid": "99bdc227-c9f7-41ea-9700-d20dd3bedd0b", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643913172, "uuid": "8d13d5bf-9305-4ebe-ae6f-13e669f940d8", "value": "tmp_ajmcf8u", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3ccd6a43-84e0-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643885916, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885916, "uuid": "8d78faab-26f0-4581-b0ee-6e6c5e33d75b", "comment": "Malware payload (Heodo)", "value": "fc8b6ca27b7cf0251156b8d36efeda0a", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885916, "uuid": "e0f6a48e-6274-46e7-8295-2e0cdbb89331", "comment": "Malware payload (Heodo)", "value": "56e6adda645e18f32aca4e33e4bcb76aa421c070ca097cbb1f69886ef03e6f15", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885916, "uuid": "32611be7-b41b-43ae-a42c-2fa2ef0b5bba", "comment": "Malware payload (Heodo)", "value": "98f1192501a9bd840f5318ae41dde05266daca24", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885916, "uuid": "bd42808e-08ca-467f-b6f5-12b877a3b2cb", "comment": "Malware payload (Heodo)", "value": "5f5e5a3e457a979348de9b9597e287f85e4fb5f2b308919b6763ea45aec43ed7b95dfeaed74a6fe46b4d1e1babbc641e", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885916, "uuid": "4977a959-266e-42e9-8bb2-f6fd0fdd58f1", "value": "T1D825C0216D8A40E6FA47193E0069B3544FDC69050BE0E8CFEF54F9A66F12CC25B785AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885916, "uuid": "585f2453-4ec9-4543-b53e-80a9280c4c88", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885916, "uuid": "35ac693e-6063-4461-8513-cc8148e847fc", "value": "24576:vyj4pucLsugl4zCy9fG+OVE+cXcs2vUrFIIm2m0:vzfnl9fYVoDvrFIr2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885916, "uuid": "1253a6ec-aec0-4e3b-8be7-bed4ad11c9d5", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885916, "uuid": "91fcd8c8-dae8-4399-957e-aad77854b5da", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885916, "uuid": "1c6fcb59-df9d-453c-9293-80508260c48b", "value": "fc8b6ca27b7cf0251156b8d36efeda0a", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "e1b0eef4-84d3-11ec-9275-42010a9c0029", "comment": "Malware payload", "timestamp": 1643880610, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643880610, "uuid": "f4ae4e88-a36e-438d-a938-59da913c3f11", "comment": "Malware payload", "value": "7d577d8a871c7340f56660b1e4389601", "object_relation": "md5", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643880610, "uuid": "020628ac-f090-4e83-a994-179cb08a3873", "comment": "Malware payload", "value": "56e791cc8e07df049102c8d489a27c08ce231b90ac97eb97c741ddeb236fec24", "object_relation": "sha256", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643880610, "uuid": "bba75d1f-c717-4f25-b7a1-cfbd822f816e", "comment": "Malware payload", "value": "6e2a1cb4eb564634baab2c1649fdaed7f92d7943", "object_relation": "sha1", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643880610, "uuid": "a0c0c3f1-3f57-4ced-8a8d-7af4cd02be88", "comment": "Malware payload", "value": "faab3ac647e201af1223538c01ad72ac193b3515b450308e658c4339c9b3ed026df4533ee1793ec0a4b5be25027c3f56", "object_relation": "sha3-384", "Tag": [ { "name": "msi", "colour": "#4F84E1", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643880610, "uuid": "a41c60bb-b340-4cb1-83a6-f576b62f3cef", "value": "T181259E217696C536C87E0570352ECBAB05297EB04BB284EB63CC6D2F1D729C11772EA7", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643880610, "uuid": "f342fd3a-d3a4-4016-87ce-9f97ebf7b232", "value": "24576:U+7tkeYe9oWVRT7MAWOfOBffR0YcBTTpVtp+GYY:U+v9oWVRT7MAWygfR0YwT1Vtp+GYY", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643880610, "uuid": "7fc0befc-3bb4-4c59-829f-0dbd1f4bfaab", "value": 975360, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643880610, "uuid": "5c9f36ad-9127-4d86-974e-6698376a3b41", "value": "application/x-msi", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643880610, "uuid": "08e89491-0ac1-4b78-a39c-e528d1dd5046", "value": "N-72kzbfcz 2d2e1q.msi", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "5a70ea2b-84da-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883389, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883389, "uuid": "f307561f-27a1-48ca-bd4a-87714479b067", "comment": "Malware payload (SilentBuilder)", "value": "56d4361589d1cfba128ec1309a77d6cb", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883389, "uuid": "ca12e763-1a6a-47fd-a58a-273f105d2f83", "comment": "Malware payload (SilentBuilder)", "value": "56f043f702b85240444f5f29097fedd6700399ab80f8378592a5f3a708d39a51", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883389, "uuid": "f86dc693-bb53-4899-99e5-c6e19f852dcb", "comment": "Malware payload (SilentBuilder)", "value": "ec6119997bfaad862bc338a261acb50c95f91de6", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883389, "uuid": "32329052-9b19-474b-8f19-87727d9534df", "comment": "Malware payload (SilentBuilder)", "value": "268f99dd828df0e51b159ab6958a47ddadbe94790020f50e0b79563a2b4b903d08c8ad10d3890ebafd93c6e10701cb93", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883389, "uuid": "0f191dd4-f35b-45f6-9292-641ca9507c97", "value": "T14CB37C5A7365884EE55A8B3488F707962333ED208B5F06477119F3D62FBAA901B03E5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883389, "uuid": "7079a551-7a32-4062-b87a-a850097afa9c", "value": "3072:MWKpbdrHYrMue8q7QPX+5xtekEdi8/dgmJodOpsHoG+qd49X:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgmj", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883389, "uuid": "36111ba4-616b-4d65-9287-73782be2c220", "value": 111616, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883389, "uuid": "34bc873f-73fd-4fbe-9baa-c35073cd9731", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883389, "uuid": "3c4c015c-0ef4-4768-b6af-f3dce846f60d", "value": "2022-02-03-56d4361589d1cfba128ec1309a77d6cb_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1c688583-84e1-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643886292, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886292, "uuid": "93f1d833-39d1-4ece-9004-146ffa84c672", "comment": "Malware payload (Heodo)", "value": "fa30ecc729834bd35064e7b1f551c0fe", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886292, "uuid": "d2417c9e-a867-4224-89a7-d32723d6a541", "comment": "Malware payload (Heodo)", "value": "572c51fd60287b302248b77687afc11defe704d7c665177f3fdd25b9bb07b9df", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886292, "uuid": "8078e5c8-674e-4763-ae77-7603f6ff139d", "comment": "Malware payload (Heodo)", "value": "d9bdd30eb7deb5f0f0cd661055c7bc0640f9b4de", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643886292, "uuid": "ebab94a1-36df-4dcc-9ea1-eed85d5c3b0b", "comment": "Malware payload (Heodo)", "value": "5f3310b986496dd98122ae8e8159b635ab0c8ac78d5a073d6c63eb07e45f010df2d0c904a2482d516337113bdd00c65a", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886292, "uuid": "e3f28259-efbb-486b-bc8c-8dbda575aa0a", "value": "T159E36B6576C5D9C6DB0822350ADACAFE2327BC479E7643C33158F30E2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886292, "uuid": "8ccfc8ae-9b7a-41f6-ac06-55c3990f17eb", "value": "3072:9cKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGx04:9cKoSsxzNDZLDZjlbR868O8KlVH3dehS", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643886292, "uuid": "1f152652-9a75-42b2-9609-b2e67751eef6", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643886292, "uuid": "2ff94fb2-aa36-43e8-ad11-ea13dc05a9f2", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643886292, "uuid": "94d4258e-b7d9-4727-a6ba-3c86332c58e6", "value": "2022-2-3-fa30ecc729834bd35064e7b1f551c0fe.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "4af09575-8526-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643916005, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916005, "uuid": "3e9dbb31-98b2-4709-b556-1a2a5d7b208a", "comment": "Malware payload (Heodo)", "value": "39399103d9ec9ff8165707a3e2ec3e51", "object_relation": "md5", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916005, "uuid": "abe47268-5182-4c5b-85b1-3c725c5b43a5", "comment": "Malware payload (Heodo)", "value": "573527569b666ab420ce960a3463b5e85a94e4c789ec947874c0d57bb582a598", "object_relation": "sha256", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916005, "uuid": "12624ee8-44f9-4ad6-a6df-4c5acd8c3e39", "comment": "Malware payload (Heodo)", "value": "b89fe28d375d0f580029dcb28671a3f981cb00d6", "object_relation": "sha1", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643916005, "uuid": "d9e367e2-4db1-42b1-bcc9-95e963d38ebd", "comment": "Malware payload (Heodo)", "value": "2d9f49a91074eb9b5f0db3aa1a0eda2b6a36ca6cbaf1d3e3d0ffc80ec2a4486a1310f294155426d40e25c01a90d8fd8c", "object_relation": "sha3-384", "Tag": [ { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916005, "uuid": "6e08d978-0f12-4507-804a-201bf8e0b013", "value": "T1DCD4C05472A28476E0AEA83404249B138D6E7F715FB0C4DBD7E539AE4D3D2D16A30E3B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916005, "uuid": "babf0976-5564-401c-b747-e4b3d43ad717", "value": "15b471bbc15a140b9567d4daee05d632", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916005, "uuid": "4a80f2d6-3a02-4cb2-a061-4ec18eb77555", "value": "12288:8m9+I/aI+W1QbBi3IjeuXe6q7nCL/xCMqYDl2JwDKCX:8XrbB2IjevCIMqW2uX", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643916005, "uuid": "caf5fd08-9782-485c-bc6a-76be6a438d72", "value": 635904, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643916005, "uuid": "5e068475-3ed8-4831-a341-1d67fcae66ed", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643916005, "uuid": "75b000fa-7603-481e-9c47-7f3c19a96a13", "value": "emotet_exe_e5_573527569b666ab420ce960a3463b5e85a94e4c789ec947874c0d57bb582a598_2022-02-03__191949.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "0113a69d-849d-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643857040, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857040, "uuid": "1646415b-b4da-4ad6-8550-23c6e6071ef5", "comment": "Malware payload (Heodo)", "value": "e1434e25aa5d97016108b2066de66cba", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857040, "uuid": "0ed4a637-da27-4cf2-8314-ead427dbb6d9", "comment": "Malware payload (Heodo)", "value": "574caa0b4610a8bcc569837e2486a7035f1b540e81da7bd8f15895c8b8773fdc", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857040, "uuid": "5c911763-33bc-4544-80e5-a634caee61ae", "comment": "Malware payload (Heodo)", "value": "15a6678ca6a3d8daa44673a8ccb1231e320843a3", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643857040, "uuid": "2c789ef8-d648-41bc-94ee-ec82f6d9d9a7", "comment": "Malware payload (Heodo)", "value": "927013ab9f27e6e92fd7630173007ce948941e83257fb9d3b15f840f60a7bd5a8d853cf3487378d77dd5020ddb2a323e", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch4", "colour": "#BDDEDB", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857040, "uuid": "ccd25072-6851-4679-ae46-b8db7ad5490a", "value": "T1F5E36B25B6C5D9C6DB0823350ADACAEE2327BC479E7643C33158F31D2DBB1909AD2746", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857040, "uuid": "9c8ce554-5e90-43a7-8305-4fad7316ec59", "value": "3072:wScKoSsxzNDZLDZjlbR868O8KlVH3dehvMqAPjxO5xyZUE5V5xtezEVg8/dgnGxb:vcKoSsxzNDZLDZjlbR868O8KlVH3dehi", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643857040, "uuid": "c4d9465c-20bd-4a21-bb3e-88184dcf741a", "value": 154112, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643857040, "uuid": "2be8985a-2d8c-46df-8024-474eaef61421", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643857040, "uuid": "20dbcacc-51bc-4862-bc86-4c26e25439e3", "value": "2022-2-3-e1434e25aa5d97016108b2066de66cba.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2fa4e38f-84e9-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1643889760, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889760, "uuid": "c425eb4c-14fc-4cc3-901f-d60c3eebd2c4", "comment": "Malware payload (Formbook)", "value": "75148a48554bf658b5bca72fd77b69ed", "object_relation": "md5", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889760, "uuid": "572c5fee-78d7-4550-80da-ae62ac4404c7", "comment": "Malware payload (Formbook)", "value": "5750f0a05c92bfe3323fb9e1e3c316a44e01338b9e2f02f4099424c3e37bc8cc", "object_relation": "sha256", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889760, "uuid": "7d2db6e5-7599-447c-927c-0707399d6581", "comment": "Malware payload (Formbook)", "value": "35efb5dec83f1a802b05c6d8f6a1046a4dc9c14e", "object_relation": "sha1", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643889760, "uuid": "2aab41dc-6ce6-4c49-8464-0ff71fd26fbd", "comment": "Malware payload (Formbook)", "value": "bc52f7447093bc75b0c1068c2b35ab554417c4a31b9d38209d92be870e50b89521f791c692000b96377de05106c20103", "object_relation": "sha3-384", "Tag": [ { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643889760, "uuid": "9d70f62c-bdc0-423e-9744-dfea316da9fd", "value": "T11EE4CD2A38BA100DB2719D6C6BBCB1B6911EF7F226365CBB0DF7050611129F0DB9D627", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643889760, "uuid": "03c19adb-f3c8-425f-bc3b-b748f48158bb", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643889760, "uuid": "16b08427-4008-4b4c-9a29-903d1c6a2436", "value": "12288:ELGSDInWnA0+rjumRpcasoOnkk34kr5oR9FMBh+OQhNOi:K4u75VE", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643889760, "uuid": "34c768c8-ab89-4506-b08e-37a0c98e6f62", "value": 679936, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643889760, "uuid": "f195c655-234b-4a62-8e85-a66348296a1d", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643889760, "uuid": "0d5ee93f-c558-4fe9-b347-56889c81d3b9", "value": "ROCA 4501226854,pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "126a6cc5-8508-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643903025, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903025, "uuid": "0e555456-856c-494e-b470-88aefdbda0f0", "comment": "Malware payload (Heodo)", "value": "b0d47ac4dfdd3786587047ce7be0e63e", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903025, "uuid": "49a7ad9c-8ad6-44c4-b96b-97812c46e0fc", "comment": "Malware payload (Heodo)", "value": "57512ae2832b7332bd350453f49eec379890201cc1b78739eb8a5545521e08f7", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903025, "uuid": "7da8b080-4192-40ee-b77b-101c6cc42445", "comment": "Malware payload (Heodo)", "value": "9d47f25a35ae0ec938b4039d9ad1c6d99ac918b3", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643903025, "uuid": "bf265c88-0667-4877-aaac-1bc94905b949", "comment": "Malware payload (Heodo)", "value": "49a1816f589e583dae0221021e2c8dc6840f4a213ec268e7cbaccf0c87f35ebd435b47868482d11365690a1a15c65484", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false }, { "name": "trojan", "colour": "#F7D566", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903025, "uuid": "72d7a59c-8c34-4e95-9be4-3757d35074d0", "value": "T1B425BF406D8980A5F6072A3D017A72924FEC69015BE0E8CFDF49F4A76F26DD1993C86F", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903025, "uuid": "18baba0b-8f14-46cf-9576-32bf75c2c4cc", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903025, "uuid": "adac91a5-cd50-4cb0-9704-70926299c2d4", "value": "24576:ktXfiIeQV8iFExIB/powWtCi3+0al+uTHYzikt2gaFIIm2mlg:kBiaa4powXiolDS2gaFIr2mu", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643903025, "uuid": "bb590508-5b44-4001-93e2-62a414948a99", "value": 1003008, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643903025, "uuid": "9e21b70c-03ab-49b2-870a-7fb6d79f7491", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643903025, "uuid": "3fcddcda-4a79-4f60-b49e-d050dfb78bb1", "value": "b0d47ac4dfdd3786587047ce7be0e63e", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "3e91e1e9-84ef-11ec-9275-42010a9c0029", "comment": "Malware payload (Formbook)", "timestamp": 1643892362, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643892362, "uuid": "b44995c4-b58c-46a5-932a-12607148e9eb", "comment": "Malware payload (Formbook)", "value": "0bb4997683868db1ce1329ab2d7d3074", "object_relation": "md5", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643892362, "uuid": "fe524c2f-14e4-4e9f-b622-ce445a344747", "comment": "Malware payload (Formbook)", "value": "579b72504de3e11698587684cf7a8f617a3891a928b40900f2970a52272cdd56", "object_relation": "sha256", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643892362, "uuid": "ee474831-0ae8-47f2-adf2-6b9ff6dceed0", "comment": "Malware payload (Formbook)", "value": "a57cffcaeb026066c9edeb09e6378a4e6aa63108", "object_relation": "sha1", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643892362, "uuid": "0db3ee6e-d60a-4b51-9999-9c703466c894", "comment": "Malware payload (Formbook)", "value": "9c8a0a586815ab4eef9fe8ceb5eade452d19888cc67d5c5aaa22f0ace224a98e1aa9f71aa0d511b899221e48cc859fe2", "object_relation": "sha3-384", "Tag": [ { "name": "FormBook", "colour": "#7E8116", "exportable": true, "hide_tag": false }, { "name": "rar", "colour": "#504BCA", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643892362, "uuid": "5fabddd1-93fe-401e-b05a-34f96b7c660c", "value": "T11D6423FAB931DA5B3A07DEC31A40B7A361A9889A2830F555321811D8BDDCFBC141779F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643892362, "uuid": "277460a7-3284-4862-9453-0f453a6e51f2", "value": "6144:sZKL+hA3+8UTFXNmieE0ZnT+hveRSHRQBBiN1G+UvkiaI/I8ZHlalXvddBP1ISK:sJy345XYieHnTUmqQiNh8ZFalXv1Q", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643892362, "uuid": "e9a779b4-0ae5-46fd-9c6c-e63dafb6c7a7", "value": 332785, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643892362, "uuid": "bec6a4dc-7ea1-48fe-9138-eb001341a6ac", "value": "application/x-rar", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643892362, "uuid": "a190b20b-dc62-4828-8e07-58a35ed216dd", "value": "1643887513.Vfc11Iba967eM352569.dynamene_INV-DHL.rar", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "c59850c4-84de-11ec-9275-42010a9c0029", "comment": "Malware payload (Heodo)", "timestamp": 1643885287, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885287, "uuid": "fd5044a7-6d23-4458-bb13-080d28cbfcbf", "comment": "Malware payload (Heodo)", "value": "27a48ef7b32c37235adc1660aa534eac", "object_relation": "md5", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885287, "uuid": "4804b4b6-aa34-4b48-836e-8a6f92415b6e", "comment": "Malware payload (Heodo)", "value": "57c62aaa7f905e6586371cbfc432c21f92cb804ea9195c2fa6b8067b9a371a35", "object_relation": "sha256", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885287, "uuid": "26d18519-6d3d-4df0-9c80-6afe060e9834", "comment": "Malware payload (Heodo)", "value": "65abce5618448c84556549ecb676927afd8a98ab", "object_relation": "sha1", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643885287, "uuid": "91923442-55ba-4de7-ad37-0fd2a3913653", "comment": "Malware payload (Heodo)", "value": "cd80942f32dc4ee4723654ece6a81e4b334229409f46a2b18687aad47316c5c4bf1460ff3a7b709866c1b48ec1dd1ad8", "object_relation": "sha3-384", "Tag": [ { "name": "32", "colour": "#7B90DC", "exportable": true, "hide_tag": false }, { "name": "dll", "colour": "#4717AD", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false }, { "name": "Heodo", "colour": "#DF76D4", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885287, "uuid": "eb221259-4096-4406-b716-d81086560a56", "value": "T10A25C0216D8A40E6FA47193E0069B3544FDC69050BE0E8CFEF54F9A66F12CC25B785AF", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885287, "uuid": "cc78a4ba-01f8-4318-a3cc-725b5d7fa1ff", "value": "fc8975c6ecfc73d720c83c2951f50cbb", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885287, "uuid": "1bc7eaad-b581-4010-9ebd-33dd71780d20", "value": "24576:vyj4pucLsugl4zCy9fG+OVE+cXcs2vU2FIIm2m0:vzfnl9fYVoDv2FIr2m0", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643885287, "uuid": "5262629f-ba2b-415f-8ac9-d23c4fd05c35", "value": 1012224, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643885287, "uuid": "5b9cc474-c576-49fc-b342-0e40bc923888", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643885287, "uuid": "555fcafa-ceb5-4aae-baa4-fcf64d6694d9", "value": "27a48ef7b32c37235adc1660aa534eac", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "2084a286-84dc-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643884151, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884151, "uuid": "a46787b5-2a09-4111-b2ca-fbb8b987387b", "comment": "Malware payload (SilentBuilder)", "value": "ec909a1c8a9e67c09255a9df415bcc47", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884151, "uuid": "7b817ac7-0770-4a56-8d92-c43c278e4939", "comment": "Malware payload (SilentBuilder)", "value": "581f65f4575e23937cc09b4dd56aa1a9bb6ce7fa90e57f8b60ffa426a9054f24", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884151, "uuid": "bec64544-0bb4-4e73-860f-4a54901936ed", "comment": "Malware payload (SilentBuilder)", "value": "6137e031e40016495f7a8c312e469db67af172b4", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643884151, "uuid": "09c9550b-7076-4b8f-a1ec-a3c52e9d65a4", "comment": "Malware payload (SilentBuilder)", "value": "ff292664874ca3359c204e6ff504bf5ba776071fd15ed8d18f32549418f960682f2a54691c8b5d1d1fdf416e664577e6", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884151, "uuid": "b0caa7b4-0080-47b0-a419-e4ad72f5edda", "value": "T1D6D38C8AF21B0D68F191CA3584DA4B1437B35DA84E5717477658B32EBFBC6E00A1723B", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884151, "uuid": "8fde98a5-9a73-4a18-9f7b-178ff163cd26", "value": "3072:T5KpbdrHYrMue8q7QPX+5xtekEdi8/dgOUqulhaFYIbiQqVOjesh5LcKwJQiomGA:VKpbdrHYrMue8q7QPX+5xtFEdi8/dgdz", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643884151, "uuid": "665c8ebc-a032-47b4-a877-709f36f64011", "value": 142848, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643884151, "uuid": "e6dc02d5-ebfd-404d-befa-79fa2be9b3bd", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643884151, "uuid": "503569cd-aeb4-4e34-bd58-150011cb36d4", "value": "2022-02-03-ec909a1c8a9e67c09255a9df415bcc47_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "46aaa269-84fa-11ec-9275-42010a9c0029", "comment": "Malware payload (AgentTesla)", "timestamp": 1643897100, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897100, "uuid": "196b50ec-c95d-4c16-b112-4729de66a879", "comment": "Malware payload (AgentTesla)", "value": "aa0ccd1a4856a74bbc4897192f1e770f", "object_relation": "md5", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897100, "uuid": "d1018ebc-7ff0-43d4-b29b-e401fa0fea84", "comment": "Malware payload (AgentTesla)", "value": "58356730c0dc1df743c59f1d32a227f2bb1c84bc440208cf43bb7460054b69bd", "object_relation": "sha256", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897100, "uuid": "11740078-2217-4bb6-b6a7-27f825ec6cf7", "comment": "Malware payload (AgentTesla)", "value": "d9530db1f3ef2f3297fb65ee985bdce51ce09324", "object_relation": "sha1", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643897100, "uuid": "5c5286b7-c186-4332-9b94-7fa3b5ec3d0b", "comment": "Malware payload (AgentTesla)", "value": "81797256d34bcb8e58f1fd73e22724ee43daab6e839b76155deb75e3f936452739372356dbee96dedce744d3a6d3909f", "object_relation": "sha3-384", "Tag": [ { "name": "AgentTesla", "colour": "#405C97", "exportable": true, "hide_tag": false }, { "name": "exe", "colour": "#8F1124", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897100, "uuid": "4d5069e3-4304-4585-8682-77899b3922fe", "value": "T18CD4D06BF74B8E81D016553321AFB85103B23FDBAAD3D6063F58B3580F762614E9924B", "object_relation": "tlsh" }, { "type": "imphash", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897100, "uuid": "2c038354-71dc-478b-ad7a-799f4235e359", "value": "f34d5f2d4577ed6d9ceec516c1f5a744", "object_relation": "imphash" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897100, "uuid": "52f0a25b-1011-4753-a8a1-ea87c762c7fa", "value": "12288:sv1jJqodqw6rRCkZE9D/jnydr2EYvs+BOd01YQrNqP7J:stjJJ8rRdi9r7ydr2EYk+5fp+J", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643897100, "uuid": "eb242d1f-32e4-490f-87e9-1bf2bc7d6b1a", "value": 641024, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643897100, "uuid": "1ec86668-fa64-4a3d-88a5-adf9e7c2ff7c", "value": "application/x-dosexec", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643897100, "uuid": "8ee9cf36-fb72-4899-bc47-c3bba5806069", "value": "0000002064.pdf.exe", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information", "uuid": "1549a25c-84db-11ec-9275-42010a9c0029", "comment": "Malware payload (SilentBuilder)", "timestamp": 1643883703, "Attribute": [ { "type": "md5", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883703, "uuid": "36b4afa9-ee2a-4e18-bfd0-e70b4f55c093", "comment": "Malware payload (SilentBuilder)", "value": "9e215d3b0e7ccd43d65f7d86790609c0", "object_relation": "md5", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha256", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883703, "uuid": "18d06f81-e130-4379-ab95-cd2ce105b7e7", "comment": "Malware payload (SilentBuilder)", "value": "584fb42b177da15611550ad2e03ef94a1df34487c892e7ba412157de6ee1725d", "object_relation": "sha256", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha1", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883703, "uuid": "bed075d3-430f-4f93-8a42-5104fe9b0f0b", "comment": "Malware payload (SilentBuilder)", "value": "8f94b5abf98228fe754db077b38f8634ac8ff728", "object_relation": "sha1", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "sha3-384", "category": "Payload delivery", "to_ids": true, "timestamp": 1643883703, "uuid": "268f591e-e8dc-4858-8bf3-4cef2c8547cb", "comment": "Malware payload (SilentBuilder)", "value": "019d461f17be7de9dd8ba910b049ac8029c014ac2afd8b5bfc67d8b7c79349225fc1cd41ecdb4d7100337ea9bcafb7ba", "object_relation": "sha3-384", "Tag": [ { "name": "doc", "colour": "#473107", "exportable": true, "hide_tag": false }, { "name": "Emotet", "colour": "#E58E90", "exportable": true, "hide_tag": false }, { "name": "epoch5", "colour": "#A241CE", "exportable": true, "hide_tag": false }, { "name": "SilentBuilder", "colour": "#D83986", "exportable": true, "hide_tag": false }, { "name": "xlsx", "colour": "#683C47", "exportable": true, "hide_tag": false } ] }, { "type": "tlsh", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883703, "uuid": "416b9180-9e0b-4022-84d6-7e80c78dd06f", "value": "T1A6A37B5A7326884EE55A8B3488F707963733ED208B5B02477215F3D62FBAA901B03D5F", "object_relation": "tlsh" }, { "type": "ssdeep", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883703, "uuid": "697e645a-ade9-491f-8693-48a9e128aa21", "value": "3072:yWKpbdrHYrMue8q7QPX+5xtekEdi8/dg1JcdOpsHgGOqd4t4:nKpbdrHYrMue8q7QPX+5xtFEdi8/dg1k", "object_relation": "ssdeep" }, { "type": "size-in-bytes", "category": "Other", "to_ids": false, "timestamp": 1643883703, "uuid": "a58ef611-4bd0-43b8-ae69-1276eaaed34e", "value": 106496, "object_relation": "size-in-bytes", "disable_correlation": true }, { "type": "mime-type", "category": "Artifacts dropped", "to_ids": false, "timestamp": 1643883703, "uuid": "57525f28-54e2-44e5-9b8b-bbbe954bb446", "value": "application/vnd.ms-excel", "object_relation": "mime-type", "disable_correlation": true }, { "type": "filename", "category": "Payload delivery", "to_ids": false, "timestamp": 1643883703, "uuid": "a98c7194-009b-491f-aba0-48f891393062", "value": "2022-02-03-9e215d3b0e7ccd43d65f7d86790609c0_unzipped.bin", "object_relation": "filename" } ], "template_uuid": "688c46fb-5edb-40a3-8273-1af7923e2215", "template_version": "24", "distribution": "5" }, { "name": "file", "meta-category": "file", "description": "File object describing a file with meta-information",